Privacy Policy

Last updated: August 5, 2026

This document is provided in English.

This policy explains what happens to data when you use our website or play our games. It sits alongside our Terms of Service, which cover the rules of using the games themselves.

1. Who we are

Goatinho games are made by Catchy, an independent game studio. You can reach us any time at info@catchy.games. For privacy questions, that address is also the contact point for the data controller.

2. What this policy covers

It covers the website goatinho.app and every Goatinho game we publish, on every platform we publish them on:

• Games: GOATINHO (football), GOATINHO Basketball, Goatinho Cricket, Goatinho Gridiron, the upcoming Goatinho Baseball and Goatinho Volleyball, and any future Goatinho titles.
• Platforms: the web build on goatinho.app, the iOS and Android apps, the CrazyGames build, and the Reddit (Devvit) build.

Some sections only apply to some platforms. Where that is the case, we say so.

3. No accounts, no profiles, no user-generated content

There is nothing to sign up for. We do not ask for your name, email address, phone number, date of birth, or any other profile information, and there is no way to create an account with us.

There is also no user-generated content anywhere in our games or on this site: no chat, no comments, no custom player names, no free-text fields at all. This is deliberate — it keeps the games safe and keeps us out of your personal data.

4. Your game saves stay on your device

Career progress, unlocked badges, museum entries, settings and similar data are stored locally on the device you play on — in your browser's localStorage on the web, or in the app's own storage on mobile. This data is not uploaded to us and we cannot read it.

Because it is local:

• Clearing your browser data, using private/incognito mode, or uninstalling the app deletes your saves.
• Saves do not sync between devices or between browsers.
• We cannot restore a lost save. There is no copy on our side to restore from.

5. The Daily Career leaderboard

The Daily Career mode is the one place where data leaves your device, and only when you choose to submit a run.

5.1 What gets sent

• Your score and a small amount of run summary data (for example the career stats the board displays).
• The run seed — the identifier of that day's shared scenario, used to verify the run belongs to the right board.
• A nickname that the game assigns at random from a fixed pool of fictional names. You cannot type your own name: there is no text input. The nickname is not tied to you and may be reused by other players.

5.2 How it is handled

Leaderboard submissions go to our own backend running on Cloudflare Workers with a Cloudflare D1 database. As with any web request, Cloudflare processes the connecting IP address transiently to route the request and to protect the service against abuse (rate limiting, bot and DDoS protection). We do not store IP addresses alongside leaderboard entries and we do not use them to build any profile of you.

Submitting is optional. If you never submit a Daily Career run, nothing about your play leaves your device.

6. The website (goatinho.app)

The web version is intentionally plain. It contains no advertising SDKs and no analytics SDKs — no Google Analytics, no tracking pixels, no advertising cookies. We do not set cookies for marketing or measurement. The only cookies or similar technologies that may appear are those Cloudflare needs to keep the site secure and available, plus the local storage described in section 4, which is used purely to remember your game.

The site loads web fonts from Google Fonts. When your browser requests those fonts, Google receives the request, including your IP address, as described in the Google Privacy Policy.

7. The mobile apps (iOS and Android)

The mobile builds include two third-party SDKs. Neither one receives your saves or anything you would recognise as personal content — but they do process device-level data.

7.1 Ads — Google AdMob

Ads in our mobile games are rewarded ads only. They are optional and user-initiated: nothing plays unless you tap a button to watch one in exchange for an in-game reward. There are no forced interstitials or banners you cannot avoid. AdMob may process device identifiers (such as Apple's IDFA or Android's advertising ID), IP address, and coarse device and app information to serve and measure ads. See how Google uses data in AdMob and the Google Privacy Policy.

7.2 Attribution and aggregate analytics — Tenjin

We use Tenjin to understand, in aggregate, where installs come from and how the game performs overall. Tenjin may process device identifiers, IP address, and coarse device data for install attribution and aggregate measurement. See the Tenjin Privacy Policy.

7.3 Your choices on mobile

• iOS: Apple's App Tracking Transparency applies. If you decline the tracking prompt, the app does not access the IDFA for tracking purposes and ads are non-personalized. You can change your answer at any time in Settings → Privacy & Security → Tracking.
• EEA, UK and Switzerland: we show Google's UMP consent flow before ads are personalized. If you do not consent, ads are served as non-personalized. You can reopen the consent options from the game's settings screen.
• Android: you can reset or delete your advertising ID in the system settings, which limits ad personalization across all apps.
• Everywhere: buying "Remove Ads" stops ads entirely, which also stops the ad SDK from requesting them.

