Toon Carnival: Privacy Policy

The short version

• The game can be played offline. There are no accounts of ours, and the game never asks for an email address, a phone number, a photo, your contacts or your location.
• Your progress (tickets, ribbons, prizes, your character) is saved on your device. For grown-ups (13 and over) only, the game also keeps a copy on our server and can put a score and a character on a grown-ups' leaderboard. A grown-up can also save a copy in their own Google account (Google Play Games, Android) or Apple account (Game Center with iCloud, iPhone).
• The game shows ads from Google AdMob on Android and on iPhone. For a player under 13, and for anyone who has not answered the age question yet, every ad is the children's kind: marked as directed at children, limited to G-rated ads, never personalised, and without the device's advertising ID. On iPhone every ad is non-personalised, and the game never shows Apple's "allow tracking" prompt.
• The game has optional purchases through Google Play or the Apple App Store: Remove Ads, ticket packs and a Snack Bundle. Google or Apple handles the payment; the game never sees card or bank details. In a game set up for a child, a grown-ups' question comes first.
• The game counts anonymous gameplay statistics (such as how long it is played and how many tries a level takes) to make levels fairer. They are tied only to a random number made on the device, never to a name or account. Every player's game sends them, children's included. See Anonymous gameplay statistics.
• A child's game sends us only those anonymous statistics. No save, name, score or restore code goes to our server for a child, and a child never sees the leaderboard or uses gift codes, Google Play Games or Game Center.
• We do not sell information, and we do not share it for advertising.

What stays on your device

The game keeps a save file in its own private storage on your phone or tablet. It holds your progress (levels, ribbons, tickets), the prizes you have won and any names you gave them, your character's look and the name you typed for it, the snacks and outfits you own, the players you blocked, your settings (including whether the game is set up for a child or a grown-up, and when that was set), and a random player number the game makes up the first time it runs. That number is not linked to your device or to any account.

For each ticket pack bought, the save also keeps a scrambled, one-way fingerprint of the store's purchase record and the number of tickets it gave, so the same pack can never be counted twice. It holds no payment details.

The game keeps its own record of the answer to the age question, and that is the record it goes by (see The age question and Phone backups). It also keeps a small note of whether Remove Ads has been bought, so that a buyer's ads stay away while the phone is offline. That note holds only "bought" or "not bought", whether the store has confirmed it, and when it last changed: never a payment detail. On Android it also remembers the day you chose "later" on an update prompt. A small file holds the statistics waiting to be sent (see Anonymous gameplay statistics).

Uninstalling the game, or clearing its storage in your phone's settings, deletes all of this from the device. A Remove Ads purchase stays with your Google account or Apple ID, and the game finds it again after a reinstall.

The age question

When the game first opens (after a new install, on a new phone, or after its storage has been cleared), it asks for a birth year and month. It uses them once, on the device, to work out whether the player is under 13, and keeps only the result (under 13, or not) and when it was given. The birth date itself is not stored and is never sent anywhere.

The game uses the answer to set itself up the right way, most importantly which kind of ads it shows and whether it offers the grown-ups' features (cloud save, leaderboard, gift codes, Google Play Games, Game Center). Until the question is answered, the game treats the player as a child.

The setup can be changed later in Settings, behind a grown-ups' question (a multiplication sum). Switching to the children's setup is always allowed. Once the age question has said a player is under 13, the grown-ups' setup cannot be turned on in that copy of the game. To answer the age question again, uninstall and reinstall the game, or clear its storage in the phone's settings (this also deletes the progress saved on that phone).

Ads

The game shows ads through Google AdMob, a service of Google LLC, on Android and on iPhone: a banner along the bottom of the screen, a full-screen ad now and then between rounds (about every four minutes of play, and never in a player's first session), and optional ads a player can choose to watch in return for a free extra throw (or extra seconds) at the end of a round, an extra spin of the Prize Wheel (at most once an hour, after the day's free spin), or a free snack from the shop or the snack tray (with daily or weekly limits). The game contains no other ad company's software. A game that owns Remove Ads shows no banner and no ads between rounds; the optional ads a player chooses to watch are still offered.

