The short versionAbout one minute
If this is all you needed, you can stop here.
- There are no accounts.You never make one, and you never sign in.
- We never ask for anything about you.No name, no email address, no phone number, no birthday, no photo.
- There is no way to type anything into this game.No chat, no messages, no usernames you write yourself. Your player name is made up for you out of a word list.
- Your progress lives on your device.If you delete the game, it goes with it.
- What leaves your device is a score, the Humlet you chose, and some counting.How many runs, how many Big Bangs. It travels with a random string of characters that identifies your device and nothing else.
- We do not know where you are.We never ask for location.
- We do not sell or share your information.And we never show ads that follow you around.
- The game plays completely offline.All of it.
The detailSections 1 to 19
The rest is the detail.
1. Who we are
Planet Plink is made and operated by [Company Legal Name], [Address].
For privacy questions, including anything about a child's data, write to hello@planetplink.com. We answer within 30 days and usually much sooner.
2. There are no accounts, and there is no sign in
You open the game and you play. That is the whole entry.
There is no registration, no login, no email verification, no "continue with Google", no "continue with Apple", no password. Nothing to remember and nothing to lose.
Because there is no account, there is nothing that connects your play to your name, your email address, your phone number, or any other identifier that belongs to a person.
3. Your player id, and why it exists
The first time you open the game, your device generates a random string. It looks like p_ followed by 16 random characters. It is produced on your device by your browser or phone's own random number generator, and it is not derived from your device's serial number, your advertising id, or anything else about you or your hardware.
That string is your player id. It exists so that a leaderboard can keep one best score for you instead of a hundred, so that a crew knows who its members are, and so that a duel result lands next to the right challenge.
It is stored on your device. On a phone or tablet it lives in the app's own private storage. On the web it lives in your browser's local storage for this site.
We cannot use it to find out who you are, and neither can anyone else. If you reset the game, it is thrown away and a new one is made.
4. Your name is made up for you
Your display name comes from a word list on your device. It is an adjective, a celestial noun and two digits, so "Bright Comet 42". You can reroll it in Settings as many times as you like. Crew names are generated the same way.
This is deliberate. A generated name means there is no field anywhere in this game that could hold a real name, and no name for anyone else to read and react to.
5. There is no way to type anything, so there is no user content
There is no text input anywhere in Planet Plink. No chat, no direct messages, no comments, no forum, no profile bio, no custom names, no photo upload, no microphone, no camera.
That is not a feature we forgot. It is a design rule in our build contract, and it is the single biggest reason this game is safe for a five year old: there are no strangers who can say anything to your child, because the game gives nobody a way to say anything at all.
The only social things you can do are: send a link to challenge someone to the same board, join a crew with a link, and share a picture of your own score that your device draws for you.
6. What we send to our servers
Our servers run on Cloudflare. Here is the complete list of what reaches them.
| What | When | Why |
|---|---|---|
| Your player id | With each of the items below | So one player has one leaderboard row, one crew place and one duel result |
| Your generated display name | With a score, a crew join, a duel result | So a leaderboard row has something to show |
| Your score, mode, and the date | When you finish a Daily Drop, beat your own best, or finish a duel board | Leaderboards, duels, leagues |
| Run counts: hugs, Big Bangs, highest Humlet reached, how long the run lasted | With a score | To check the score is possible, and to count Big Bangs for the live world number |
| The Humlet you chose and your Crest pattern | With a score, a crew join, a planet you conquered | So your row and your planet marker look like you |
| Your crew id, if you are in a crew | With a score | So the crew's weekly goal counts your play |
| Which planets you have conquered | When you conquer one | So other players see that somebody stood there |
| Counting events, with no id attached | Batched every 30 seconds or so | See section 7 |
| Purchase receipts | Only when you buy something | See section 9 |
That is the list. Not on it, and never sent: your location, your contacts, your photos, your calendar, your microphone, your other apps, your browsing, your advertising id, or anything you typed (because you cannot type).
