Privacy Policy

Effective date: September 29, 2026

This policy explains what MalcolmToddle ("we", "us", the "Service" at malcolmtoddle.com) collects, why, and the choices you have. The Service is operated by Summit Development.

What we collect

• Account details: the email address and display name you provide at signup. Your password is handled by our authentication provider and stored only in hashed form; we never see or store your plaintext password.
• Gameplay data: your scores (Todd Points), streaks, daily and duel results, and rank. Your display name, score, rank, stats, achievements and equipped cosmetics appear on the public leaderboard and on your public profile page; your email never does.
• Profile photo (optional): if you add one, it's public on your profile. Your browser crops and shrinks it to a small square and re-saves it before upload, which strips hidden file data such as the location a photo was taken. If other players report a photo, we record who reported it so each player counts once.
• Gems: a record of every gem you earn, buy or spend (amount, reason and time) and which items you received from Mystery Boxes, so balances stay correct and purchases can be checked.
• Purchase data: if you buy a cosmetic or become a Supporter, we keep a record of what you bought, the amount, currency and date, your Stripe customer ID, and your Supporter status and renewal date. Card and payment details are entered on Stripe's checkout page and go straight to Stripe: we never see or store your full card number.
• Marketing consent record: if you opt in to marketing email, we record that you consented, the date and time, the source of the consent, and your IP address at that moment. We keep this to prove consent was given, as data-protection law requires.
• Technical data: standard server and security logs (e.g. IP address, browser type, timestamps) generated when you use the Service.

Cookies and local storage

We use a login session cookie so you stay signed in, and your browser's local storage to remember guest progress and small preferences.

Advertising cookies: we show ads through Google AdSense to keep the game free. Google and its partners use cookies (including the DoubleClick cookie) to serve ads based on your prior visits to this and other websites. You can opt out of personalized advertising at Google Ads Settings or aboutads.info. Learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. If you're in the EEA, UK, or Switzerland, we ask for your consent before serving personalized ads.

Affiliate links

Some links on MalcolmToddle are affiliate links, including links to Amazon and Apple Music. If you buy something or sign up after clicking one, we may earn a commission at no extra cost to you. As an Amazon Associate I earn from qualifying purchases. When you click an affiliate link, the destination site (for example Amazon) may set its own cookies to track the referral; that is governed by its privacy policy, not ours.

How we use your data

• To run the game, your account, your public profile, and the leaderboard.
• To process purchases and subscriptions, deliver what you bought, and keep the records we need for tax and accounting.
• To send you marketing email about new drops and merch, only if you opted in, and you can unsubscribe at any time.
• To send you essential service email (for example, confirming your account or a security notice). These are not marketing and are sent regardless of marketing consent.
• To show advertising through Google AdSense, which funds the Service.
• To keep the Service secure, prevent abuse, and comply with our legal obligations.

We never sell your personal data.

Who we share it with (service providers)

We use trusted providers that process data on our behalf:

• Supabase: authentication, database hosting, and storage for profile photos.
• Vercel: website hosting.
• Google AdSense and Google Ad Manager: advertising, including optional ads you choose to watch for gems. Google may collect device identifiers, IP address, and browsing activity on this site to show and measure ads.
• Amazon Associates: affiliate links to products on Amazon. We do not share your account data with Amazon; Amazon only sees that you arrived from our link.
• Apple: 30-second song previews are streamed from Apple's iTunes service.
• Stripe: processes payments and Supporter subscriptions. Where Stripe acts as the seller of record, it also handles sales tax and receipts, and its own privacy policy covers the payment details you give it.
• Resend: sending account emails (such as sign-up confirmation) and, only if you opt in, marketing email.
• The merch shop is hosted separately by Fourthwall; visiting it is subject to Fourthwall's own privacy policy.

Your rights and choices

From the Preferences page in your account you can, at any time:

• Export your data: download everything we hold about you as a file.
• Delete your account: this permanently removes your account, gameplay data, profile photo, and consent record, and cancels any active Supporter subscription so you aren't billed again. It cannot be undone.
• Cancel a subscription: use "Manage or cancel" in the Shop at any time.
• Withdraw marketing consent: unsubscribe, effective immediately.

Depending on where you live (e.g. the EU/UK under GDPR, or California under CCPA/CPRA), you may also have rights to access, correct, or restrict processing of your data. To make a request, email privacy@malcolmtoddle.com.

Data retention

We keep your account data while your account is active. When you delete your account, your personal data is removed. We may keep minimal records where the law requires (for example, proof that you unsubscribed). Purchase records (what was bought, when, and for how much) are kept, no longer linked to your account, for as long as tax and accounting law requires. Stripe keeps its own payment records under its policies.

Children

The Service is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child has given us data, contact us and we will delete it. Users under 18 need a parent or guardian's permission before making a purchase.

Security

We use industry-standard measures (encryption in transit, hashed passwords, and access controls) to protect your data. No system is perfectly secure, but we work to keep yours safe.

Changes

We may update this policy. If we make a material change, we'll update the effective date above and, where appropriate, notify you.

Contact

MalcolmToddle is operated by Summit Development.
Questions or requests: privacy@malcolmtoddle.com
Governing law: State of Ohio, USA.