Privacy policy

Who we are

Pawpon is made and published by Ludilume, the studio name of Talha Abid, an independent developer based in Pakistan ("we", "us"). Ludilume is the developer name shown on Google Play. We are responsible for the personal data described in this policy. If you have a question about it, or want to use any of your rights, write to talhaabidj1@gmail.com. A real person reads every message.

This policy covers the Pawpon app on Google Play (package com.pawpon) and this website. The services we rely on are listed in Who receives data, and each has its own privacy policy as well.

Your Pawpon account and cloud save

From version 1.1.1, Pawpon asks you to sign in when it starts, in one of three ways: as a guest (no details at all), with an email address and password, or with Google Play Games. Accounts are provided by Google Firebase (Firebase Authentication and Cloud Firestore), which processes this data on our behalf under Firebase's privacy and security terms. We store:

• an account ID, a random identifier Firebase creates for you. It is also the ID our purchase provider uses (see Purchases), so what you buy belongs to your account;
• your email address, only if you sign in with one or bind one to a guest account, and whether you have confirmed it. Your password is held by Firebase in a one-way hashed form; we never see it;
• your Play Games player ID and name, only if you sign in with Play Games;
• a copy of your game (your cats, currencies, progress and settings), with its version and when it was last saved, a count of nights and cats for the choice screen when two phones disagree, and a random ID for the phone that saved it.

We use this to sign you in, to keep your game safe across phones and reinstalls, to tie your purchases to your account, and to stop the same purchase or code being claimed twice. The cloud copy is stored in the United States. Only you can read or change your own copy; nobody else can list or open another player's save.

If you play as a guest, your game is only as safe as the phone: a guest cannot sign back in after clearing the app or changing phones. The game offers to bind an email to a guest account, and asks before a guest buys anything.

What stays on your device

Pawpon is a single-player game. As well as the cloud copy above, your game is stored in the app's private storage on your phone:

• your collection, shelves, currencies and purchase history as the game sees it;
• your settings, tutorial progress and story progress;
• a short on-device log of recent gameplay events and technical diagnostics, used by in-game readouts and to help you describe a problem if you contact us.

Apart from the cloud copy of your game, none of this is transmitted to us. The game also remembers your sign-in on the phone so you stay signed in; that is not included in Android backup. The game contains an analytics module that is switched off and has no server to send to; if that ever changes, this policy will change first and you will be asked.

Android backup. If backup is turned on for your Google account, Android may include Pawpon's save file in your device backup, so your progress can come back when you set up a new phone. That backup is stored by Google under your Google account and Google's privacy policy. We cannot see it. You can turn backup off in your phone's settings.

Purchases

Pawpon is free to play. It sells a small number of optional in-app items, such as the Nightlight Pass and packs of Star Gems, Moon Dust and Whisper Coins. Every payment is processed by Google Play. We never see or store your card or bank details.

To confirm purchases, deliver them and let you restore the Nightlight Pass on a new phone, the app uses RevenueCat, Inc. as our service provider. When the app starts, when the store opens and when you buy or restore something, the app sends RevenueCat:

• your Pawpon account ID (see Your Pawpon account), a random identifier. It is not your name, email or Google account;
• purchase records: which product, the Google Play purchase token and order ID, the price, currency and time;
• basic device and app details that come with any request: device model, Android version, app version, language and country setting, and your IP address, which RevenueCat uses to connect and to work out regional pricing.

We use this to deliver what you paid for, to prevent fraud and duplicate grants, to handle refunds, to answer support requests and to see overall sales figures. RevenueCat processes it on our behalf under its privacy policy. Google keeps its own record of your order under its privacy policy.

Google Play Games

Pawpon supports Google Play Games Services for a player profile, leaderboards and achievements, and as one of the ways to sign in to your Pawpon account. The game is fully playable without it: you can sign in with an email address or play as a guest instead.

If you use Play Games on your phone, Google may sign you in automatically when the game starts. That is a Play Games feature, and you control it in the Play Games app. When you are signed in, Google gives the app your Play Games player ID, display name and avatar so it can show your profile, and the app may send Google your scores and achievements. Other players may then see your Play Games name and score on a leaderboard.

We do not receive your Google account email or password. If you choose Play Games as your way to sign in to Pawpon, your Play Games player ID and name are stored with your Pawpon account (see Your Pawpon account); otherwise we store no Play Games details on any server of ours. Play Games data is held by Google under Google's privacy policy; you can change your visibility, sign out or delete it in the Play Games app or your Google Account.

Optional rewarded ads

We are introducing optional rewarded ads, which we call Catvertising: short videos you can choose to watch for a small bonus, such as an extra token. They never play on their own and never interrupt a pull or a purchase. If your version of Pawpon does not show these offers, the ad service is not active and this section does not apply to you.

