Privacy

Privacy policy

Last updated: 13 October 2026.

MangyByte Ltd is the data controller for Toy Tidy. MangyByte Ltd is a company in England and Wales, company number 17175779.

Our registered office is 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.

This policy covers the Toy Tidy game and this website. If we change how the game uses data, we update this policy first.

Summary

The game shows ads. Google AdMob provides them. Where the law asks for it, the game asks you first.
Apart from the ad software and the sign-in software of Google and Apple, the game has no analytics tools and no crash reporting tools.
The game never asks for your name, your email address, your date of birth or your location.
You do not need an account to play. Sign-in is optional, and it is only for saving your progress.
The game sends data to our server for one thing: purchases.
Apple or Google takes the payment. We never see your card details.
The game is for people aged 13 and over.

Who the game is for

Toy Tidy is for players aged 13 and over. It is not for children under 13. The game does not ask for your age.

If you are a parent or guardian and you think a child under 13 uses the game, tell us at privacy@toytidy.app. We help you to remove the data.

This website

This website has no accounts, forms, analytics or advertising. It sets no cookies of its own and does not ask you for personal data. It loads no fonts, scripts or pictures from other companies.

Cloudflare delivers this website to you. Your IP address passes through Cloudflare and reaches our hosting provider, Hetzner. Cloudflare can set a security cookie if it must check a visitor. Migadu provides our support email service.

This site does not write an access log. The web server can write a technical error record for a failed request. That record can have your IP address. We keep it for up to 53 days. Cloudflare can keep technical records to deliver the service and to prevent abuse.

What the game keeps on your device

The game keeps this data on your device:

your completed levels and the stars of each level;
your sound setting and your "Less movement" setting;
the number of hints, undo moves and shelf places that you have, and the list of your orders;
a mark that you finished the tutorial;
the state of the optional cloud save (see below);
a random player ID, which the game makes when you first buy or restore a purchase.

The ad software and the sign-in software of Google also keep data on your device, for example your consent answer.

The game makes the player ID itself, from random numbers. It does not make the ID when you install the game. The player ID is not your device serial number, your advertising ID or your account.

On Android, clear the app data or delete the game to remove this data. On iPhone or iPad, delete the game. The game turns off app backup on Android. On iPhone and iPad, a device or cloud backup can keep a copy of this data, with your player ID and your orders. Use your backup settings to remove those copies.

The game shows two kinds of ads. Google AdMob provides both.

A rewarded ad. You choose to watch it. It gives you one more place on the shelf for the level.
An ad after a loss. It comes from level 15. It does not come again within 60 seconds of an ad. If you buy "Remove ads", the game shows no ads after a loss.

The consent question comes from the Google User Messaging Platform. It shows a message where the law asks for one, for example in the UK and in the European Economic Area. Where the message shows, the game asks for an ad only after you answer it. If the question fails to load, the game asks for no ad.

If you choose not to agree, the game can still ask for ads. Google then shows ads that are not personalised, or no ad. Google applies your answer to each ad request.

When the game asks for an ad or shows an ad, Google collects data from your device. This can include your advertising ID, your IP address and data about your device and about how you use the game. Google uses it to show you ads and to measure them. MangyByte does not get this data. The privacy policy of Google applies to it. Google explains its use of this data on its page "How Google uses information from sites or apps that use our services".

The game does not tell AdMob that a person is a child. The game is for people aged 13 and over.

You can change your consent answer at any time. At this time, on Android, clear the app data of the game, or delete the game and install it again. On iPhone or iPad, delete the game and install it again. The question then comes again. This also removes your progress and the hints, undo moves and shelf places that you did not use. "Save my progress" keeps your levels and stars only. "Restore purchases" gives you "Remove ads" again. It cannot give back hints, undo moves or shelf places.

On Android, you can also reset your advertising ID or turn off ad personalisation in the settings of your device. On iPhone and iPad, the system asks you before an app can use your advertising identifier to track you. You can change your answer in the Settings app.

Buying things in the shop

The shop sells four things: "Remove ads", a pack of 20 hints, a pack of 40 undo moves and a pack of 10 shelf places. They cost real money. The game has no random prizes and no loot boxes. If a purchase did not give you what you bought, tap "Restore purchases" in the shop.

Apple or Google takes the payment. They handle billing and refunds. We do not get your card details, your name or your email address.

When you buy or restore a purchase, the game sends our server this data:

the name of the game;
your player ID;
the name of the store;
the product;
the proof of purchase from the store.

Our server checks the purchase with Google, or checks the Apple signature. The game gives you what you bought only after this check.

The stores tell us about refunds. Apple sends a message to our server when it refunds an order. Our server asks Google which purchases it refunded. The game then asks our server about refunds. It does this about every 15 minutes while it has an order. It sends your player ID with each request. The game then takes back what the refunded orders gave.

The store can connect your purchase to your player ID. Google gets a one-way hash of the player ID. Apple gets the player ID inside the purchase.

For each order, our server keeps this data:

Data	Why
The store and the order ID	To find the order again.
A one-way hash of the purchase token (the proof of purchase from the store)	To stop the same purchase from giving the same things twice.
Your player ID	To give what you bought to the right game.
The product, the name of the game, and whether the product is a one-time product	To know what the order gave.
Whether it is a test order or a real order	To keep test orders apart from real orders.
The state (given or taken back) and the dates	To take things back after a refund.

Nothing in the record is a real name or an email address. The player ID is a random number. It is not an account.

