LEGAL / 01

Privacy Policy

How the taplevelpat website, games, and related services handle personal data. Last updated: 2026-08-15.

This Policy explains how taplevelpat handles personal data when you use this website, our mobile games, and related services (together, the “Services”). It is written to be read without a lawyer.

1. Who we are and what this Policy covers

taplevelpat is the trading name of an independent game developer based in Ukraine. We decide what personal data is processed and why, which makes us the data controller.

This Policy covers this website and every mobile app published under the developer name taplevelpat with a package identifier in the com.taplevelpat.* namespace. The current titles are listed on the games page.

Contact. Privacy questions: privacy@taplevelpat.com. Legal matters: legal@taplevelpat.com. Security reports: security@taplevelpat.com. General enquiries: hello@taplevelpat.com.

Controller: Mykhailo Didenko. Privacy contact: privacy@taplevelpat.com.

How we appear in each store. On Google Play the games are published under the developer name taplevelpat. Apple lists an individual developer account under the account holder's legal name, so where our account is of that type the seller shown on an App Store product page is the operator's registered personal name rather than taplevelpat. It is the same operator, the same games, and the same Policy in both stores.

Before offering a game to people in the EEA, we will complete the GDPR Article 27 assessment and, if a representative is required, appoint and name them here.

If an individual game processes data differently from what is described here, we will publish a supplement in that game and on its product page. A supplement applies only to that game. App stores, payment providers, and external sites process data under their own policies, which we do not control.

2. Data we process

  • Website technical data. When you open a page, our hosting processes the IP address, date and time, requested address, HTTP headers, browser and device type, approximate region, and response codes. A page cannot be delivered without this.
  • Your correspondence. If you email us, we receive your email address, name or alias, the message, any attachments, and whatever details you choose to include.
  • Game data. A game may keep settings or progress locally on your device. If a particular game transmits diagnostics, identifiers, purchase information, or advertising data, we will say so in the game, in a supplement to this Policy, and in the Google Play Data safety and Apple App Privacy declarations before release.
  • Store data. An app store may give us limited information about installs, version, country, purchases, refunds, reviews, or aggregate performance. Apple, Google, and payment providers handle payment credentials themselves, and we never receive a full card number.

The support form runs only in your browser. The site does not send what you type to a server, store it in cookies, localStorage, or sessionStorage, or pass it to a form service. When you select “Open email draft,” your browser hands the subject and body to your own email application through an ordinary mailto: link. Nothing reaches us until you send the message yourself.

We deliberately collect very little. This site has no accounts, no server-side forms, no advertising SDKs, no behavioural analytics, no newsletter, no remote fonts, no tracking pixels, and no third-party JavaScript. Please do not send us passwords, full payment details, identity documents, private keys, or recovery codes, because we do not need them.

3. Cookies and local storage

This site sets no cookies. It uses no localStorage, no advertising identifiers, and no cross-site tracking. That is why there is no consent banner: there is no optional technology to consent to.

By default the site opens in English with the “Auto” theme, which follows your system setting. Only after you choose otherwise does the site write your language (en or uk) and theme (auto, light, dark) to sessionStorage. Those values contain no identifier, never leave your device, and normally disappear when you close the tab.

If optional analytics, advertising, or third-party widgets are ever added, they will not load before valid consent where consent is required, and this Policy will be updated first.

4. Why we process data, and on what legal basis

  • Providing the Services and answering you: performance of a contract, or steps taken at your request before entering one.
  • Security, abuse prevention, and diagnostics: our legitimate interest in Services that stay reliable and safe.
  • User support: carrying out your request, or our legitimate interest in supporting the people who play our games.
  • Tax, accounting, lawful requests, and legal claims: compliance with a legal obligation, or legitimate interests.
  • Optional features: your consent, where law or platform rules require it. You can withdraw consent at any time; this does not affect processing that was lawful before.

How to withdraw consent. Where a feature runs on your consent, withdrawing it is as easy as giving it. You can turn the feature off on the settings screen of the game that offers it, change the matching permission in your device settings at any time, or email privacy@taplevelpat.com and we will act on it. Withdrawal takes effect for the future and does not make earlier lawful processing unlawful. No paid feature depends on your agreeing to optional data collection.

Providing data is voluntary, apart from the minimum technical information needed for network access. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile you.

5. Who receives data

We do not sell personal data, share it for cross-site behavioural advertising, or trade it for anything of value. Access is limited to providers that genuinely need it: hosting and delivery, domain registration and DNS, email, app stores, payment infrastructure, and professional advisers or public authorities where the law requires.

