Privacy Policy

Controller: Pyxel Bytes (Biel Carpi)
Address: Avinguda de les Nacions Unides 40, Escaldes-Engordany, Andorra
Email: privacy@thejumpingdino.com
Terms of Service: https://thejumpingdino.com/terms

The Jumping Dino is a mobile runner game and website (the “Service”). This Privacy Policy explains what data we collect, why, how long we keep it, and your rights. By using the Service you agree to this Policy. If you do not agree, do not use the Service.

Brief summary (not legally binding): Mobile-app game data lives on your device by default unless you use connected features. On the website, every completed browser run is automatically published to the public score boards under a safe random dino name by default. You may edit that public name, so do not enter personal information you do not want to publish. If you sign in to the app, we sync your progress to our servers (Google Cloud). The free tier shows ads via LevelPlay (IronSource) ad mediation. We use your Advertising ID to maximize ad relevance and revenue. We use Firebase for authentication, analytics, and crash reporting. Purchases are managed through RevenueCat. We never sell your data. You can play without an account, remove ads with a purchase, or delete your account anytime.

1) Scope

This Policy applies to The Jumping Dino mobile app (iOS and Android) and website at thejumpingdino.com, including the web-based game at /play. It does not apply to third-party services linked from our Service (e.g., app stores, social media).

2) What We Collect

2A) Data You Provide

• Account info (optional): If you sign in via Apple or Google, we receive your name and email address. You can play the full game without ever signing in.
• Purchase receipts: When you make an in-app purchase (coin packs, ad removal, Gold Premium, or starter packs), Apple or Google sends us a receipt token so we can validate and unlock the purchase. We do not receive your payment card details.
• Website leaderboard runs: When you finish a browser-game run, the website automatically sends a random run identifier, a random browser player identifier, your score, selected site language, completion time, and public leaderboard name to the leaderboard service. A safe random dino name is assigned by default; you may replace it with a name you choose. That name and your best score for each period are public, so do not use personal information you do not want to publish.
• Support inquiries: If you contact us via email, we receive the content of your message and your email address.

2B) Data Collected Automatically

• Gameplay data: Game progress, high scores, level attempts (result, stars earned, coins collected, duration, jumps, bends), infinite mode runs (score, duration, seed), unlocked items, selected dinosaur/trail/colors, coin balance and full transaction history, daily login streaks, daily deals, collection milestone claims, ad reward verifications (transaction ID, ad network, timestamp), and first-clear bonus records.
• AI ghost mode statistics: Multiplayer mode uses nine locally simulated AI ghost dinos. Your selected mode, finishing position, and wins may be stored locally, included in optional cloud sync, and recorded as pseudonymous analytics. The current mode does not upload your replay for another player to race.
• Diagnostics: Crash logs, performance metrics, and error reports via Firebase Crashlytics.
• Analytics: Pseudonymous usage events (e.g., sessions started, game modes played, levels completed) via Firebase Analytics in the app. On the website, Google Analytics 4 is loaded only after you accept analytics cookies. These data help us understand which features and pages lead to app-store visits and improve the Service.
• Advertising ID: We collect your Advertising ID (IDFA on iOS, GAID on Android) in the free tier to serve personalized ads and maximize ad relevance via LevelPlay (IronSource). On iOS, we will ask for your permission using Apple's App Tracking Transparency (ATT) prompt before accessing your IDFA. If you decline, only contextual (non-personalized) ads are shown and your IDFA is not collected. You can change this at any time in Settings → Privacy & Security → Tracking. On Android, you can opt out via Settings → Google → Ads.
• Device integrity: We use Google Play Integrity API (Android) and Apple App Attest (iOS) to verify device and app authenticity. Integrity verdicts are stored on our servers.
• Anti-cheat data: The app monitors for speed manipulation and memory tampering. Detection events (type and details) are reported to our servers to protect fair play.
• Website leaderboard abuse prevention: When a run is published, the leaderboard application converts the requesting IP address into a shortened one-way SHA-256 hash used only to count submissions for up to 60 seconds. The application does not write the raw IP address to Redis. Browser scores are rate-limited and may be removed for abuse, but they are not cryptographically verified.

