Koko & Momo · Privacy

Your progress stays with you.

Last updated 13 November 2026

Koko & Momo: The Expedition is made by QuantumCat Terminal Private Limited, a company in India. Playing alone needs no account, and your progress is kept on your phone. The game never asks for your email address, contacts or location. Playing together online is only for adults (18 or over), only in the countries where it is open, and only with an account, as described under “Accounts and sign-in”. Under 18 there is no online play and no account: a child's or teen's phone never connects to our online play servers, and we keep nothing about them there. Ads appear only when you choose to watch one for a reward, as described under “Rewarded ads”. Apart from the purchase reports described under “The Club, coin packs and avatars” and the ad provider described under “Rewarded ads”, the game uses no external analytics service.

What the game keeps on your device

Your stages, stars, berries, coins, outfits, goals, daily runs, settings (sound, graphics, camera, effects and vibration) and whether you are a Club member are saved on your phone by the game itself. A few local counters also record goal discovery, purchases and return visits, so the game can remember your progress. These records are not uploaded to us and we keep no copy of them. Your phone's own backup to your Google or Apple account may keep a copy (you control it in your phone's settings). Deleting the app, or clearing its data in your phone's settings, deletes them from the phone.

When the game starts with a network connection, it may download the latest list of extra stages from our server. That request is the same for every player and carries nothing about you beyond what any connection shows. Apart from that, if you never play online and never start a purchase, the game makes no internet connection of its own, except to the ad provider described under “Rewarded ads”.

Your own photo runner

Club members on Android phones can make their own runner from a photo: your face on a runner, in Koko's place, in Momo's place or in both.

Your photo never leaves your phone. You choose one picture in your phone's own photo picker; the game asks for no permission and cannot see the rest of your photos. The game keeps only the part you frame in the circle, as one small picture, together with the look you choose for it (skin and hair). They are kept in the game's private storage on your phone, in a folder that other apps cannot read and that is left out of your phone's backup. We never receive your photo and keep no copy of it. It is never sent to our servers, to other players, to the ad provider or to anyone else.

The game does not detect, measure or recognise faces. You place the face in the circle yourself, and the game only reads the picture's colours to match the skin and the hair.

Only you see your photo runner. When you play together online, your teammate's phone shows its own runners and never yours. Victory pictures that show your photo runner are kept beside it, in the same private folder, and appear only in your own Memories; they leave your phone only if you share them yourself.

Use a photo of yourself, or of someone who has said yes. If you are under 18, ask a parent or guardian first.

You can delete your photo runner at any time: open WHO RUNS?, tap your photo runner, then tap “delete my photo runner”. That removes the picture, everything made from it and every victory picture that shows it from the phone at once. Deleting the game or clearing its data removes them too. If your Club membership ends, your photo runner stays on your phone, unused, until you rejoin or delete it; the victory pictures you already have stay in your Memories.

Playing together online

Playing together online is only for adults: 18 or over, or the age of majority where that is higher (for example 19 in some countries). It is open only in some countries, and it needs an account.

When two adults play together, each phone connects to a relay server run by QuantumCat so that the two phones can share one run. While the session lasts, the relay passes the room code, game version, course, each player's moves, stickers and recovery snapshots between the two phones. A dropped seat is held for up to 45 seconds so you can reconnect. The relay does not store what passes through it after the session ends.

As with any internet connection, the relay and its hosting provider see your device's IP address, and the hosting provider may keep technical logs of connections for a short time. We use them only to deliver the session, to apply each country's rules and to keep the service working and secure, never to build a profile of you.

To apply each country's rules, the relay works out which country a connection comes from. It uses the IP address (IP Geolocation by DB-IP, https://db-ip.com), the country kept with your account (for a phone sign-in, the country of the number; for a Google, Apple or Facebook sign-in, the country your phone is set to) and your phone's region setting. It applies the strictest of the three. This gives only an approximate location (a country), and the relay keeps it only while you are connected.

To connect you to the nearest of our server regions, your phone measures how long it takes to reach each region and sends those times, with your phone's region setting, when it connects. They are used for matching while you are connected and are not stored.

Quick Match and friends

Quick Match finds you a teammate to run a stage with. Before it starts you choose which bear you run as, Koko or Momo. If the search takes a while, you can say that either bear is fine. The game never asks for or uses anyone's gender. Your teammate sees your game name, your avatar and its decoration, which bear you run as, how far you have got in the adventure and whether you are a Club member.

