Law 21.719
Updated July 26, 2026 · The law takes effect on December 1, 2026
Law No. 21.719 completely modernizes personal data protection in Chile: it replaces the Law No. 19.628 regime, creates the Personal Data Protection Agency, and takes effect on December 1, 2026.
Kimcura is used by school students, many of them minors. That places us in the most demanding part of the law. In July 2026 we audited our own source code against the law and against Google Play's Families Policy, and we publish the full result here: what we already comply with, and what we do not yet.
This page is updated when the real status of a row changes, not when our intentions change. An item marked pending is an item that is not yet implemented.
See also the Privacy Policy and the Data Safety Form.
Lawful basis and consent
Every processing operation must rest on an identifiable lawful basis.
Every category of data we process has its basis stated in the Privacy Policy: performance of the service, consent, or legitimate interest.
Consent must be free, specific, unambiguous, informed, and demonstrable by the controller.
We record every consent decision with its date, the policy version accepted, and the method. Withdrawal is recorded as a new event rather than erasing the previous one.
Withdrawing consent must be as easy as giving it.
Privacy preferences live in the You tab and can be changed at any time, without contacting us and without losing access to the app.
Consent-based processing cannot occur before the consent exists.
Product analytics starts disabled and sends no events until the person accepts. The age screen and the consent screen themselves are not tracked.
Legitimate interest requires a balancing test against the data subject's rights, especially for minors.
We no longer rest analytics and behavioural telemetry for minors' accounts on legitimate interest: they now require consent. The app works fully if consent is refused.
Children and adolescents
The controller must be able to tell a child from an adolescent from an adult in order to apply different rules.
A neutral age screen appears before any collection, on first launch. It does not hint which answer unlocks more features, and cannot be retried.
Processing data of children under 14 requires the authorization of the parent or legal guardian.
An account declared as under 14 is held pending and sends no data until confirmation arrives from the responsible adult's email. We are assessing with legal counsel whether this verification method is sufficient or needs strengthening.
All processing of minors' data must serve the best interests of the child.
Social features — comments, the 3D plaza with strangers, and duels — are off by default on under-14 accounts and are only enabled if the responsible adult explicitly authorizes them.
Profiling of minors demands particular caution and a solid basis.
The personalized feed can be turned off entirely. With personalization off, the model stops learning from that person and content is served without profiling.
No behavioural advertising or advertising identifiers directed at minors.
Kimcura has no advertising of any kind, no ad SDK, and does not read the device advertising identifier.
Data subject rights
Right of access: to know what data is processed and obtain a copy.
From within the app you can download a file with everything we hold: profile, comments, reactions, skill vector, telemetry, PvP record, inventory, and consents.
Right to portability: to receive data in a structured, commonly used format.
That same download is delivered as JSON — a structured, machine-readable, non-proprietary format.
Right to erasure: to obtain deletion of personal data.
Deleting your account in the app now also erases everything living outside the accounts table: comments, reactions, telemetry, skill vector, inventory, record, and notifications.
Exceptions to erasure must be narrow, justified, and time-bound.
Only moderation records survive deletion, in pseudonymized form: they exist to protect other people from conduct that already occurred. They have a defined retention period.
Right to rectification: to correct inaccurate or incomplete data.
Username, bio, and grade are editable from the profile. For anything else, the email request has a named owner and a response deadline.
Right to object to certain processing, including profiling.
There is a switch to turn off feed personalization and another for analytics, both independent and with no loss of functionality.
A rights-request channel with response deadlines.
contacto@kimcura.cl, with a named owner and a request log. Anything resolvable in the app is resolved in the app, without writing to us.
Transparency and information
Information given to the data subject must be accurate: a policy that misdescribes the processing breaches the principle.
We audited the policy against the source code in July 2026 and corrected four discrepancies we found, including the real scope of analytics and providers that were not listed.
The information must be accessible at the point of collection.
The policy, the data safety form, and this page are linked from inside the app and from the Google Play listing.
For minors, information must be given in language they can understand.
The consent screen explains each option in one plain sentence. We have not yet published a full version of the policy written for 11-year-old readers.
Security and confidentiality
Technical and organizational measures appropriate to the risk of the processing.
In July 2026 we commissioned a security audit of the entire codebase. Its remediation plan is underway and is the reason several rows on this page changed status. For obvious reasons we do not detail open findings on a public page.
Protective measures must be effective, not nominal.
We fixed user blocking so it fails safe: if the server cannot verify who you blocked, it does not seat you in the plaza, rather than seating you unprotected.
Notification of security breaches to the Agency without undue delay, and to data subjects where risk is high.
We have a written procedure covering detection, severity assessment, deadlines, and who decides to notify.
Retention and minimization
Data cannot be kept indefinitely: each purpose has a retention period.
We defined a retention period per data type and an automated process that applies deletion. Raw behavioural telemetry is no longer kept without limit.
Only data necessary for the stated purpose may be processed.
We removed the microphone permission the app declared without using, and stopped keeping the email of suspended accounts: we store a hash, which blocks re-registration equally well and is not readable.
Minimization is served when the service can be provided without identifying the person.
Kimcura can be used in full as a guest, with no email, no name, and no photo.
Governance and accountability
Record of processing activities.
We maintain the record with purpose, lawful basis, data and subject categories, recipients, transfers, and retention, for each activity.
Impact assessment for high-risk processing, such as systematic profiling of minors.
We carried out the impact assessment covering the exercise recommender and behavioural telemetry, which are our highest-risk processing.
Designation of a data protection officer where required.
An internal privacy owner is assigned. Formal designation of a data protection officer is under assessment with legal counsel.
Processing agreements with every provider processing data on the controller's behalf.
We are formalizing processing agreements with all our providers. Until they are signed, this row stays pending even though the providers already apply their own measures.
International transfers require a legal mechanism recognized by the law.
Our data is hosted in the United States and we have always disclosed this. The formal transfer mechanism is being prepared with legal counsel, to be in place before December 1, 2026.