Winterloon: Privacy Policy

Last updated: August 1, 2026

Winterloon uses three services, described plainly below: our own anonymous usage statistics, optional rewarded ads (Google AdMob) that only ever play when you choose to watch one, and our own game service — which gives your install an anonymous account, keeps a copy of your progress for achievements and the leaderboards, and carries co-op matches when you play with a friend over the internet. There are no other SDKs, trackers, or data recipients.

You never sign up for anything, and we never ask for your name, email or any other identifying detail. The account is a random identifier your device makes for itself.

Anonymous usage statistics (first-party)

With “Share anonymous stats” enabled (it is on by default), the game sends us a stream of gameplay events. This is the whole of it:

• Sessions — when a session starts, and when you put the game in the background (with how long that stretch in the foreground lasted). The first event of a session carries a little context with it: how far you have got (levels cleared, snowflakes banked), how long you had been away, how long the game took to load, your device’s language (never its region), whether notifications are permitted, and a count of any events the game had to drop while you were offline. After an update, we also record which version you came from.
• Match results — every match you finish, in every mode: campaign nodes, versus, trials, Deep Winter and co-op. A result says which board and mode it was, the difficulty, whether you held the larder, how many waves you played of how many, how much of the larder survived (and its lowest point), how much gold you spent and had left, how many towers you built, how long the match ran, and which version of the game’s balance numbers you played against. Versus matches, Deep Winter runs and trials also report a short result of their own — the rival’s difficulty, the world and depth reached, which trial.
• Screens and settings — which screen you moved to and where you came from, and when you change a setting, which setting and its new value (game speed, text size, reduce motion, colour vision, volumes, mute, battery saver, reminders, cloud save).
• Friction — when the game refuses a tower placement, which tower you were placing and why it was refused. Where on the board you were aiming is deliberately not recorded.
• Ads — when you watch a rewarded ad through to the reward, and when you close one without taking it. Which offer it was, and nothing else.
• Diagnostics — if a script error occurs, the file name, line number, and error message (shortened), so we can fix crashes.

Almost none of this is anything you typed: the game has no chat and no free-text fields anywhere in play. The one exception is the optional leaderboard name described under “Ranked play” below.

Each event is tagged with a randomly generated install identifier, a per-session random identifier, and a random identifier for the event itself (so an event that has to be re-sent is never counted twice), plus the app version, the platform name (e.g. “android”), whether the build is a released one or a development one, and a timestamp. The install identifier is minted on your device, is not derived from your device or any account, and is deleted when you uninstall the game.

We do not collect your name, email, contacts, precise or approximate location, advertising ID, or any file on your device, and our server does not log or store IP addresses. This data goes only to our own self-hosted service over an encrypted (HTTPS) connection, is used for aggregate analytics only — never for advertising, profiling, or any per-person decision — and is never shared with or sold to anyone.

• Turn it off: Settings → “Share anonymous stats”. Turning it off discards anything queued but not yet sent, and records that single decision — that stats were declined, and nothing else — before it stops. We keep that one record because a withdrawal we kept no trace of is one we cannot show we honoured, and because without it we cannot tell how many players a given number actually speaks for.
• Reset your identity: Settings → “Reset analytics ID” mints a fresh random identifier and discards anything still queued; data collected before the reset can no longer be associated with your device. One event — the reset itself — is sent under the old identifier immediately before the new one is minted, so that starting over is not counted as a brand-new install. It carries no gameplay data, and the old and new identifiers are never sent together.
• Deletion requests: email us (below) and we will delete the server-side data for the install identifier you reset or describe.
• In regions where an ads-consent form is shown (see below), declining consent also disables usage statistics, and is recorded in the same single-row way as opting out.

Your install's anonymous account

When the game first runs, it generates a random identifier for your install and registers it with our own game service (winterloon.ferkistudios.ca). This is what lets your achievements and leaderboard entries belong to you across sessions without you ever making an account. It is not derived from your device, your hardware, or any account you hold anywhere; it is a random number, and a fresh install makes a fresh one.

Alongside it we keep a copy of your progress summary so achievements can be awarded and so a leaderboard entry can show what it belongs to: how many levels you have cleared, how many were perfect clears, your snowflake and lantern totals, your versus wins, your best Deep Winter depth, how many trials you have cleared, your Hearth ranks, and the app version. It contains no gameplay recording and nothing you typed.