With a teammate who is not your friend you can only send the game's preset stickers. There is no text, no voice and no photos. After a run each of you can tap ADD FRIEND or SKIP. You become friends only if you both tap ADD FRIEND. Your tap is not shown to the other player unless they tap ADD FRIEND too, and a SKIP is never shown.

Friends can invite each other to play, see whether the other is in the game right now, see their duo streaks, shared challenges and the weekly board, and chat by text, with photos and videos too. The weekly board shows game names, avatars, points and duo streaks only.

For everyone who plays online, our servers keep your player number, a one-way fingerprint of a secret made on your phone (never the secret itself), your game name, your avatar and its decoration, when you were last online, the players you blocked and your friends. For each pair that played together they keep the duo streak, this week's and last week's points and shared-challenge progress, and which challenge rewards were claimed, each with a random mark made by the phone that claimed it, so that a reward is paid exactly once even if the connection drops. To count runs, both phones report each run's stage, whether it was cleared, its stars and its berries.

Voice

Voice works only between two friends who are both Club members, both 18 or over, and who have both said yes to talking, in countries where voice is allowed. Your voice goes from your phone through our relay to your friend's phone while you talk. It is never recorded or stored. You can mute yourself, turn your friend's voice off, block or report at any time, and the game asks your phone for microphone permission before it uses the microphone.

Accounts and sign-in

Online play needs an account. Making one goes in this order:

Your date of birth, asked first, before anything is said about age. If it shows you are under 18, it stops there: nothing is sent to us, and online play stays closed on that phone. The answer is kept on the phone and is not asked again.
An “18 and over” notice, shown only after a date of birth that shows you are an adult.
A sign-in with Google (on Android phones), with Apple (on iPhones), with your phone number or with Facebook (see below).
Accepting our Terms of Use, Community Guidelines, Safety Tips and this policy.
A game name made by the game (two words and a number, for example “Honey Panda 482”; you never type one) and an avatar.

These are the ways to sign in:

Google (on Android phones) or Apple (Sign in with Apple, on iPhones), with one tap: Google or Apple confirms your sign-in and gives our server a signed token made for this game. Our server checks the token with Google's or Apple's public keys and keeps only a keyed hash of the account ID in it (a one-way code made with a secret key), never the ID itself, so we can recognise your account the next time you sign in. We do not keep the email address or the name a Google token carries, and the game asks Apple for neither. Google and Apple handle your sign-in under their own privacy policies (Google, Apple).
WhatsApp: we send a one-time code to your number through WhatsApp.
Phone number: we send a one-time code to your number by SMS.
Facebook Login (on Android phones): Facebook confirms your sign-in and tells our server the app-specific ID it uses for you in this game. We keep only a keyed hash of that ID (a one-way code made with a secret key), never the ID itself, so we can recognise your account the next time you sign in.

Codes are sent by Twilio Verify, a service of Twilio, which receives your phone number to deliver the code; WhatsApp codes travel through WhatsApp, which is run by Meta. They handle your number under their own privacy policies (Twilio, WhatsApp).

We do not keep your phone number itself. Our server uses it only to send and check the code. We keep a keyed hash of it (a code made from the number with a secret key, which lets us recognise the same number again without storing it) and its country, to stop duplicate accounts and keep banned people out. With your account we also keep your date of birth, how you signed in, the version of the terms you accepted and when, when the account was made and last used, your game name and your chosen avatar. Teammates and friends you make in the game never see your real name, email address, phone number, date of birth or Facebook name.

When your date of birth shows you are an adult, the game connects to our servers and makes an anonymous player record: a random player number, a one-way fingerprint of a secret made on your phone, your game name and your avatar. It becomes part of your account when you finish signing in. If you never finish, it is deleted when it has not been used for 13 months.

We use your date of birth to make sure only adults play online, and to apply a higher minimum age where a country has one. Your phone also keeps your date of birth, how you signed in and the terms you accepted, so that you stay signed in.

Chat

Chat is only between two friends: two adults who both tapped ADD FRIEND after running together. Starting a chat is a Club perk; once a member writes, the friend can reply. Club members can also send photos and videos, only to a friend and never to anyone else. You can stop receiving them with Photos and videos in Safety and privacy.

