Toca Boca World

"Device Information: Information from Your device - such as device IDs, Android ID, IDFV, operating system, platform, screen resolution and similar information about Your device and device settings/usage, IP address (including Your approximate location). ... We will only process the minimum amount of data to understand what other apps You have downloaded from Us on Your device."

Toca Boca collects persistent device identifiers (Android ID, IDFV), device settings, and scans for other installed apps on the device — notably in a children's app, where such broad device data collection raises heightened concerns.

"Device Information: Information from Your device - such as device IDs, Android ID, IDFV, operating system, platform, screen resolution and similar information about Your device and device settings/usage, IP address (including Your approximate location). Unique Identifiers: Information from Your account - such as account ID, Toca profile ID, email address and password (where email login is applicable), IP address (including Your approximate location)."

Toca Boca collects IP addresses to derive approximate location from both device information and account identifiers, collecting location data in multiple contexts for a children's app.

"Toca Boca may share Your information, including Your personal data which includes but is not limited to billing information or user names, with Our agents, contractors, or service providers who are hired to perform services on Our behalf. We may also share Your information with Our affiliates. ... We use Google Crashlytics, Firebase and BigQuery for bug reporting, crash reporting and analytics. ... We also work with AppsFlyer as an attribution provider to help Us understand Your interactions with the apps and to optimize and analyze mobile ad campaigns."

Data is shared with a broad set of third parties including Google (Crashlytics, Firebase, BigQuery), AppsFlyer, Amazon Web Services, Helpshift, DataDog, and multiple Spin Master group companies across different countries.

"When You use Toca Boca World We will process personal data to cross promote other apps that we develop and publish. We will only process the minimum amount of data to understand what other apps You have downloaded from Us on Your device. ... We also work with AppsFlyer as an attribution provider to help Us understand Your interactions with the apps and to optimize and analyze mobile ad campaigns."

Toca Boca checks which of their other apps are installed on the user's device for cross-promotion, and uses AppsFlyer for marketing attribution to track user interactions across ad campaigns — linking activity across apps and media platforms.

"We will keep Your personal data that is tied to Your account and Your usage of Our apps as long as You use the services and for a period of two years after You last used the service unless You contact Us asking for a removal. For analytics, instead of deleting Your personal data We may anonymise the personal data so that no direct or indirect identifiers remain and after such anonymisation We will store the information for an indefinite period."

Personal data is retained for two years after the user stops using the service, and analytics data is kept indefinitely in anonymized form. Users must proactively contact Toca Boca to request earlier deletion.

"This privacy notice may be changed from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. We will provide notice to You if these changes are material and, where required by applicable law, We will obtain Your consent. The notice may be sent to You by email to the last email address You provided Us with, by posting notice of such changes on Our sites and applications, or by other means, consistent with applicable law prior to making the change."

Toca Boca reserves the right to change the privacy policy at any time, only obtaining consent 'where required by applicable law' — meaning in most cases changes take effect with mere notice via website posting or email.