Winterloon: Privacy Policy

Last updated: September 4, 2026

Winterloon uses three services, described plainly below: our own anonymous usage statistics, optional rewarded ads (Google AdMob) that only ever play when you choose to watch one, and our own game service, which gives your install an anonymous account, keeps a copy of your progress for achievements and the leaderboards, and carries co-op matches when you play with a friend over the internet. If you buy one of the game’s two one-time purchases, the payment itself is handled by Google Play or the App Store and never by us. There are no other SDKs, trackers, or data recipients.

You never sign up for anything, and we never ask for your name, email or any other identifying detail. The account is a random identifier your device makes for itself.

Anonymous usage statistics (first-party)

With “Share anonymous stats” enabled (it is on by default), the game sends us a stream of gameplay events. This is the whole of it:

• Sessions: when the app is opened, when a session starts, and when you put the game in the background (with how long that stretch in the foreground lasted, and which screen you were on when you left). The first event of a session carries a little context with it: how far you have got (levels cleared, snowflakes banked), how long you had been away, how long the game took to load, your device’s language (never its region), whether notifications are permitted, and a count of any events the game had to drop while you were offline. After an update, we also record which version you came from.
  
  The app-opened event is recorded before the game finishes loading, on purpose: it is the only way we can tell that a launch failed partway, rather than that nobody opened the game at all.
• How well the game ran: when you put the game in the background, a summary of how smoothly that stretch played: an average and a worst-fifth-percentile frame rate, the longest single frame, and a count of the frames slow enough to feel like a stutter. It is four numbers about the app’s own performance on your device, gathered from the game’s own drawing loop. The model and graphics-chip names that let us read those numbers against the hardware they happen on ride every event and are described under “Each event is tagged” below; beyond those two names we do not read your memory, your storage, serial numbers, or anything else about your hardware.
• Match starts: when you begin a board, in every mode: which board, which mode, the difficulty, and how many times you have started that same board without yet beating it. That last number resets as soon as you clear it. Together with the results below it lets us see a board people start and give up on, which a finished-match record cannot show.
• Match results: every match you finish, in every mode: campaign nodes, versus, trials, Deep Winter and co-op. A result says which board and mode it was, the difficulty, whether you held the larder, how many waves you played of how many, how much of the larder survived (and its lowest point), how much gold you spent and had left, how many towers you built, how long the match ran, and which version of the game’s balance numbers you played against. Versus matches, Deep Winter runs and trials also report a short result of their own: the rival’s difficulty, the world and depth reached, which trial. A finished campaign, co-op or trial match sends the shape of it as well, wave by wave: how much of the larder was left, how much gold you had when you called, how many towers stood, and how much got past you: one number per wave, and nothing about where anything stood. A co-op match played with a friend over the network also records how it ended: that it played out, or that your partner left, or that the connection dropped or the two games fell out of step. Nothing about who your partner was.
• Matches you leave: when you quit a board before it finishes, the same details a finished match would have reported, taken wherever you stopped: which board and mode, the difficulty, how far into the wave table you got, what the larder and your gold were down to, how many towers stood, how long you had played, and how many times you had started that board without beating it. It also records whether you left through the pause menu or the board simply closed. It never records anything the finished-match record above would not have.
• Screens and settings: which screen you moved to and where you came from, and when you change a setting, which setting and its new value (game speed, text size, reduce motion, colour vision, volumes, mute, battery saver, reminders, cloud save).
• Friction: when the game refuses a tower placement, which tower you were placing and why it was refused. Where on the board you were aiming is deliberately not recorded.
• Ads: when the game offers you a rewarded ad, when you watch one through to the reward, and when you close one without taking it. Which offer it was, and nothing else. The offer is recorded once per offer type per session, so it counts that the choice was put in front of you rather than how often a button was on screen. If you have bought the ad-free upgrade, no offer is recorded, because you are never shown one.
• Cloud save and sign-in: whether a cloud backup succeeded or failed, and how a restore turned out (including whether the save came from a newer version of the game than the one you are running). A silent backup failure means someone believes their progress is safe when it is not, which is why both outcomes are recorded. We also record once, per install, that a platform sign-in succeeded. Never your account, your name, your email, or anything else about the identity you signed in with.
• Review prompts: that the game asked the store to show you a review prompt, and which moment prompted the ask. The store never tells us whether the prompt appeared or what you did with it, so that is all there is to record.
• Purchases: when a one-time purchase completes, which of the two products it was. Never the price, the order, or anything about how you paid, and restoring a purchase you already made sends nothing at all. See “One-time purchases” below.
• Diagnostics: if the game hits an error, the file name, line number, error message (shortened), and what kind of error it was, so we can fix crashes. Warnings are not reported, and the same fault repeating is sent once rather than over and over.