7.4 Purchases

The mobile games offer a single one-time in-app purchase, Remove Ads. The transaction is handled entirely by the App Store or Google Play. We never receive your card number, billing address, or any other payment details — we only receive the store's confirmation that a purchase exists so we can unlock the feature. Restore purchases is supported so you can re-enable it after reinstalling or on another device signed in to the same store account.

8. The CrazyGames build

On CrazyGames, rewarded ads are served by the CrazyGames SDK, and CrazyGames operates that platform, including any advertising and measurement it performs. Your use of the game there is also subject to the CrazyGames Privacy Policy. Game saves still live in your browser's local storage on that domain.

9. The Reddit build

Our Reddit game runs inside Reddit's Devvit platform, and your use of it is governed by Reddit's own policies, including the Reddit Privacy Policy. We store no personal data from your Reddit account. Whatever Reddit shows or handles inside its app is Reddit's processing, not ours.

10. Third-party services at a glance

11. Why we are allowed to process this data (GDPR legal bases)

If you are in the European Economic Area, the United Kingdom or Switzerland, these are the legal bases we rely on:

• Legitimate interests (Art. 6(1)(f)) — keeping the site and backend secure and available, preventing abuse of the leaderboard, and running the leaderboard itself, which is a core feature you chose to use.
• Consent (Art. 6(1)(a)) — personalized advertising on mobile, collected through Google's UMP consent flow (and Apple's ATT prompt on iOS). You can withdraw it at any time; ads then become non-personalized.
• Performance of a contract (Art. 6(1)(b)) — delivering the "Remove Ads" feature you purchased, including restoring it.

12. How long we keep things

• Daily Career leaderboard entries are kept for the lifetime of the board they belong to — the day's board plus the archive period we display — after which individual entries are deleted or reduced to aggregate statistics (totals, averages, distributions) that no longer identify a single run.
• Local saves stay on your device until you delete them. They are entirely under your control; we hold no copy and no schedule applies.
• Security logs processed by Cloudflare are retained for short, standard periods under Cloudflare's own retention practices.
• Ad and attribution data is retained by Google and Tenjin under their own policies, linked above.
• Emails you send us are kept only as long as needed to answer you.

13. International transfers

We are based in the Republic of Türkiye, and the services we use — Cloudflare, Google, Tenjin, Apple, CrazyGames, Reddit — operate global infrastructure. This means data may be processed in countries outside your own, including the United States. Where these providers transfer personal data out of the EEA, the UK or Switzerland, they do so under the safeguards available to them, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Details are in each provider's policy, linked in the table above.

14. Your rights

14.1 If you are in the EEA, UK or Switzerland (GDPR)

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your local supervisory authority.

14.2 If you are in California (CCPA/CPRA)

You have the right to know what personal information is collected and how it is used, the right to delete it, the right to correct it, and the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising, plus the right not to be discriminated against for exercising these rights. We do not sell personal information for money. Sharing device identifiers with AdMob for personalized ads may be treated as "sharing" under the CPRA; declining Apple's tracking prompt, declining the UMP consent flow, resetting your advertising ID, or buying "Remove Ads" all stop it, and you can also email us to opt out.

14.3 How to exercise them — and an honest limitation

Email info@catchy.games and we will respond within the time limits the law sets. Please note: because there are no accounts and leaderboard nicknames are randomly assigned and shared, we usually have no way to identify which data belongs to you. If you want a specific leaderboard entry removed, tell us the game, the date of the board, and the score and nickname shown, and we will remove it. For anything stored on your device, you can delete it yourself instantly by clearing the site's data or uninstalling the app.

15. Children

Our games are not directed at children under 13, and we do not knowingly collect personal data from children. We do not ask for age, name or any other identifying information from anyone. Where consent for personalized advertising is absent — which is always the case if a user is treated as a child under applicable rules — ads are non-personalized. If you believe a child has provided personal data to us, contact info@catchy.games and we will delete whatever we can identify.

16. Security

Traffic to the site and to our leaderboard backend is encrypted in transit (HTTPS), and the backend runs on Cloudflare's infrastructure with rate limiting and abuse protection. Because we deliberately collect almost nothing, there is very little about you for anyone to steal. No system is perfectly secure, and we do not claim otherwise.

17. Changes to this policy

If we add a feature or a service that changes how data is handled, we will update this page and change the "Last updated" date at the top. Significant changes will also be noted in the games' release notes. Continuing to use the site or the games after an update means the revised policy applies to you.

18. Contact

Catchy — Republic of Türkiye
Email: info@catchy.games
Website: goatinho.app

See also our Terms of Service.