When they are available, ads are served by Google AdMob (Google LLC, or Google Ireland Limited in the EEA and UK). When the ad service starts and when an ad loads or plays, Google's software on your phone collects:

• your device's advertising ID, which you can reset or delete at any time in Android settings;
• your IP address, from which an approximate location can be worked out;
• device and app information, such as model, operating system, language and app version;
• ad interactions: which ads were shown, whether they were watched to the end or tapped.

Google uses this to deliver and measure ads and to prevent fraud, and, where the law allows and you have agreed, to personalise ads. Google explains how at How Google uses information from sites or apps that use its services.

• Your choice in Europe. In the EEA, the UK and Switzerland, the game shows Google's consent form before any ad is requested, and you can decide whether ads may be personalised. You can change your answer later from the ad privacy option in the game's settings.
• Everywhere else, you can stop personalised ads by deleting or resetting your advertising ID in Android settings (Settings, then Privacy, then Ads).
• Suitable for teens. Pawpon asks Google to show only ads rated suitable for teenagers and older.

To make sure a reward is only given once, Google tells RevenueCat when an ad has been watched to the end, together with the account ID described under Purchases and which reward it was. Nothing else about you is added.

The update check

Recent versions of the game look at a tiny file on this website when they start, to find out whether a newer version is available on Google Play and whether yours is too old to keep playing safely. The request contains nothing about you. Like any web request, it reaches GitHub, which hosts this site, with your IP address and a basic description of the app making the request. We do not receive or keep those details. See This website.

When you contact us

If you email us, we receive your email address and whatever you choose to write, attach or include, such as your phone model or a screenshot. We use it only to answer you and fix the problem, and we keep it for as long as that takes, plus a reasonable time in case you write back. Please do not send passwords or payment card numbers; we will never ask for them.

Our community lives on Discord, which is run by Discord Inc. under its own privacy policy. What you post there is visible to other members of the server.

This website

This website is a set of static pages hosted by GitHub Pages. It sets no cookies, uses no analytics or advertising tags and loads its fonts and images from this same site, so no third party is told that you visited. GitHub receives your IP address in order to deliver the pages and may keep it in server logs for security, under the GitHub General Privacy Statement.

The cabinet on our home page remembers which cats you have found using your browser's local storage. That record never leaves your browser and you can clear it with your browser's site data.

What we do not do

• We do not sell personal data, and we do not share it with data brokers.
• We do not collect your name, email address (unless you write to us), contacts, photos, files, precise location, microphone or camera.
• We do not use your data to decide anything automatically that has legal or similarly significant effects on you.
• We do not ask for any Android permission beyond what the features above need: internet access, the Google Play billing permission, vibration for haptic feedback and, in builds with ads, the advertising ID permission.

Who receives data

We may also disclose information if the law requires it, to protect players or our rights, or to a buyer if the game is ever sold, in which case this policy continues to apply to the data transferred.

Our legal bases

If you live in the European Economic Area, the United Kingdom or another place with similar law, we rely on these legal bases:

• Performing our contract with you: processing purchases and restoring what you bought.
• Our legitimate interests: preventing fraud and duplicate rewards, keeping the game secure and up to date, answering your messages and understanding overall sales. We keep these uses narrow, and you can object to them.
• Your consent: personalised advertising, where the law requires consent. You can withdraw it at any time.
• Legal obligations: keeping records of transactions where tax or consumer law requires it.

International transfers

We are based in Pakistan, and our service providers operate in the United States and other countries. When personal data from the EEA, UK or Switzerland is transferred, those providers rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep data

How to ask for deletion, and what happens when you do, is set out step by step on Delete your data.

Your rights

Depending on where you live, you have the right to ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. Residents of California and other US states have similar rights to know, delete and correct, and the right not to be discriminated against for using them. We do not sell personal information, and we do not share it for cross-context behavioural advertising except through Google's personalised ads as described above, which you can switch off.

To use any of these rights, email talhaabidj1@gmail.com. Because we do not know your name, it helps to include your Google Play order number (it starts with GPA and is in your purchase receipt email) or your phone model and roughly when you bought something, so we can find the right anonymous record. We will reply within 30 days.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to your local data protection authority.

Children and teenagers

Pawpon is made for players aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has sent us personal data, for example by email, contact us and we will delete it.

For players under 18, purchases go through Google Play, where parents can require approval for every purchase with Google Family Link or purchase authentication settings. Ads, where offered, are limited to content suitable for teens.

Security

Everything the app sends travels over encrypted HTTPS connections. Your save file sits in the app's private storage, which other apps cannot read. No system is perfectly secure, but we keep the data we handle to the minimum the game needs, which is the best protection there is.

Changes to this policy

If the game starts handling data differently, for example by switching on a new service, we will update this policy before that version is released and change the date at the top. If a change is significant, we will also say so in the game or in its release notes. Earlier versions are available on request.

Contact

Ludilume (Talha Abid)
Email: talhaabidj1@gmail.com
Website: https://pawpon.pages.dev

Thank you for reading this far. Most people don't.