Almost none of this is anything you typed: the game has no chat and no free-text fields anywhere in play. The one exception is the optional leaderboard name described under “Ranked play” below.

Each event is tagged with a randomly generated install identifier, a per-session random identifier, and a random identifier for the event itself (so an event that has to be re-sent is never counted twice), plus the app version, the platform name (e.g. “android”), whether the build is a released one or a development one, which distribution channel the build came from (a testing track or the public store: a fact about the build, not about you), the model name of your device (for example “Pixel 9”), the name of its graphics chip, and a timestamp. The two hardware names exist so a frame-rate problem can be traced to the hardware it happens on, and so we can recognise the store’s own automated pre-release testing; they are shared by every device of the same model and identify neither you nor your individual device. The install identifier is minted on your device, is not derived from your device or any account, and is deleted when you uninstall the game.

We do not collect your name, email, contacts, precise or approximate location, advertising ID, or any file on your device, and our server does not log or store IP addresses. This data goes only to our own self-hosted service over an encrypted (HTTPS) connection, is used for aggregate analytics only (never for advertising, profiling, or any per-person decision), and is never shared with or sold to anyone.

• Turn it off: Settings → “Share anonymous stats”. Turning it off discards anything queued but not yet sent, and records that single decision (that stats were declined, and nothing else) before it stops. We keep that one record because a withdrawal we kept no trace of is one we cannot show we honoured, and because without it we cannot tell how many players a given number actually speaks for.
• Reset your identity: Settings → “Reset analytics ID” mints a fresh random identifier and discards anything still queued; data collected before the reset can no longer be associated with your device. One event (the reset itself) is sent under the old identifier immediately before the new one is minted, so that starting over is not counted as a brand-new install. It carries no gameplay data, and the old and new identifiers are never sent together.
• Deletion requests: email us (below) and we will delete the server-side data for the install identifier you reset or describe.
• In regions where an ads-consent form is shown (see below), declining consent also disables usage statistics, and is recorded in the same single-row way as opting out.

How the game closed last time

When the game opens, it asks the operating system how it closed the last time: whether it crashed, ran out of memory, or was simply closed by you, whether it was on your screen at the time, roughly how much memory it was using, when it happened, and which version of the game it was. We do this because a game that crashes cannot report its own crash, so the report has to come afterwards, from the system that watched it happen.

It is a single line about the app. It describes nothing you did, contains nothing about you, and is covered by the same opt-out as everything else on this page.

The session’s first event also carries two facts about the phone itself, and no more: roughly how much memory it has, and its operating system version. Those say which devices the game is too heavy for, and which ones can answer the question above at all. Neither is unique to you, and there are millions of phones that would answer both identically.

Your install's anonymous account

When the game first runs, it generates a random identifier for your install and registers it with our own game service (winterloon.ferkistudios.ca). This is what lets your achievements and leaderboard entries belong to you across sessions without you ever making an account. It is not derived from your device, your hardware, or any account you hold anywhere; it is a random number, and a fresh install makes a fresh one.

Alongside it we keep a copy of your progress summary so achievements can be awarded and so a leaderboard entry can show what it belongs to: how many levels you have cleared, how many were perfect clears, your snowflake and lantern totals, your versus wins, your best Deep Winter depth, how many trials you have cleared, your Hearth ranks, and the app version. It contains no gameplay recording and nothing you typed.

This happens without a separate opt-in, and we want to be plain about that. It is on whenever the game can reach the service. If you would rather it did not, play with the device offline, or write to us at the address below and we will delete everything held for your identifier.

Ranked play and the ladder

Off by default in the public release. Ranked play is a setting you turn on yourself (Settings → “Ranked play”), and until you do, nothing in this section happens.

If you are a Winterloon tester, read this instead. Test builds (the ones handed out through the Google Play internal test track or Apple TestFlight) ship with Ranked play already on, so match recordings are uploaded from the first game you finish rather than after you opt in. We do this because tuning a tower-defence game needs real games played by real people on real phones, and a test build’s whole purpose is to produce them.

Everything else in this section applies to you unchanged: the same recording, the same contents, the same deletion promise. You can turn it off at any time in Settings → “Ranked play” and we will stop, and your choice is remembered: turning it off is not undone by an update. To have what you already sent deleted, use the contact address below.

This applies to test builds only. The public release keeps the off-by-default behaviour described above.

With it on, finishing a ranked match uploads a recording of that match (the sequence of moves you made and the board you made them on, compressed) so our server can replay it and confirm the score is real. That is the whole reason it exists: a leaderboard nobody can verify is a leaderboard of whoever is best at editing save files. The recording holds no personal information; it is a list of game actions.

