プライバシーポリシー
Cargo Flowは幼いお子様を含む家族向けです。ゲームの提供と保護のため、アカウント識別子と進行状況を保存します。保護者はデータへのアクセスや削除を依頼できます。一部のバージョンでは広告を表示します。任意のリワード広告と、序盤のレベル以降のレベル間広告で、プレイ中には表示しません。詳細は英語の全文に記載しています。削除はSettings → Account → Delete accountから行うか、再インストールせずにsupport@piagames.ioへメールしてください。所有権を確認します。パスワードやログインコードは送らないでください。データ、サービス提供者、保存期間の詳細は英語の全文をご確認ください。 自動ランキングに対応したバージョンでは、すべてのプレイヤーが当社サーバーの生成した名前で公開の累計ランキングに表示されます。名前は、お使いの言語の「プレイヤー」とランダムなコードの組み合わせです。コードはCargo Flow内で一意で、アカウント、端末、プラットフォーム、ストアの識別子から作られたものではなく、この名前に個人データは含まれません。ほかのプレイヤーに見えるのはランキング名、累計スコア、レベルです。大人は自分で入力したニックネームを使えます。ニックネームは当社サーバーでフィルタリングされます。ファミリー表示（子どもと年齢不明のプレイヤー）では、生成された名前のままにするか、リストの候補から選ぶことだけができます。国旗には、サーバーが接続から判定した国が表示されます。Cloudflareが伝えるのは国コードのみで、IPアドレスは保存せず、正確な位置も判定しません。自動のままにするか、別の国を選べます。ファミリー表示でも同じです。すべてのプレイヤーは設定でランキングに表示しないよう選べ、その場合はフレンドランキングにも表示されません。スコアは引き続き自分の進行に反映され、自分の順位は本人だけが見られます。この設定はアカウントとともに当社サーバーに保存されます。 Androidのフレンドランキングに対応したバージョンでは、フレンド画面を開くと、プラットフォームでの許可に基づき当社サーバーがGoogleから最新のリストを取得します。ゲーム専用の識別子を、公開されているCargoランキングのプロフィール（自分を非表示にしていないプレイヤー）とだけ一時的に照合します。リストは保存せず、プラットフォーム上のフレンドの名前や写真も取得しません。アプリが結果を保持するのは画面が開いてアクティブな間だけです。プラットフォームのアカウント設定でアクセスを取り消せます。新たな読み込みのたびに権限を確認します。この操作で公開ランキングに表示されるかどうかは変わりません。この機能のないバージョンはフレンドを取得しません。 iOSのフレンドランキングに対応したバージョンでは、端末上のGameKitが、このアクセスを許可したフレンドを読み取ります。開発者単位の識別子は、このゲームの公開Cargoランキングプロフィールとの照合に限り、一時的に当社サーバーへ送信されます。このリストは保存せず、報酬の付与には使用しません。フレンドのプラットフォーム上の名前や写真も使用しません。画面上での保持期間とアクセスの取り消しには同じルールが適用されます。 任意の診断データ（設定の「診断データを共有」）は初期設定でオフで、大人にのみ表示され、子どもや年齢が不明な場合には表示されません。オンにすると、名前・スコア・購入・年齢を含まない、アカウントに紐づくエラー・接続・レベル終了の分類を送信します。受信から30日後、オフにしたとき、またはアカウント削除時に削除されます。 結果シェアに対応したバージョンでは、クリアしたレベルをシェアできます。シェアすると、サーバーがランダムなリンク（piagames.io/cargo-flow/r/…）に公開ページを作成します。このページに表示されるのは、そのレベルについてサーバーが検証した結果（レベル、星、タイム、スコア、時間内の配達）のみです。ランキングに表示されている間は、ランキング名も表示されます。ランキングで非表示にしている場合、名前は表示されません。アカウントや端末の識別子が含まれることはありません。リンクを知っている人は誰でも閲覧できます。ファミリー表示では、シェアの前に保護者の承認が必要です。シェアした結果は、サービスが定める一定期間が過ぎたとき、またはアカウントを削除したときに自動で削除されます。 Meta と TikTok のキャンペーン計測を含むバージョンは、成人と確認できたプレイヤーに対してのみ、共通の広告プライバシー選択の後に開始します。子どもや年齢不明の場合には開始しません。詳細は英語本文にあります。 成人と確認できたプレイヤー（プラットフォームの年齢シグナル、またはご自身の成人回答）だけが通常の広告リクエストを受け、共通の広告プライバシー選択が許可する場合に限りパーソナライズされます。その他のプレイヤーは広告IDを使わない子ども向け処理のままで、年齢はこの処理を選ぶためにのみ端末内で使われます。 インストール元の計測は、成人と分かっている場合にのみ行います。Android では Google Play インストールリファラーのキャンペーンラベル（ソース、メディア、キャンペーン）、iOS では「App Store」のみです。アカウントとともに保存され、子どもや年齢不明の場合は一切記録せず、共有せず、アカウント削除で消去されます。詳細は英語の本文をご覧ください。 Google Analytics for Firebase を含むバージョンでは、共通の広告プライバシー設定で許可した、年齢が確認できた大人の場合にのみ有効になります。子どもや年齢が不明な場合は使われません。通知の許可はメニューで尋ね、起動時には尋ねません。リマインダーは端末内で予約されます。サーバーは Firebase Cloud Messaging のトークンを、アプリが送るはい/いいえの値ひとつ（はいになるのは年齢が確認できた大人だけ）とともにアカウントに保存しますが、何かを送るためには使いません。当社サーバーから通知は送らず、宣伝の通知もありません。通知は端末内で予約される毎日の配達ルート報酬のリマインダーだけです。詳細は英語の本文をご覧ください。 iOSではAppleのトラッキング許可も必要です。新しいバージョンでは、許可された識別子とイベントを当社サーバー経由でMetaに送信します。以前のバージョンはSDKから直接送信します。サーバーは未送信イベントを最大24時間保存し、送信後に識別情報を削除し、イベントIDを7日間保持します。リワード広告はGoogleの署名付き完了確認を待ちます。金額は推定値です。TikTokはAndroidのみで使用します。 任意の診断では、アカウントに紐づく最初のステージのチュートリアル段階、一時停止、バックグラウンド移行と復帰、メニューや再挑戦の選択、接続待ち、失敗とクリアも記録します。バックグラウンド移行やイベントの欠落は終了やクラッシュの証拠ではありません。新しい追跡用識別子は作成しません。
