Effective 4 November 2026
This policy explains how Tarakan Limited ("Tarakan", "we", "us"), a company based in New Zealand, handles information when you play our mobile games (the "Games") or visit our websites, tarakan.app and messabout.app (the "Websites"). It applies to all of our Games unless a Game has its own policy.
Our Games are for a general audience that includes children, so we treat every player as if they might be a child. You do not need an account, we never ask who you are, and the only information involved is the limited device and gameplay data described below.
Your progress (stars, unlocked rooms and furniture, keepsakes found, your daily streak) and your settings (sound, vibration, language, reminders) are saved on your device only. The Game also stores a random identifier it creates itself, which it uses to fetch game settings. Uninstalling the Game deletes all of this.
Ads are served by Google AdMob. We set up every ad request to be tagged as child-directed and under the age of consent, so that ads are non-personalised and limited to G-rated content. AdMob receives what it needs to serve and measure an ad (such as IP address, device type, operating system, and app version) and uses it for delivery, frequency capping, fraud prevention, and aggregate reporting. We do not give it the device advertising identifier: we remove the permission for it on Android and never request it on iOS.
Where it is switched on, Firebase Analytics records how the Game is played, such as levels started and finished, stars earned, and ads watched, and how smoothly it runs (frame rate, graphics chip, and memory size), along with the device model. It is tied to an app-instance identifier (on iOS, Firebase also uses Apple's identifier for vendor, which is not an advertising identifier), never to your name, and it does not collect the advertising identifier. Analytics is switched off on devices we identify as being in the European Economic Area, Brazil, South Korea and Thailand.
Firebase Crashlytics reports crashes and errors so we can fix them. A report contains the error and where in the code it happened, the device model and operating system, which screen was open and which level was being played, memory use, and an installation identifier.
Firebase Remote Config lets us adjust the Game (for example how often ads appear) without an update. Each time the Game starts it sends its random identifier, its version and the language of the device, and receives the current settings. Sometimes we give different players slightly different settings to see which works better; where gameplay analytics is on, the settings a device received are recorded with it. Like any request over the internet, it also reaches Google with the device's IP address.
If you turn reminders on, the Game schedules them on your device. No reminder is sent from a server and nothing is shared to deliver them. You can turn them off in the Game's settings or in your device settings.
Our Websites set no cookies and run no analytics, advertising, or tracking scripts, and everything on them, fonts included, comes from our own sites. Cloudflare, which hosts them, receives what any web server needs to deliver a page (IP address, browser and device type, the page requested, and the page you came from) and uses it to deliver and protect the Websites and to give us visitor numbers in aggregate. If you pick a language, your browser remembers it on your device. When you follow one of our links to an app store, we count the click by link and by type of device (Android, iOS, or other), and nothing else.
We do not collect precise location, contacts, photos, microphone or camera data, or anything you type. When a store shows its own rating prompt, Apple or Google handles it, not us.
We do not profile players, show personalised ads, or use information for anything unrelated to running and improving the Games.
The information above goes only to the services that make the Games and Websites work: Google services for the Games, each set up for child-directed treatment so none of it is used for personalised advertising, and Cloudflare for the Websites.
Non-personalised, child-directed ads and aggregate ad measurement. It also runs Google's consent tool, which works out from the IP address whether a device is in the EEA, the UK, or Switzerland.
AdMob and privacy →Gameplay analytics, crash reporting, and game settings, processed by Google on our behalf.
Firebase privacy →How Google handles data across the services above.
Google Privacy Policy →Hosting and security for our Websites. It processes website request data on our behalf to deliver and protect them.
Cloudflare privacy →We may also disclose information when the law requires it, to protect the safety of players or the rights of Tarakan, or as part of a sale or merger of our business, in which case this policy continues to apply to it. Ads, app stores, and our Websites may link to other websites, apps, and services, which have their own privacy policies; we are not responsible for how they handle information.
We apply children's privacy protections to everyone, and design our Games to comply with the U.S. Children's Online Privacy Protection Act (COPPA), the children's provisions of the EU and UK GDPR, Brazil's LGPD and Digital Statute of Children and Adolescents, South Korea's PIPA, and New Zealand's Privacy Act 2020.
We never ask a child for personal information. Where a law requires a parent's consent that we could only collect by asking a child's age, we switch Firebase Analytics off instead, which today covers the European Economic Area, Brazil, South Korea and Thailand. The Games work out where a device is from its region and language settings, on Android also from its SIM and mobile network, and in Europe also from Google's consent tool, and apply the stricter rule whenever any of these points to one of those places. This relies on what the device reports, so it cannot be perfect: a device that reports no country from those places, such as one used while travelling, may not be identified.
Parents and guardians can write to privacy@tarakan.app with any question or request. Because we hold no names or accounts, we usually cannot link data to a particular child. Uninstalling the Game deletes everything stored on the device and stops any further collection, and data our providers hold is deleted under the retention periods below.
Where a legal basis is required, we rely on our legitimate interests in running, securing, and improving the Games and our Websites and in funding the Games with non-personalised ads. We do not rely on consent, because we never ask a child for it. The bases for specific regions are in "Information for your region" below.
Data is encrypted in transit, and access to it is limited to the people who need it to run the Games. No system is completely secure; where the law requires it, we will tell affected players and regulators about a breach.
