Privacy Notice

2026-08-05

KROMA is used in many countries, so this notice is written to cover them: Mexico's LFPDPPP, the GDPR in Europe and the UK, Brazil's LGPD, California's CCPA/CPRA and Canada's PIPEDA. It explains what we collect, on what legal basis, and what control you have wherever you live.

Who is responsible

KROMA is a service of Strike Gaming Center S.A.S. de C.V., the controller of your personal data.
Registered address: Calle José Morelos 1120, Jardines de Santa Catarina II, Santa Catarina, Nuevo León, México, C.P. 66362.
Privacy contact: privacidad@playkroma.com.
If you are in the European Economic Area or the United Kingdom, write to the same address for anything concerning data protection.

What we collect

Your phone number or email address, to create and verify your account.
Your team, so we know which colour you paint in.
Your approximate location at the moment you tap “I’m here”, and only at that moment. We do not track your location in the background or between matches.
The language and country you choose, to show you the app in your language.
Your birth year, only if you choose to give it. It is used solely to decide whether you may see age-restricted advertising (for example, alcoholic drinks). If you do not give it, you simply never see those ads.
Basic technical data your device sends when it connects: IP address, browser type and operating system. Used for security and to detect falsified locations.

What we use it for, and our legal basis

To run your account and the game: legal basis, performance of the contract you accept when you sign up.
To use your location for a check-in: legal basis, your consent. You give it by allowing location and can withdraw it at any time in your phone settings.
To show aggregate totals on the map: how many fans are in an area or a bar, and what share each team holds.
To prevent fraud and protect the service: legal basis, our legitimate interest in points and prizes being real.
To meet legal obligations where they apply.

What we never do

We never show a person on the map. No user pins, no personal dots, no blurred positions.
We never show data for an area or a bar with fewer than 5 people present. Below that, the map shows “few fans” and nothing else.
We never send alerts targeted against rival supporters.
We never show your name at a bar unless you turn that on yourself. It is off by default.
We never make automated decisions that produce legal effects for you, and we do not profile you.

We do not sell your data

We do not sell or share personal information as those terms are defined by California’s CCPA/CPRA, and we have not done so in the last twelve months.
We do not run cross-context behavioural advertising. The only ad targeting is by age, and only if you gave us your birth year.
We will not discriminate against you for exercising your privacy rights.

Who processes it for us

We use providers to run the service: hosting and database, maps, email and SMS verification, push delivery, site usage measurement, and payment processing for venue subscriptions.
Usage measurement is Google Analytics with its advertising features switched off: it feeds no profiles and no ad audiences. In the EEA, the UK and Switzerland it does not run until you accept; everywhere else it runs and you can switch it off below, on this page.
These providers process data on KROMA’s behalf and on our instructions, under a processing agreement. They are not permitted to use it for their own purposes.
Today they are: Supabase (database and accounts), Vercel (hosting), Resend (email), Twilio (verification SMS), Stripe (subscription payments) and Google Analytics (usage measurement). You can ask us for the current list of processors at privacidad@playkroma.com.
Address search when registering a venue is answered by public OpenStreetMap services — Photon (Komoot) and Nominatim (OpenStreetMap Foundation) — which receive only the text searched or the pin coordinate, never your identity.

International transfers

Some providers operate servers outside your country, including in the United States and the European Union.
When we transfer data out of the EEA or the UK, we do so under appropriate safeguards: the European Commission’s Standard Contractual Clauses, with the UK addendum where it applies.
You can ask us for a copy of those safeguards.

Cookies and similar technology

We use browser storage to keep you signed in and to remember your language, your country and the league you were viewing. It is strictly necessary for the app to work.
We do not use advertising cookies or cross-site tracking, so you will not see a banner asking permission for something we do not do.

How long we keep it

Every location record is deleted after 4 hours. We do not keep a history of your movements.
The points you earn are stored by neighbourhood and team, without coordinates.
Your account is kept until you delete it. Deleting it removes your profile and its associated records.
We may retain minimal records where the law requires it, or to resolve a dispute or a case of fraud.

Security

We encrypt traffic, restrict access to data by role, and enforce database-level rules so that one account cannot read another’s data.
No system is perfect. If a breach occurs that materially affects your rights, we will notify you and the relevant authority within the time limits the law sets.

Children

KROMA is not directed at children under 13 and we do not knowingly collect their data.
Where the law sets a higher age for consenting to data processing — 16 in several European countries — we apply that age instead.
If we find an account below the applicable age, we delete it. If you are a parent or guardian and believe one exists, write to us.

Your rights

You can ask us for access to your data, its correction, its deletion, a restriction on how we process it, to object to processing, and for a portable copy.
You can withdraw your location consent at any time in your phone settings. You will still be able to watch the map.
You can delete your account from your profile at any time, without writing to us.
Write to privacidad@playkroma.com. We answer within the time limits the applicable law sets, and we do not charge for it.

Depending on where you live

Mexico: your ARCO rights (Access, Rectification, Cancellation and Opposition) are exercised at the address above. The competent authority is the Mexican Secretaría Anticorrupción y Buen Gobierno, which took over these functions after INAI was dissolved in 2025.
European Union and United Kingdom: you have the GDPR rights described above and can lodge a complaint with your data protection authority, or with the ICO in the UK.
Brazil: you have the LGPD rights and can contact the ANPD.
California: you can exercise the CCPA/CPRA rights to know, delete and correct. We do not sell or share your data, so there is nothing to opt out of.
Canada: you have PIPEDA rights and can contact the Office of the Privacy Commissioner.

Changes to this notice

If we change this notice materially, we will show you in the app and update the date above.
If the change broadens how we use your data, we will ask you to accept it again.