Privacy Policy - Tossmallow: 2048 Merge Blocks

Last updated: 2026-11-13

Effective date: 2026-11-13

Version: v1.0

App: Tossmallow: 2048 Merge Blocks, Android package kts.laboon.tossmallow (iOS bundle identifier: kts.laboon.tossmallow).

Public URL (Google Play Data safety form): https://kientaoso.com/privacy/tossmallow

1. Who We Are

Tossmallow: 2048 Merge Blocks (the "Game") is published by KTS Laboon Digital Creation Technology Co., Ltd ("KTS Laboon", "we", "us", "our"), the data controller for this Game. We appear on Google Play under the developer name "Laboon Digital Creation"; our brand is KienTaoSo / KTS Laboon. This game-specific Privacy Policy supplements our corporate Privacy Policy at https://kientaoso.com/legal/privacy. It describes how we handle information when you play the Game on Android or iOS.

2. What We Collect

2.1 Information you provide directly

The Game has no account or login, no chat, and no user-generated content. We receive personal information only if you contact us by email (for example, a support or data-rights request).

2.2 Data stored only on your device

The Game stores the following locally (local app storage / PlayerPrefs). It is never transmitted to our servers, and there is no cloud save:

• Game progress: levels, scores, and merge history.
• In-game coins: your coin balance.
• Daily login reward state: whether you have claimed the daily reward (claim coins once a day) and related progress.
• Settings: sound, haptics, and other preferences.

This local data is deleted when you uninstall the Game. Because it never leaves your device, we cannot recover it if you reinstall or switch devices.

2.3 Data collected automatically by the integrated SDKs

The current build integrates analytics, crash-reporting, and attribution SDKs (section 3). They may collect the following when you play:

[CONFIRM with the dev team]: whether Adjust and the Facebook SDK still read the Android advertising ID (GAID) in the current build, or only after user permission. The answer determines the final Google Play Data safety declaration for "Device or other IDs" (see our Data safety worksheet).

2.4 What we do NOT collect

• No location data (GPS or otherwise).
• No contacts, photos, microphone, or camera data.
• No payment data: there are no in-app purchases. The Unity IAP package is present in the build but disabled; this policy will be updated before any ads or IAP launch.
• No account, chat, or user-generated content, so none of that data exists.
• We do not sell your personal information.

3. SDKs Integrated in the Current Build

• Firebase Analytics and Firebase Crashlytics (Google): crash reports, diagnostics, app usage events, and a pseudonymous app instance ID.
• Voodoo TinySauce 8.3.3 (publishing-test SDK), which bundles: GameAnalytics (gameplay and progression events, device info); Adjust (install attribution; may use the advertising ID / IDFA when the user allows it); Facebook SDK (app events and install attribution); and Voodoo Analytics (gameplay events sent to Voodoo). TinySauce shows its own GDPR consent screen to users in the EEA/UK.

4. How We Use Information

• To operate the Game and keep your progress, coins, and daily reward on your device.
• To measure performance, understand gameplay, and improve balance, difficulty, and content.
• To detect and diagnose crashes.
• To attribute installs (which campaign or store an install came from) for our publishing test with Voodoo.
• To prevent fraud, cheating, and abuse.
• To comply with legal obligations.

5. Legal Basis (GDPR)

For users in the European Economic Area, the United Kingdom, and Switzerland:

• Contract (Art. 6(1)(b) GDPR): processing necessary to deliver the Game you chose to install and play.
• Legitimate interests (Art. 6(1)(f) GDPR): game operation, security, fraud prevention, and crash diagnostics.
• Consent (Art. 6(1)(a) GDPR): analytics and attribution that require it, collected through the TinySauce consent screen in the EEA/UK before those services run.

6. Third Parties

Each partner processes data under its own privacy policy:

7. International Transfers

Our team operates from Vietnam. The partners in section 6 process data globally, including in the United States and the European Union. Where data is transferred out of the EEA or UK, we rely on the partners' Standard Contractual Clauses (SCCs) or equivalent safeguards; Google LLC is also certified under the EU-US Data Privacy Framework.

8. Data Retention

• Local game progress, coins, daily reward state, and settings stay on your device until you uninstall the Game.
• Firebase Analytics data is retained for up to 14 months, then aggregated or deleted.
• Crashlytics crash reports are retained for 90 days.
• GameAnalytics, Adjust, Facebook, and Voodoo Analytics retain data per their own policies (section 6).
• Email you send us is kept only as long as needed to handle your request.

9. Your Rights and How to Exercise Them

GDPR / UK GDPR (EEA and UK): you have the rights to access, rectify, erase, restrict, and port your personal data, and to object to processing or withdraw consent at any time.

California (CCPA/CPRA): you have the rights to know, access, correct, and delete personal information, and to opt out of its "sale" or "sharing" for cross-context behavioral advertising. We do not sell personal information for money; disclosures of identifiers to attribution partners may constitute "sharing", and you can opt out using the device controls in section 10 or by emailing us.

Vietnam (Decree 13/2023/ND-CP on personal data protection): you have the rights to access and view your personal data, request copies, withdraw consent, request deletion, and complain to the competent authority (A05, Ministry of Public Security).

To exercise any right under any of these frameworks, email hello@kientaoso.com with "Privacy" in the subject line. We respond within 30 days. Because the data most SDKs process is pseudonymous, we may ask for identifying details (for example, device and play dates) to locate your records; the fastest way to delete device-linked data is to reset your advertising ID and uninstall the Game (section 10).

10. Opting Out

• In-app consent screen: in the EEA/UK, TinySauce shows its own consent screen before analytics and attribution run; refusing consent keeps those identifier-based services off.
• Android advertising ID: Android 12+ — Settings > Privacy > Ads > Delete advertising ID. Older versions — Settings > Google > Ads > Reset advertising ID or enable Opt out of Ads Personalization.
• iOS: the current build shows no App Tracking Transparency prompt and does not perform tracking. If a future version adds ATT, tracking would happen only after you grant permission.
• Uninstall: uninstalling removes all on-device game data and stops the SDKs from collecting anything new.

11. Children's Privacy

The Game is a general-audience game (rated Everyone / 4+) and is not directed at children. We do not knowingly collect personal information from children under 13 (COPPA) or from users below the digital-consent age applicable in their country (up to 16 in the EEA, GDPR-K). If you believe a child has provided us with personal information, contact us at hello@kientaoso.com and we will delete it.

12. Security

Your game data is stored only on your device under the operating system's app sandbox. Data that the SDKs transmit (analytics and crash events) travels over encrypted connections (TLS). No method of transmission or storage is 100% secure, but we and our partners apply industry-standard safeguards.

13. Changes to This Policy

We may update this Privacy Policy — for example, before ads or in-app purchases are enabled, or if the SDK set changes. Material changes will be posted on this page with a new "Last updated" date.

14. Contact

CÔNG TY TNHH CÔNG NGHỆ KIẾN TẠO SỐ LABOON (KTS Laboon Digital Creation Technology Co., Ltd)

For privacy inquiries, include "Privacy" in the subject line.