What Google's ad software collects

To show and count ads, and to fight ad fraud, the AdMob software in the game collects information from the device and sends it to Google over encrypted connections, including:

• the device's IP address, which may be used to estimate the general area the device is in;
• how the app and ads are used: when the app opens, taps, and ad views;
• performance information, such as how long the app takes to start;
• device identifiers. On Android these include the advertising ID (for grown-ups only) and the app set ID. On iPhone the game never asks to track you, so Google's software does not get the iPhone advertising identifier (IDFA); it may still use other device identifiers to count ads and fight fraud.

For children, and before the age question is answered

• every ad request is marked for child-directed treatment, as Google's rules for children ask;
• ads are limited to Google's most family-friendly rating (G) and are never personalised (no ads based on interests, and no remarketing);
• the advertising ID is not sent;
• Google's consent form is never shown to a child;
• on Android, the ad software is Google's own, which is on Google Play's list of ad software certified for apps that children use.

The optional ads are offered to children too, each on a card that says it is an ad, with a button to watch it and a button to say no thanks.

For grown-ups

On Android, grown-ups' ads may be rated up to Google's PG rating (never higher) and may be personalised, which means chosen using information like the above. On iPhone, grown-ups' ads are non-personalised too, because the game does not ask for tracking permission.

In the European Economic Area, the UK and Switzerland, Google's consent form asks grown-ups for their choice before ads are shown, and ads are personalised only if they agree. You can change your answer at any time: open the game's Settings (the gear button) and press PRIVACY CHOICES, which opens Google's consent form again. The button appears where Google requires it, on the map and the other screens outside a booth.

On Android, you can delete your advertising ID in your phone's settings (Settings, Privacy, Ads, or Settings, Google, Ads, depending on the phone), which stops it being used to personalise ads. Resetting it only swaps it for a new one.

Google's own policies describe what Google does with this information: policies.google.com/privacy and policies.google.com/technologies/partner-sites. We do not sell any information, and we do not receive the information AdMob collects about individual players.

Purchases (optional)

The game offers a few things for real money, all optional:

• Remove Ads: a one-time purchase that takes away the banner and the ads between rounds. It stays with the Google account or Apple ID that bought it.
• Ticket packs: tickets added to your carnival.
• The Snack Bundle: snacks (small helpers for a round) added to your carnival.

Everything else in the game is earned by playing.

The payment is Google's or Apple's. On Android, Google Play shows its own purchase screen and handles the payment. On iPhone, the App Store does (through Apple's StoreKit). Both work under their own policies. The game never sees card or bank details, and it sends the store nothing about the player: it only names the product and confirms that the purchase arrived. To know whether Remove Ads is owned, the game asks Google Play or the App Store when it starts, when it is opened again, and when RESTORE PURCHASES (in Settings) is pressed. It keeps only the answer, on the device.

What reaches us. Nothing about a payment reaches our server. For a grown-up, the save that is copied to our server (see Cloud save and the leaderboard) contains the scrambled ticket-pack fingerprints and ticket counts described above, and the leaderboard check is sent the total number of tickets that ticket packs gave, so that prizes bought with those tickets count fairly. Remove Ads is not part of the save.

For children. In a game set up for a child, or before the age question is answered, the buttons for Remove Ads, ticket packs and the Snack Bundle first ask the grown-ups' question (a multiplication sum). Only a right answer opens the store's purchase screen.

Cloud save and the leaderboard (players 13 and over)

Who. Only a player the game treats as a grown-up: someone who answered the age question 13 or over, in a game that is not in the children's setup. For everyone else, the game sends our server nothing except the anonymous statistics (see Anonymous gameplay statistics).

What is sent. A grown-up's game sends our server a copy of the whole save: the progress (levels, ribbons, tickets and how they were earned), the prizes won and any names given to them, outfits and snacks, weekly trophies, the players the grown-up blocked, the character's look and the name typed for it, the settings (including that the game is set up for a grown-up, and when), the dates the save was made and last changed, the scrambled ticket-pack fingerprints, and the random player number. The birth date is never sent: the game does not keep it. The save is sent when the game starts, when it is put away or opened again, and at most every five minutes while playing, if something has changed. It is automatic, and happens only when the phone is online.

