Privacy Policy

Age notice: Kit Cat Toe is intended for users aged 13 and older. It does not require an account or ask users to enter a phone number, precise location, photo, or other direct contact information during normal play. A user may optionally contact support through their own email app as described below.

This Privacy Policy explains how Individual Entrepreneur Ilia Borisenko, registered in Georgia (identification number 304711792), legal address: Ponichala 3, Building 5, Floor 4, Krtsanisi District, Tbilisi, Georgia, the developer of Kit Cat Toe ("we", "us", or "our"), handles information when a user plays the Kit Cat Toe mobile game (the "App") or uses this website. We are the controller for the personal data we collect about users of the App and this website.

Information stored on the device

The App stores the selected age range, game progress, settings, achievements, rewards, and a player nickname locally on the device. The age range is used to apply age-appropriate access, privacy, and advertising settings. The selected range remains on the device; eligible users' service requests include only the corresponding age-treatment signal, not a birth date. We do not upload the local game information to our own servers. Removing the App or clearing its storage may delete this local information.

Information processed automatically

The App uses service providers to operate, improve, protect, and support the game. These providers may automatically process limited technical and usage information, such as:

• device type, operating-system version, app version, and language;
• game interactions and feature usage;
• crash reports, diagnostic information, and performance data;
• advertisement delivery, views, rewards, and interaction data; and
• general region inferred from an internet address, where applicable.

We do not use this information to identify users by name or contact them. We use it to provide and improve the App, maintain security, diagnose errors, measure feature performance, deliver advertising, control ad frequency, and comply with legal obligations.

Advertising

Kit Cat Toe may display banner, interstitial, and optional rewarded advertisements supplied by Google Mobile Ads. Users identified as being under the applicable age of consent receive age-restricted ad treatment. They are not served interest-based advertising or remarketing. Adult users may receive personalized advertising only where permitted and after any consent required by law. If consent is unavailable or declined, Google may serve non-personalized, limited, or technical-delivery ads instead. Ad content is restricted to an age-appropriate rating.

Analytics, diagnostics, and configuration

The App uses Google Firebase services, including Analytics, Crashlytics, and Remote Config, as well as PostHog product analytics. These services help us understand whether features work, diagnose errors, protect the App, and safely adjust game configuration. We do not create public profiles or sell users' personal information. For a private online brawl, the game may copy your public Google Play Games display alias into that temporary room so the invited player can recognize you. It does not copy your Play Games player ID or profile photo into the room.

This website

This site is hosted by Vercel and uses Vercel Web Analytics, which counts page views without cookies and without following visitors between sites. It records the page visited, the referring page, and coarse details such as country, browser, and device type. It does not collect names, email addresses, or anything that identifies a visitor personally, and it is separate from the analytics described above, which belong to the App.

The No Ads Forever page stores the order number of a completed purchase in your browser's local storage, so that reopening the page shows your activation code again. The checkout on that page is provided by Paddle, which may use cookies or similar technologies that are needed to take the payment and prevent fraud, as described in Paddle's privacy notice.

Support and feedback

If a user selects Send feedback, the App opens the device's email application with a draft addressed to borisenkoilia487@gmail.com. The draft includes the App version and build, package identifier, operating-system information, and selected language so that we can investigate the report. It does not include game progress. The user can review, edit, or delete any part of the draft and decides whether to send it. If sent, we receive the sender's email address, message, and any information or attachments the sender chooses to include. We use this information only to respond, troubleshoot, improve the App, protect users, or meet legal obligations.

Google Play rating

After certain positive gameplay milestones, the App may ask Google Play to display its native rating dialog. Google controls whether the dialog appears and processes any rating or review submitted through it under Google's terms and privacy practices. The App does not read the rating entered in that dialog.

Sharing a game result

The App can open the device's standard sharing menu when a user chooses to share a game result. The user decides which installed app, if any, receives that text. We do not receive the shared message. Parents should supervise children's use of external apps.

Private online brawls

When a user creates or joins a private online brawl, Firebase Authentication assigns the App a pseudonymous identifier. The user does not need to provide us with a name, email address, or password for this identifier. Firebase Realtime Database temporarily stores the two pseudonymous identifiers, room status, moves, turn and presence timestamps, game settings, rematch choices, and a limited snapshot of each selected cat's appearance and in-game name.

The room is protected by a random invite token contained in the invitation link or code. Anyone who receives that invitation may attempt to join the room, so users should share it only with the intended opponent. Private brawls do not include free-form chat. The App never uploads a custom meow recording or a local file path as part of online play.

Private rooms expire after no more than 24 hours and are then eligible for deletion. A room may also be removed earlier when its creator leaves before an opponent joins. A short-lived private copy of the active invitation is stored on the device so the user can return to an interrupted brawl; it is removed after expiry or an intentional exit.

If the user separately enables online-brawl notifications, Firebase Cloud Messaging stores a device registration token associated with that pseudonymous identifier, together with the selected language, platform, app version, enabled status, and update timestamp. We use it only to notify that device when the invited opponent joins or when it becomes the user's turn. Opening the notification returns the user to that private room. The invitation capability is sent in the private notification data, not displayed in its title or body, and is not included in analytics or application logs.

Online-brawl notifications are optional and can be disabled in the App's settings. Disabling them removes the registered device entry and asks Firebase to delete the device token. Invalid tokens are removed automatically. Delivery deduplication and daily counters are retained only as short operational safeguards against duplicate or excessive messages.

A user may block an opponent or submit a category-only safety report from an active private brawl. A block stores the two pseudonymous identifiers and a timestamp so the pair can be excluded from future matchmaking. A report contains the reporter and opponent pseudonymous identifiers, the selected reason, a one-way hash of the private room, its review status, and a timestamp. The reporting service verifies that both users participated in the room before it accepts the report. It does not collect free-form chat or retain the invitation token in the report.

