LEGAL / 01

Privacy Policy

How the taplevelpat website, games, and related services handle personal data. Last updated: 2026-08-24.

This Policy explains how taplevelpat handles personal data when you use this website, our mobile games, and related services (together, the “Services”). It is written to be read without a lawyer.

1. Who we are and what this Policy covers

taplevelpat is the trading name of an independent game developer based in Ukraine. We decide what personal data is processed and why, which makes us the data controller.

This Policy covers this website and every mobile app published under the developer name taplevelpat with a package identifier in the com.taplevelpat.* namespace. The current titles are listed on the games page.

Contact. Privacy questions: privacy@taplevelpat.com. Legal matters: legal@taplevelpat.com. Security reports: security@taplevelpat.com. General enquiries: hello@taplevelpat.com.

How we appear in each store. On Google Play the games are published under the developer name taplevelpat. Apple lists an individual developer account under the account holder's legal name, so where our account is of that type the seller shown on an App Store product page is the operator's registered personal name rather than taplevelpat. It is the same operator, the same games, and the same Policy in both stores.

If an individual game processes data differently from what is described here, we will publish a supplement in that game and on its product page. A supplement applies only to that game. Read the supplements for One Second Garden, Morse Petals, and Pairilumi. App stores, payment providers, and external sites process data under their own policies, which we do not control.

2. Data we process

  • Website technical data. When you open a page, our hosting processes the IP address, date and time, requested address, HTTP headers, browser and device type, approximate region, and response codes. A page cannot be delivered without this.
  • Your correspondence. If you email us, we receive your email address, name or alias, the message, any attachments, and whatever details you choose to include.
  • Game data. A game may keep settings or progress locally on your device. Separate supplements for released Android versions appear below; every Google Play Data safety declaration must match the relevant supplement.
  • Store data. An app store may give us limited information about installs, version, country, purchases, refunds, reviews, or aggregate performance. Apple, Google, and payment providers handle payment credentials themselves, and we never receive a full card number.

Numberlight: Numbers & Stars on Android (com.taplevelpat.numberlight). The game has no accounts, chat, publisher-hosted progress database, or standalone analytics SDK. Progress and preferences remain local. On every launch, the app refreshes consent information through Google User Messaging Platform 4.0.0 with the under-age-of-consent flag. Google Mobile Ads 25.4.0 is not initialised and no ad is loaded until an adult deliberately starts an optional rewarded video from the protected area and UMP confirms that ad requests are permitted. According to Google, Mobile Ads automatically collects and shares with Google the IP address (which can estimate a general region), app interactions (including launch, taps, and video views), diagnostic information, and device or account identifiers including App Set ID for advertising, analytics, and fraud prevention. Transmission uses TLS. The Android Advertising ID (AAID) permission is explicitly removed; ad requests are child-directed, non-personalised, not used for remarketing, and limited to the G content rating. There are no banner, interstitial, App Open, or third-party mediation placements.

Android purchases. The optional one-time unlock is processed by Google Play Billing. Google Play handles payment credentials, purchase status, and restoration; we do not receive a full card number. The app stores only the local access state and can verify the entitlement with Google Play.

The support form runs only in your browser. The site does not send what you type to a server, store it in cookies, localStorage, or sessionStorage, or pass it to a form service. When you select “Open email draft,” your browser hands the subject and body to your own email application through an ordinary mailto: link. Nothing reaches us until you send the message yourself.

We deliberately collect very little. This site has no accounts, no server-side forms, no advertising SDKs, no behavioural analytics, no newsletter, no remote fonts, no tracking pixels, and no third-party JavaScript. Please do not send us passwords, full payment details, identity documents, private keys, or recovery codes, because we do not need them.

2.1. Sittoria supplement (Android)

App and operator. This supplement covers Sittoria, package com.taplevelpat.sittoria, published by taplevelpat. The game creates no account and does not send progress or settings to a taplevelpat server.

Local data. Progress, settings, consent choices, and a cache of the Remove Ads entitlement remain on the device until reset, storage clearance, or uninstall.