Everything else, which is most of the game, stays on your device: your whole save file, your Humlet collection, your Stardust, your Journey stars, your Garden, your streak, your settings, your purchase history and the queue of things waiting to be sent when you get signal.
Our servers see your internet address, because every connection on the internet carries one. Cloudflare uses it to deliver the response and to stop abuse. We do not write it into any game record, we do not keep a log of it beside your player id, and we do not use it to work out where you are.
7. Gameplay counters, and why there is no analytics company here
The game sends small counting events, like "a run started" or "a Big Bang happened", to our own server. They arrive in batches. Before they leave your device the code strips out anything that looks like an id or a name.
On the server they are added into a daily total per event name and the individual messages are thrown away. So the server ends the day knowing "there were 41,208 Big Bangs" and knowing nothing at all about who had them. There is no per player event table in our backend, by design.
There is no third party analytics kit in the game itself. No Firebase Analytics, no Amplitude, no Mixpanel, no crash reporter, nothing. The store consoles (App Store Connect, Google Play Console, Steamworks) give us their own aggregate numbers about installs and crashes, and those are Apple's, Google's and Valve's own reporting about their own platforms, not something we added.
8. We never ask for your location
Planet Plink does not request location permission, does not read your device's location, and has no feature that uses it.
One honest caveat. If you choose to watch a rewarded video, the ad network (Google AdMob, section 10) estimates a general area from the internet address the request arrives on, the way any website can. It is not your device's location, we do not receive it, and it is not stored by us. If you never watch an ad, this does not happen at all.
9. Purchases
You can play the whole game without spending anything.
If you do buy something, the payment is handled entirely by the store you bought from: Apple on iPhone and iPad, Google on Android, Valve on Steam. They take the payment and they are the merchant on your receipt. We never see your card number, your bank details, your billing address or your store account.
We use RevenueCat to check that a receipt is genuine and to remember what you are entitled to (for example No Ads, or a Star Pass) so it survives reinstalling the game. RevenueCat receives the receipt and your player id. It does not receive your payment details, because the store does not give them out.
Nothing in the shop uses randomness. Every purchase shows exactly what you get before you buy it. There are no loot boxes in Planet Plink.
10. Ads, and the fact that they never follow you
There are no ads unless you ask for one.
The main kind is a rewarded video: you tap a button that says what you get, you watch, you get it. We also reserve at most one full screen ad per session, on the way back to Home after a finished run, and never during play, never on a losing screen, and never in your first two sessions. Buying No Ads removes that one. Rewarded videos stay available if you want them, because they are a benefit rather than a nuisance.
Ads are served by Google AdMob. Every ad request we make is configured for non personalized ads, which means the ad is chosen from the content around it and not from a profile of you. We set the child treatment signal on every request, we never transmit an advertising identifier, and we never show Apple's tracking permission prompt, because we do not track anyone across apps or websites. There is nothing we would do with that permission.
Google still processes the request in order to serve an ad. What it uses for that is described in Google's own documentation and in our data map, and the short version is: the request itself, a general area from the internet address, and how you interacted with the ad.
11. Notifications
If you allow them, the game can remind you that your Daily Drop is ready, that your streak is at risk, or that your Garden is full. At most one a day.
These are local notifications. Your own device schedules them and shows them. There is no push server, we send nothing to your device, and we do not learn whether you saw one or tapped it. Turning them off in your device settings ends them completely.
We ask for permission only after your second session ends, and only once.
12. How long we keep things
| What | How long |
|---|---|
| Daily and weekly leaderboards | 45 days, then the whole board is deleted automatically |
| All time leaderboard | Kept while the game runs, one best score per player id |
| Crews and leagues | Per week. A week's standings and progress are replaced by the next week's |
| Duels | 14 days from creation, then deleted automatically |
| Planet conquest markers and monument names | Kept while the game runs, because the point of them is that they are permanent |
| Inbox items | Until claimed, then removed |
| Purchase entitlements at RevenueCat | While you hold them, so a reinstall can restore them |
| Daily counting totals | Aggregates with nobody in them. Kept as history |
| Your save file | On your device, until you delete it or reset the game |
13. Deleting your data
Two routes, and both work without an account.
