Privacy Policy

This policy explains how Pewter Software Ltd collects, uses, shares and protects your personal data when you play Cow Clicker on iOS or Android. It also explains your rights and how to use them.

The current version is always at pewtersoftware.co.uk/cowclicker/privacy. You can open it in the app from Settings → Account & Privacy → About & legal → Privacy policy.

1. The short version

• You sign in with Google or Apple. We receive your email address and an account ID from them. We don't keep your real name or photo.
• Other players only see the display name you choose, your cow's look, your title, and your tap totals and rank. Friends also see your cow's name and your friend code.
• Our database is hosted by Supabase in Frankfurt, Germany.
• Ads are optional. They only play when you choose to watch a rewarded ad. They're served by Google AdMob, and personalised ads depend on your consent.
• Purchases are handled by Apple or Google, with RevenueCat confirming them. We never see your card details.
• Reminders are scheduled on your phone. Nothing about them is sent to us.
• We don't use analytics, crash reporting, location, contacts, your camera, your microphone or your photos.
• You can delete your account at any time in the app. It happens straight away. You can also email pewtersoftware@gmail.com.
• Cow Clicker is for people aged 16 and over.

2. Who we are

Pewter Software Ltd is the controller of your personal data. That means we decide how and why it's used.

We haven't appointed a data protection officer, because the law doesn't require one for our processing. Please send any privacy question to pewtersoftware@gmail.com. We don't have an office or a representative in the European Union. Players in the EU can contact us directly at the address above, and can also contact their local data protection authority (see section 15).

3. What this policy covers

This policy covers the Cow Clicker app for iOS and Android and the services behind it. Apple, Google and the other companies named here have their own privacy policies for their own services. We link to them where they're relevant.

4. The personal data we collect

4.1 Your account

When you sign in with Google or Apple, we receive:

• Your email address. With Sign in with Apple you can hide your real address. Apple then gives us a private relay address that forwards to you. We show your email in Settings so you know which account you're using.
• An account ID from your sign-in provider. This links your Google or Apple account to Cow Clicker.
• Sign-in records. These are when you signed in, your active sessions, and the IP address and device type (user agent) used. They keep you signed in and protect your account.

Google includes your name and profile photo in every sign-in. We don't keep them: our database deletes them as soon as they arrive. Apple doesn't give us your name, because we don't ask for it.

We also create a random account ID for you. It's a long code that identifies your account inside our systems.

4.2 Your profile and game

• Display name. You choose it (3 to 24 characters). It's checked against a list of blocked words. You can change it up to twice a day, and we record when you change it so we can apply that limit.
• Your cow. Its name (picked from a fixed list), its look, the cosmetics you own and wear, and your title.
• Taps and progress. Your tap totals for all time, this month and this year. Your rank. When you last tapped, and when you can tap next (one tap every six hours). We don't keep a history of individual taps.
• When you last opened the app. The date you last opened Cow Clicker while signed in, updated at most once a day, so we can tell whether an account is inactive (section 13).
• Settings. Your theme, sound, haptics and reduced-motion choices, so they're the same on every device.
• Records about you. When you accepted the Terms of Service, which version you accepted, and your confirmation that you're 16 or older. When you finished onboarding, when you joined, and a join number we use to break ties on leaderboards.
• A public player ID. This is a separate random code, not your account ID. It's sent with leaderboard rows so other players can hide or report you.

4.3 Leaderboards

We keep regularly refreshed copies of the top 100 players for all time, this month and this year. Each copy has the player's display name, cosmetics and taps. We also keep the final monthly and yearly top 100 as a results history.

4.4 Friends and pokes

You get a friend code, and adding someone's friend code is the only way to find them. You can swap it for a new one once a day, and we record when you last did. We store friend requests, your friends (up to 200), and pokes, which are one nudge per friend every six hours. For each one, we store who it's between and when it happened. When you decline a request, we keep a note of who asked whom and when for 24 hours, so the same player can't ask again straight away.

4.5 Name reports

You can report another player's display name, which also hides that player on your phone. We store who reported whom, the reported name, and when. Reports are never shown to other players, and the reported player isn't told who reported them. See section 5.2 for how reports work.

4.6 Purchases

When you buy an item, we receive a purchase record: the product, the store's transaction ID, whether it was a test or real purchase, the time, and any refund. We use it to give you, or take back, cosmetics and skip credits. See section 8.

4.7 Rewarded ads

When you choose to watch a rewarded ad, we record each reward Google confirms: the ad transaction ID, the ad unit, what the reward was for, whether it was granted, and when. We also count how many ads you've watched. See section 7.