We store your Cargo player identifier, session credentials, level results, game currency, depot upgrades and active gameplay commands. We use them to provide your game, save progress and prevent cheating. Versions offering Play as Guest let you play without a platform account: the server saves your depot and a device-held credential controls access. Until you link an account, losing the device or app data can make that depot unrecoverable. On a fresh installation, the game attempts platform sign-in before offering guest entry. If platform sign-in succeeds or you link your guest depot, we also store the verified Game Center or Google Play Games identifier and account link. We do not receive your platform password or request your email address, address book, photos or precise location. In versions with automatic rankings, every player appears in the public all-time rankings under a pseudonymous name generated by our server: the word “Player” in your language followed by a random code. The code is unique within Cargo Flow and is not derived from your account, device, platform or store identifiers; the generated name contains no personal data. Other players see your ranking name, all-time score and level. Adults can replace the generated name with a nickname they type, which our server filters. In the family view, used for children and players whose age is unknown, you can keep the generated name or pick a suggested name from a list; typed names are not available. A flag shows the country our server reads from your connection: Cloudflare reports only the country code; we do not store your IP address and never determine a precise location. You can keep it automatic or choose another country; the country can change at most once in a period set by our service. This works the same in the family view. Any player can turn on the Settings option that hides them from rankings. Hidden players are not shown to other players, including in friends rankings; their scores still count for their own progress, and only they see their own rank. We store this choice with your Cargo account on our server. Earlier versions showed a ranking profile only after you joined, and leaving rankings removed it while keeping your depot progress. Builds with Share diagnostics in Settings offer it only when the platform signal or your own age answer indicates an adult; it is off by default and never offered to children or when age is unknown. If you turn it on, the game sends fixed categories to our server: app session start, first-delivery steps, level finishes (first or later level, won or lost, new or replay), connection and reconnection outcomes, and error types. These records contain no name, score, wallet, purchase, message text, device profile or age. They are linked to your Cargo account and a random installation identifier so they can be deleted. Turning the switch off stops collection and deletes this installation's diagnostic records; deleting the account deletes them all. No third-party analytics or crash-reporting service receives them. In versions with result sharing, you can choose to share a completed level. Our server then creates a public page at a random link (piagames.io/cargo-flow/r/…) that shows only results our server verified for that level: level, stars, time, score and on-time deliveries. While you are visible in rankings, the page also shows your ranking name; if you hide yourself from rankings, it shows no name. It never contains your account or device identifiers. Anyone with the link can view it. In the family view, a parent must approve sharing first. Shared results are removed automatically after a limited period set by our service, and when you delete your account. Optional diagnostics also records account-linked first-level tutorial steps, pauses, background/return events, menu and restart choices, connection waits, losses and completions. Backgrounding or missing events does not prove an app exit or crash. No new tracking identifier is created.
