Privacy Policy

Privacy Policy

This privacy policy applies to the Kuku app for mobile devices, together with any related services operated by Cherry & Bridge (collectively, the "Application"). Cherry & Bridge is hereinafter referred to as the "Service Provider".

Data Controller Information

Cherry & Bridge acts as the Data Controller responsible for the processing of your personal data.

Name: Cherry & Bridge
Address: Sitsi tn 16-12, 10313 Tallinn, Estonia
Email: contact@cherryandbridge.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

The Application does not require registration and has no user accounts. It does not collect, log or store personal information on the Service Provider's systems during normal use. Your settings, chime schedule and saved places are stored only on your device.

The Service Provider receives information in two cases only.

Feedback: you can choose to send feedback from the Application's settings. A feedback message contains the feedback type you pick (bug or improvement) and the text you write. Nothing else is attached: no name, email address, device identifier or location. Because you write the text yourself, please do not include personal details you do not want to share.

Premium purchases: if you buy the premium version, Google Play gives the Service Provider the order details (such as order number, product, price, date and country) and lets it look up an order by the buyer's email address. The Service Provider uses these only to handle the purchase, refunds and support, and to meet accounting and tax obligations. It never receives your payment details.

The Service Provider does not send marketing communications.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on the following lawful bases:

Legitimate interests: feedback you choose to send is processed in the Service Provider's legitimate interest in fixing bugs and improving the Application. You can object to this processing at any time (see "What are your GDPR data protection rights?").
Contract performance: if you buy the premium version, the order details are processed to provide the features you paid for and to handle refunds and support. Payment is handled entirely by Google Play.
Legal obligation: purchase records are kept to meet accounting and tax law, and information may be disclosed to comply with laws or government requests.

Cookies and similar technologies

The Application does not use cookies, advertising identifiers, tracking pixels or analytics. The third-party services listed below may use their own technologies as described in their privacy policies.

Automated decision-making and profiling

The Application does not use automated decision-making or profiling.

What information does the Application collect automatically?

The Application does not collect information automatically and contains no analytics. When the Application connects to the internet, your IP address is necessarily visible to the services it connects to (see "Do third parties see and/or have access to information obtained by the Application?"). The Service Provider does not use it to identify or track you.

Does the Application collect precise real time location information of the device?

With your permission, the Application accesses your device's precise location, including in the background, for one purpose: to stay silent inside the places you set (or, if you choose, to chime only inside them).

Your location and saved places are processed on your device and are never sent to the Service Provider. When you add a place or search for an address, Google receives the information described under Google Maps and Google Places below.
Checking whether you are inside a place uses the location and geofencing services of Google Play Services, which Google processes under its own privacy policy.
Saved places are excluded from Android's cloud backup, so they do not leave your device through backups.
You can withdraw location access at any time in your device's settings. The Application keeps working, but location-based silencing stops.

Does the Application use Artificial Intelligence (AI) technologies?

The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.

Do third parties see and/or have access to information obtained by the Application?

The Service Provider does not sell your information or share it for advertising. The Application relies on the following third-party services, which process data as described:

Google Play Services: device location and geofencing for the places feature. Google Privacy Policy
Google Maps and Google Places: the map and address search used to add places. The area shown on the map, the addresses you search for, and the coordinates of places you add (to look up their street address) are sent to Google. By using these features you agree to the Google Maps Additional Terms of Service and the Google Privacy Policy.
Google Play Billing: processes premium purchases and shares order details with the Service Provider as described above. The Service Provider does not receive your payment details. Google Privacy Policy
Cloudflare: receives feedback messages and forwards them for storage. Cloudflare can see the IP address of the device sending the message and may keep technical request logs, including IP addresses, for up to 7 days. Cloudflare Privacy Policy
GitHub: stores feedback messages in a private repository. GitHub General Privacy Statement

Cloudflare processes feedback under its Data Processing Addendum. GitHub hosts the private repository under its Terms of Service, which treat private repository contents as confidential.

The Service Provider may also disclose information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

International Data Transfers

Google, Cloudflare and GitHub may process data outside the European Economic Area (EEA), including in the United States. These transfers rely on a transfer mechanism recognised under GDPR Chapter V:

the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it
Standard Contractual Clauses (SCCs) approved by the European Commission

Countries outside the EEA may not provide the same level of data protection as the EEA. You can request details of these safeguards by contacting the Service Provider.

What are my opt-out rights?

Sending feedback and buying premium are both optional; if you do neither, the Service Provider receives no information from you. You can stop all data processing by the Application by uninstalling it, which also deletes your settings and saved places from your device. Uninstalling does not delete feedback you have already sent; see "Data Deletion" below.

What is the data retention policy and how can you manage your information?

Settings and saved places: stored on your device until you clear the Application's storage or uninstall it.
Feedback messages: kept for as long as they remain useful for fixing the reported problem or improving the Application. Messages that are no longer needed are deleted.
Premium purchase records: kept as long as accounting law requires (in Estonia, seven years).
Data required for legal compliance: retained as long as required by applicable law.

Data Deletion

Data on your device: clear the Application's storage in your device's settings, or uninstall the Application. This deletes your settings and saved places immediately. None of this data is held by the Service Provider.

Feedback you have sent: feedback is not linked to your identity, so the Service Provider cannot find your messages by your name or device. To have a message deleted, email contact@cherryandbridge.com with its text, or roughly when you sent it. The Service Provider will find and delete it within one month. No proof of identity is required.

How does the Application address children's privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

If you are a parent or guardian and believe your child has sent personal information through the feedback form, please contact the Service Provider (contact@cherryandbridge.com) so that it can be deleted.

How is your information kept secure?

The Service Provider keeps feedback in a private repository, and transmits it over encrypted connections (HTTPS). However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay where it is possible to identify you.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at contact@cherryandbridge.com.

This privacy policy is effective as of 2026-10-08

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

Right of Access: You can request access to your personal data.
Right to Rectification: You can request correction of inaccurate data.
Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
Right to Object: You can object to processing based on legitimate interests, including the processing of feedback.

Because feedback is not linked to your identity, please identify the message concerned (its text, or roughly when you sent it) when exercising these rights.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee). Contact details for each country's Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out: The Service Provider does not sell your personal information or share it for cross-context behavioral advertising.
Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at contact@cherryandbridge.com. You may designate an authorized agent to make a request on your behalf.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at contact@cherryandbridge.com.

The Service Provider will respond to requests within one month of receiving them, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.

This privacy policy page was generated by App Privacy Policy Generator