4.8 Security and service logs

Our hosting provider keeps short-lived technical logs of requests to our servers. These can include IP addresses, request paths, and purchase or ad transaction IDs. Section 13 says how long we keep them.

4.9 What we don't collect

We don't collect your precise or approximate location from your device. We also don't collect your contacts, photos, camera, microphone, health data, date of birth, phone number or payment card details, or any special category data (such as health, religion or ethnicity). There's no in-game chat, and we use no analytics or crash-reporting tools.

5. How we use your data, and our legal bases

UK and EU data protection law requires a lawful basis for each use of personal data. These are ours:

Where we rely on legitimate interests, we've weighed our interests against your rights. You can object at any time (section 15).

5.1 Bans

If someone breaks the Terms of Service, we may ban their account. That's a decision made by a person on our team. We record when, and a short reason that's shown to the banned player in the app. A banned player is removed from leaderboards and friends' lists, can't use friends, skips or ad rewards, and their reports no longer count. A banned player can appeal by email (Terms of Service section 13.3).

5.2 Automatic name resets

If 20 established players report the same display name, it's reset automatically. Established means an account at least 7 days old, with at least 10 taps, that isn't banned. The name changes to a default made from your cow's name (for example, "Daisy Fan 1234"), and you can't rename for 7 days. This is the only automated decision we make about you. It has no legal or similarly significant effect. If you think it was a mistake, email us and a person will review it.

6. What other players can see

Our database enforces this with row-level security. Player data can only be read through functions that return the fields above, and leaderboard data never includes your account ID.

7. Advertising: Google AdMob

Cow Clicker shows rewarded ads only. An ad plays only when you choose to watch one, for example to skip a cooldown. You never have to watch an ad to play.

Ads are provided by Google AdMob, a service of Google. When an ad loads or plays, Google collects information from your device. That includes:

• your device's advertising ID (IDFA on iOS if you allow tracking, or the Android advertising ID);
• your IP address, and the approximate location Google works out from it;
• device and operating system details;
• how you interact with the ad.

Google uses this to show ads, measure them, prevent fraud and, if you agree, personalise them. Google acts as an independent controller for this data. Its use is covered by Google's own policies:

• How Google uses information from sites or apps that use its services: policies.google.com/technologies/partner-sites
• Google Privacy Policy: policies.google.com/privacy

7.1 Your consent choices

• Google's consent form (UMP). In the UK, the European Economic Area and Switzerland, we show Google's User Messaging Platform consent form before any ads load. It follows the IAB Transparency & Consent Framework. You can accept, reject or customise personalised advertising and the storing of advertising data on your device. The ad service doesn't start until this choice is made.
• Changing your choice. Where the law requires it, you can reopen the form at any time from Settings → Account & Privacy → About & legal → Ad privacy options.
• App Tracking Transparency (iOS). On iPhone, Apple asks whether Cow Clicker may track you. If you say no, Google doesn't receive your IDFA, and the game works exactly the same. You can change this in iOS Settings → Privacy & Security → Tracking.
• Android. You can delete or reset your advertising ID, or opt out of personalised ads, in your device's Google or privacy settings.

If you don't consent, Google may still show non-personalised ads. These use limited data, for example for frequency capping, fraud prevention and measurement.

Ads are limited to content rated suitable for teenagers and older.

7.2 Confirming your reward

To make sure the reward goes to the right account, we pass your random Cow Clicker account ID to Google with each rewarded ad. After the ad, Google sends a signed confirmation to our server with that ID and an ad transaction ID. We check Google's signature before giving you the reward. Google doesn't receive your email or display name.

8. In-app purchases

Cow Clicker sells one-time items, such as cosmetics and skip credits. There are no subscriptions.

• Apple and Google take the payment. Purchases are made through the Apple App Store or Google Play, under their terms. They're the seller, and they process your payment details. We never see or store your card details.
• RevenueCat confirms purchases. RevenueCat, Inc. checks store receipts for us. It receives your random Cow Clicker account ID, the purchase receipt and product, and basic device, store country and IP information. It then tells our server about the purchase, and we add the item to your account. We don't share your advertising ID or any other details with RevenueCat.
• Refunds are requested from Apple or Google. If a store refunds a purchase, we remove the item or any unused credits.
• Restore purchases in Settings asks the store for your past purchases again.

