Short version: No Karpool accounts, ads, behavioral analytics, or developer-operated crash reporting. Microphone audio and QR camera frames are processed on the device. Companion sends derived pitch events—not audio recordings—to the joined game.
1. Scope and controller
This policy covers Karpool (fun.karpool.game) on phones, Android Auto, and Android Automotive OS, Karpool Companion (fun.karpool.companion) on Android and iOS, and this website. On Android Auto, Karpool runs on your phone and its data is stored on the phone; on Android Automotive OS, it is stored in the vehicle’s head unit.
The publisher and data controller is APLAUSO QUANTUM - TECNOLOGIAS, UNIPESSOAL, LDA, based in Portugal, with its registered office at Rua Ferreira de Castro 11, 2605-761 Casal de Cambra, Portugal. We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the GDPR. Privacy questions can be sent to privacy@oikostech.io.
Most processing described below happens only on the devices participating in a game, and the publisher never receives that gameplay data. The publisher receives personal data when you contact us (section 10) and, through its hosting provider, when you visit this website (section 11). An app store or operating-system provider may also make diagnostics available to the publisher under that provider’s terms and your platform settings (section 8).
2. Microphone and singing data
Both apps can use a microphone for karaoke pitch detection. Audio samples are processed in memory on the device that records them to estimate pitch.
Karpool Companion sends beat or timing position, detected musical note, and detected frequency to the joined Karpool game. It does not send microphone recordings or raw audio samples. Karpool uses these events to score the round and can save scores and round results locally.
3. Camera and QR codes
Companion uses the camera only when you open the QR scanner. QR frames are decoded on the phone and are not saved or sent.
A join code contains local connection details and a short-lived session secret in the URL fragment; an extended invitation can also contain Wi-Fi credentials. Browsers do not send the fragment to the web host. The join page removes it from the address bar immediately and can keep a validated invitation in page memory for a user-tapped action. Only legacy connection fields can be sent to Google Play as an install referrer after a store-button tap, when the listing is configured. Wi-Fi credentials are excluded from that referrer and from the browser-to-iOS Continue action.
On a regular phone screen—not a car display—Karpool can optionally use the camera for a player picture or live webcam view. Webcam frames are not sent anywhere; a player picture is saved only in Karpool’s app storage. The AAOS version does not request camera access.
4. Local-network play and permissions
When you join a Karpool party or game, Companion communicates directly with Karpool over the local network. The apps can exchange:
- a Companion name, initially based on the device name when available and editable by you, a random Companion identifier, and your chosen avatar/color identity;
- session, connection, party role and presence, player assignment, and round information;
- the game’s song list, song details, queue information where permitted, and cover images;
- derived pitch, song choices, and other gameplay events; and
- short-lived join, local-access, party, round, and reconnect credentials.
This traffic is used to connect the apps and run the game. It is not routed through a Karpool cloud service. The current local protocol uses ordinary HTTP and UDP rather than transport encryption, although session secrets authorize joining. Someone else able to observe the same network may be able to see this traffic, so use a local network you trust.
Android uses Wi-Fi and network-state permissions to check the connection and support passenger Wi-Fi. When Karpool creates a local-only hotspot on Android 12L or earlier (API 26–32), Android requires the permission labelled Location and location services to be enabled. Karpool uses that permission for hotspot creation, not to read, store, infer, or transmit physical location. On Android 13+ it uses Nearby devices (NEARBY_WIFI_DEVICES, declared neverForLocation) instead. The phone/Android Auto and AAOS game variants follow the same rule. The game also declares coarse location with the same API-32 cap because Android 12 requires it alongside the fine-location runtime request; approximate-only consent does not satisfy legacy hotspot creation. Neither location grant is used to read location data. Android Companion declares neither location permission and has no Wi-Fi state/change grant; its optional network request uses network-state permissions.
Local-network access is separate: Android 16's opt-in network restriction uses Nearby devices; target-37+ builds declare Local network access. iOS Companion uses Local Network access. Before the hotspot OS prompt, Karpool shows a permission screen explaining hotspot-only use and, on older Android, the Location label and absence of physical-location processing. An explicit Allow action requests Location on API 26–32 (fine/coarse together on Android 12) or Nearby devices on API 33+. Users can cancel and use a shared network instead; after a permanent denial, the screen offers app permission settings. Android Auto setup belongs on the phone while parked: Allow on phone can post a setup notification when notifications are available, otherwise it gives instructions to open Options > Companion Apps > Car setup: Passenger Wi-Fi on the phone and reconnect. No hotspot permission prompt originates on the projected display. Same-phone loopback joins do not need Wi-Fi setup. Microphone and camera permissions are used as described above and can be refused or revoked in system settings.
