Legal

Privacy Policy

Effective September 13, 2026 · Applies to every Android app published by Shura Studios

Kuro: Private Diary Journal Tengu: Bird ID & Sounds Shura Kids Piano

01 Scope and who we are

Shura Studios ("we", "us") is an independent Android developer. This policy is the single privacy policy for every app we publish on Google Play, and it is the policy linked from each app's Play Store listing and from the Settings screen inside each app. Where a rule applies to only one app, that app is named.

The apps covered are Kuro: Private Diary Journal (com.shura.studios.diary), Tengu: Bird ID & Sounds (com.shura.studios.birds) and Shura Kids Piano (com.shura.studios.kids.piano). If we publish another app, this policy is updated to cover it before that app ships.

For users in the European Economic Area and the United Kingdom, Shura Studios is the data controller for the limited processing described here. You can reach us at shurastudios@gmail.com.

02 The catalogue at a glance

Our apps are not equally chatty. This table is the honest summary; the sections after it give the detail.

03 What stays on your device

Content you create

Diary entries, titles, tags, moods, attached photos and voice notes in Kuro; saved birds, your collection and your identification history in Tengu; progress and settings in Shura Kids Piano — all of it is written to the app's private storage on your device. It is not transmitted to us and we have no ability to read it.

Your PIN and biometrics

The PIN that locks Kuro is stored only on your device. Fingerprint and face unlock are handled entirely by Android's BiometricPrompt: the app receives a yes-or-no result and never sees your biometric data, which never leaves the secure hardware on your phone.

App settings

Theme, language, sound preferences, reminder times and similar choices are stored locally.

What we never collect

We do not ask you to create an account with us. We do not collect your name, email address, phone number, contacts or precise location. None of our apps request location permissions. We do not sell personal data to anyone, and we do not share it for cross-context behavioural advertising.

04 What leaves your device

Bird identification in Tengu

Identification runs on services outside the app, so the media you submit has to be uploaded to be analysed:

• Photo identification. The image you capture or pick is sent to an image-recognition endpoint at objectdetector.aitools.fun, which returns candidate species and a confidence score.
• Sound identification. The recording you make — up to two minutes — is sent to the BirdNET analysis service operated by the Cornell Lab of Ornithology at birdnet.cornell.edu, which returns the species it hears. BirdNET's own handling of submitted audio is governed by Cornell's terms and privacy notice.

Only the media you explicitly submit for an identification is uploaded, at the moment you tap to identify. Your photo library is not scanned, the microphone is not opened outside a recording you started, and no identification request carries your name or a persistent identifier for you. Reference imagery and species data shown in the field guide are fetched from the Cornell Lab's public media servers.

If you would rather not upload anything, simply do not use the photo and sound identification features — the rest of the app, including the guide and your saved collection, works without them.

Ordinary network requests

Kuro and Tengu also make requests to Google for ads, crash reporting and purchase verification, and to Google Play when you tap a link to a store page. Those are covered in §7, §8 and §9.

Shura Kids Piano makes no network requests of its own at all beyond the ad requests its ad component makes.

05 Google Drive backup (Kuro only, optional)

Backup is off by default. If you turn it on, you sign in with your Google Account and the app requests a single scope:

• https://www.googleapis.com/auth/drive.appdata — access to the hidden, application-specific data folder in your Google Drive.

With that scope the app can create, list, download and delete only the files it created itself. It cannot see, open or modify any other file, photo or document in your Drive, and it cannot list the rest of your Drive contents.

A backup is an archive of your entries and their attachments, packed on the device and uploaded straight to that hidden folder. The archive never passes through any server operated by us. Google's handling of data stored in your Drive is governed by the Google Privacy Policy.

When you sign in, the app receives basic Google Account identifiers such as your account email, purely to show you which account is connected and to make authenticated Drive requests. You can sign out inside the app at any time, and you can revoke the app's access entirely at myaccount.google.com/permissions.

06 Limited Use disclosure

07 Advertising

The free versions of our apps show ads through Google AdMob. AdMob is an independent controller for the data it collects, under the Google Privacy & Terms. To serve and measure an ad, AdMob may process technical information such as your device model, operating system version, coarse region derived from your IP address, and — outside our kids' app — the resettable Android advertising ID.

Consent in the EEA, the UK and Switzerland

Where the law requires it, the first launch shows a Google-certified consent form (the User Messaging Platform) before any personalised ad loads. Choosing to refuse personalised ads does not lock you out of anything: the app still works and shows non-personalised ads instead. You can reopen that choice at any time from the app's Settings screen.

Shura Kids Piano

Because this is a Families app, its ad configuration is stricter. The advertising ID permission is explicitly removed from the app at build time, along with the Android Ad Services permissions, so no advertising identifier is available to any ad request. Ad content is capped at the G (general audiences) rating, and requests are tagged as directed to children, which disables personalised advertising and remarketing for them.