Messages are stored on QuantumCat's servers so they can be delivered and shown in the conversation. They are deleted after 30 days, or sooner if you delete your account, and a conversation keeps at most its newest 500 messages. Chats are not end-to-end encrypted. Our servers look for links, phone numbers and email addresses in messages and hide them until both of you have written and 24 hours have passed. They also look for words about money or about moving to another app, and the game shows a warning under such a message. Our team reads the messages that are reported to us.

Photos and videos sent in chat are stored on QuantumCat's servers and in Cloudflare's storage, and delivered through Cloudflare, so they can be shown to your friend. Before one is stored, our server removes the location, camera and other details hidden inside the file. Only you and your friend can open them, through links that work for ten minutes. They are deleted after 30 days, or sooner if either of you deletes the account or asks to be forgotten. We do not check photos and videos for nudity, because they go only to a friend you both chose. Cloudflare compares the photos we serve with lists of known child sexual abuse images; a match is blocked, and we report it to the authorities (in the United States, NCMEC) as the law requires. A photo or video that is reported is kept with the report for review.

Moderation and reports

You can report a player from the card after a run, from your friends list or from a chat. The reasons are: harassment or hate, sexual content, money or a scam, might be under 18, something else.
A report goes to our team for review. We keep a record of it: both player numbers, the reported player's game name, the reason chosen, the time and the room code. A report from a chat also carries the reported message and up to ten messages before it. A reported photo or video is kept with it.
A report also blocks that player for the person who reported.
A report that someone might be under 18, made by a player who has run or chatted with them recently, pauses that account's online play until our team has looked at it. Each player can pause up to three accounts a day this way; a further such report that day goes to our team for review in the same way, without the pause.
If several different players who have run or chatted with an account report it within a week, its online play is paused for a week, or until our team has looked.
Repeat or serious offenders are banned by account and by phone number. For a banned account we keep the keyed hash of its phone number, Facebook ID or Google or Apple account ID, so the same number or account cannot sign up again.
If an account is deleted while its online play is paused, we keep the keyed hash of its phone number, Facebook ID or Google or Apple account ID with the pause, so a new account made with it is paused too: for a pause after an under-18 report, until our team has looked or for up to 180 days; for a pause of a set length, until it ends.
A block, a report or a deletion you ask for while your phone is offline is kept on your phone and sent the next time it connects.

We share information with the police, courts or other authorities when the law requires it, for example to report content that sexually exploits a child, or when someone is in immediate danger.

Playing with Facebook friends

Logging in with Facebook is optional and only for adults. Facebook's software inside the game starts only on an adult's phone, in a country where online play is open. It never starts for a child or a teen. When you log in to play with your Facebook friends, Facebook gives the game your public profile (your name and an app-specific Facebook ID) and the list of your Facebook friends who also play Koko & Momo. We do not receive your email, password, posts or any other Facebook data, and we never post anything for you.

While the game is open and you are logged in, your phone tells our relay your Facebook ID and name so that your Facebook friends can see you are online and invite you. Every few seconds it also sends the relay the Facebook IDs of your friends who play, only to ask which of them are online; the relay answers and keeps nothing. The relay passes an invitation with your game name and a room code to the friend you choose. The relay keeps this only while you are connected and forgets it when you close the game. Apart from the keyed hash of the app-specific ID kept with an account you sign in to with Facebook (see “Accounts and sign-in”), nothing about your Facebook account is saved on our servers. On your phone, Facebook's own software keeps you logged in until you choose LOG OUT OF FACEBOOK in the game.

You can remove the game from your Facebook account at any time in Facebook under Settings & privacy → Settings → Apps and websites. See how to delete your data.

Rewarded ads

The game shows only rewarded ads, and only when you tap to watch one: for one more life after a crash, or for one more Quick Match once today's free ones are used. Club members never see ads. The ads come through Unity LevelPlay (ironSource), run by Unity Technologies, and the Unity Ads network. Its software starts with the game on Android and iPhone so an ad is ready when you want one.

Every ad is child-directed and non-personalised for everyone, whatever their age. The game does not use your device's advertising identifier, and the app does not ask for the permission to read it.

To show ads, limit how often you see them, prevent fraud and measure them, the ad provider may receive your IP address, the approximate location it can work out from that address, device and operating system details, and how you interact with the ads. Unity describes this in its privacy policy for game players.