This happens without a separate opt-in, and we want to be plain about that. It is on whenever the game can reach the service. If you would rather it did not, play with the device offline, or write to us at the address below and we will delete everything held for your identifier.

Ranked play and the ladder

Off by default in the public release. Ranked play is a setting you turn on yourself (Settings → “Ranked play”), and until you do, nothing in this section happens.

If you are a Winterloon tester, read this instead. Test builds — the ones handed out through the Google Play internal test track or Apple TestFlight — ship with Ranked play already on, so match recordings are uploaded from the first game you finish rather than after you opt in. We do this because tuning a tower-defence game needs real games played by real people on real phones, and a test build’s whole purpose is to produce them.

Everything else in this section applies to you unchanged: the same recording, the same contents, the same deletion promise. You can turn it off at any time in Settings → “Ranked play” and we will stop, and your choice is remembered — turning it off is not undone by an update. To have what you already sent deleted, use the contact address below.

This applies to test builds only. The public release keeps the off-by-default behaviour described above.

With it on, finishing a ranked match uploads a recording of that match — the sequence of moves you made and the board you made them on, compressed — so our server can replay it and confirm the score is real. That is the whole reason it exists: a leaderboard nobody can verify is a leaderboard of whoever is best at editing save files. The recording holds no personal information; it is a list of game actions.

You may also claim a display name for the boards. This is the only text you can type into Winterloon, it is entirely optional, and whatever you enter is shown publicly to anyone viewing that leaderboard, so please do not put anything private in it. Ask us and we will remove it.

Playing with a friend over the internet

Co-op can be played with a real person over the internet. One of you creates a match and gets an invite code; the other types it in. While the match runs, our relay passes each side's game actions — towers placed, upgrades bought, waves called — and a short checksum used to confirm both devices agree on what happened.

There is no chat, no voice, and no messaging of any kind, and no way to send a friend anything but moves in a game of Winterloon. We do not keep the contents of a match after it ends. Your partner never learns anything about you beyond the display name you chose, if you chose one.

Playing co-op with the computer villager instead — which is what happens unless you deliberately start an online match — transmits nothing at all.

Rewarded ads (Google AdMob)

Winterloon shows ads only when you choose to watch one for an in-game reward (doubling the lanterns a trial, Deep Winter run, or versus win just paid). There are no banner ads, no interstitials, and no forced ads of any kind.

Ads are served by Google AdMob. When an ad is loaded or shown, Google may collect device information such as the advertising ID to serve and measure ads, as described in Google's Privacy Policy and how Google uses information from sites or apps that use its services. In regions where consent is required (for example the EEA and UK), a consent form is shown before any ad is loaded, and you can revisit your choices any time via Settings → “Ad privacy options”.

What the game never touches

• No names, email addresses, or accounts.
• No location.
• No contacts, photos, files, microphone, or camera — the game never asks for those permissions.
• No chat, messages, voice, or free-text communication of any kind. The rival village in versus is always local AI. Co-op is local AI too unless you deliberately start an online match with an invite code, and even then the only thing that crosses the wire is the moves each side makes — see “Playing with a friend” above.
• No friend lists, contacts, or social graph. An invite code is typed in by hand and belongs to one match.

Local saves

Your game progress lives in a save file on your own device, and the file itself never leaves it — there is no cloud save, and uninstalling the app deletes it.

What does leave the device is the progress summary described above (counts and totals for achievements and the boards) and, only with ranked play switched on, the recordings of ranked matches. Neither is the save file, and neither can restore your game.

Children

The game collects the same minimal anonymous data from everyone, and our own data is never used for advertising or profiling. Ads only play when deliberately chosen from an end-of-run screen, and AdMob is configured to serve general-audiences ad content.

Changes

If a future update changes any of the above (for example, adding in-app purchases or cloud saves), this policy will be updated before that version ships, and the in-store data-safety section will be revised to match.

This policy was revised on August 1, 2026 to describe the game service, the verified leaderboards and online co-op. Those shipped in versions 0.6.2 and 0.6.3 and this text did not describe them at the time — the revision is late, and is recorded as late rather than backdated.