On your device. Settings has a reset. It wipes the save file: your player id, your collection, your Stardust, your stars, your Garden, your streak and your settings. It cannot be undone and there is a confirmation before it happens. Deleting the app does the same thing on iPhone, iPad and Android.
On our servers. Write to hello@planetplink.com with your player id, which Settings shows and can copy. We delete every row that carries it: leaderboard entries, crew membership, league standings, duels, inbox items and planet markers. We confirm when it is done. We do not ask you for anything else to prove it is yours, because there is nothing else to ask for. Aggregate daily counters cannot be unpicked and contain nobody, so they are not affected.
If you have already reset the device and lost the id, tell us and we will explain what we can and cannot find, which is honestly not much: without the id there is no way to locate rows that carry no other identifier.
14. Children
Planet Plink is made for everybody, and we expect children to play it. That shapes the whole build.
For every player, whatever their age: no accounts, no personal information, no free text, no chat, no photos, no location, no personalized ads, no advertising identifier, no tracking prompt, and only ad software that Google has certified for family apps.
We do this for everyone rather than only for children, because the alternative is asking every player how old they are in order to decide how carefully to treat them, and we would rather treat everyone carefully and ask nothing.
Purchases and children. Every purchase goes through the store's own payment sheet, which is where Apple's, Google's and Valve's family controls live: ask to buy, spending limits, purchase approval. Settings also has a Purchases off switch inside the game. Nothing in the game uses a countdown timer over a buy button, and no offer appears in a first session.
For parents. You have the right to know what we hold about your child, to get a copy, and to have it deleted, and you do not need to prove an account exists to exercise it. Write to hello@planetplink.com. In practice what we hold is a random id, a made up name, some scores and a chosen character, and we will show you exactly that.
United States. Where the Children's Online Privacy Protection Act applies, our position is that the only persistent identifier we use is generated on the device, is used to support the internal operations of the game (keeping one leaderboard row per player, delivering the game features the player asked for, security and rate limiting), and is not used for behavioural advertising or shared for it.
Europe and the United Kingdom. The age of digital consent runs from 13 to 16 depending on the country. We do not rely on a child's consent for anything, because we do not process personal data on the basis of consent (section 16). The UK Children's Code applies to services likely to be accessed by children, and its central requirement is high privacy by default, no nudges toward giving up data, and no profiling by default. We meet it by not collecting the data in the first place.
15. Where your data goes
Our servers run on Cloudflare's global network, which means a request is answered by whichever of its locations is nearest to you. Data may therefore be processed in the United States and in other countries.
Our processors (Cloudflare, RevenueCat, Google) are United States companies. Where we send personal data out of the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, which are part of the agreements we hold with each of them.
16. Your rights, and the legal bases
If the UK GDPR or the EU GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to complain to your data protection regulator (in the UK, the Information Commissioner's Office).
Our legal bases:
| What we do | Basis |
|---|---|
| Run the game you asked for, including leaderboards, crews, duels and the save file | Performance of a contract (Article 6(1)(b)) |
| Stop cheating, spam and abuse, and keep the service up | Legitimate interests (Article 6(1)(f)) |
| Count aggregate gameplay so we can improve the game | Legitimate interests (Article 6(1)(f)), on data that has nobody in it |
| Serve a rewarded video you asked to watch | Performance of a contract for the reward, and Google's own basis for the ad request |
| Validate a purchase receipt | Performance of a contract and legal obligation (tax and records) |
| Show you a local reminder | Consent, which is the device permission, withdrawable in device settings |
We do not rely on consent for anything except notifications, and we do not use automated decision making that has legal effects on you.