We are based in New Zealand, and Google and Cloudflare process data in other countries, including the United States. Where the law requires it, transfers rely on adequacy decisions or standard contractual clauses. Regions that ask for more detail get it in the next section.
These sections add to the rest of this policy for players in the places they name.
Tarakan Limited is the controller. The EU GDPR applies to players in the European Economic Area, the UK GDPR to players in the United Kingdom, and the Federal Act on Data Protection to players in Switzerland.
In the European Economic Area the Games do not run Firebase Analytics. Crash reports, game-settings requests, and non-personalised ad requests rely on our legitimate interests in keeping the Games working, secure, and free to play. Ads go through Google's certified consent platform, set up so that no personalisation choice is ever put to a child.
In the United Kingdom and Switzerland we also use Firebase Analytics, relying on our legitimate interest in improving the Games. It is never used for profiling or advertising.
Transfers outside the EEA, the UK, or Switzerland rely on adequacy decisions (New Zealand, where we are based, has them from the European Commission, the UK, and Switzerland) or on the standard contractual clauses in Google's and Cloudflare's data processing terms.
You can complain to your local data protection authority, in the UK to the Information Commissioner's Office (ico.org.uk), or in Switzerland to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
Tarakan Limited is the controller (controlador) under the Lei Geral de Proteção de Dados (LGPD). You can reach our data protection contact (encarregado) at privacy@tarakan.app.
Because children and adolescents play the Games, we process their data only in their best interest, as the LGPD (Article 14) and the Digital Statute of Children and Adolescents (Lei 15.211/2025) require. Firebase Analytics is switched off on devices in Brazil. Crash reports, game settings, and non-personalised ads rely on legitimate interest (Article 7, IX). The Games have no loot boxes or other paid random items, no profiling, and no targeted advertising.
You have the rights in Article 18 of the LGPD: confirmation and access, correction, anonymisation, blocking or deletion, portability, information about sharing, and review of automated decisions. Data goes to Google LLC and, for our Websites, Cloudflare, Inc. in the United States under their standard contractual terms. You can complain to the Autoridade Nacional de Proteção de Dados (gov.br/anpd).
This section sets out what the Personal Information Protection Act (PIPA) requires. Firebase Analytics is switched off on devices in South Korea, and we collect nothing from children under 14 beyond the device data the Game needs to run and the request data a web server needs to show our Websites.
Items processed: app-instance and installation identifiers, device model, operating system, language and region, and crash logs. Purposes: running the Game, fixing crashes, and serving non-personalised ads. Retention: as set out under "Data retention and security", after which data is deleted or anonymised.
Overseas transfer: these items are sent over the internet to Google LLC in the United States whenever the Game is online, for crash reporting, game settings, and ad serving, and are kept for the periods above. You can refuse the transfer by playing offline, when nothing is sent, or by uninstalling the Game.
Our Websites: each time a page loads, your IP address, browser and device type, the page requested, and the page you came from are sent over the internet to Cloudflare, Inc. in the United States (dpo@cloudflare.com), which hosts the Websites on our behalf. It uses them only to deliver and protect the Websites and keeps them for a short time for security and troubleshooting. You can refuse this transfer by not visiting the Websites, which the Games do not need. A language you pick stays in your browser.
Destruction: electronic records are deleted so they cannot be restored. Privacy officer: Tarakan Limited, privacy@tarakan.app. You can ask to access, correct, or delete your information or to suspend its processing, and you can complain to the Personal Information Protection Commission (pipc.go.kr) or the Personal Information Infringement Report Center (privacy.kisa.or.kr, phone 118).
Under the Act on the Protection of Personal Information (APPI), the identifiers and device data described above may be "personally referable information". We provide it to Google LLC in the United States. The United States has no comprehensive federal privacy law; Google handles the data under its data processing terms, which are the measures we rely on for this transfer.
Our Websites send nothing from your browser to any third party: every page, font, and image comes from our own sites, and the only thing your browser keeps is the language you pick. Cloudflare, Inc. in the United States hosts the Websites on our behalf and receives the request data any web server needs (IP address, browser and device type, the page requested, and the page you came from), which it handles under its data processing terms.
Information sent from your device to third parties: Google AdMob (ad requests with device and app information, for non-personalised ads), Firebase Crashlytics (crash reports with an installation identifier, for fixing crashes), Firebase Remote Config (the Game's random identifier and version and the device's language, for game settings), and Firebase Analytics (gameplay events with an app-instance identifier, for improving the Game). You can ask us to disclose, correct, or stop using your information at privacy@tarakan.app, and you can complain to the Personal Information Protection Commission (ppc.go.jp).
Players elsewhere, including in the United States, Canada, Australia, Latin America, Asia, and the Middle East, have the rights their local law gives them. These usually include access, correction, deletion, and objection, and sometimes portability or withdrawing consent. Email privacy@tarakan.app to use them. You can also complain to your local data protection authority.
Depending on where you live, you (or a parent for a child) may have the right to:
To use any of them, email privacy@tarakan.app. We will not treat you differently for doing so.
When we change this policy we will post the new version here with a new effective date. If a change materially affects how we handle information, we will also say so on this page before it applies.
Questions about this policy or your child's information can go to Tarakan Limited at privacy@tarakan.app.
In New Zealand, if you are not satisfied with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz. Elsewhere, you can complain to your local data protection authority; several are listed in "Information for your region" above.