Sharing a victory card

When you finish a stage you can make a picture of the moment. It is created on your phone and only leaves it if you choose an app in your phone's share sheet; we do not receive it.

The game engine

Koko & Momo is built with the Unity engine. Unity's online analytics and crash and performance reporting are switched off in the game; its In-App Purchasing library is used only for the Club, coin packs and avatars, and its LevelPlay ads only for rewarded ads, as described in those sections. The engine itself may send anonymous technical information about your device's hardware and software, such as the model, operating system and graphics capabilities, to Unity Technologies. That information does not identify you to us. Unity describes this in its privacy policy for game players.

The Club, coin packs and avatars

The game sells three things, always through Google Play or the App Store under their own terms. The Koko & Momo Club is an optional monthly subscription that keeps the game free of ads and doubles the coins from every stage you clear. On Android phones it also lets you make your own photo runner (see “Your own photo runner”). For adults, where online play is open, it also gives unlimited Quick Match, lets you start chats with friends, and lets you talk by voice with friends who are members too. It renews every month until you cancel it in the store. Coin packs add play coins, and a starter pack, sold once, adds coins and a few items. Avatars for online play are one-time purchases; one avatar and five emblem pictures are free. We never see your name or payment details.

To show the Club's price and to know whether you are a member, the game asks the store app on your phone each time it starts; the store answers with the price and whether your store account has an active Club subscription. The game remembers the answer on your phone, so the Club keeps working for up to three days without a connection. Coins from a pack are added to the coins saved on your phone. Which avatars you own also comes from your store purchases; the avatar you choose is kept with your account and shown to other players when you play online.

The game talks to the store through Unity's In-App Purchasing library. When you start a purchase, and when that purchase completes or fails, the library sends Unity Technologies a purchase report: the product, its price, the store and the order's result and transaction number, the app and Unity versions, the device model, system version, languages, storage size and the time the device last started, and a random number Unity creates for this app on your phone (on iPhone and iPad also Apple's identifier for vendors). It never includes your name, contact details or an advertising identifier. Unity describes its use of this information in its privacy policy for game players. If you never start a purchase, no report is sent.

Downloads and app stores

Downloads and purchases are handled by Google Play or the App Store under their own terms; we never see your payment details.

Besides our own team and our hosting provider, these companies handle some of your information for the purposes described on this page: Cloudflare (our network, and storage for photos and videos sent in chat), Twilio (sign-in codes), Google (Sign in with Google), Apple (Sign in with Apple), Meta (WhatsApp codes, Facebook Login and Facebook friends), Unity Technologies and the Unity Ads network (rewarded ads, purchase reports and the engine), and Google Play and the App Store (downloads and purchases). They, and our servers, may process your information outside your country, including in India and the United States.

How long we keep things

Progress and settings: on your phone (and in your phone's own backup, if it is on), until you delete the game or its data.
Your photo runner and the victory pictures that show it: on your phone only, until you delete them, the game or its data. They are not in your phone's backup, and we hold no copy.
Rooms, moves and the Quick Match queue: in memory while you play or search; a dropped seat is held for up to 45 seconds.
Your account: until you delete it. You can do that in the game at any time, and the data deletion page explains the same.
An anonymous player record with no account: deleted when it has not been used for 13 months.
Friends: until either of you unfriends or blocks the other, or deletes their account.
Blocks: until you unblock, or delete your account.
Duo streaks, points and challenges: weekly points and shared challenges for this week and last week only; a pair that has not played together for 60 days is removed.
Who you ran with, and an ADD FRIEND that waits for an answer: one week.
Chat messages: 30 days, then deleted, or sooner if you delete your account.
Photos and videos in chat: 30 days, then deleted, or sooner if you or your friend deletes the account; one that was reported is kept with the report.
Reports, with what they include: 180 days.
Banned accounts: the keyed hash of the phone number, Facebook ID or Google or Apple account ID, for as long as the ban lasts, so the same one cannot sign up again.
A pause left by a deleted account: the keyed hash of the phone number, Facebook ID or Google or Apple account ID with the pause, until our team has looked or for up to 180 days (a pause of a set length: until it ends).
Voice: never recorded or stored.

