Privacy Policy
This policy explains what data CATD: Paws & Towers ("CATD", "the game") and the websites playcatd.com and shop.playcatd.com collect, why, and what you can do about it.
The data controller is PT Richfield Widjaja Digital (RW Play), Indonesia. Contact: support@playcatd.com.
1. Playing as a guest: nothing leaves your device
You can play CATD without an account. As a Local Guest, your progress is stored only on your device, and the game sends nothing about you to us. Uninstalling the game or clearing its data deletes that progress.
The game contains no advertising and no third-party analytics or tracking SDKs.
2. Cloud save and sign-in (optional)
If you choose to back up your progress, the game creates a CATD account on our server. We then process:
| Data | Why |
|---|---|
A random CATD account ID and public Player ID (for example CATD-AB12-CD34) | To identify your account |
Google sign-in: your Google account identifier and a masked e-mail address (for example m***@gmail.com) | To let you recover your account on another device. The masked e-mail is only shown to you. |
| Facebook login: your app-scoped Facebook user ID | To let you recover your account on another device. We do not request your friends list, posts or e-mail. |
| Cloud guest: a random secret stored securely on your device; we keep only a one-way hash of it | To sign the device back in |
| Your game progress: stages, stars, Heroes, levels, abilities and in-game currencies | To restore your progress and to resolve conflicts between devices |
| A device name such as "Device 3F9A", generated randomly by the game (not your phone model or any hardware identifier) | To show you which device made each save |
| Session records: sign-in method and times | To keep you signed in and to protect your account |
3. Purchases
Google Play: purchases inside the game are processed by Google Play. We receive the purchase details our server needs to deliver your Diamonds once: product, order ID, purchase token, status and quantity. We never receive your card or bank details.
CATD Diamond shop (shop.playcatd.com): to deliver Diamonds to the right account, you link the shop to your account with a one-time code shown in the game. We keep order records: pack, price, currency, payment method type, status and the payment provider's reference. Payments are handled by our payment provider; we never see or store card numbers. Web top-ups are not open yet.
We keep a ledger of every Diamond credit, spend and refund for your account, to prevent duplicate deliveries and fraud.
4. Security logs
To protect accounts and payments, we record security events such as sign-ins, failed attempts, purchases and refunds. These records include a salted one-way hash of your IP address, never the IP address itself. We also briefly count requests to limit abuse.
5. Cookies
shop.playcatd.com uses one strictly necessary cookie, __Host-catd_web. It keeps your linked account signed in on the shop for up to 24 hours. playcatd.com uses no cookies. We use no advertising or analytics cookies.
6. Who processes the data
- Cloudflare, Inc.: hosts our websites, API and database. Data may be processed in Cloudflare data centres outside Indonesia.
- Google: Google sign-in and Google Play billing, when you use them.
- Meta Platforms: Facebook Login, when you use it.
- Our payment provider: website payments, once web top-ups open. This policy will name the provider before then.
We do not sell your data, and we do not share it for advertising.
7. How long we keep data
| Data | Kept |
|---|---|
| Cloud saves | Your newest 20 saves and your first one, until you delete your account |
| Sign-in sessions | Up to 60 days of inactivity, then 30 more days for security checks |
| Security logs | 12 months |
| Purchase and Diamond ledger records | As long as Indonesian tax and accounting law requires (up to 10 years). These records are kept under the random account ID only. |
8. Your rights
Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and other laws that apply to you, you may ask to access, correct or delete your data. You may also withdraw consent or object to processing. Write to support@playcatd.com and include your Player ID.
You can delete your account at any time. See Delete your account.
9. Children
CATD is not directed at children under 13, and we do not knowingly collect personal data from them. A parent who believes their child created an account can contact us, and we will delete it.
10. Security
All connections use HTTPS. Account secrets are stored on your device in the Android Keystore, and only hashes of them are kept on our server. Sign-ins and purchases are verified on our server with Google and Meta. Paid Diamond balances are controlled by our server, not by the device.
11. Changes
If we change this policy, we will update the date above. If the change is significant, we will also tell you in the game.