Passenger Wi-Fi credentials
Karpool can display a separate Wi-Fi QR containing a network name (SSID), security type and password, alongside the authenticated game invitation. Anyone who scans or photographs the Wi-Fi QR can obtain those credentials. Share it only with people you intend to let onto that network. Automatic Wi-Fi joining in Android Companion remains disabled for release pending physical-device verification; iOS hotspot configuration also remains build-gated. The separate Wi-Fi QR and game Join QR are the fallback.
On the Android game device, saved manual Wi-Fi credentials and the stable app-created hotspot identity used on API 36+ are encrypted with an AES-256-GCM key in Android Keystore. The encrypted preferences are excluded from Android cloud backup and device transfer. The hotspot SSID/password is generated per installation and reused across sessions; it is not an account identity. Saved manual credentials remain until cleared or replaced, and the app-created identity remains until rotated or app storage is removed. Neither saved record is deleted by the party's two-hour idle timeout.
The active app-owned hotspot and new-join admission end on explicit Stop, party end, car exit, or the shared two-hour idle deadline. Closing the join screen, an approval dialog, or a driving pause can hide the QR without ending the hotspot. Older APIs may issue different credentials after a reservation is lost. Wi-Fi passwords are not written to Settings.json or app logs. Companion handles decoded Wi-Fi invitation details in memory; its party/round reconnect files do not store Wi-Fi passwords. If you join through the operating system's Wi-Fi scanner/settings, the operating system may retain the network under its own settings.
5. Online Game (not available)
Karpool’s code base includes an Online Game mode inherited from UltraStar Play that would connect Karpool games directly over the internet. It is switched off in current release builds and cannot be turned on by users. If it is ever offered, this policy and the store disclosures will be updated first.
6. Information stored on your device
Karpool
- preferences, microphone settings, player names, profiles, and an optional player picture;
- names and random identifiers of Companion phones that joined, so players can be reassigned and reconnected;
- current song or round state used to recover from interruption;
- song metadata, scores, player names, dates, and song hashes;
- songs you choose to download and temporary download files; and
- local diagnostic logs.
Karpool Companion
- an editable name, random Companion identifier, and chosen avatar/color identity;
- language, microphone, permission, and developer preferences;
- short-lived party and round reconnect state with local endpoints, connection and session details, and reconnect tokens; and
- local diagnostic logs.
A join invitation normally lasts ten minutes. Local-access and reconnect credentials expire two hours after they were issued or last renewed by party activity. An expired credential stops working and is deleted the next time Companion starts or tries to reconnect. A round reconnect ticket is removed when the round ends. Party reconnect state is removed when you explicitly disconnect or leave, when the party ends, or when you use a new invitation. Full logs roll daily, are limited to 250 MB per file, and retain up to five files. Warning/error logs roll daily, are limited to 512 KB per file, and retain up to three files. Logs can contain app, device, player-name, and local-network details; join and reconnect secrets are redacted from handled error messages. Logs are not uploaded automatically.
7. Other network requests
When you open the song catalog, Karpool requests it over HTTPS from karpool.fun, hosted on Microsoft Azure Static Web Apps for the publisher. A bundled catalog is the fallback if the remote catalog is unreachable. The offered free song pack is downloaded from the same host only when you choose to download it. Catalog and archive requests expose ordinary request data such as IP address, request time, and transport metadata to the hosting provider for delivery; the website hosting processing described in section 11 also applies. These requests do not upload player profiles, singing data, scores, or logs. Song archives are integrity-checked and stored on your device.
Karpool can also contact hosts you select for song archives, GitHub when you explicitly download a speech-recognition model for the song editor on a phone screen, hosts named by user-added song content (for example cover art or a video thumbnail), or a help page when you tap a browser link. Those hosts receive ordinary request data under their own policies. Neither app checks for updates automatically, and Karpool Companion does not fetch song-archive catalogs or download song archives.
