Privacy Policy

Product: Cat Journey (TriPeaks, iOS) · Version 1.1 · Effective date: 1 October 2026

1. Overview

This policy explains what data Cat Journey (the “Game”) collects, why we collect it, how we use and share it, how long we keep it, and the choices you have.

Before you start, you may choose “Required data only”. In that case we process only the data needed to run the Game and save your account, and your main journey and basic rewards are unaffected.

2. Data we collect

2.1 Account and device identifiers

• Device identifiers: on iOS the identifier for vendor (IDFV) plus an anonymous device ID generated by the app. Used to create your anonymous account, restore your save, and support offline play.
• Account identifier (UID): the anonymous account number assigned by our server.
• When you use Sign in with Apple: the Apple user identifier (sub). Our server stores only an HMAC hash of it, never the raw value. We also store the Apple authorization token solely so we can revoke the authorization when you delete your account, as Apple requires.

2.2 Gameplay data

• Progress (levels, journey meters, stars, best scores, story and collection completion);
• Resources and items (coins, food, wild cards, travel stamps, furniture and outfits);
• Settings (music, sound, haptics, large cards, reduced motion, language, privacy preference);
• Activity and reward records (daily check-in, daily walk, share rewards, rewarded ad grant status);
• Purchase state (for example whether the supporter pack is unlocked) so purchases can be restored.

2.3 Technical data

• IP address: used for rate limiting and security auditing and may appear in server logs;
• Runtime details: device model, OS version, app version, language and region.

2.4 Third-party SDKs and tracking

• We show rewarded video ads through Google AdMob (Google Mobile Ads SDK) (watching an ad grants coins, wild cards and similar rewards). On first launch we ask for your consent through the system App Tracking Transparency (ATT) prompt:
• If you allow tracking, the ad SDK may use the advertising identifier (IDFA) together with device information for ad delivery, frequency capping and measurement. If you decline, we only serve non-personalised ads and every feature and reward keeps working. You can change this at any time in iOS Settings → Privacy & Security → Tracking;
• For those purposes the ad SDK processes: device model and OS version, language and region, IP address (coarse region and fraud prevention), the advertising identifier (only after you allow tracking), ad impression/click/completion events, and the transaction identifier used to validate rewards;
• We use Google Firebase Analytics to understand overall level performance and stability. It is only enabled when you choose “Allow optional data”; with “Required data only” nothing is reported;
• We do not request contacts, photo library, microphone, precise location, or social graph access.

3. How we use data

• Create and maintain your account and sync progress and resources;
• Move an account to a new device with a recovery code, and keep the game playable on weak connections or offline;
• Settle purchases and rewards, and prevent reward abuse, cheating, and misuse;
• Show rewarded ads and validate reward grants against Google’s server-side callback so faked ad completions cannot claim rewards;
• Diagnose problems and keep the service safe and stable (including rate limiting).
• Once you allow optional data, understand overall level completion and experience problems so we can improve content and balance.

4. Sharing and processors

We do not sell your data. We share the minimum necessary data with the providers below; ad data is processed by Google as described in section 2.4.

Privacy policies of the providers above: Google (https://policies.google.com/privacy, which also covers AdMob and Firebase) and Apple (https://www.apple.com/legal/privacy/). If we add further advertising or analytics services, we will update this policy with each provider and a link to its privacy policy.

5. Retention

• Account and saves: kept until you delete your account. On deletion our server removes the account record, the device binding, and the third-party sign-in binding.
• Server access logs: used only for security and troubleshooting and kept for no longer than 30 days.
• Recovery codes: single use, and they stop working once used or expired.

6. Your rights and how to use them

• Delete your account: in the Game, “Settings → Delete Account”, confirmed in two steps. It also clears the local save and account bindings on your device and cannot be undone.
• Change your privacy choice: in the Game, “Settings → Privacy”, you can switch to “Required data only” at any time.
• Sign out: the in-game settings can end the current account session.
• Access and correction: progress, resources and settings are visible in the Game; contact us for anything else.

When an account created with Sign in with Apple is deleted, we call Apple’s API to revoke the authorization so the Apple ID is no longer linked to the Game.

7. Children

The Game is not directed to children under 13 and we do not knowingly collect their personal information. If you are a guardian and believe we have collected such information, contact us and we will delete it promptly.

8. International transfers

Our servers may be located outside your country or region. We protect data in transit and at rest with HTTPS, hashed tokens, hashed device identifiers, and access rate limiting.

9. Changes to this policy

If this policy changes materially we will update the version and effective date and notify you in the Game. Continued use means you accept the updated policy.

10. Contact

For any privacy question or data access/deletion request, email support@caugames.xyz or use Developer Support on our App Store product page.