Last updated: 1 August 2026
Playing requires a connection, and a name. It is our server that vouches for every dive: without it neither your pearls nor your record could be guaranteed, and the game would rather not let you play for nothing. What is sent is limited to the following:
One thing does not go through our server: the rewarded video the Android application may offer you when you die. It is served by Google, with your consent, and the “Rewarded advertising” section below is devoted to it.
The application is published by KFR Studio (Theo Kiefer), the data controller for everything described here. For any question, or to exercise your rights: tk.contact.pro@gmail.com.
Your settings, your progress (tiers, missions, fish unlocked) and your records are stored on your device, and disappear if you uninstall the application. Most of it never leaves your phone — with two exceptions, described on this page: your deepest dive, which appears in the Pantheon, and your pearl balance, held by the server.
Your pearl balance was part of that list until version 2.5; it is now held by our server (see below). Your device only keeps a display copy, so the screen tells the truth without waiting for the network — the server's balance is the one that counts.
In a browser, they use the site's local storage
(localStorage). The application sets no cookies
and uses no tracker: this storage only exists to hand your game back to you
next time you play, and nothing in it is read by any third party.
Your name is chosen when you first launch the game: it is part of entering it. Every player appears in the ranking — the same mechanism is what lets the server vouch for dives, keep pearls safe, and give your game back if you change phone. The following is sent to our server:
This identifier is not a hardware identifier: it comes neither from your phone nor from any account, and cannot be used to track you across other applications. It exists solely so that you occupy a single line in the ranking, and so that you can be removed from it.
Your name and score are public by nature, since they appear in the ranking. Exchanges with the server are encrypted (HTTPS).
The Settings screen offers a form to report a problem or to ask us to act on your ranking entry. If you use it, we receive:
Do not write anything in that message you would rather not share with us: its content is free-form, and you are the one writing it. We ask for neither your name, nor your e-mail address, nor any other contact details. We therefore have no way of replying to you from within the game: if you expect an answer, please write to the address at the bottom of this page instead.
Messages are read by the publisher, are never shared with anyone, and are deleted once the request has been handled — and in any case if you ask for your data to be deleted.
Since version 2.5, your pearl balance is held by our server rather than by your device alone. Two reasons: giving your pearls back when you change phone or reinstall the game, and preventing anyone from granting themselves what is being sold. We therefore store your random identifier, your balance, and any operations still waiting to be applied (a purchase made offline, for instance) — the latter are deleted automatically after seven days.
If you buy a pearl pack, the game sends our server the receipt issued by Google Play: a purchase token, the signed description of the transaction, and its signature. Our server checks that signature, then credits the pearls. We keep that receipt, the pack concerned and the date: this is what prevents the same purchase from being credited twice, and what lets us find your payment again if something went wrong. We receive no name, no address and no payment details: the transaction itself takes place entirely at Google, under its own policy.
Settings → Change phone issues an eight-character code, valid for thirty minutes and usable once. During that time we keep the code and the identifier of the player it grants access to; afterwards it is worthless. Entering that code on a second device attaches it to the same game: we then store its random identifier alongside the first.
Beyond what is described above, no data is sent to our server: no e-mail address, no contacts, no location, no hardware identifier. Your device's advertising identifier never reaches us either: only Google uses it, on Android and with your consent, for the rewarded video described below. The game contains no tracker and no analytics tool.
| Processing | Why | Legal basis | Retention |
|---|---|---|---|
| Name, depth, tier, fish | Displaying the public ranking, and vouching for your dives | Performance of the contract: the game is online by construction — the server is what guarantees dives, pearls and records, and the name, chosen at first launch, is your line in the ranking | For as long as you appear in the ranking, until you ask for deletion |
| Random identifier | Occupying a single line in the ranking, and being able to leave it | Performance of the contract (same mechanism) | Same |
| Date you first took part | Recognising early players | The publisher's legitimate interest | Same |
| Dive checkpoints | Verifying that a record was actually played, not fabricated — and crediting a record played just before the application was closed | Legitimate interest: fairness of the ranking, which every player benefits from | A dive's session is kept for thirty days at most — long enough to catch up with a record that left late — and the server keeps only the last three unused sessions |
| Pearl balance and pending operations | Giving your pearls back from one device to another, and protecting what is sold | Performance of the contract: it is what you buy | As long as your game exists; pending operations, seven days |
| Google Play receipt (token, signed description, pack, date) | Crediting the pearls paid for, and crediting them only once | Performance of the contract, and legal obligation as proof of the transaction | Kept even after account deletion, but detached from you: only the receipt remains, no longer its owner |
| Rewarded advertising (Android) | Giving a dive back in exchange for a video, if you choose to | Your consent, collected through the form required by European regulations — and withdrawable at any time in the settings | We keep nothing: this data is processed by Google, from your device (see “Rewarded advertising”) |
| Change-of-phone code | Giving your game back on another device | Your consent: you ask for the code | Thirty minutes, or a single use |
| Messages sent from the game | Handling your report or request | Your consent: you write only if you want to | Until the request has been handled |
The server and database are hosted by Cloudflare (D1 service), in its Western Europe region. Cloudflare acts as a processor: it hosts, and does nothing else with your data. As a US company, its technical teams may access it to operate the service; such access is covered by the European Commission's standard contractual clauses.