8. Analytics, crash reporting, ads, and accounts
The current apps have Unity Analytics, Unity Cloud Diagnostics, Unity engine diagnostics, Unity Ads, In-App Purchasing, and Performance Reporting disabled. There is no Firebase, Sentry, App Center, ad network, account service, or similar developer-operated SDK. Local logs stay on your device unless you deliberately share them.
An app store or operating system (for example Google Play or Apple) may separately share crash or usage statistics with the publisher if you have allowed this in your platform settings, under that platform’s own terms. The publisher uses any such statistics only to find and fix problems.
9. Optional mods
On phone screens, Karpool supports optional UltraStar Play mods, off by default and not available on car displays. A mod runs inside Karpool and can change data handling. For example, the included Mic Recording Saver saves microphone recordings locally when you turn it on. It does not upload them.
10. Contacting us
If you email us, we receive your email address, the content of your message, and anything you choose to attach, such as logs. We use this only to answer you and handle your request. We keep support and privacy correspondence for 24 months after the matter is closed, unless a longer period is required to establish or defend legal claims. You can ask us to delete it earlier.
11. This website
This website uses no cookies, analytics, advertising, or third-party embeds. It is hosted on Microsoft Azure Static Web Apps. When you visit it, the hosting provider processes technical data such as your IP address, requested page, time, and browser user agent in order to deliver the page and protect the service, as a processor for the publisher. Microsoft processes this data under its Data Protection Addendum, which includes the EU Standard Contractual Clauses for any transfer outside the European Economic Area, and retains it according to those terms. We do not collect or keep website access logs ourselves.
12. Legal bases
Where the EU or UK GDPR or similar law applies:
- To the extent the publisher is a controller of in-app processing, it is necessary to provide the game you request (Art. 6(1)(b)).
- microphone, camera, local-network and optional features such as the player picture and mods are used only when you choose them and grant the related permission;
- answering your messages is based on our legitimate interest in responding to you, or on steps you ask us to take (Article 6(1)(f) or (b));
- website hosting logs are based on our legitimate interest in delivering and securing the website (Article 6(1)(f)); and
- keeping records needed to meet legal obligations is based on Article 6(1)(c).
13. Sharing, transfers, and retention
Karpool and Companion exchange gameplay data only between the devices participating in the game you deliberately join. We do not receive it on a developer server, sell it, or disclose it to advertisers or data brokers. For personal data we do receive, we use service providers acting for us (website hosting and email) and disclose data to authorities where the law requires it.
If a service provider processes personal data outside the European Economic Area, we rely on an applicable adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or the European Commission’s standard contractual clauses. You can ask us for details.
Local data remains until replaced, removed in the app, cleared through the operating system, or deleted when the app is uninstalled, subject to the shorter reconnect and log limits above. Saved Wi-Fi passwords follow the separate retention rules in section 4. Retention of correspondence and website logs is described in sections 10 and 11.
14. Security
App data is kept in each app’s private storage protected by the operating system. Join codes expire after about ten minutes. Local-access and reconnect credentials expire two hours after they were issued or last renewed by party activity. An expired credential stops working and is deleted the next time Companion starts or tries to reconnect. Secrets are redacted from handled error logs; song downloads use HTTPS with an integrity check. Local multiplayer traffic is not transport-encrypted, as explained in section 4.
15. Your rights and choices
Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting processing that took place before. Because Karpool has no accounts or server-side profile, the publisher generally cannot identify or retrieve data stored only on participating devices. You can manage permissions in system settings and erase app-private data on a device you control by clearing app storage or uninstalling. See the Data deletion page for steps.
Send requests to privacy@oikostech.io. We answer within one month, which can be extended by two further months for complex requests. If we cannot identify data because it never reached us, we will explain that. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
16. Children
The apps do not create accounts, show ads, or knowingly build profiles of children, and the publisher does not receive children’s gameplay data. A parent or guardian can remove app-private information by clearing app data or uninstalling. The publisher will maintain store age-rating and target-audience declarations appropriate to released content and markets.
17. Changes
We may update this policy when the apps or legal requirements change. The effective date at the top identifies the current version. Material changes will be published here before or with the relevant app update.
18. Contact
Publisher and controller: APLAUSO QUANTUM - TECNOLOGIAS, UNIPESSOAL, LDA
Registered office: Rua Ferreira de Castro 11, 2605-761 Casal de Cambra, Portugal
Email: privacy@oikostech.io
Karpool is an MIT-licensed fork of UltraStar Play. Open-source licensing does not change the data handling described in this policy.