Apple's privacy policy: www.apple.com/legal/privacy/ · Google's privacy policy: policies.google.com/privacy · RevenueCat's privacy policy: www.revenuecat.com/privacy

9. Where your data is hosted, and who processes it

9.1 Supabase

Our backend runs on Supabase, provided by Supabase, Inc. That covers our database, sign-in, and the server code that confirms ad rewards and purchases. Your data is stored in Amazon Web Services' eu-central-1 region in Frankfurt, Germany. Supabase acts as our processor, so it may only use your data on our instructions, under a data processing agreement. Supabase's support staff may access data from outside the EU when needed to support the service. Privacy policy: supabase.com/privacy

9.2 Everyone who receives your data

We don't share your personal data with anyone else, except:

• if the law requires it;
• to protect the rights, safety or property of our players or our company;
• with a buyer or successor if the business is sold or reorganised. We'd tell you before your data became subject to a different privacy policy.

10. International transfers

Our main database is in the European Union. The UK recognises the EU as giving adequate protection. Some providers (Google, Apple and RevenueCat) process data in the United States and elsewhere, and Supabase support may access data from the US. When personal data leaves the UK or EU, we rely on one of these protections:

• an adequacy decision;
• the EU–US Data Privacy Framework and its UK Extension, where the provider is certified;
• the European Commission's standard contractual clauses, together with the UK International Data Transfer Addendum, in the provider's data processing terms.

You can ask us for more information about these protections.

11. Reminder notifications

If you turn on tap reminders or "nudge me if I've been away", the app schedules notifications on your phone using the operating system. Notification text may include your cow's name. Reminders don't go off between 10pm and 8am, using your phone's local time zone. None of this is sent to us: no reminder schedule, notification token or time zone leaves your device.

We only ask for notification permission when you turn reminders on, never at launch. You can turn reminders off in Settings → Notifications or in your phone's settings.

Cow Clicker doesn't send notifications from our servers. If we add them in future, they'll be off unless you turn them on, and we'll update this policy first.

12. Data stored on your device

The app keeps some data in its private storage on your phone:

• Strictly necessary data:
  • your sign-in session;
  • your settings and reminder choices;
  • a cached copy of the leaderboards;
  • players you've hidden;
  • a record of which accounts have finished onboarding on this device.
• Data kept by the ad, consent and purchase tools: Google's record of your consent choice, RevenueCat's purchase cache, and, only if you consent, Google's advertising data.

UK and EU law (PECR and the ePrivacy Directive) only allows non-essential data to be stored on your device with your consent. Google's consent form asks for that consent before ads load.

This data is protected by your phone's operating system, not stored in a separate encrypted vault.

• Signing out removes your session and cached leaderboards.
• Deleting your account also removes your onboarding record and the players you hid.
• Uninstalling the app removes everything it stored on the device.

On Android, Cow Clicker's data isn't included in device backups. On iPhone, it may be included in your iCloud or computer backups, under Apple's terms.

13. How long we keep your data

14. Account & Data Deletion

You can delete your Cow Clicker account and its data at any time, free of charge.

14.1 In the app: straight away

1. Open Settings → Account & Privacy → About & legal → Delete my account.
2. Confirm. The app asks you to type a short word to make sure you mean it.
3. If you signed in with Apple on an iPhone, Apple asks you to confirm once more, so we can revoke Cow Clicker's access to your Apple ID.

When you confirm, deletion starts and finishes straight away. We:

• permanently delete your account and everything linked to it. That includes your email, sign-in identities, display name, cow, cosmetics, taps and rankings, friends and friend requests, pokes, name reports, purchase records, skip credits and ad reward records;
• revoke Sign in with Apple (on iPhone), and disconnect Google sign-in, from Cow Clicker;
• delete your customer record at RevenueCat;
• sign you out and clear Cow Clicker's data about you on that device.

Deletion can't be undone, and purchased items are lost. Your past taps stay in the anonymous worldwide total.

14.2 Inactive accounts

If you haven't opened Cow Clicker while signed in, signed in, or tapped for 12 months, we delete your account in the same way, including your customer record at RevenueCat. Accounts that have bought something (and kept it) are never deleted for inactivity. If you've allowed notifications, your phone shows a warning about 30 days before. We can't revoke Sign in with Apple for an inactive account; you can remove it at appleid.apple.com (section 14.4).

14.3 By email

If you can't use the app, email pewtersoftware@gmail.com from the email address linked to your account, and ask us to delete it. We'll check the request is yours. We'll reply to that address, and may ask for your friend code from the app. We'll then delete your account in the same way. We'll complete the deletion and confirm it without undue delay, and within one month.