2C) Data We Do NOT Collect

• Precise location (GPS)
• Contacts, photos, camera, or microphone
• Health, financial, or biometric data

3) How We Use Data

• Provide and operate the game: save/sync progress, run the AI ghost mode, populate global score leaderboards, and manage daily logins and deals.
• Validate purchases: process purchase events via RevenueCat, verify receipts, grant entitlements and coins, handle refunds.
• Improve reliability: monitor crashes, fix bugs, and optimize performance.
• Understand usage: aggregate analytics to prioritize features and improvements.
• Serve and optimize ads: display interstitial ads and optional rewarded video ads in the free tier via LevelPlay (IronSource) ad mediation. We use your Advertising ID to serve personalized ads and maximize ad revenue.
• Verify ad rewards: confirm rewarded video completions via server-to-server callbacks to prevent fraud and grant coins.
• Fair play & integrity: detect cheating, verify device integrity, and enforce game rules.
• Respond to inquiries: answer support emails.
• Legal compliance: comply with applicable laws, enforce our Terms, and protect rights.

4) Data Sharing

We do not sell your personal data. We share data only with:

• Google (Firebase and Google Analytics): Firebase provides app authentication, usage analytics, Crashlytics, and App Check. If you accept website analytics, Google Analytics 4 receives pseudonymous website usage and app-store click events. Advertising storage, Google Signals, and ad-personalization signals are disabled for the website analytics tag. Google Privacy Policy.
• Google Cloud: Our backend servers and game data are hosted on Google Cloud infrastructure in the United States. Google Cloud Privacy.
• LevelPlay (IronSource / Unity): Ad mediation platform that serves interstitial and rewarded video ads in the free tier. LevelPlay may use your Advertising ID and contextual signals to serve and measure ads via demand partners including Google AdMob. Unity Game Player & App User Privacy Policy.
• RevenueCat: Manages in-app purchases and entitlements. Receives purchase events from Apple/Google to validate and process transactions. RevenueCat Privacy Policy.
• Upstash: Provides managed Redis storage for the website's public daily, monthly, and all-time score boards, anonymous run identifiers, aggregate run counts, and short-lived submission counters. Upstash Privacy Policy.
• Apple / Google Play: Process in-app purchases, provide purchase receipts, and handle device integrity verification (App Attest / Play Integrity API).
• Other players: Browser leaderboard names and ranked scores are public. A non-personal random dino name is used unless you choose another public name. We may reject or remove abusive, promotional, impersonating, or otherwise inappropriate names. App-store game-services leaderboards may also show the profile and score information permitted by the platform. The current AI ghost race does not share your live game state or replay with another player.
• Legal obligations: We may disclose data if required by law, court order, or to protect the safety or rights of Pyxel Bytes, our users, or the public.

5) Cookies & Tracking Technologies

The mobile app does not use cookies. The website (thejumpingdino.com) uses a necessary first-party tjd_cookie_consent cookie for 180 days to record your analytics-cookie choice and the date and policy version attached to it. Functional local storage supports browser-game statistics, a random leaderboard player identifier, your public leaderboard name, a bounded queue of completed runs awaiting publication, and a dismissed app banner. The website uses Vercel Web Analytics for aggregate cookieless statistics and Vercel Speed Insights for anonymous performance measurement. Google Analytics 4 is off by default; its tag does not load and its cookies are not created until you choose “Accept analytics.” If accepted, Google Analytics may set first-party _ga and _ga_* cookies and receives page-view, game, score-sharing, and app-store-click events. Advertising storage, Google Signals, ad-user-data consent, and ad personalization remain disabled. You can reject optional cookies initially or change your choice at any time through “Cookie settings” in every page footer. See the complete Cookie Policy for names, purposes, providers, durations, and withdrawal details. Firebase Analytics in the app uses device identifiers rather than website cookies.

6) Your Choices & Controls

• Play without an account. No sign-in is required. Completed website runs publish automatically under a safe random name. You may edit that public name or request another random name without losing the scores attached to the same browser identifier. Clearing website storage breaks that link and does not automatically remove scores already published under the previous identifier.
• Remove ads. Purchase ad removal or Gold Premium to stop all ad serving and associated data collection by LevelPlay (IronSource) and its ad network partners.
• Opt out of personalized ads. On iOS, use the ATT prompt or go to Settings → Privacy & Security → Tracking. On Android: Settings → Google → Ads → Delete advertising ID.
• Delete your account. In the app: Settings → Account → Delete Account. This permanently removes all your data from our servers and resets your local game data on next app launch. See thejumpingdino.com/delete-account for details.
• Request data access/deletion. Email privacy@thejumpingdino.com and we will respond within 30 days.