No data held by our server is sold, rented, or passed to any third party for advertising or commercial purposes — nor to anyone else, for that matter. Rewarded advertising does not contradict that sentence: the data it involves never passes through us — Google processes it directly from your device, and only if you have consented.
You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as a right to portability. The simplest way to exercise them is described just below, under “Deleting your data” — the same route works for any request, and your identifier is attached automatically.
If our answer does not satisfy you, you may lodge a complaint with a supervisory authority: in France, the CNIL (www.cnil.fr).
Two mechanisms run without human intervention, and it is only fair to say so: names are filtered automatically to rule out insulting terms, and a score judged physically impossible is refused by the server. Neither has any effect outside the game, and you can dispute either by writing to us: a human will look.
This section concerns the application “Fable of the Abyss”, published by KFR Studio (tk.contact.pro@gmail.com).
Two ways, whichever you prefer:
Either way, deletion is carried out within 30 days at most.
Deletion erases all the data concerning you on our server:
One thing remains, and it no longer identifies you: the receipt of any purchase, whose link to you is erased at the same moment. The receipt alone, with no owner, is what prevents an already-paid purchase from being submitted again to be credited a second time; it is also the accounting proof of the transaction, which we are required to keep. Apart from it, no data concerning you is kept, and we retain no copy for any other purpose.
Our host (Cloudflare D1, Western Europe) makes automatic technical backups so the database can be restored after an incident. These backups are kept for 30 days at most, then destroyed: after that, no trace of your data remains. They are never consulted or used outside of a restoration following a technical incident.
Your records and unlocked fish are stored locally on your device. They are deleted when you uninstall the application or clear its data from the Android settings. Your pearl balance, however, is held by our server (see “Your pearls and your purchases”): the copy kept on your phone disappears with the rest, but it is the deletion request above that erases the balance itself.
Names are filtered automatically to rule out insulting or hateful terms. An inappropriate name can be reported from Settings → Contact us or by e-mail, and will be removed.
A single form of advertising exists in the game, and only in the Android application: a so-called “rewarded” video, offered on the death screen when you have run out of pearls, at most once per dive. It only plays if you tap the button — never forced, never between screens, no banner, no interstitial. The browser version of the game shows no advertising at all.
These videos are served by Google AdMob. Before the very first one, a consent form appears, as required by European regulations: you can consent, fine-tune (“Manage options”), or refuse. If you refuse, the video button simply never appears, and the game remains fully playable — the choice costs nothing but the second chance the video would have offered.
To display an ad and guard against fraud, Google processes data directly from your device, to the extent your choice allows: the advertising identifier, the IP address, information about the device, and how you interact with the ad. None of it passes through our server or is shared with us — all we learn, from your own device, is that the video was watched to the end, so we can give the dive back. What Google does is detailed in its privacy policy and in the list of partners shown by the form.
Changing your mind can be done at any time, inside the game: Settings → Ad privacy settings reopens the form. Your choice is stored on your device, not with us.
The application is intended for players aged 13 and over — not least because it offers purchases and advertising. As the Pantheon is public, we encourage younger players never to use their real name as their player name, and not to write personal information in the contact form.
The date of the last update appears at the top of this page. Any change to what is collected, why, or for how long, will be announced in the release notes of the update concerned: you will not have to re-read this page to find out that something moved.
For any question regarding this policy, or to exercise your rights: tk.contact.pro@gmail.com. Please write from your own mailbox — we do not ask for your address inside the game, and that is how we can reply to you.