Privacy Policy

Last updated: August 16, 2026

At Tappatapps, accessible from https://tappatapps.com, one of our main priorities is the privacy of our visitors and players. This Privacy Policy explains the types of information collected and recorded through our website, our mobile applications on the Google Play Store and other app stores, including Tokitopia®, and the related services we operate (together, the “Services”), as well as how we use, share, retain, and protect that information.

1. Who We Are and the Scope of This Policy

The data controller is TAPPATAPPS S.L. (“Tappatapps”, “we”, “us”, or “our”), a company established in Spain with its registered office at Carrer de Provença, 420-422, Barcelona, Spain.

This Policy applies to the Tappatapps website, our games and mobile applications, AI-powered features, cloud saves, support and data-rights requests, and other Services that link to this Policy. Third-party websites, app stores, and services are governed by their own privacy policies.

2. Information We Collect

For a better experience while using our Services, we may require you to provide us with certain personally identifiable information. The information we request is retained and used as described in this Privacy Policy. Depending on the Service and the features you use, we collect:

• User-provided and account information: your player name or nickname, email address, user ID, age-confirmation and terms-acceptance status, support messages, or other registration details if you create or link an account.
• Gameplay and cloud-save information: game progress, settings, resources, buildings, tasks, purchases and entitlements, notification choices, chat state, Keeper memory, and other information required to save, restore, and operate your game.
• AI conversation information: messages you send to Keepers, recent conversation history, generated replies, player name, relevant game context, safety classifications, feedback such as likes, and technical details needed to provide the chat and voice features.
• Device information: mobile hardware model, operating-system and app version, language, region or country signals, device or app-instance identifiers, Firebase identifiers, session identifiers, and unique device identifiers such as Advertising IDs where available and permitted.
• Usage and analytics information: session times, screens and features used, gameplay events, performance information, approximate location derived from country or network signals, interactions with chat, purchases and settings, and website page views, outbound-link clicks, and email-link clicks.
• Advertising information: your Advertising ID or an equivalent device identifier, IP address and approximate country, device and app details, your advertising consent choices, and events showing that a rewarded ad was requested, shown, completed, skipped, or clicked.
• Log and diagnostic data: if an error occurs, we collect data and information through third-party products on your device called Log Data. This may include crash traces, device state, IP address, timestamps, app configuration, and diagnostic or security events.
• Purchase information: product, transaction, entitlement, storefront, and purchase-validation information. Payments are processed by the relevant app store or payment provider; we do not receive your full payment-card details.
• Website and communications information: IP address, browser and device type, requested pages, timestamps, consent and language preferences, and information you provide when emailing us or submitting a data-deletion request.
• Deletion-request information: user ID, email address, selected application, request type, language, date and time, IP address, confirmation correspondence, and any additional information reasonably needed to verify account ownership and safely complete the request.

We collect information directly from you, automatically from your device or use of the Services, and from service providers such as app stores and payment processors. If required information is not provided, some features, account verification, support, purchases, or deletion requests may not be available.

3. How We Use Information and Our Legal Bases

Where we rely on consent, you may withdraw it at any time without affecting processing that took place before withdrawal. Where we rely on legitimate interests, we balance those interests against your rights and expectations.

4. AI Chat, Keeper Memory, and Voice Processing

When you chat with a Keeper, your messages are sent through our encrypted backend and processed by a third-party AI service, including Anthropic, to classify the message and generate a response. Depending on service configuration, we may also use another contracted model provider, such as Alibaba Cloud Model Studio (Qwen). Recent conversation history, player name, game context, and identifiers may be included so the Keeper can respond consistently and remember relevant interactions. Conversation content may be temporarily stored to enable, secure, evaluate, and improve this feature.

If a spoken reply is enabled, the generated Keeper text may be sent to ElevenLabs to create audio. We do not need to send your microphone audio to ElevenLabs for this text-to-speech feature.

We use automated filters designed to mask common forms of sensitive information, such as email addresses, phone numbers, payment-card numbers, IBANs, and government identifiers, before player text leaves the device. These filters cannot reliably detect every name, address, or sensitive detail. Please do not share personal, sensitive, financial, health, or identifying information with a Keeper.