You can report a player from rankings or a shared result. We store the reporter and reported player identifiers, the displayed name at report time, reason, optional note, dates and review outcome for up to 365 days. These reports are reviewed by our team and are not public. Reporting replaces that player’s name with a generated name in your view; the personal hidden list stays with your account and can be undone from Rankings → Hidden players. Deleting your account removes your reports and hidden list. Reports made by others about your account are closed and retained for review until this retention period expires. Please do not include personal information in a report.
In Settings → Send feedback you can write to the team. We store the topic, your message, the game version, the platform and your Cargo player identifier, read it to support you and improve the game, and keep it for up to 365 days; deleting your account removes it sooner. Messages are not shown in the store or to other players. Please do not include personal details. The family view does not offer this option.
In versions with install-source measurement, the game records where it was installed from, and only for a known adult (the platform's age signal or your own adult answer); for children and when age is unknown nothing is read or sent. On Android it reads the Google Play install referrer once and keeps only four campaign labels (source, medium, campaign and content, for example “instagram / social / bio”); on iOS it only notes “App Store”. Our server stores these labels with your Cargo player identifier, the platform, whether this device started a new depot, the day the depot was created and whether you opened the game again on the next day and on the seventh day. We use this only to see which channels bring players who keep playing. It contains no advertising ID, click ID, IP address or device profile, is not shared with anyone and is kept for up to 395 days; deleting your account removes it sooner.
In versions with Google Analytics for Firebase, the game turns it on only for a known adult (the platform's age signal or your own adult answer) who allowed analytics in the shared ad privacy choices. It is never started for children or when age is unknown, and it stops collecting if that changes or you withdraw the choice. It measures app use, such as first open, sessions, completed levels and, on iOS, App Store purchases verified by Apple, to understand how the game is played and to measure our Google Ads campaigns. We do not give it your Cargo player identifier, name, score, age or email; on iOS it does not collect the advertising identifier (IDFA) or the vendor identifier, and ad personalization signals stay off. Google processes this data under its own policies and keeps it for the retention period set in our Google Analytics property. Deleting your account resets the app's local analytics identifier but does not erase data Google already holds; ask us for help with that. See Google Privacy.
