Privacy Policy

1. Information We Collect

We collect device signals, cryptographic signatures, user account identifiers, and application data strictly for the purpose of hardware attestation, security, account management, device-bound account verification, and authentication.

We automatically collect and log technical data when you access or use the service, including IP addresses, user agent strings, timestamps, and request metadata. This data is used strictly for security, authentication, abuse prevention, rate limiting, and infrastructure protection.

When a device interacts with a service that uses Kubian, we collect and process the following device-level data:

Age Requirements & Intended Audience: Kubian services integrated within third-party applications are intended for end-users and players aged 13 and older. Except for the limited blocking measures described in Section 8, we do not knowingly collect or process personal data from children under 13 years of age. Registration for Kubian developer accounts, project creation, and administrative dashboard access strictly requires individuals to be at least 18 years of age (or the legal age of majority in their jurisdiction) or have explicit, verified involvement and consent from a parent or legal guardian.

2. Use of Information

The collected information is utilized solely to verify device integrity, protect our infrastructure, enforce rate limits, process developer-directed device bans, establish and verify device-bound user accounts, authenticate physical devices via permanent account identifiers, and ensure compliance with our security standards. We do not use your device information or device-bound account identifiers for tracking, profiling, ad tracking, or personalized advertising.

We process personal data based on our legitimate interests in maintaining service security, preventing fraud and abuse, verifying user accounts via device binding, and fulfilling contractual obligations to provide the service.

We may collect and process device-level identifiers and hardware-backed attestation signals strictly for security, account verification, fraud detection, and abuse prevention purposes. These signals may be evaluated alongside internal security checks and platform-provided attestation indicators to identify high-risk or potentially compromised environments. This data is not used for tracking, profiling, or advertising purposes.

3. Device Identifiers, Permanent Account IDs, & Device Bans

When your device interacts with an application using Kubian services, Kubian issues a permanent 16-character numeric account identifier (user_account_id) derived from your device's hardware Widevine ID using a project-scoped, keyed derivation (not a raw copy or unkeyed hash of the raw hardware value). The user_account_id is project-scoped: a separate identifier is issued for every application on the same physical device. It does not expire or rotate within an application and is made accessible to that application's developer through the Kubian Client API and SDK only under an approved Account ID Collection grant for persistent identity, device-bound account verification, and account attestation. Additionally, Kubian generates project-scoped unique identifiers ("unique IDs") derived from your hardware signals, which are specific to individual applications and isolated between projects.

Access Control, Purpose Limitation & Audit Trail: The user_account_id is treated as exceptional, high-sensitivity identity data and an application never receives it by default. Before any delivery, the responsible developer must submit a formal Data Collection Request through the Kubian dashboard declaring the requested purposes (such as approved "Other — Device-Bound Accounts" verification grants), a specific justification for the persistent identifier, and their intended retention period, and must accept a binding usage agreement before Kubian grants access. Approved use is strictly limited to application protection and security (including anti-cheat), ban enforcement, user account verification via device binding, and account/device attestation and record-keeping. Use of the identifier for advertising, ad tracking, behavioral profiling, ad profiling, marketing, data enrichment, sale of data, or correlation across applications is explicitly prohibited. Every approval creates an ACCESS GRANT audit record capturing the project, the developer account, the approved purposes, the accepted agreement version, the approval date, and the expiry date. Grants are scoped to the single approved project, expire after one (1) year, and may be revoked at any time; violations may result in warnings, temporary restriction, permanent revocation of identifier access, or termination of the developer's Kubian integration. Until such a grant exists and remains active, the identifier is technically withheld — it is never transmitted to the application or its developer through any API, SDK, token, or response payload.

Each application that integrates Kubian receives its own independently generated project-scoped unique ID and its own independently issued user_account_id for your device. This means two different applications using Kubian cannot cross-reference or correlate your identity — neither via project-scoped identifiers nor via the permanent account ID. Your identifiers in one application remain entirely separate from your identifiers in another.

Your underlying Android ID and raw Widevine MediaDrm ID are never exposed to developers. Kubian exposes the generated user_account_id and project-scoped unique IDs to integrated applications via developer APIs for authentication and attestation. Raw hardware signals are used internally by Kubian to link restrictions directly to hardware identity, ensuring bans persist securely across unique ID rotations and re-installations.

If an application developer implements a temporary restriction or device ban, that ban is enforced via Kubian's internal hardware identity linkage and permanent user_account_id. Because bans are linked to permanent hardware identity, they cannot be evaded by app uninstalls, clearing local application data, or unique ID rotations.