You may also claim a display name for the boards. This is the only text you can type into Winterloon, it is entirely optional, and whatever you enter is shown publicly to anyone viewing that leaderboard, so please do not put anything private in it. Ask us and we will remove it.

Playing with a friend over the internet

Co-op can be played with a real person over the internet. One of you creates a match and gets an invite code; the other types it in. While the match runs, our relay passes each side's game actions (towers placed, upgrades bought, waves called) and a short checksum used to confirm both devices agree on what happened.

There is no chat, no voice, and no messaging of any kind, and no way to send a friend anything but moves in a game of Winterloon. We do not keep the contents of a match after it ends. Your partner never learns anything about you beyond the display name you chose, if you chose one.

Playing co-op with the computer villager instead (which is what happens unless you deliberately start an online match) transmits nothing at all.

Rewarded ads (Google AdMob)

Winterloon shows ads only when you choose to watch one for an in-game reward (doubling the lanterns a trial, Deep Winter run, or versus win just paid). There are no banner ads, no interstitials, and no forced ads of any kind.

Ads are served by Google AdMob. When an ad is loaded or shown, Google may collect device information such as the advertising ID to serve and measure ads, as described in Google's Privacy Policy and how Google uses information from sites or apps that use its services. In regions where consent is required (for example the EEA and UK), a consent form is shown before any ad is loaded, and you can revisit your choices any time via Settings → “Ad privacy options”.

One-time purchases

Winterloon sells two things, both one-time, and neither of them is power: Keeper’s Lantern, which pays every lantern double out instantly and stops offering you ads anywhere in the game, and Warm the Hearth, a tip that puts a supporter’s mark on your results card. Every board is beatable without either, and nothing you can buy makes a tower stronger.

We never see how you paid. The purchase happens inside Google Play or the App Store: the card, the billing address, the store account and the receipt are theirs, and none of it is sent to us or passes through our servers. What the game learns is one fact (that this install owns that product), and it keeps that in the save file on your device.

Because the store remembers the purchase and we do not, Restore purchases in the Shop asks the store rather than us, and that is what carries a purchase to a new phone. It is also why a refund takes back what it bought: the game asks the store what you own and takes the answer.

If usage statistics are on, a completed purchase sends one event naming which product it was and nothing else: no price, no order number, no payment detail of any kind. With statistics off, nothing about purchases leaves your device.

Your store’s own handling of the transaction is covered by Google’s Privacy Policy or Apple’s Privacy Policy.

What the game never touches

• No names, email addresses, or accounts. Buying something uses your Google Play or App Store account, and we never see it.
• No location.
• No contacts, photos, files, microphone, or camera: the game never asks for those permissions.
• No chat, messages, voice, or free-text communication of any kind. The rival village in versus is always local AI. Co-op is local AI too unless you deliberately start an online match with an invite code, and even then the only thing that crosses the wire is the moves each side makes (see “Playing with a friend” above).
• No friend lists, contacts, or social graph. An invite code is typed in by hand and belongs to one match.

Local saves

Your game progress lives in a save file on your own device, and the file itself never leaves it: there is no cloud save, and uninstalling the app deletes it. Which of the two purchases you own is kept in that same file; it is not progress, and it is the store rather than the file that restores it on a new phone.

What does leave the device is the progress summary described above (counts and totals for achievements and the boards) and, only with ranked play switched on, the recordings of ranked matches. Neither is the save file, and neither can restore your game.

Children

The game collects the same minimal anonymous data from everyone, and our own data is never used for advertising or profiling. Ads only play when deliberately chosen from an end-of-run screen, and AdMob is configured to serve general-audiences ad content.

Changes

If a future update changes any of the above, this policy will be updated before that version ships, and the in-store data-safety section will be revised to match.

This policy was revised on August 23, 2026 for the same unreleased version the August 18 revision below describes, which also tags each event with the model name of the device it came from, the name of that device’s graphics chip, and the distribution channel the build came from. Written before that version ships rather than after it.

This policy was revised on August 18, 2026 for the next version, which records a match you leave before it finishes, and how a networked co-op match ended. Written before that version ships rather than after it.

This policy was revised on August 16, 2026 for version 0.9.3, which adds the app-opened event, match starts, ad offers, cloud save and sign-in outcomes, review prompts, and the summary of how smoothly the game ran. This revision was written and published alongside that version rather than after it, which the two revisions below were not.

The August 12, 2026 revision described the two one-time purchases and the per-wave shape of a finished match. Those shipped in version 0.8.0, on August 10, and this text did not describe them at the time; the revision is late, and is recorded as late rather than backdated. The August 1 revision was late in the same way: it described the game service, the verified leaderboards and online co-op, which had shipped in versions 0.6.2 and 0.6.3.