The purchase service runs on MangyByte servers at Hetzner in Europe. The service uses your IP address to limit how many requests one network can send. It keeps a one-way keyed hash of the IP address. A hash is a code that the service makes from the address with a one-way method. We do not use it to find your address. The service keeps the hash only while the limit period runs. Then it deletes it. It does not keep the address in its database.

The web server for this service writes a technical log. A log line has your IP address, the time, the request method and path, the result, and the size and duration of the response. It does not have your player ID. The game sends the player ID in the body of the request, and the log does not write the body. Cloudflare passes these requests to our server. The web server can also write a technical error record for a failed request. That record can have your IP address. We keep these logs for up to 53 days.

Optional cloud save

Sign-in is optional. The game works fully without it. The game sends nothing to the cloud until you tap "Save my progress" on the level list. After you tap it the first time, the game updates the copy by itself when you win a level and your progress changes.

On Android, you can sign in with Google Play Games. The game then keeps a copy of your progress in your own Google Play Games account, in Saved Games.

The game uses the Google Play Games software for this sign-in and for the copy. This software starts only after you tap "Save my progress". After that first tap, it starts each time the game starts. After you sign in, it sends Google your Google Play Games player ID and profile, and the copy of your progress. When this software runs, it also sends Google analytics and diagnostics data about the software. The privacy policy of Google applies to this data. MangyByte does not get your Google Play Games player ID or the copy.

To stop the sign-in software on Android, clear the app data of the game. On iPhone or iPad, delete the game. Both remove your progress and the hints, undo moves and shelf places that you did not use. The copy in your account stays. "Restore purchases" gives you "Remove ads" again. It cannot give back hints, undo moves or shelf places.

On iPhone and iPad, you can sign in with Game Center. The game then keeps a copy of your progress in your own iCloud account, in iCloud key-value storage.

The copy holds your completed levels and the stars of each level. It also holds a random copy ID and the time of the save. It holds a short text that says how many levels and stars the copy has.

The copy does not hold your hints, undo moves, shelf places, orders, settings or player ID.

The game code does not read, show or keep your Google Play Games or Game Center account name or player ID.

MangyByte does not get the copy. It goes to Google or Apple, in your own account. Their privacy policies apply to it.

To delete the copy on Android, remove the data of Toy Tidy in the Google Play Games app or in your Google account settings. To delete the copy on iPhone or iPad, remove the iCloud data of Toy Tidy. Look in the iCloud settings of your device.

Permissions and tracking

The Android game with ads asks for these permissions: internet, network state, billing, the advertising ID, basic phone state, wake lock and foreground service. The ad software, the store software and the sign-in software add some of them. The game does not ask for your location, contacts, photos or microphone.

Apart from the ad software and the sign-in software, the game has no analytics, no crash reporting tools and no tracking software of our own. The stores give us reports about installs and crashes. The reports do not name you.

Why we use data, and the legal basis

What we do	Legal basis
Check a purchase and give you what you bought, and keep the order record	Contract: you ask to buy it.
Apply refunds and keep accounting records	Contract, and the law that asks us to keep accounts.
Limit requests, keep technical logs, stop fraud and keep the service secure	Legitimate interests: we must protect the service and our customers.
Answer your support email	Legitimate interests: we must help you.
Show personalised ads, and read or keep ad data on your device	Your consent, where the law asks for it (for example in the UK and in the European Economic Area).
Show ads that are not personalised	Legitimate interests: ads pay for a free game.
Keep a copy of your progress in your account	Your consent: you tap "Save my progress". Google or Apple holds the copy.

You must give the purchase data to buy something. The cloud save is optional. The game sends ad requests when it shows ads. Our servers get your IP address when the game connects.

How long we keep data, and how to remove it

We keep a purchase record while we need it to apply refunds and to keep our accounting records. We have no automatic deletion of purchase records at this time. The only data that our service deletes by itself is the one-way IP hash that limits requests. We also delete web server logs after 53 days at most.

You can ask us to remove your data at any time. Read Delete your data and email privacy@toytidy.app. If the law makes us keep a record, we tell you which one and why.

If we remove a purchase record, you do not get a refund. Ask Apple or Google for refunds. If you use "Restore purchases" after we remove a record, the game checks the purchase with the store again. Our server can then make a new record.

Support and your rights

If you email us, we receive your email address and your message. We use them to answer your request. We keep support messages only while we need them to resolve the request or to meet a legal duty.

Under UK data protection law, you can ask to access, correct or delete personal data that we hold about you. You can ask us to limit how we use your data. You can object to our use of your data. You can ask for a copy of the data that you gave us for a purchase, in a form that a computer can read. You can withdraw your consent at any time (see "Ads" and "Optional cloud save"). These rights do not apply in all cases.

We make no automatic decision that has a legal effect or a similar important effect on you.

To ask about your data, email privacy@toytidy.app. We reply within one month. If you do not agree with our answer, you can complain to us. You can also complain to the UK Information Commissioner's Office at ico.org.uk at any time. You do not have to complain to us first.

Service providers and transfers

Cloudflare operates in many countries and can process data outside the UK. Its data processing terms include standard contract terms and the UK Addendum. These terms protect personal data during international transfers. Contact us for information about the safeguards that apply to your data.

Hetzner provides hosting in Europe. Migadu provides email through infrastructure in Europe (the European Economic Area and Switzerland). UK rules allow the transfer of personal data to the European Economic Area and to Switzerland.

Google and Apple run the stores, the purchase windows, Google Play Games, Game Center and iCloud. Google also runs AdMob. They can process data in other countries, including the United States. Their own privacy policies explain the safeguards that they use.