7) Data Retention

• Local game data: Stored on your device until you uninstall the app, clear app data, or delete your account (local data depends on your cloud account and is reset upon account deletion).
• Account & sync data: Retained while your account is active. Deleted within 30 days of account deletion.
• Crash logs: Retained for up to 90 days in Firebase Crashlytics, then automatically deleted.
• Analytics data: Retained in aggregate form for up to 14 months in Firebase Analytics, then automatically deleted.
• Support emails: Retained for 1 year after the inquiry is resolved, then deleted.
• Purchase records & webhook events: Purchase receipts, entitlement records, and RevenueCat webhook event logs are retained for 7 years to comply with tax and financial recordkeeping obligations and to support chargeback resolution.
• Gameplay logs: Level attempts, infinite runs, coin transactions, and ghost challenge data are retained while your account is active and deleted with your account.
• Anti-cheat & integrity data: Cheat detection logs and device integrity verdicts are retained while your account is active for fair play enforcement.
• Website leaderboard: Daily boards and daily run totals expire after eight days. Monthly boards and monthly run totals expire after 62 days. The all-time board retains up to 5,000 ranked player identifiers. A public-name record expires after 366 days without a score submission or name update, after which the safe generated name is shown. A run identifier used to prevent duplicate retries expires after eight days, and submission rate-limit hashes expire after 60 seconds. Entries may be removed earlier for moderation or after a valid deletion request. A local retry queue holds at most 500 completed runs until they publish or you clear website data.

8) Data Storage & Security

Mobile app cloud data is stored on Google Cloud infrastructure in the United States. Firebase services (Authentication, Analytics, Crashlytics) may also process data in the United States. Website leaderboard data is stored in managed Redis provided by Upstash. We use security measures including TLS in transit, Firebase App Check for mobile client attestation, HMAC-signed server-to-server callbacks, restricted storage credentials, and access controls. However, no system is 100% secure — we cannot guarantee absolute security.

9) International Transfers

Your data may be transferred to and processed in countries outside your own. Our mobile backend servers and game data are hosted in the United States. Firebase, RevenueCat, and Upstash or their subprocessors may also process data outside your country. For transfers from the EEA/UK, we rely on applicable data-processing terms, Standard Contractual Clauses, and other appropriate safeguards as required by GDPR Chapter V.

10) Your Rights by Region

Depending on where you live, you may have additional rights:

Andorra & European Economic Area (GDPR)

Under the General Data Protection Regulation, you have the right to: access your data, rectify inaccurate data, erase your data (“right to be forgotten”), restrict processing, data portability, object to processing, and withdraw consent. Our legal bases for processing are: (a) contract performance (providing the game), (b) legitimate interest (security and cookieless aggregate service measurement), and (c) consent (website Google Analytics and personalized ads). To exercise your rights, email privacy@thejumpingdino.com. You also have the right to lodge a complaint with your local data protection authority.

United Kingdom

You have the same rights as under the GDPR. Our representative for UK data protection inquiries can be reached at privacy@thejumpingdino.com.

California (CCPA/CPRA)

California residents have the right to: know what personal information is collected and how it is used, request deletion, opt out of the sale/sharing of personal information, and non-discrimination for exercising these rights. We do not sell or share personal information as defined by the CCPA. To exercise your rights, email privacy@thejumpingdino.com.

11) Children

The Jumping Dino is not directed to children. The minimum age to use this Service is 13, or the higher age of digital consent in your country (e.g., 16 in some EEA member states). If you are below the applicable age of consent for data processing in your region, a parent or guardian must agree on your behalf. We do not knowingly collect personal data from children below the applicable minimum age. If you are a parent/guardian and believe your child has provided us with personal data, please contact us at privacy@thejumpingdino.com and we will promptly delete it.

12) Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy at thejumpingdino.com/privacy and update the effective date. Material changes will be announced in-app or on our website. Your continued use of the Service after changes means you accept the updated Policy.

13) Contact

Pyxel Bytes (Biel Carpi)
Avinguda de les Nacions Unides 40, Escaldes-Engordany, Andorra
privacy@thejumpingdino.com

App Store Privacy Summary

The following table summarizes our data practices for the App Store and Google Play privacy labels:

We do not use collected data for tracking across third-party apps or websites (except LevelPlay (IronSource) ad mediation in the free tier, which you can opt out of via ATT on iOS or via your Android Ads settings).