Privacy policy

Last updated 30 October 2026

Tiny Toyworks is a toy shop game for iPhone and Android made by Devinity (devinity.gr), Greece. Devinity is responsible for your data. This page explains what we keep, why, for how long, and what you can do about it. Questions: support@tinytoyworks.com.

The short version

You can play as a guest. A guest is anonymous: we don’t know your name or email, and your factory is saved only on your phone.
If you connect an account (Game Center, Apple or Google), we keep your account id, the email it shares with us and a cloud save of your factory, so it survives a new phone.
We collect a few game events to balance the game. We never sell your data.
Our server is in the EU.

What we keep

Every player, guests too: a random sign-in key for your device (the “device token”) and a player record with your phone’s platform (iPhone or Android), the game version and the days you played. No name, no email, no contacts, no location.
If you connect an account: your Game Center player id and nickname, or your Apple or Google account id, the email address Apple or Google shares with us (with Apple you can share a private relay address instead) and the name they share, if any. We never see your passwords.
Your cloud save (connected players only): your factory: coins, machine levels, rooms, helpers, upgrades and play time, with a few older copies so a bad save can be undone.
Purchases: what you bought, when, and the store’s transaction id, so we can give you what you paid for and restore it. You pay Apple or Google; we never see your card or payment details.
Game events, for game balance: when a session starts and how long it lasts, milestones reached (for example your first sale or your first helper), purchases, rewarded ads offered and watched, and coins earned while you were away. They tell us where the game is too slow or too hard.
Server logs: for a short time, technical logs with IP addresses, to keep the game running and stop abuse.

Tiny Toyworks can show ads from Google AdMob: rewarded ads you choose to watch for a gift, and, later in the game, an occasional ad between screens. When ads are live in your version of the game, AdMob receives data from your phone to show and measure ads and prevent fraud, such as your IP address, device model and your phone’s advertising id. When ads are on, the game asks players in the EU and UK for consent before showing personalised ads; without consent you get ads that aren’t based on your interests. On iPhone, the advertising id is only shared if you allow tracking. You can change these choices any time in the game’s settings or in your phone’s privacy settings. How Google uses this data: policies.google.com/technologies/partner-sites.

Why we use it (legal bases)

To run the game you asked for (GDPR article 6(1)(b), a contract): your device token, the account you connect, your cloud save and your purchases.
Our legitimate interests (article 6(1)(f)): game events to balance and improve the game, and server logs to keep it safe. We keep these to the minimum and you can object (see your rights below).
Your consent (article 6(1)(a)): personalised ads. You can withdraw it at any time.
The law (article 6(1)(c)): purchase records that tax law asks us to keep.

Who else handles it

Hetzner, our server host, in the EU (Germany and Finland).
Apple and Google, when you sign in with Game Center, Apple or Google, and when you buy something in their stores.
Google AdMob, for ads, as described above.

We don’t sell your data or share it with anyone else, unless the law makes us. Apple and Google may process data outside the EU; they do so under their own privacy policies and the EU’s safeguards for such transfers (the Standard Contractual Clauses or the EU-US Data Privacy Framework).

How long we keep it

Your account, cloud save and device tokens: while you play. When you delete your account they’re deleted straight away (see Delete account).
Game events and ad records: while they’re useful for game balance. When you delete your account, they stay only as anonymous numbers, no longer linked to you.
Purchase records: as long as Greek tax law requires, without anything that identifies you once your account is deleted.
Server logs: a short time, then they’re deleted.

Your rights

You can ask to see your data, get a copy of it, correct it, delete it, restrict how we use it, or object to it; and you can withdraw your consent for personalised ads at any time. Email support@tinytoyworks.com and we’ll answer within a month. You can delete your account yourself in the game: here’s how.

If you’re unhappy with how we handle your data, you can complain to the Hellenic Data Protection Authority (dpa.gr), Kifisias 1-3, 115 23 Athens, Greece, or to the authority in the EU country where you live.

Children

Tiny Toyworks is a cozy game for everyone. We don’t knowingly collect personal data from children: guests are anonymous, and connecting an account is optional. If you’re a parent and think your child connected an account or gave us their data, write to us and we’ll delete it.

Changes

If we change this policy, we’ll update this page and the date at the top. If a change matters, the game will tell you too.

Contact

Devinity, Greece · support@tinytoyworks.com