Ads and consent. Google Mobile Ads provides a banner and user-initiated rewarded ads. The SDK automatically collects and shares IP address, app interactions, diagnostic information, and device or account identifiers for advertising, analytics, and fraud prevention; an IP address may estimate approximate location. Google User Messaging Platform requests and stores privacy choices where required and provides an in-game entry point for managing those choices again. Transmission is encrypted in transit.

Purchases. Google Play Billing processes the one-time Remove Ads purchase and restoration. The game receives product, purchase-state, and purchase-token information to confirm the entitlement, but no full payment-card details. The purchase removes the persistent banner; rewarded ads remain optional and appear only when the user deliberately requests a bonus.

Audience. The release is intended for users aged 16 and over and is not specifically directed to children.

2.2. Wonderbid supplement (Android)

App and operator. This supplement applies to Wonderbid, package com.taplevelpat.wonderbid, published by taplevelpat. The game creates no accounts and has no first-party analytics server.

Local data. Progress, accessibility settings, language choice, and the remove-ads entitlement flag stay on the device. They are not sent to taplevelpat and are removed when the app data is cleared or the app is uninstalled, subject to the device owner’s own backup settings.

Advertising and consent. The free version uses the Google Mobile Ads SDK and Google User Messaging Platform. These SDKs may automatically transmit to Google an IP address (which may estimate a general region), app interactions, diagnostic data, and device or app identifiers for advertising, measurement, analytics, security, and fraud prevention. Data is encrypted in transit. Wonderbid disables ad personalization, does not request the Android Advertising ID, and sends no advertising data to a taplevelpat server. Where required, ads are requested only after Google’s consent flow has completed; any required privacy choices can be reopened from the game settings.

Purchases. The one-time Remove Ads purchase is processed only through Google Play Billing. Google collects payment credentials directly under its own terms; taplevelpat never receives a card number. The game receives only the data needed to verify the current entitlement (product identifier, purchase state, purchase token, and acknowledgement state), processes it on the device, and stores only a local remove-ads entitlement flag.

Audience and controls. Wonderbid is intended for users aged 16 and over and is not a child-directed app. A user can reopen any required privacy choices in the game, remove ads with the one-time purchase, or delete all local game data through Android system settings. Google’s privacy, advertising, and payment terms also apply to the corresponding Google services.

2.3. Velvet Recall supplement

This supplement applies to the Android game Velvet Recall, package com.taplevelpat.velvetrecall. The game is intended for a general audience aged 13 and older and does not create user accounts.

Local data. Language, accessibility and sound settings, story progress, unlocked levels, scores, and a local copy of the remove-ads entitlement stay on the device. taplevelpat does not receive these data. They are removed when App storage is cleared or the App is uninstalled.

Advertising. The free version displays a bottom banner through the Google Mobile Ads SDK. According to Google's disclosure, the SDK can automatically collect and share with Google the IP address used to estimate approximate location, app interactions, diagnostics, and device identifiers for advertising, analytics, fraud prevention, security, and compliance. Data is encrypted in transit. Where required, Google User Messaging Platform manages consent before ads are requested; privacy options remain available in the game's Settings. See Google's Privacy Policy and Google's advertising technologies.

Purchase. The optional one-time purchase that permanently removes the banner is processed by Google Play Billing. The game never receives payment-card details and does not send purchase history or purchase tokens to a taplevelpat server; it checks the entitlement locally and acknowledges a completed purchase.

This release has no developer analytics, cloud save, profiling, contacts, chat, location, camera, or microphone access. Data processed by Google is retained and deleted under Google's policies and controls. Questions and requests: privacy@taplevelpat.com.

2B. Woven Evidence supplement (Android)

App and operator. This supplement applies to Woven Evidence, package com.taplevelpat.wovenevidence, published by taplevelpat. The release is intended for a general audience aged 13 and older, is not specifically directed to children, and creates no user account.