Why. So a grown-up's carnival is not lost with a lost or new phone, and for the leaderboard and the weekly trophies.

The restore code. On the grown-ups' card (Settings, then MY PROGRESS), PROTECT MY PROGRESS gives a 12-character restore code, and RESTORE PROGRESS on another phone or tablet, Android or iPhone, brings the same carnival there. Asking for a new code cancels the old one. Anyone who has the code can open that carnival, so keep it private. Our server keeps only a scrambled (hashed) form of the code, never the code itself.

The leaderboard and weekly trophies. A grown-up's game puts the player on a leaderboard of carnival scores. It sends the character's name, the ribbons earned in each booth, the prizes that count toward the score, the tickets earned, the total tickets that ticket packs gave, the save's revision number, and when levels were first finished (used only to break ties), with the player number. The name is checked against a word filter on the device and again on our server; a name that fails is shown as "A Carnival Player". The game also sends the character's look, as choices from the game's own lists (body, skin tone, eye colour, hair and its colour, outfit, hat, and what the character carries, such as a prize and its colour), with nothing typed in it. If the character carries a prize the player has named, that name is sent too, but only if it passes the same word filter. Other grown-ups see the name, the score, the ribbons and the prize points, the character's face beside the name and, when they tap the name, the whole character holding its prize with the prize's name under it. They also receive a public id that cannot be turned back into the player number. The week's top ten get a trophy in their game. There is no chat and no way to send anyone a message. If you do not want your own name there, give your character a made-up name: the leaderboard shows the new one after the next sync. The same goes for the look, and for a prize's name, which is shown only while the character carries that prize.

Reporting and blocking. A grown-up can report a leaderboard name, or a prize's name, or "something else", and can block a player. A report is picked from a short list; there is no box to type in. It records the reporter's and the reported player's public ids, the reason, the name the board showed and when. When three different players report the same name, it is hidden for everyone and shows as "Player" and four digits. Reports are kept for 6 months. A block is kept only in the blocking grown-up's own save, and a blocked player is left off that grown-up's boards.

Where. Our server and the saved copies are run and stored for us by Cloudflare, our server provider, which may keep them in the United States or other countries. It handles them only to run the service for us.

Keeping it safe. The game talks to our server only over encrypted connections (HTTPS). There are no passwords. Restore codes are kept only in hashed form. The player number is never put in a web address. The server uses the IP address for a moment, to stop abuse (too many tries in a minute), and does not write it to its database or storage. We have turned off the per-request logs that Cloudflare could keep for our server.

What our server does not keep: your email, your birth date, your advertising ID, your device model, your location or your IP address.

Switching to the children's setup. If a grown-up switches the game to the children's setup, the game stops sending anything but the anonymous statistics at once. The grown-up's copy already on our server stays there until it is deleted as described under How long we keep things, and deleting them.

Gift codes (players 13 and over)

Golden Oak Games sometimes gives out gift codes, which can hold tickets, prizes, outfits or snacks. A grown-up can type one in under REDEEM A CODE. When they do, the game sends our server the code, the carnival's player number and the fact that the player is a grown-up. The server checks the code and records, under the player's public id, which code was redeemed and when, so that a code cannot be used more times than it allows. The code itself holds no information about any player. A child's game cannot redeem codes and sends nothing about them. Gift-code records are deleted together with the player's other data (see How long we keep things, and deleting them).

Google Play Games and Game Center (players 13 and over)

On Android: Google Play Games

If you are 13 or over and signed in to Google Play Games, the game keeps a copy of your carnival in your own Google account, through Google Play Games' saved games, so that it comes back on a new Android phone without any code. The copy holds the same save as the phone. Google keeps it in your Google account, in an area only Toon Carnival can read. It does not come to us. The game does not ask Google for your email address or your profile, and does not keep or send us your Play Games identity. Google Play Games itself collects some information, such as your Play Games identity and usage and diagnostic information, under Google's privacy policy (policies.google.com/privacy), described at developer.android.com/games/pgs/data-collection. You can delete your Play Games profile and its game data in your Google account's settings.

