Privacy policy
DRAFT for review by a lawyer. Not legal advice and not yet our final policy. Last updated 2026-10-30.
TOOY is a free game for everyone, including kids. We collect as little as we can and never sell data.
The short version
- No account is needed. We never ask for an email, phone number, real name, photo or birthday to play.
- Your profile (name, level, cosmetics, settings) lives in your browser.
- We count visits and matches anonymously so we know whether the game works.
- No third-party analytics, session recorders or advertising trackers for players under 13 or whose age we don’t know.
- There is no free-text chat.
What stays on your device
The game saves your profile in your browser’s local storage: the name you pick, a random player id, your level and points, the cosmetics you own and wear, your class and your settings. Clearing your browser’s site data deletes it.
What reaches our servers
Playing online
Your browser connects to our game server and sends your chosen name, your random player id, your look and class, your rating and your controls (movement, aim, shots) so the match can run. Other players in the match see your name, look and actions.
Leaderboard
For ranked play the server keeps your random player id, name, rating, wins and matches played. The leaderboard shows names and ratings.
Anonymous counts
The game sends simple counts: a random player id, a random id for this visit, which step happened (visit, match started, match finished, played again, still playing, first-time steps such as a first win) and seconds played. Test browsers never report. We use these counts only to improve the game.
Server logs
Our hosting providers (Vercel for the website, Cloudflare for the game server) process technical data such as IP addresses to deliver pages and stop abuse. We do not store IP addresses in our own database; rate limits use them only briefly in memory.
Ads
Before launch, ad spaces show labelled placeholders and send nothing anywhere. When real ads arrive, players under 13 or of unknown age will only ever see non-personalised ads, and we will update this page first.
Game portals
If you play TOOY on a game portal (such as Poki or CrazyGames), that portal’s own privacy policy also applies to what it collects.
Children
TOOY is made to be safe for children. We do not knowingly collect personal information from children. We only ask for an age at the moment a feature needs it, never on the first visit, and until then every player gets the protected settings. See Parents and safety.
How long we keep things
Leaderboard entries stay while they are active. Anonymous counts are kept as daily totals. Server logs are kept briefly by our providers.
Your choices
You can change your name at any time, clear your browser data to start fresh, or write to us at hello@tooy.io to have your leaderboard entry removed. Depending on where you live (for example under the GDPR, UK GDPR, CCPA or COPPA), you may have rights to access, correct or delete data. Write to us and we will help.