Our online play database is backed up, encrypted, so that it can be restored after a failure. Something deleted from it, by you or at the end of the times above, stays in those backups until they are replaced, for up to 14 days; if a backup is ever restored, we delete again every account deleted since it was made.

We may keep information for longer when the law requires us to, for example to help an investigation. Twilio, Meta, Unity and the app stores keep what they receive under their own policies.

Children and teenagers

Children and teenagers can play the whole adventure alone. For everyone under 18:

There is no online play at all: no Quick Match, no rooms, no friends, no invitations, no chat, no voice and no contact with other players.
There is no account. A child's or teen's phone never connects to our online play servers, and we keep nothing about them there. Their progress stays on the phone.
Ads are the same as for everyone: only rewarded ads the player chooses to watch, child-directed and non-personalised. The game does not use the device's advertising identifier.
Purchases with real money go only through the store's own purchase screen, where family purchase controls such as Google Family Link approval or Apple's Ask to Buy apply.
Facebook Login is for adults only, and Facebook's software inside the game never starts on a child's or teen's phone.
A photo runner (a Club perk, see “Your own photo runner”) is made and kept on the phone only. We never receive the photo, whatever the player's age.

What the ad provider, the store and the game engine receive is the same as for every player, and the sections above describe it.

Online play for adults has block and report. A report that a player might be under 18 pauses that account's online play until our team has looked at it (up to three such pauses a day from each player), as described under “Moderation and reports”. Adults who break the rules are banned. Our child safety standards say more.

Where the law asks for it (Texas, Utah and Louisiana in the United States, and Brazil), the game also reads the age range that Google Play or the App Store holds for the account on the phone (Google's Play Age Signals, Apple's Declared Age Range). It reads it once each time the game starts; where the store's rules let you choose, Google Play or Apple may first ask you whether to share it. The answer stays in the phone's memory until the game closes: it is never saved, never written to a log, and never used for ads, analytics or anything but age rules and safety.

If the store says the player is under 18, or that a parent or guardian supervises the account, online play stays closed on that phone, as it does after a date of birth under 18; the solo game is unchanged, and the store itself asks the parent before any download or purchase. If the store says the player is 18 or over, the usual sign-in follows. Where online play needs the store's word (now the United States and Brazil), our servers hear only, for that connection, whether the store says the player is an adult or that its age rules do not apply on that phone. We do not store it.

Parents and guardians: we hold nothing about your child on our servers. Their progress is on the phone, and deleting the game or its data deletes it. If you think someone under 18 has made an account by giving a false age, tell us and we will close it.

Your rights

Wherever you live, you can ask us what information we hold about you, and ask us to correct or delete it. You can delete your account, and everything kept with it, yourself in the game: open PLAY TOGETHER, tap Safety and privacy, then tap DELETE beside “Delete my account”. For anything else, write to [email protected] with your game name and how you signed in (and the phone number, if you used one), so we can find your information. We reply within 30 days.

India

Under India's Digital Personal Data Protection Act, 2023 and its Rules, notified in November 2025, you have the right to:

get a summary of the personal data we process about you, what we do with it, and who we share it with;
have it corrected, completed, updated or erased;
have your grievances dealt with by us; and
nominate someone to use these rights for you if you die or become unable to use them.

We use your personal data for online play because you consent to it when you accept this policy in the game. You can withdraw that consent at any time, as easily as you gave it, by deleting your account; this ends online play for you but does not undo what happened before. The Act treats everyone under 18 as a child, which is why there is no online play and no account under 18. If our grievance process does not resolve your complaint, you can complain to the Data Protection Board of India.

European Union and United Kingdom

If you live in the European Union or the United Kingdom, data protection law also gives you the right to see your information, correct it, have it deleted and object to how we use it. We use your information to provide the game and the features you choose, to keep players safe and the service secure, because you agreed, and when the law requires it. You can also complain to your local data protection regulator, such as the Information Commissioner's Office in the UK.

Grievances

Grievance Officer, QuantumCat Terminal Private Limited: [email protected] (subject: Grievance). We acknowledge every complaint within 24 hours and resolve it within 15 days. See Complaints and grievances in the Terms of Use for the faster times for removal requests and how to appeal.

Questions and changes

Write to [email protected] with any question about your privacy. If this policy changes, the new version will appear here with a new date before it applies, and if the change matters for online play, the game will ask you to accept it again.