On iPhone: Game Center and iCloud

If you are 13 or over and signed in to Game Center, the game keeps a copy of your carnival as a Game Center saved game, which Apple stores in your own iCloud. It comes back on a new iPhone with the same Apple ID, without any code. The copy holds the same save as the phone, and it does not come to us. The game only learns whether you are signed in: it does not read your Apple ID, your name or your Game Center profile, and does not keep or send us your Game Center identity. Apple's own privacy policy applies to Game Center and iCloud (apple.com/legal/privacy). You can delete the game's saved data in your iPhone's iCloud settings.

Both are optional. The whole game works without them. The game never starts Google Play Games or Game Center for a player under 13, or before the age question has been answered.

Anonymous gameplay statistics

Toon Carnival collects anonymous gameplay statistics, such as the days the game is played, how long it is played and how many tries each level takes. These are tied to a random ID made on the device, which is not linked to the player's name, account, leaderboard entry or advertising ID. We use them only to improve the game and its difficulty, never for advertising, and we never share or sell them. The daily numbers are kept for up to 13 months, and the random ID itself is not kept on our server.

In more detail, the game counts, per day and per level (Bonus Rounds too):

• that the game was played that day, for how many seconds, how many visits, and the platform (Android or iPhone) and game version;
• how long each visit (session) lasted;
• how many tries a level took, how many were cleared or left, how many ribbons were won and how many throws the clears used;
• how many tries it took before a level was cleared for the first time;
• which snacks were used to clear a level;
• how many ads were shown per session (full-screen ads, optional ads offered and watched, and how long a banner was on screen);
• how a session ended, in broad groups: for example after a full-screen ad, after several failed tries, in the middle of a round, after a win, or while idle on the map.

These arrive only as anonymous daily totals, added together with every other player's. They are never combined with the name, the player number or the save. The random ID is not the advertising ID, the player number or the leaderboard's public id. The server never stores it: it keeps only a one-day scrambled copy, for two days, to count each player once a day.

Statistics are sent only by the released game on a phone (not by test builds), a few times a day when the phone is online; if it is offline, the phone keeps them (up to 14 days) and sends them later. This applies to every player, children included, because it is used only to run and improve the game (counting how the game is played), never for ads, and nothing is shared.

Children

Toon Carnival is made for all ages, including children. We designed it to follow children's privacy rules, including the US Children's Online Privacy Protection Act (COPPA), Google Play's Families Policy and Apple's rules for apps used by children, so that a child can play without giving us anything that identifies them. When the game is set up for a player under 13, or the age question has not been answered yet:

• there are no accounts, no email, no chat, and no way to message other players (this is true for everyone);
• the age question keeps only "under 13 or not" and when it was answered, never the birth date;
• ads are only the children's kind described under Ads: child-directed, rated G, never personalised, without the advertising ID;
• the game never starts Google Play Games or Game Center;
• the Remove Ads, ticket pack and Snack Bundle purchases can only be started after the grown-ups' question;
• once the age question has said "under 13", the grown-ups' setup cannot be turned on in that copy of the game;
• nothing about the child reaches our server except the anonymous statistics described under Anonymous gameplay statistics: no save, no name, no score, no restore code, no gift code. The cloud save, the restore code, gift codes and the leaderboard are not shown, and a child is never on the leaderboard. Anything a child types, such as a name for their character or a prize, stays in the save on the device (and in the phone's own backup, if it is turned on). Apart from the game asking Google Play or the App Store whether a purchase is owned, and what Google's ad software sends Google to show the children's ads, no other information leaves the device;
• if a grown-up switches their game to the children's setup, it stops sending anything but the anonymous statistics at once.

The anonymous statistics use a random number that is not tied to the child, are used only to support the internal operations of the game (counting how it is played so levels can be tuned), and are never used to show ads, to build a profile, or to contact anyone.

Because nothing identifying a child reaches us, a parent or guardian can remove all of the game's data from the phone by uninstalling the game or clearing its storage. Parents and guardians are welcome to write to [email protected] with any question or concern.

