Nothing is sent anywhere, and the build could not send it
Otok asks nobody to register. It keeps no profile, publishes no times, shows no advertising, counts nothing and maintains no mailing list. Beneath that string of absences lies one that makes the rest testable rather than merely asserted: the published package declares no internet permission. Android will not open a connection for an application that never asked for one, whatever the code inside might attempt, and the declared permissions are printed on the store page for anybody to read before installing.
What the game retains of you — maps finished, which packs stand open, the half-shaded coastline you abandoned — is written into the private area Android reserves for this application and travels no further. Not one byte of it is duplicated onto anything we own, so there is simply nothing of yours in our custody that could be leaked, sold, misplaced or compelled out of us.
Eleven sections follow, each a little deeper than the last. Taken together they answer everything the General Data Protection Regulation asks a notice of this kind to answer, and the eleventh gives the address for arguing with any of it.
Who stands behind the page
ControllerAQ Capital d.o.o.
Formdružba z omejeno odgovornostjo — a Slovenian limited company
AnswerableJure Drobnak
SeatV Murglah 263, 1000 Ljubljana, Slovenia
For this pageotok@aqcapital.world
ApplicationOtok — com.morjeotok.otok
Article 4(7) assigns the label controller to whoever settles the purposes a processing operation serves and the means by which it is done. Fixed to this page, the title brings a single obligation that is not ceremonial: that what follows was written truthfully, and that one named person answers for any part of it that was not.
You will find no data protection officer named here. Article 37 compels that appointment only where the controller is a public body, where the central activity consists of monitoring individuals regularly and in volume, or where special-category data is handled on the same scale. A company whose one application opens no connection comes nowhere near any of the three, and naming an officer regardless would look like a safeguard while protecting nobody.
Everything the game writes down
Without a memory of some kind, a game of this size would send you back to the first shoreline every time you opened it. The whole of it:
- Maps completed, and in which pack, so the map list can show how far out you have sailed.
- Best times for maps already cleared, so that a return visit has something to measure itself against.
- The map in progress — which cells you have shaded as sea, which you have marked as land, and the sequence of undos available to you this evening — so shutting the app does not carry off the thinking with it.
- How much of the hint allowance is left.
- Your preferences — which of the two languages the interface speaks, the shade of the sea, live clash flagging on or off, the timer, the haptics, reduced motion.
Now read that list for the things it declines to hold. No name is requested at any point. Nothing resembling an address is written down. The identifier Android offers for advertising goes unread. No gathering of handset properties is assembled into anything that would work as a fingerprint. And no installation number is minted, which is the quiet omission carrying the rest: lacking it, nothing distinguishes the copy of Otok on your device from any of the thousands of others, not to us and not to anybody else. The system then keeps that private area shut to every other application on the device.
Delete the game and the list goes out with the tide. Should you prefer to wipe the slate without losing the app, a reset waits in the settings screen, while Android exposes an equivalent control of its own, filed under "clear data" in the app's system settings.
Why no lawful ground is named anywhere
Notices of this kind proceed in pairs down the page: a thing collected, the basis for collecting it, the next thing collected. Nothing here is given a basis, where a reader has learned to expect the second half of a pair, an empty space ought to be explained rather than passed over.
A lawful ground answers one thing: what entitles you to be holding this? For the question to arise at all somebody must be holding something, and here nobody is. What section 3 lists sits on equipment belonging to you and beyond our reach, and it picks out nobody: remove the identifiers — none of which were present in the first place — and you are left with a note of how one handset got on with a few coastlines. The Regulation engages where a controller processes personal data; the second element is missing, and without it the first cannot exist either.
That reasoning survives only as long as its premise. Should a later build take on a login, an advertisement, an instrumentation library or a till, the premise is gone, and this page has to be redrawn and shipped with the very release that introduces the change, every new item arriving with its ground stated. The instructions for doing that are kept in a comment block closing this document.
No cookie banner appears, for a related reason. Rules of that family bite on the placing of something on, or the taking of something from, a person's own device beyond what is strictly needed to deliver the service asked for, and the usual carriers are an embedded browser, a measuring pixel or a marker written by an outside component. This game holds none of the three and has no line out over which any of them could report, so Slovenia's version of those rules finds no subject matter in this app at all.
A single permission, and a long list refused
Asked
Just the vibration motor, used for the brief tap as a run of sea fills in, and then only if the setting is left enabled. Android grants it without asking anybody, and a motor has nothing to disclose about the person carrying it.
Never asked
The network heads the list of refusals, and once the network is out the rest follow for want of a reason: no camera, no microphone, no positioning, no reading of contacts, no files beyond the app's own, no handset status, no notifications.
The right-hand column is the foundation of everything else written here. Where there is no path out of the device, a statement about destinations is no longer a matter of trusting us; it is a fact fixed in the package, and any reader with the patience to inspect it can settle the question without us.
Decline anything you were not expecting, then let us know the build number at otok@aqcapital.world. Only two things could explain it — the page has fallen behind the build, or the package is not one of ours — and we would want to know which before anybody else meets it.
The store lies outside all of this
Every section so far concerns Otok once it is running. Acquiring it is something else entirely, and it happened between you and Google before we entered the picture. Google notes the install, every subsequent update, and a rating should you post one, all against the account you used and under rules Google writes for its own platform. That exchange is not ours to see into or to change.
All we see of it is the Play Console, which deals in totals: a count of installs, a rough geography, repeated faults grouped together, the rating averaged out. At no point does that view narrow to one person. The account you used stays entirely out of sight on our side: the address behind it, any card attached to it, the devices it has been signed into. Whatever controls Google provides over what it keeps are operated from within that account, which this app cannot touch, so such questions belong there.