The user may explicitly link the App's online identity to the signed-in Google Play Games player. The device obtains a short-lived, one-time server authorization code. Our backend exchanges it with Google, verifies that it belongs to this Play Games application, and creates a stable pseudonymous Firebase identifier. We store a one-way hash of the Play Games player ID and linking timestamps; we do not request or store the user's Google email, profile photo, access token, refresh token, or authorization code. Linking is refused while a private room is active so its permissions cannot change in the middle of a brawl.

If the user starts the optional unranked Quick Match test, our backend temporarily stores the stable pseudonymous identifier, a one-way installation hash, selected arena, sanitized cat profile, queue and expiry timestamps, and an idempotency key. These values are used only to find a compatible opponent, reject the same account or installation, enforce blocks, and safely retry a request. Queue entries expire after about 90 seconds. A matched room expires after no more than two hours. Quick Match test games do not award repeatable fish and do not change a public rating.

No Ads Forever purchases and activation codes

The optional No Ads Forever purchase is sold on this website through Paddle.com, our online reseller and Merchant of Record. Paddle collects the details it needs to take the payment, such as your name, email address, country, and payment details, and processes them as an independent controller under the Paddle Privacy Notice. We never receive your card details.

From Paddle we receive, and store in Google Firebase, the order (transaction) number, Paddle's customer identifier, the time of the purchase, and whether it was later refunded or charged back, together with the activation code we issue for it. When a code is entered in the App, we record the pseudonymous online identifier of the game account that activated it and the time, so that one code works on a limited number of accounts. The App keeps the code on the device to confirm it again on later launches.

We use this information to deliver and confirm the purchase, to honour refunds and chargebacks, to help a buyer who has lost their code, and to prevent codes from being shared or abused.

Service providers and disclosure

We use the following service providers:

• Google Firebase Authentication, Realtime Database, Cloud Messaging, App Check, Analytics, Crashlytics, and Remote Config;
• Google Mobile Ads, Google Play Games Services, Google Play, and their consent or review tools; and
• PostHog product analytics;
• Paddle.com, the Merchant of Record for purchases made on this website, for the sale of the product, payments, invoicing, and tax compliance; and
• Vercel, which hosts this website and counts its page views.

Their processing is governed by Google's terms and privacy practices. You can read the Google Privacy Policy and Firebase Privacy and Security information. You can also read the PostHog Privacy Notice and the Paddle Privacy Notice. We may also disclose information to professional advisers, and when reasonably necessary to comply with law, protect users, investigate abuse, or defend legal rights.

Legal bases for processing

• Performance of a contract: providing the App and its online features, and delivering, confirming, and supporting purchases and their activation codes.
• Legitimate interests: keeping the App and its online features secure and working, preventing fraud, cheating, and abuse, including the sharing of activation codes, and understanding problems through diagnostics. We rely on these interests only where they are not outweighed by users' interests and rights.
• Consent: personalised advertising and, where the law requires it, analytics. Consent can be withdrawn at any time through the App's privacy settings.
• Legal obligations: keeping accounting and tax records and responding to lawful requests.

Retention

Local game data remains on the device until it is reset, the App's storage is cleared, or the App is removed. Technical information processed by our service providers is retained according to their applicable settings and policies, only for as long as needed for the purposes described above or as required by law. Support emails and their diagnostic details are kept only as long as reasonably needed to answer the request, investigate the reported issue, protect users, or satisfy a legal obligation, and are then deleted when no longer needed.

Private online room data expires after no more than 24 hours and is deleted by our cleanup process. Service-provider backups and security logs may persist for a limited additional period under the provider's retention practices.

Unmatched Quick Match queue records expire after about 90 seconds. Temporary pairing assignments and unranked Quick Match rooms expire after no more than two hours and are then eligible for deletion.

Records of No Ads Forever purchases and their activation codes are kept for as long as the purchase remains valid, and afterwards only as long as needed for accounting, tax, refund, and fraud-prevention obligations.

Block entries remain until they are removed or the associated online identity is deleted. Safety reports are retained only as long as reasonably needed to review the issue, prevent abuse, protect users, or meet a legal obligation.

Security

We protect information with appropriate technical and organisational measures, including encryption in transit, access controls, and database rules that keep purchase and code records readable only by our own backend services.

Age requirements

The App is not directed to children under 13. Users who select the under-13 age range cannot enter the game. Analytics collection remains disabled, and the App does not request consent or advertisements for them. We do not knowingly ask children under 13 to submit personal information. If you are a parent or guardian and believe that a child under 13 has provided personal information through the App, contact us so that we can investigate and take appropriate action. In some countries, a higher age may apply for consent to certain data processing; users below that age receive the corresponding age-restricted treatment.

Your privacy choices and rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, or to withdraw consent. You can contact us to exercise an applicable right. Because we do not operate user accounts and generally cannot connect technical records to a named person, we may need limited information about the device or event to evaluate a request.

Users can clear local game data through the device settings or remove the App. Advertising privacy choices required by applicable law are available through the App's privacy settings where required.

International processing

Service providers may process information in countries other than the user's country. Where required, appropriate safeguards are used for such transfers.

Changes to this policy

We may update this Privacy Policy when the App, our service providers, or legal requirements change. We will post the revised policy on this page and update the effective date above.

Contact us

For privacy questions and requests, parents, guardians, and other users can contact us at borisenkoilia487@gmail.com, or by post at Ponichala 3, Building 5, Floor 4, Krtsanisi District, Tbilisi, Georgia.