14.4 Sign in with Apple on Android

On Android, Apple sign-in happens in your web browser, so the app can't revoke it automatically. Your Cow Clicker account and data are still fully deleted. To remove Cow Clicker from your Apple ID too, go to appleid.apple.com, open Sign in with Apple, and choose Stop using Apple ID for Cow Clicker.

14.5 What other companies keep

Some companies keep their own records under their own policies and legal duties. We can't delete these records for you:

• Apple and Google keep records of your sign-ins, purchases and payments.
• Google AdMob keeps records of the ads served and the reward confirmations (including the account ID sent with them).
• Our hosting logs expire on the schedule in section 13. The security log is kept for 30 days, and request logs for 1 day.

You can contact Apple or Google directly to exercise your rights over their records.

15. Your rights

Under UK and EU data protection law, you have the right to:

• be informed about how we use your data (this policy);
• access your data and get a copy;
• correct inaccurate data. You can change your display name in Settings yourself;
• delete your data (section 14);
• restrict how we use your data;
• object to uses based on legitimate interests;
• data portability: receive your data in a machine-readable format;
• withdraw consent at any time, without affecting what we did before. For ads, use Ad privacy options or your device settings (section 7.1). For reminders, use Settings → Notifications;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We make no such decisions (section 5.2).

How to use your rights. For a copy of your data, email pewtersoftware@gmail.com with the subject "Data Export Request". For anything else, just email us. Please send it from the address linked to your account so we can confirm it's you. We'll answer within one month. If a request is complex, we may extend that by up to two more months, and we'll tell you if so. It's free, unless a request is clearly unfounded or excessive.

Complaints. Please contact us first so we can try to help. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• website: ico.org.uk/make-a-complaint/
• phone: 0303 123 1113
• post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you live in the European Economic Area, you can also complain to the data protection authority in your country.

15.1 Players in the United States

Depending on your state, you may have the right to:

• know what personal data we hold and get a copy;
• correct it;
• delete it;
• opt out of targeted advertising and of the "sale" or "sharing" of personal data.

We don't sell your personal data for money. When Google AdMob shows you personalised ads, US state laws, including California's, may treat this as "sharing" for targeted advertising. To opt out:

• on iPhone, don't allow tracking;
• on Android, opt out of ads personalisation or delete your advertising ID;
• use Ad privacy options in Settings, where shown;
• or email us.

We won't treat you differently for using these rights. If we turn down a request, you can appeal by replying to our decision. We'll respond to your appeal in writing. If you're still not satisfied, you can contact your state's Attorney General.

15.2 Players elsewhere

Wherever you live, you can contact us to access, correct or delete your data. We'll respond in line with the law that applies to you.

16. Age requirement and children

Cow Clicker is for people aged 16 and over. It isn't designed for or aimed at children, and players confirm they're 16 or older when they accept our terms. We set things up to protect privacy by default:

• personalised ads are off unless you consent, where the law requires a choice;
• ads are limited to content suitable for teenagers and older;
• reminders are off until you turn them on;
• there's no chat, and display names are filtered;
• players only see your pseudonymous display name.

If we learn that someone under 16 has an account, we'll delete it and its data. In the US, this includes any personal data from a child under 13 under the Children's Online Privacy Protection Act. If you're a parent or guardian and think your child has an account, email pewtersoftware@gmail.com and we'll delete it.

17. How we protect your data

• All data between the app and our servers is encrypted in transit (HTTPS).
• Our database uses row-level security. The app can only reach a player's data through functions that check who is asking. Leaderboards never expose account IDs.
• Ad rewards are confirmed with Google's cryptographic signature. Purchases are confirmed by authenticated messages from RevenueCat. Neither is granted on the device's word alone.
• We collect only what the game needs. We don't keep a tap-by-tap history, and we delete Google's name and photo as they arrive.
• Only our team can access our systems, and only when needed.

No system is perfectly secure. If a data breach is likely to put your rights at risk, we'll report it to the ICO within 72 hours, and tell you without undue delay if the risk is high.

18. Changes to this policy

We'll update this policy when the app or the law changes. The effective date at the top shows when it last changed. If we make important changes, for example new kinds of data or new uses, we'll tell you in the app before they take effect. Where needed, we'll ask you to review and accept again before you keep playing.

19. Governing law and contact

This policy is governed by the laws of England and Wales. The courts of England and Wales have non-exclusive jurisdiction, so you can also bring a claim in the courts where you live, if your local law allows it. This doesn't affect your right to complain to the ICO or your local data protection authority.

Contact us: Pewter Software Ltd, 203 West Street, Fareham, England, PO16 0EN Email: pewtersoftware@gmail.com Support: pewtersoftware.co.uk/cowclicker/support