A last word, about the listing page: the moment a review is submitted it is public, over whatever name the account shows, and it stays there for every visitor who comes afterwards.
Nobody downstream, and no border crossed
You cannot delegate an activity you are not carrying out. Nothing of this game sits on anybody's server. No measurement account exists for it, no fault-collection service is subscribed, no ad exchange is plumbed in, no newsletter tool holds a list and no payment intermediary has been engaged. It is not that such suppliers were approached and refused; there was never any work for them to take on. Article 13(1)(e) wants the recipient categories set down, and the honest entry is a blank one.
Transfer abroad closes on the same fact. The machinery for lawful export — adequacy findings, model clauses, the restricted Article 49 grounds — all of it presupposes a shipment. There is no shipment. Your fastest run at a map was written to the device you played it on, and that is the only place it has ever been.
Set down as where our responsibility ends rather than as something left unsaid: section 6 describes an exchange carried out on Google's machines under Google's own agreement with you, finished and done with before anybody taps the icon.
For how long, and for whom
Duration. The usual reason a clause like this names a number of months is that the data sits with a party the reader cannot command. Nothing of the sort applies here, so the answer takes the form of a condition: the record lives exactly as long as you want it to, since the reset and an uninstall both end it on the spot. Nothing is mirrored to a backup overnight, no older snapshot is filed away, and we operate no system where some leftover could survive what you chose to do.
Audience. Otok carries a general-audience rating, and colouring in a quiet sea around a handful of islands is an unobjectionable thirty minutes for a child. The four things that usually make a parent keep reading are — advertising aimed at the child, something buyable within reach of a careless finger, messages from strangers, material other players have uploaded — and none of the four was built into it. There is also Article 8, which fixes an age under which a child's agreement to an online service has to be backed by a parent. Nothing in this app brings it into play: agreement is not asked for, of children or of adults. Slovenia draws that line at 15 in ZVOP-2, the number is set down in advance, so that it is already here on the day advertising is introduced and the question acquires weight.
Eight rights, answered one at a time
Not one of the eight is reduced here. What is unusual is the venue: this app puts nearly all of them within reach of the person holding the telephone, without any correspondence at all. A formal procedure that could only ever conclude with us writing "we have nothing of yours" would be ceremony, so the chart states the real result instead.
Access · 15What comes back is a brief note stating that no record of you exists on our side. Everything the game has stored is laid out on the map list, which you can read without asking permission of anyone.
Rectification · 16Accuracy presupposes a record, and we keep none. A stored time that flatters you insufficiently is put right by sailing that map faster.
Erasure · 17Instant, and entirely yours: the reset in settings, or removing the app. No request reaches us, which also means no request of yours can be denied, delayed or answered on the last day of the statutory month.
Restriction · 18The purpose is to pause processing while something is contested. We are not processing anything of yours, so there is nothing available to pause.
Portability · 20Concerns what a person handed to a controller so it may be carried elsewhere. You handed over nothing, and the record already sits where you could carry it.
Objection · 21Something has to be objected to. The branch of the right that admits no refusal deals with direct marketing, and no marketing of any sort leaves this game.
Consent · 7(3)Nothing in the game rests on your agreement, because your agreement was never sought. No permission stands open to be withdrawn.
Automated decisions · 22Testing whether a shaded sea is still one body is a walk across neighbouring cells. It tints some squares blue and settles nothing whatever about you.
Nothing here costs money, nothing needs a form, and nobody will ask you to prove who you are. An identity check exists to stop one person's file reaching somebody else; with no files on this side it guards nothing, and performing it would mean taking a document off you while explaining that nothing is taken.
Carrying a complaint past us
The company is registered in Slovenia, which places it under the General Data Protection Regulation together with the national act, Zakon o varstvu osebnih podatkov (ZVOP-2). The authority charged with supervising it is the Informacijski pooblaščenec, Slovenia's Information Commissioner. Its offices are at Dunajska cesta 22, Ljubljana, and everything needed to lodge a complaint sits on ip-rs.si.
Ljubljana is not your only option. Article 77 offers a complainant a choice of forum, and any of three will take the matter: the country where you habitually live, the country where you work, or the one covering the place you believe the breach occurred. Choose on whichever is easiest to reach. Nothing written here may cut that list down, and a clause purporting to do so would have no legal force.
A word on order, which is advice rather than a condition. A letter to the address above will usually have a reply the same afternoon; an authority has a procedure to follow and a queue in front of it. Writing here first is sensible, not obligatory, and there is nothing improper about a case already lodged with the Commissioner while our correspondence continues.
The address, and the rule on revisions
Everything in this section arrives at otok@aqcapital.world, and nothing is sorted anywhere else. Use it to exercise a right, to challenge something written above, to report a permission prompt that section 5 fails to explain, or just to ask a question about how any of this operates. Letters in Slovenian and in English arrive at the same desk.
Pišite nam lahko v slovenščini — isti naslov, odgovor pa prispe v slovenščini.
Under the title sits a version, and it advances the moment anything below it is edited. The timing of those edits follows a single rule from which we do not depart: where a revision reflects a change in what the software actually does — a category of data newly retained, a new party let into the chain, data that begins crossing borders, an additional purpose taken on — then the amended wording is part of that release and not of some later one. We will not let a new behaviour reach handsets while the page describing it is still a fortnight away. Checking the version is therefore a one-second way of asking whether this text was written for the build you installed. Previous versions are retained; ask and you will be sent one.