To maintain absolute alignment with data minimization principles, our device-banning mechanisms enforce the following strict privacy constraints:

Project-scoped Unique IDs are valid for a period of sixty (60) days from the date of generation or last renewal. After this period, the unique ID is considered expired. Once expired:

Kubian does not provide any mechanism for developers or third parties to recover, reconstruct, or retrieve an expired unique ID. Once purged, it is permanently inaccessible through our systems.

Data Deletion & Ban Preservation: Device bans are tied to persistent device signals, the user_account_id, and security enforcement records. Submitting a data deletion request, opting out of processing, or requesting an identity reset will not lift, revoke, or shorten an active device ban. In the event of a data deletion request, Kubian retains minimal, isolated cryptographic hashes of device signals strictly necessary to maintain active restrictions and prevent platform abuse. All non-essential data associated with the request will be purged in accordance with applicable law. This preservation is limited to the retention exceptions further described in Sections 6 and 9.

4. Data Sharing

We do not sell or share your personal data for cross-context behavioral advertising as defined under the Oregon Consumer Privacy Act (OCPA). Information is not shared with outside third-party entities unless legally required (e.g., via subpoena or court order) or necessary for infrastructure operations and security enforcement.

The permanent user_account_id provides a consistent device identity within each application integrating Kubian. It is not distributed automatically: it becomes visible to an application's developer only after that specific project has been granted an approved, purpose-limited Account ID Collection access (Section 3). Because it is project-scoped, it cannot be used to correlate a user between different applications. This identifier is generated and processed solely by Kubian and its approved integrated application developers for authentication, user account verification via device binding, security attestation, anti-cheat, ban enforcement, cross-install state management, and abuse prevention. Developers who receive access are each responsible for their own collection of, access to, use of, disclosure of, retention of, and protection of the identifier, including unauthorized uses by their personnel or systems, as provided by their binding agreement with Kubian and applicable law; Kubian remains responsible for its own security and processing obligations. The identifier is strictly prohibited from being shared with outside third-party advertising networks, used for ad tracking, or used for cross-context behavioral profiling.

We may share information with trusted third-party service providers who perform services on our behalf, such as payment processing, hosting, and infrastructure security. These providers are contractually obligated to protect your data and use it only for the services they provide.

5. Data Security & Storage Technologies

We implement robust security measures, including hashing (e.g., bcrypt for account passwords), encryption in transit and at rest, and IP logging to protect against unauthorized access, alteration, disclosure, or destruction of your personal information and project API keys.

Storage & Session Technologies & Persistent Authentication: For developers accessing the Kubian administrative dashboard, we utilize essential session cookies, local storage, and secure client-side authentication tokens strictly necessary for account security, session persistence, and state management. To maintain an efficient workflow, a secure login token may be stored on the developer’s local device. Upon opening or restarting the application or browser session, Kubian communicates directly with our authentication validation endpoint to verify token validity and automatically restore the session without requiring continuous manual re-authentication. For end-users interacting with third-party applications integrated with Kubian services, Kubian does not store browser cookies or use web tracking mechanisms; all device validation and user_account_id resolutions are performed strictly via direct, encrypted API attestation requests.

We limit access to personal data to authorized systems and personnel strictly required for operational, technical, and security purposes.

Internal Data Isolation: Ban-enforcement cryptographic hashes and security records are stored in a dedicated, logically isolated repository separate from Kubian's standard operational data stores. This separation ensures that ban-enforcement records are subject to distinct access controls, retention policies, and audit procedures, and that no operational data is inadvertently merged with security-enforcement records during routine processing.

6. Data Retention

There are two retention regimes under this Policy. (a) Ordinary devices: we retain your personal data, user_account_id records, and project metrics for as long as your account or associated service integration is active. Usage statistics and anomaly logs may be retained longer for security analysis and to combat future automated abuse. Upon account deletion, personal data is purged from active systems in accordance with Oregon law and our Terms of Service, except for the limited security, fraud-prevention, ban-enforcement, and legal records described in this Section 6 and in Section 9.

Deletion requests are processed within a reasonable timeframe, generally within 30 days, unless retention is required for legal, security, or fraud prevention purposes as described in this Section 6 and in Section 9.

Notwithstanding the standard 60-day project-scoped unique ID retention window described in Section 3, Kubian reserves the right to retain device signals, user_account_id mapping records, attestation records, hardware certificate identifiers, and associated metadata beyond the standard retention period (b) only where a device has a known or documented history of any of the following:

In such cases, retained data is used exclusively for security enforcement, platform integrity, fraud prevention, and, where applicable, cooperation with law enforcement or legal proceedings. Such data will not be used for advertising, profiling, or purposes unrelated to security and compliance. Extended retention under this paragraph is limited to what is reasonably necessary for those stated security purposes, is stored exclusively in the dedicated, isolated ban-enforcement repository described in Section 5, is subject to periodic necessity review, and is deleted when no longer reasonably necessary or required by law. It does not extend ordinary operational retention for devices without such a documented security history.