Infrastructure providers. Hosting and content delivery: Vercel. Domain registrar and DNS: Hosting Ukraine LLC (Ukraine.com.ua). Email: Hosting Ukraine LLC (Ukraine.com.ua / mx.services). Hosting technical-log retention: within the active Vercel plan limits: queryable runtime logs are retained from 1 hour to 30 days depending on the plan and add-ons; this static site keeps no separate request-log database.

Equal protection downstream. Every third party that receives personal data through the Services, including analytics tools, advertising networks, third-party SDKs, and any related entity, is bound to protect it to the same standard as this Policy sets out and as the app stores require. We do not engage a provider that cannot meet that standard, and a provider may use the data only to perform the service we asked for, never for its own purposes.

We treat a third-party SDK inside a game as collection by us: before release we review its permissions, the data it takes, its purposes, retention, child-safety terms, and contractual protections. The SDKs in each released game are disclosed in the store declarations and, where needed, in a supplement to this Policy.

Some providers may process data outside Ukraine, the EEA, or your own country. Where the law requires safeguards, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism, and we will tell you which one on request.

6. How long we keep data, and how we protect it

  • Language and theme preferences: the current tab session only; we never receive them.
  • Technical logs: the shortest period needed for delivery, security, and diagnostics.
  • Correspondence: until the matter is resolved, and normally no longer than 24 months after the last substantive contact, unless a dispute or the law requires longer.
  • Tax and accounting records: for the period the law sets.
  • Game-specific data: for the period stated in that game’s supplement, then deleted or anonymised.

We use data minimisation, HTTPS, access restrictions, strict browser security headers, component maintenance, and provider review. No method of transmission or storage is completely secure, so we do not promise absolute security. If an incident requires notification, we will inform users and the supervisory authority within the time the law sets.

If you find a vulnerability, please write to security@taplevelpat.com. We will not pursue good-faith security researchers who report privately, access no more data than needed to demonstrate the issue, and give us reasonable time to fix it.

7. Your rights

Depending on where you live, you may have the right to: know what data we hold, where it came from, and who receives it; access it and obtain a copy; correct or update it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; not be treated worse for making a lawful request; and complain to a supervisory authority or a court.

To exercise any of these, email privacy@taplevelpat.com and tell us the service, the platform, and enough detail for us to find the data. We may ask for proportionate identity verification, only as much as is needed to avoid handing your data to someone else. An authorised agent may act with adequate proof of authority. We respond within the period applicable law requires; in the EEA and the UK that is normally one month.

You can complain to the Ukrainian Parliament Commissioner for Human Rights, to the supervisory authority in your own country, or to a court.

8. Deleting your data

Our current games do not create accounts. Progress is stored on your device, so deleting the game removes it along with the app and, if you use Apple or Google device backup, from your own cloud storage according to your device settings.

To have us delete your correspondence or any other data we hold about you, use the deletion request page. It explains exactly what is deleted, what we are required to keep, and how long it takes.

If a future game offers accounts, it will have a clearly visible way to delete the account from inside the game, plus an external request page on this site that stays reachable after the app is uninstalled.

9. Children and families

This website is not intended for children to submit personal data on their own. If a child has written to us, a parent or guardian can contact privacy@taplevelpat.com and we will delete the message.

Games for children. Our catalogue includes Numberlight: Star Trails, an early-learning game made for children of roughly 4-6. For any child-directed game we commit, before release, to:

  • no personalised or behavioural advertising;
  • no third-party analytics and no advertising identifiers;
  • no purchases, outbound links, or social features outside a parental gate;
  • only SDKs verified as suitable for a child audience;
  • a separate review against COPPA, GDPR Article 8, Google Play Families, and the Apple Kids Category rules;
  • a plain-language explanation for parents, in the game and on its product page.

We do not knowingly collect a child’s personal data without appropriate notice and verifiable parental consent where it is required. If you believe we have received a child’s data without that consent, email privacy@taplevelpat.com and we will check and delete it.

10. Regional information

EEA, United Kingdom, and Switzerland

The legal bases are set out in section 4. You have the rights described in section 7, and you may complain to the supervisory authority where you live, where you work, or where you believe an infringement took place.

United States

We do not sell personal data and do not share it for cross-context behavioural advertising as those terms are used in California and other state laws. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit. We will not discriminate against you for exercising your rights. Send requests to privacy@taplevelpat.com.

Ukraine

Processing is carried out under the Law of Ukraine “On Personal Data Protection.” You have the rights set out in Article 8 of that Law and may contact the Ukrainian Parliament Commissioner for Human Rights.

11. Changes and contact

Links to Google Play, the App Store, or other external resources lead to independent services with their own rules; this Policy does not cover them.

We update this Policy when features, providers, or legal requirements change. Every new version carries an updated date at the top of the page. We will give prominent notice in the Service, or by another appropriate means, before material changes take effect.

Privacy questions: privacy@taplevelpat.com. General enquiries: hello@taplevelpat.com.