Privacy Policy

This policy covers the website tyttoot.com (including games played at tyttoot.com/play/), tyttoot accounts, and every app and game we publish on the App Store, Mac App Store and Google Play under the developer names "tyttoot" and "trochoicodien". We collect as little as we can, we never sell personal information, and you can export or delete your account data yourself at any time.

Who is responsible

TYTTOOT Co., Ltd (business registration 0318064799, Ho Chi Minh City, Vietnam), 151/53/7/13 Lien Khu 4-5 Street, Binh Hung Hoa B Ward, Binh Tan District, Ho Chi Minh City, Vietnam. Privacy contact: privacy@tyttoot.com or the contact form. We answer privacy requests within 30 days.

Using the website without an account

You can read every page and play every web game without an account.

No tracking cookies by default. The site sets no cookie until you sign in. Favorites, recently viewed games, display mode and your cookie choices are stored in your browser's local storage and never leave your device unless you sign in (then favorites and recent games sync to your account).
Page counter. After a page has been visible for a moment, your browser tells us the page path and site language. We add one to a daily total for that page. We do not store your IP address, a cookie or any identifier with it. The counter is not sent at all if your browser sends Global Privacy Control or Do Not Track, or if you turn analytics off in Cookie settings.
Server logs. Our host records technical request data (IP address, browser, time, requested URL) for security and troubleshooting, and deletes it on its normal log rotation.
Videos. YouTube videos are shown as a picture first. Nothing is loaded from YouTube until you press play; the player then loads from youtube-nocookie.com under Google's privacy policy.
Web games save progress and settings in your browser. A game with an online leaderboard only sends a score if you choose a nickname (see below).

tyttoot accounts

An account is optional. It lets you sync favorites, rate and comment, collect points and link your game progress. When you create one we process:

Sign-in details: your email address (stored encrypted), a password hash (never the password itself) or the identifier returned by Google or Apple if you sign in with them, and, if you enable it, your two-step verification secret (stored encrypted) and recovery codes (stored as hashes).
Profile: handle, display name, optional short bio and language. Your public profile at /u/handle can be hidden in Account settings.
Birth year: asked once to apply our age rules. We do not ask for your full date of birth.
Sessions: a random session token in the tyt_sid cookie; on our side we keep only a hash of it, the time it was created and last used, a shortened browser description and a keyed hash of the IP address (not the address itself), so you can review and sign out devices.
Activity you create: ratings, comments, reports, people you block, support messages, points history, rewards you redeem, notifications and moderation decisions about your account.
Consents: which version of the terms and privacy policy you accepted and when.

We use this data to run your account, show your contributions, keep the community safe (spam and abuse prevention, moderation, appeals), answer your messages, and send account emails such as verification, password reset and deletion confirmation. We do not send marketing email.

Children

Anyone can play and read without an account. Accounts, comments, ratings and points require age 13 or older; if the birth year shows a younger age, no account is created and nothing is stored. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to privacy@tyttoot.com and we will delete it.

Games and online leaderboards

Nickname and scores (optional). If you enter a nickname to appear on a leaderboard, we store the nickname, your scores, the game and mode, and a random player token kept on your device. We never ask for your name, email or phone number for this. Leaderboards list scores submitted by real players only; your nickname is never reused for computer-controlled opponents.
Usage counters. Games and apps tell us when they are opened, how many seconds they were on screen, when a round ends, and when an ad was shown or tapped, together with the game and platform (web, iPhone/iPad, Mac or Android). We add these to daily totals per game. No player token, device identifier or IP address is stored with them.
Contact from inside a game. If you send a message from a game's help screen, we receive what you type (name and email are optional), the game, its version, the platform and your language, and handle it like any other support request.
Linking a game to your account (optional). A game can show a short one-time code that you enter in your account to connect that game's player to it. You can see linked games in your data export.
Game progress stays on your device unless a game clearly offers cloud sync through your account.

Apps from the App Store, Mac App Store and Google Play

Many of our apps show ads served by Google AdMob (Google LLC). The Google Mobile Ads SDK may collect and share with Google: device or advertising identifiers (the Apple IDFA only if you allow tracking), IP address and approximate location derived from it, device and app information, and interactions with ads plus diagnostic data. Google uses this to deliver and measure ads, limit repetition and prevent fraud. Learn more in How Google uses information from sites or apps that use its services.

Your choices: on iPhone, iPad and Mac our apps ask through Apple's App Tracking Transparency prompt; if you choose "Ask App Not to Track" you see non-personalised ads. You can change this in Settings > Privacy & Security > Tracking. On other devices, use the system's ad settings to reset your advertising ID or opt out of personalised ads.

Our apps do not collect your precise location, contacts, photos, files, microphone or camera recordings, or payment card numbers. When a feature needs a device permission (for example the camera for text recognition), the app asks first and processes the data on the device for that feature only.

Purchases in apps are processed by the app store; we receive only confirmation of what was bought, not your payment details.

Advertising on the website

If ads are shown on tyttoot.com, they are served by Google AdSense and only in marked ad spaces. Before any ad loads, the cookie bar lets you choose personalised or non-personalised ads; you can change your choice any time in Cookie settings at the bottom of every page. Account pages and the console never show ads.

Who processes data for us

Hostinger (web hosting, database and email delivery) stores the website, the account database and our mailboxes.
Google processes data when you choose Sign in with Google, when an app shows AdMob ads, when website ads are enabled, and when you play a YouTube video.
Apple processes data when you choose Sign in with Apple and for App Store downloads and purchases.
App stores process downloads, purchases, reviews and crash reports under their own policies.
Authorities, only when the law requires it.

We do not sell or rent personal information and we do not share it with data brokers. Providers may process data outside your country; we rely on their contractual safeguards for these transfers.

How long we keep data

Account data: until you delete the account. Deletion is immediate: your email, password, sign-in links, settings, notifications and ratings are erased, comments are removed, game players are unlinked and renamed, and your profile becomes "Deleted user". A numeric record without personal data remains so that points history and moderation records stay consistent.
Sessions: deleted 7 days after they expire or are signed out (sessions last 30 days from last use).
Security and audit log: 400 days, with hashed IP addresses only.
Support tickets: deleted 2 years after the ticket is closed.
Reports: deleted 2 years after they are resolved.
Page counts: daily totals per page, with no personal data, kept for statistics.
Backups: our host's backups are overwritten on its regular rotation.

Your rights

Depending on where you live (for example under the EU/UK GDPR, Vietnam's Decree 13/2023 on personal data protection, or US state privacy laws) you may have the right to access, correct, export, restrict or delete your data, to object to processing and to withdraw consent. You can do most of this yourself:

Export: Account > Data > Download my data gives you a JSON file with everything we hold about your account.
Correct: edit your profile, email and settings in Account.
Delete: Account > Data > Delete account, or follow the steps on Delete your account.
Anything else: write to privacy@tyttoot.com. You may also complain to your local data protection authority.

Legal bases

We process account data to provide the service you asked for (contract), keep the platform secure and prevent abuse (legitimate interests), meet legal obligations, and — for optional personalised advertising — with your consent, which you can withdraw at any time.

Security

All traffic uses HTTPS. Email addresses are encrypted at rest, passwords are stored as slow one-way hashes, session tokens and IP addresses are stored only as keyed hashes, and you can turn on two-step verification. Staff access to the console requires two-step verification and is logged.

Changes

When this policy changes we update the date at the top. For important changes we also show a notice on the site before the change takes effect.