7. Developer Disclosure Obligation

Any developer, company, or individual ("Developer") that integrates Kubian services into their application, product, or platform is required to provide clear, conspicuous, and accurate disclosure to their end users regarding the data collected and accessed by Kubian as part of their service.

At a minimum, this disclosure must include a reference to or summary of the data collection practices described in this Privacy Policy, including but not limited to:

Developers are required to either directly incorporate the relevant provisions of this Privacy Policy into their own application privacy policy or provide a clearly accessible link to Kubian's Privacy Policy located at https://kubian.app/Privacy-Policy.

Failure to provide adequate disclosure to end users constitutes a material breach of the Developer's obligations under Kubian's Terms of Service. In the event that Kubian or Static Labs LLC incurs any legal liability, claim, regulatory action, fine, penalty, or enforcement action arising from or related to a Developer's failure to properly disclose Kubian's data collection practices to their end users, the Developer agrees to:

Kubian reserves the right to suspend or terminate access to its services for any Developer found to be in violation of this disclosure obligation, without prejudice to any other legal remedies available.

8. Children's Privacy (COPPA) & Developer Safe Harbor

App Developer Responsibility: As between Kubian and a Developer under this Policy, a Developer is not treated as knowingly directing Kubian services to children under 13 where an end-user or player under the age of 13 accesses their application or Kubian services without the Developer's knowledge, direction, or intent. This contractual allocation does not determine liability under applicable law (including COPPA or other privacy statutes), which depends on the facts and applicable legal requirements. Developers remain responsible for meeting their own legal obligations, including providing required notices and age-gating where applicable.

Underage Protection & Active Blocking: Kubian services are not directed to children under 13. Where an end-user or player is identified as being under the age of 13, Kubian will perform to the best of its technical capabilities to block or restrict their interaction with Kubian Services. To enforce these protections, Kubian processes the minimum technical signals strictly necessary to maintain the block (which may include limited device hardware identifiers, user_account_id records, and IP metadata) solely to filter out, drop, or restrict processing for underage sessions. Such data is maintained in a secure, localized in-server store, is not used for advertising, profiling, or unrelated purposes, and is kept only as long as reasonably necessary to maintain the block, subject to Sections 6 and 9.

Disclaimer on Intentional Evasion & Device Modification: Because hardware attestation relies on persistent technical signals, if an underage end-user deliberately circumvents detection checks—such as by performing a factory reset on their device, altering their device fingerprint, or modifying their network location/IP to bypass security controls—such evasion alone shall not be deemed a breach of this Policy by Kubian or the Developer. Obligations under applicable privacy laws remain determined by the facts and applicable law. Kubian utilizes Widevine MediaDrm ID to generate the persistent user_account_id that persists across factory resets, app uninstalls, cache clears, and user profile changes, making identity evasion significantly more difficult. However, on certain low-end devices, modified environments, or devices without a proper Widevine implementation, identifier behavior may vary.

If an underage user is subsequently discovered to have bypassed detection, Kubian will exercise its best efforts to promptly reinstate the block, terminate active token sessions, and restrict further interaction to the fullest extent technically possible.

9. User Rights & Legal Exceptions (OCPA)

In accordance with Oregon law (OCPA), eligible users have the right to access, correct, or request deletion of their personal data held by Kubian, as well as request a portable copy of their data. To exercise these rights, please submit a request through the official dashboard support channel or contact us directly at [email protected].

Statutory Security Exceptions to Deletion: Pursuant to applicable state privacy laws, Kubian reserves the right to deny or limit data deletion or access requests where retaining the specific data is necessary to:

Data retained under these legal exceptions will remain strictly isolated and used exclusively for security, anti-fraud, and compliance purposes.

Deletion Requests for Banned Devices: Pursuant to applicable state privacy laws (including the Oregon Consumer Privacy Act), Kubian reserves the right to deny deletion requests in whole or in part where retaining device signals, user_account_id values, cryptographic signatures, or attestation records is necessary to maintain active developer-directed or platform-level device bans, investigate fraudulent activity, or protect system integrity. Upon processing a deletion request for a banned device, all non-essential data will be purged, while minimal, isolated cryptographic hashes of device signals — stored exclusively in a dedicated ban-enforcement repository separate from standard operational data stores — will be permanently retained solely for anti-abuse and ban enforcement. These hashes cannot be reversed to reconstruct the original device signals and are used only to verify that a previously banned device remains blocked.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will become effective upon posting. Continued use of the service after such changes constitutes your acceptance of the updated policy.



© 2026 Static Labs LLC. All rights reserved.  ·  Oregon, USA

Return to Dashboard Privacy Policy Terms of Service DMCA Copyright Policy