AI outputs may be inaccurate or unexpected. Keeper chats are interactions with an AI system, not private communications with a human adviser.

5. Advertising

We show advertising in Tokitopia® through Google AdMob. Advertising is currently limited to rewarded ads: you choose whether to watch an ad in exchange for an in-game reward. Our website does not carry advertising.

To request, display, cap, measure, and secure these ads, Google and its advertising systems receive information such as your Advertising ID or an equivalent device identifier, IP address and approximate country, device model, operating-system and app version, language, app-instance identifiers, your consent choices, and events showing that an ad was requested, shown, completed, skipped, or clicked. Google acts as an independent controller for its own advertising purposes as described in its policies. We do not send Google your player name, email address, chat content, or game account details.

Your advertising consent. In the European Economic Area, the United Kingdom, and Switzerland, and anywhere else this is required, we use Google’s User Messaging Platform to ask for your consent before personalized ads are shown and before advertising identifiers are stored on or read from your device. If you decline, rewarded ads remain available but are non-personalized and are selected using only limited information such as approximate location and the context of the app. You can review or change your choice at any time through the privacy options in the game’s settings, and you may withdraw consent without affecting processing that took place beforehand.

Device-level controls. Your device offers advertising controls independently of the game: on Android, Settings → Google → Ads lets you delete or reset your Advertising ID and turn off ad personalization; on iOS, Settings → Privacy & Security → Tracking lets you withdraw app-tracking permission.

Because our Services are intended for people aged 18 and over, our ad requests are not tagged as directed to children, and we do not knowingly serve ads to anyone under 18.

6. Third-Party Services and Recipients

We use service providers that process information for the purposes described above. Depending on the platform and feature, these include:

• Google Play Services and Google Privacy Policy: app distribution, purchases, platform features, cloud infrastructure, and email support.
• Google Analytics for Firebase: app and website analytics.
• Firebase services, including Authentication, App Check, Remote Config, Cloud Storage, and Crashlytics: anonymous or linked accounts, integrity checks, configuration, cloud saves, telemetry, and crash diagnostics.
• Anthropic: AI message classification and response generation.
• Alibaba Cloud Model Studio: alternative AI response processing when configured.
• Google AdMob: rewarded advertising, ad selection and measurement, consent collection through the User Messaging Platform, and ad-fraud prevention.
• ElevenLabs: text-to-speech generation for Keeper voice replies.
• Amazon Web Services: backend hosting and security infrastructure.
• Apple and Google: app-store distribution, purchases, subscriptions, refunds, and purchase validation.
• Google Fonts and YouTube: website fonts and videos that you choose to play.

We may also disclose information to professional advisers, competent authorities, courts, or law-enforcement bodies when necessary to comply with law, protect rights and safety, or establish or defend legal claims. If our business is reorganized or transferred, information may be disclosed under appropriate confidentiality and data-protection safeguards.

We do not sell your personal information for money. Under some United States privacy laws, showing personalized advertising may count as “sharing” personal information for cross-context behavioural advertising. Where those laws apply, you can opt out by declining personalized ads in the game’s privacy options.

7. Website Cookies and Similar Technologies

Our website uses cookies and browser local storage. Except for storage necessary to remember your choices, Google Analytics is loaded only after you select “Accept”. You can reject analytics and later change your choice through Cookie settings in the footer.

Google Analytics may receive page and event information, browser and device details, approximate location, IP-derived information, and a cookie identifier. We also record outbound-link destinations and the non-domain part of a clicked Tappatapps email alias, but not the visitor’s email address. Google Fonts is requested when pages load and may receive basic connection data such as your IP address. Ordinary server logs may also record IP address, user agent, requested page, and timestamp for security and reliability.

8. International Data Transfers

We are based in Spain, but some providers process information in the United States and other countries outside the European Economic Area. For example, portions of Firebase and Google Cloud, AI, voice, and app-store processing may take place outside the EEA, while our principal game backend is hosted in the European Union.

Where required, we use an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, together with contractual and technical safeguards. You may contact us for information about the safeguards relevant to your data.

9. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, after which we delete or anonymize it. Different information requires different periods:

• Raw gameplay telemetry and uploaded debug logs: kept for a maximum of 90 days. After that period they are deleted automatically from our primary storage, with no action required on your part. A provider’s restricted soft-deletion backup may remain recoverable for up to 7 additional days.
• Backend security and operational logs: retained according to log-rotation, security, abuse-prevention, and incident-response needs, then deleted or anonymized when no longer needed for those purposes.
• Cloud saves and account information: kept while you use the Service. The current live cloud save is automatically deleted after approximately 18 months (540 days) without an update. Up to five replaced save versions may be retained for recovery and normally expire within 30 days.
• AI processing: we keep conversation information in the game save and telemetry according to the periods above. Under Anthropic’s standard commercial API terms, inputs and outputs are normally deleted from its backend within 30 days, subject to safety, legal, or contract exceptions. Other providers apply their contracted settings and retention terms.
• Crash data: Firebase Crashlytics generally retains crash traces and related installation identifiers for 90 days before removal begins.
• Advertising information: your consent choice is stored on your device until you change it or reinstall the app. Ad requests, impressions, and fraud signals are held by Google under its own retention periods; on our side we keep aggregated ad-performance reporting and the ad events recorded in our telemetry, which follow the 90-day period above.
• Analytics information: user-level and event-level Google Analytics data is retained according to the settings of the relevant property, generally for up to 14 months; aggregated reports may be retained longer.
• Support, contact, and privacy requests: kept while we handle the request and afterwards only as needed to document our response, protect against unauthorized deletion, resolve disputes, or comply with applicable limitation periods.
• Purchase and legal records: kept for the period required by tax, accounting, consumer-protection, fraud-prevention, and other applicable laws.

10. Account and Data Deletion

If you would like to request deletion of your account and all associated data, you can do so by:

• Visiting our Data Request Portal: https://tappatapps.com/delete-account
• Contacting us directly at support@tappatapps.com

Requests are typically processed within 7 business days after ownership is sufficiently verified. Deletion removes the account and associated personal information from active systems, including the current cloud save and identifiable raw telemetry. Limited information may be retained where required by law, to document compliance, prevent fraud or repeated abuse, resolve disputes, or protect the rights of others. Data already placed in restricted backups is isolated from ordinary use and expires according to the provider’s backup cycle.

Deleting an app from your device does not by itself delete information already stored in our systems. Deleting an account may not automatically cancel an app-store subscription; subscriptions must also be managed through the relevant app store.

11. Your Privacy Rights

Depending on your location and subject to legal exceptions, you may have the right to:

• access your personal information and obtain a copy;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• receive information you provided in a portable format;
• withdraw consent at any time; and
• request human review of a restriction produced by an automated safety or age system.

To exercise these rights, email legal@tappatapps.com. We may request information reasonably necessary to verify your identity and protect the account from unauthorized access or deletion. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

12. Automated Systems and Profiling

Our Services use automated systems to generate Keeper responses, classify conversation intent and sentiment, personalize interactions and memory, detect spam, abuse, security threats, and possible underage use, select and cap the rewarded ads you are offered, and apply chat limits or account restrictions. These systems may use message content, behavioral patterns, identifiers, IP address, and account or purchase state. They do not make decisions about credit, employment, insurance, or similarly unrelated matters.

If you believe a restriction is incorrect, contact support@tappatapps.com to request review by a person.

13. Security

We value your trust in providing us your Personal Information and strive to use commercially acceptable means of protecting it. We use HTTPS encryption for data transmission and follow industry standards to safeguard information, including access controls, authentication, integrity checks, provider security rules, data minimization, and monitoring.

No method of transmission or storage is completely secure. You are responsible for protecting access to your device and linked app-store account. Please notify us if you believe your account or information has been compromised.

14. Children’s Privacy

Our Services do not address anyone under the age of 18. People under 18 may not create an account or use our games. We do not knowingly collect personally identifiable information from people under 18. If we discover that a person under 18 has provided us with personal information, we promptly restrict access and delete that information from our active servers. A parent, guardian, or affected person may contact support@tappatapps.com to request deletion or review.

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. You are advised to review this page periodically for changes. We will notify you of changes by posting the new Privacy Policy on this page and changing the “Last updated” date. Where required, we will provide an additional in-app notice or request renewed consent before a material change takes effect.

16. Contact Us