Local data. Language, accessibility and sound preferences, game progress, achievements, hints, saved offline levels, advertising-consent state, and a local copy of the Remove Ads entitlement remain on the device. They can be cleared through the in-game reset or Android system settings; an eligible one-time purchase can be restored through the store.

Advertising and consent. The free version uses Google Mobile Ads for an adaptive banner and optional rewarded videos deliberately started by the user. Google User Messaging Platform requests and stores privacy choices where required and provides access to privacy options again. According to Google, the advertising SDKs may process IP address for approximate location, app interactions, diagnostic data, and device or app identifiers for advertising, analytics, security, and fraud prevention. Data is encrypted in transit. See Google's Privacy Policy and Google's advertising technologies.

Purchase and restoration. Google Play Billing directly processes the one-time Remove Ads purchase. The game receives from Google Play only the product identifier and current purchase state needed to unlock and restore access, sends no purchase token to a taplevelpat server, and uses no additional purchase broker. Woven Evidence and taplevelpat do not receive a full payment-card number.

Disabled features. The release has no publisher-hosted accounts, chat, community-level publishing, online leaderboard, cloud save, standalone taplevelpat analytics, crash-reporting SDK, contacts, precise location, camera, or microphone access. Data requests: privacy@taplevelpat.com.

3. Cookies and local storage

This site sets no cookies. It uses no localStorage, no advertising identifiers, and no cross-site tracking. That is why there is no consent banner: there is no optional technology to consent to.

By default the site opens in English with the “Auto” theme, which follows your system setting. Only after you choose otherwise does the site write your language (en or uk) and theme (auto, light, dark) to sessionStorage. Those values contain no identifier, never leave your device, and normally disappear when you close the tab.

If optional analytics, advertising, or third-party widgets are ever added, they will not load before valid consent where consent is required, and this Policy will be updated first.

4. Why we process data, and on what legal basis

  • Providing the Services and answering you: performance of a contract, or steps taken at your request before entering one.
  • Security, abuse prevention, and diagnostics: our legitimate interest in Services that stay reliable and safe.
  • User support: carrying out your request, or our legitimate interest in supporting the people who play our games.
  • Tax, accounting, lawful requests, and legal claims: compliance with a legal obligation, or legitimate interests.
  • Optional features: your consent, where law or platform rules require it. You can withdraw consent at any time; this does not affect processing that was lawful before.

How to withdraw consent. Where a feature runs on your consent, withdrawing it is as easy as giving it. You can turn the feature off on the settings screen of the game that offers it, change the matching permission in your device settings at any time, or email privacy@taplevelpat.com and we will act on it. Withdrawal takes effect for the future and does not make earlier lawful processing unlawful. No paid feature depends on your agreeing to optional data collection.

Providing data is voluntary, apart from the minimum technical information needed for network access. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile you.

5. Who receives data

taplevelpat does not sell personal data or trade it for anything of value. Individual games may share data with Google Mobile Ads for advertising, measurement, analytics, security, and fraud prevention exactly as their supplements above describe. Otherwise, access is limited to providers that genuinely need it: hosting and delivery, domain registration and DNS, email, app stores, payment infrastructure, and professional advisers or public authorities where the law requires.

Infrastructure providers. Hosting and content delivery: Vercel. Domain registrar and DNS: Hosting Ukraine LLC (Ukraine.com.ua). Email: Hosting Ukraine LLC (Ukraine.com.ua / mx.services). Hosting technical-log retention: within the active Vercel plan limits: queryable runtime logs are retained from 1 hour to 30 days depending on the plan and add-ons; this static site keeps no separate request-log database.

Equal protection downstream. Before release, we review third-party provider terms, security, and store disclosures. Providers process data under their published policies, contractual terms, and applicable law; a game's supplement identifies the specific data categories and purposes attributable to each third-party SDK.

We treat a third-party SDK inside a game as collection by us: before release we review its permissions, the data it takes, its purposes, retention, child-safety terms, and contractual protections. The SDKs in each released game are disclosed in the store declarations and, where needed, in a supplement to this Policy.

Some providers may process data outside Ukraine, the EEA, or your own country. Where the law requires safeguards, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism, and we will tell you which one on request.