Phone backups

Android. If backup is turned on in your phone's settings, Android's Auto Backup may copy the game's stored files to your Google account: the save, the Remove Ads note, and what Google's ad software keeps in the game's storage (such as the answer given on Google's consent form). Android puts them back if you reinstall the game or set up a new Android phone. That is Google's backup of your phone: Google runs it under Google's privacy policy, and you control it in your phone's settings. The game's own record of the age answer is left out of that backup on purpose, so when the game is reinstalled or installed on a new Android phone, the progress can come back, but the game ignores the setup in the restored save and asks the age question again, treating the player as a child until it is answered.

iPhone. If you back up your iPhone (to iCloud or to a computer), Apple may copy the game's files with it, including the age answer, and put them back on a restored iPhone. That is Apple's backup of your phone: Apple runs it under Apple's privacy policy, and you control it in your phone's settings.

We never see these backups, and we do not collect them.

How long we keep things, and deleting them

Deleting your cloud copy (grown-ups)

Email [email protected] with your restore code (the grown-ups' card, PROTECT MY PROGRESS), and we will delete the save, the restore code, the leaderboard rows, the weekly results and trophies, the reports and the gift-code records within 30 days. The game has no accounts, so the code is how we find your data. If you never made a code, tell us your character's name as it shows on the leaderboard and roughly when you last played; without the code we may not be able to tell which data is yours.

Deleting everything else

Uninstall the game, or clear its storage in your phone's settings, to remove the save, the age answer and the notes from the device. Delete a Google Play Games or Game Center copy in your own Google or Apple account settings. The anonymous statistics are not tied to a person, so they cannot be looked up or deleted for one player; they are deleted automatically at 13 months.

Your choices and rights

• Ad consent (the European Economic Area, the UK and Switzerland): Settings (the gear button), then PRIVACY CHOICES opens Google's consent form again, for grown-ups.
• Personalised ads on Android: delete your advertising ID in your phone's settings. On iPhone the game's ads are never personalised.
• Phone backups: turn them on or off in your phone's settings.
• Your progress: uninstalling the game, or clearing its storage, deletes it from the device.
• Your cloud copy (grown-ups): email us with your restore code to have it deleted. Switching the game to the children's setup stops all syncing.
• Your name and look on the leaderboard (grown-ups): change your character's name, look or what it carries in the game.
• Google Play Games or Game Center (grown-ups): decline the sign-in, sign out, or delete the saved copy in your account's settings.
• The age question: uninstall and reinstall the game, or clear its storage, and it is asked again.

Depending on where you live (for example the European Economic Area, the UK or California), you may have the right to ask what information we hold about you, to have it corrected or deleted, and to object to how it is used. Write to [email protected] and we will help. Because we do not collect names or emails, we may need your restore code to find your data.

Who else is involved

• Google: AdMob shows the ads and collects the information described under Ads. Google Play distributes the Android game, handles its payments, and offers in-app updates (the question carries nothing about the player). Google Play Games keeps a grown-up's saved carnival in their Google account. Android's backup is run by Google. All under Google's privacy policy.
• Apple: the App Store distributes the iPhone game and handles its payments. Game Center and iCloud keep a grown-up's saved carnival in their Apple account. iPhone backups are run by Apple. All under Apple's privacy policy.
• Cloudflare runs our server and stores grown-ups' cloud saves, restore codes, leaderboard rows and the anonymous statistics for us, and hosts this website (see Cloud save and the leaderboard and This website).

We do not share information with anyone else, and we do not sell it.

This website

tooncarnival.com is a few plain pages. It has no accounts, no cookies, no ads, no analytics and no trackers, and it loads nothing from other companies' servers. It is hosted by Cloudflare, which, like any web host, handles visitors' IP addresses and basic technical details of each request to deliver and protect the site, under Cloudflare's privacy policy. We do not use that information to identify visitors. If you email us, we use your message and address only to answer you.

Changes to this policy

If what the game does changes, this page will change first, with a new date at the top. A big change will also be mentioned in the game's update notes.

Contact

Golden Oak Games: [email protected]
For help with the game, see our Support page.