If you are in California, you have the right to know what we collect and why, to get a copy, to have it deleted, to correct it, and not to be discriminated against for asking. Write to hello@planetplink.com.
We do not sell your personal information and we do not share it for cross context behavioural advertising. There is nothing to opt out of, and that is why you will not find a "Do Not Sell or Share My Personal Information" link: the honest version of that link would say "we do not". If you want it in writing anyway, this sentence is it. We do not knowingly sell or share the personal information of anyone under 16 for any purpose, and running every ad request non personalized is the mechanism that makes that true rather than a promise.
17. Security
Everything that leaves your device travels over HTTPS. The app talks to our own domain and to the stores' and ad network's own domains, and nothing else: a content security policy on our server blocks any other destination.
There is no database of people to breach. The worst case is a list of random ids, made up names and scores, which is the reason the architecture is shaped this way.
18. Changes
If we change this policy we will change the date at the top, and if the change is material (a new vendor, a new kind of data, a new purpose) we will say so in the game before it takes effect.
19. Contact
hello@planetplink.com
[Company Legal Name], [Address]
Support: hello@planetplink.com. If you would rather not email, the Settings screen has a support link.
Review statusNothing hidden
What is still open, quoted rather than summarised.
This policy is drafted and has not yet been through legal review. The source document carries seven notes marked "review with counsel". They are questions for a lawyer, not notice to a player, so they are not woven into the policy above. They are reproduced here word for word instead, because quietly dropping them would be the dishonest way to publish a privacy policy. The operating entity and its address are also still placeholders.
- Section 1, who we areWhether an EU or UK representative under GDPR Article 27 and UK GDPR is required, and if so who is appointed and where they are named in this document. Whether a Data Protection Officer is required (we do not believe one is: no large-scale profiling, no special category data, no systematic monitoring).
- Section 7, countersIf a mobile measurement partner or a crash reporter is ever added to the native shell for paid marketing, this section, section 6, the store disclosures and the data map all change in the same release. That is an obligation, not a nicety.
- Section 12, retentionThe amended COPPA Rule requires a written, published data retention policy for children's personal information, including that information is kept no longer than reasonably necessary and is not kept indefinitely. That table is that policy, and the two "kept while the game runs" rows are the ones counsel needs to look at hardest, because "permanent by design" and "no longer than necessary" have to be reconciled in writing. Our position is that a conquest marker (a generated name, a Crest pattern and a character choice) is the record of a game event rather than information about a person, and that the retention is what the player asked for when they conquered the planet. That position needs signing off, and if it does not hold, the fix is a fixed window (for example 24 months) with an in game notice.
- Section 13, deletionA build gap worth naming: today the reset covers the device and the server route is a support email, not a button. Google Play's Data safety form asks whether we provide a way for users to request deletion, and the honest answer with a support route is yes. An in game control that calls a server delete endpoint would be better and is already assigned. Section 13 must be rewritten the day that ships.
- Section 14, children (United States)That characterisation is the single most important legal question in this document. If counsel concludes that a public leaderboard row keyed to a persistent identifier is outside the internal operations exception, the answer is not a longer policy, it is a design change: leaderboard submission becomes opt in, or off by default for players the platform tells us are under 13.
- Section 15, transfersThe transfer basis for each vendor, whether a transfer impact assessment is needed, and whether the EU-US Data Privacy Framework certification of any vendor can be relied on instead.
- Section 16, CaliforniaWhether "share" as defined by the CCPA as amended reaches a non personalized ad request to Google, and whether the Global Privacy Control signal must be honoured on the web build even though there is nothing to sell. Our reading is that a non personalized request is not cross context behavioural advertising, and that the safest posture is to honour the signal anyway by disabling ads entirely for that visitor.
Related pages: how to delete your data, whether it is safe for a child, and the terms of use.