6. How long we keep data, and how we protect it

  • Language and theme preferences: the current tab session only; we never receive them.
  • Technical logs: the shortest period needed for delivery, security, and diagnostics.
  • Correspondence: until the matter is resolved, and normally no longer than 24 months after the last substantive contact, unless a dispute or the law requires longer.
  • Tax and accounting records: for the period the law sets.
  • Game-specific data: for the period stated in that game’s supplement, then deleted or anonymised.

We use data minimisation, HTTPS, access restrictions, strict browser security headers, component maintenance, and provider review. No method of transmission or storage is completely secure, so we do not promise absolute security. If an incident requires notification, we will inform users and the supervisory authority within the time the law sets.

If you find a vulnerability, please write to security@taplevelpat.com. We will not pursue good-faith security researchers who report privately, access no more data than needed to demonstrate the issue, and give us reasonable time to fix it.

7. Your rights

Depending on where you live, you may have the right to: know what data we hold, where it came from, and who receives it; access it and obtain a copy; correct or update it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; not be treated worse for making a lawful request; and complain to a supervisory authority or a court.

To exercise any of these, email privacy@taplevelpat.com and tell us the service, the platform, and enough detail for us to find the data. We may ask for proportionate identity verification, only as much as is needed to avoid handing your data to someone else. An authorised agent may act with adequate proof of authority. We respond within the period applicable law requires; in the EEA and the UK that is normally one month.

You can complain to the Ukrainian Parliament Commissioner for Human Rights, to the supervisory authority in your own country, or to a court.

8. Deleting your data

Our current games do not create accounts. Progress is stored on your device, so deleting the game removes it along with the app and, if you use Apple or Google device backup, from your own cloud storage according to your device settings.

To have us delete your correspondence or any other data we hold about you, use the deletion request page. It explains exactly what is deleted, what we are required to keep, and how long it takes.

If a future game offers accounts, it will have a clearly visible way to delete the account from inside the game, plus an external request page on this site that stays reachable after the app is uninstalled.

9. Children and families

This website is not intended for children to submit personal data on their own. If a child has written to us, a parent or guardian can contact privacy@taplevelpat.com and we will delete the message.

Games for children. Our catalogue includes Numberlight: Numbers & Stars, an early-learning game made for children of roughly 4-6. For any child-directed game we commit, before release, to:

  • no personalised or behavioural advertising;
  • no standalone analytics SDK and no Android Advertising ID (AAID); Google Mobile Ads processing for the optional rewarded video is disclosed in section 2;
  • no purchases, outbound links, or social features outside a parental gate;
  • only SDKs verified as suitable for a child audience;
  • a separate review against COPPA, GDPR Article 8, Google Play Families, and the Apple Kids Category rules;
  • a plain-language explanation for parents, in the game and on its product page.

We do not knowingly collect a child’s personal data without appropriate notice and verifiable parental consent where it is required. If you believe we have received a child’s data without that consent, email privacy@taplevelpat.com and we will check and delete it.

10. Regional information

EEA, United Kingdom, and Switzerland

The legal bases are set out in section 4. You have the rights described in section 7, and you may complain to the supervisory authority where you live, where you work, or where you believe an infringement took place.

United States

We do not sell personal data and do not share it for cross-context behavioural advertising as those terms are used in California and other state laws. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit. We will not discriminate against you for exercising your rights. Send requests to privacy@taplevelpat.com.

Ukraine

Processing is carried out under the Law of Ukraine “On Personal Data Protection.” You have the rights set out in Article 8 of that Law and may contact the Ukrainian Parliament Commissioner for Human Rights.

11. Changes and contact

Links to Google Play, the App Store, or other external resources lead to independent services with their own rules; this Policy does not cover them.

We update this Policy when features, providers, or legal requirements change. Every new version carries an updated date at the top of the page. We will give prominent notice in the Service, or by another appropriate means, before material changes take effect.

Privacy questions: privacy@taplevelpat.com. General enquiries: hello@taplevelpat.com.