Removing ads

Every app with ads offers a paid upgrade that removes them entirely. Once the upgrade is active, the ad component is not initialised and no ad requests are made.

08 Analytics and crash reports

Kuro and Tengu include Firebase Analytics and Firebase Crashlytics. They tell us which screens are used and what crashed, so we can fix the right things. What they collect is aggregate and technical: screen names, app version, device model, OS version, coarse region, a pseudonymous app-instance identifier, and — when something crashes — a stack trace and the state of the app at that moment.

Crash reports never contain the content of your entries, your photos, your recordings or your PIN. We use this data to diagnose bugs and prioritise work, nothing else, and we do not attempt to identify individual users from it. Firebase's own processing is described in the Firebase Privacy and Security documentation.

Shura Kids Piano contains no analytics or crash-reporting SDK whatsoever.

09 Purchases and subscriptions

All purchases — one-time upgrades and subscriptions — run through Google Play Billing. Your payment method, billing address and transaction history are handled by Google and are never seen by us. The app receives only a purchase token and the entitlement state it implies, which it uses to unlock the paid features on your device.

We keep no purchase database of our own. Refunds, cancellations and payment questions are handled by Google Play, though you are welcome to write to us and we will help where we can. See §5 of the Terms of Service for how subscriptions renew and cancel.

10 Permissions

Android permissions are requested at the moment a feature needs them, with an explanation, and declining one only disables that feature.

11 Retention and deletion

On your device. Your content stays until you delete it. Uninstalling an app removes its private storage, and with it everything the app held. That is irreversible — export or back up first if you want to keep anything.

Drive backups. They live in your Drive until you delete them, either from inside Kuro or from Google Drive's "Manage apps" screen. Deleting the app does not delete the backups.

Identification uploads. A photo or recording you submit is transmitted for analysis and is not stored by us — we operate no storage for it. Retention on the analysis services themselves is governed by their operators, and for BirdNET by the Cornell Lab of Ornithology.

Analytics and crash data. Retained by Google under Firebase's default retention windows, which are measured in months, and then deleted.

12 Security

App content is written to Android's per-app private storage, which other apps on the device cannot read. Kuro adds an optional PIN and biometric lock on top. All network traffic to Google, to Cornell and to the Drive API uses HTTPS.

We are honest about the limits: no security is absolute, a rooted or compromised device can defeat app-level protections, and anyone who knows your PIN can open your diary. If you keep something in a Drive backup, its safety also depends on the security of your Google Account — turn on two-step verification.

13 Children and families

Shura Kids Piano is designed for children and participates in Google Play's Families programme. It collects no personal information, asks for no permissions, requires no account, works entirely offline, and has the advertising ID stripped out at build time. Ads in it are restricted to general-audience content and tagged as child-directed, which turns off personalised advertising. We believe this meets the requirements of the US Children's Online Privacy Protection Act (COPPA) and the equivalent rules for children's data in the EEA and the UK.

Kuro and Tengu are general-audience apps, not directed to children, and are not intended for anyone under 13 (or the higher minimum age that applies where you live). We do not knowingly collect personal information from children in those apps. If you believe a child has provided us with personal information, write to shurastudios@gmail.com and we will delete what we can reach.

14 International transfers

The third-party services described above — Google (ads, analytics, Drive, billing) and the identification services in §4 — operate infrastructure in several countries, including the United States. Where data reaches them, the transfer is carried out under those providers' own safeguards, which for Google include the European Commission's Standard Contractual Clauses. We ourselves hold no database of user data in any country.

15 Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent — under the GDPR and UK GDPR, the California Consumer Privacy Act, and similar laws elsewhere.

Because our apps keep your content on your own device, you can exercise most of these rights directly and immediately:

• Access and portability — your content is on your device; Kuro's export and backup produce a copy you can take away.
• Deletion — delete individual items in the app, delete a Drive backup from Kuro's settings, or uninstall to remove everything at once.
• Withdraw ad consent — reopen the consent form from Settings at any time.
• Reset the advertising identifier — Android Settings → Privacy → Ads.
• Revoke Drive access — myaccount.google.com/permissions.

For anything you cannot do yourself, write to shurastudios@gmail.com. We aim to respond within 30 days. We do not sell or share personal information as those terms are defined under California law, so there is no opt-out to offer — there is nothing being sold. If you are in the EEA or the UK and are unhappy with our response, you may complain to your national data protection authority.

16 Changes to this policy

If we change this policy we update the effective date at the top of the page, and the current version always lives at this URL. For a change that materially affects how your data is handled, we will also surface a notice inside the affected app before the change takes effect. Continuing to use an app after a change means you accept the updated policy.

17 Contact

Questions about this policy, or a request about your data: shurastudios@gmail.com. A person reads that mailbox — please say which app you are writing about, and it will get answered faster.