In versions with notifications, the game asks for permission on the menu after you have completed some levels, never at launch. You can turn notifications off in Settings or in your phone settings. The only notification is the reminder that today's delivery route reward is ready: it is scheduled on your device and sends nothing to us. We do not send notifications from our server, and there are no promotional notifications. The app still registers a Firebase Cloud Messaging token with our server, together with your Cargo player identifier, platform, app language, app version and one yes/no value about promotional announcements, which the app sets to yes only for a known adult. No age or age group is sent. We do not use the token or this value to send anything. The token is deleted when you turn notifications off, when you delete your account, or after 270 days without use.
Cloudflare hosts the service and database and processes network information, including IP addresses, request URLs and technical error logs, for delivery and security. Google Firebase App Check and Apple or Google platform services process app/device verification and sign-in information. Connections are encrypted in transit. These providers may process data outside your country under their applicable safeguards and privacy policies. Google Analytics for Firebase and Firebase Cloud Messaging are described below; versions without them do not use them. If you email support, we receive your email address and the information you choose to send. Google Play Games also processes your gamer tag/avatar when you create or update its profile, and usage and diagnostic information to maintain and improve its services. In versions with Android friends rankings, opening Friends uses your platform permission to fetch a fresh friends list from Google on our server. We temporarily match game-scoped identifiers only to public Cargo ranking profiles (players who have not hidden themselves). We do not store the friends list or request friends’ platform names or photos. The app keeps ranking results only while the screen is open and active. You can withdraw friends access in your platform account settings; the next read checks access again. This does not change whether you appear in the public Cargo rankings. Versions without this flow do not request friends. Google-held Play Games data can be managed or deleted through your Play Games profile or Google account; deleting Cargo does not automatically erase that separate data. See Google Privacy and Google Play Games data deletion. In versions with iOS friends rankings, GameKit on your device reads the friends who have allowed this access. Their developer-scoped identifiers are sent temporarily to our server to match only public Cargo ranking profiles in this game. We do not store this list or use it to grant rewards, and we do not use friends’ platform names or photos. The same screen lifetime and access-withdrawal rules apply.
Cargo Flow is intended for families, including children aged five and under. In builds with age screening, Game Center or Google Play may provide an age signal for account guidance and age-appropriate store access. If no signal is available, you can choose an age group or skip. Only your manual choice is remembered locally for this depot. No age answer or age group is sent to our server, analytics, Google or anyone else. On the device it decides the ad treatment described below (child treatment for everyone except a known adult) and which optional sharing and measurement are offered; the only value derived from it that reaches our server is the yes/no value stored with the notification token, which we do not use to send anything (see notifications). A parent or guardian should manage a young child's platform account and privacy requests. We use game identifiers for gameplay, recovery and security, not to build advertising profiles of children. Earlier builds may ask everyone a parent question. With age-based store access, adults and players whose age remains unknown can open the store directly. A minor signal, an under-18 answer or required store verification keeps the parent question. The platform handles payment approval. Purchases and advertisements are described below. Parents can contact support@piagames.io to ask about, access or request deletion of their child's data.
Ad-supported builds show Google advertisements: optional rewarded ads and, after the early levels, full-screen ads between levels. Between-level ads appear only after the player chooses to continue, never during play or at launch. Every player who is not a known adult, including when age is unknown, receives child age treatment, general-audience content filtering and non-personalized ad requests, and no advertising ID is used for them. A known adult (an adult platform age signal, or your own adult answer on the neutral age screen) receives ordinary ad requests: Google Mobile Ads may then read the Android advertising ID or, on iOS, Apple's identifier for vendor and, if Apple tracking permission is granted, its advertising identifier, and whether ads are personalized is governed by the shared ad privacy choice shown by its User Messaging Platform where that applies; if that choice does not allow personalized ads, requests are non-personalized. The age result is used only on your device to choose this treatment; it is never sent to us, Google or anyone else. On iOS, versions with Meta measurement request Apple tracking permission only after a known adult allows Meta in the shared privacy choice; denial or an unanswered request keeps Meta measurement off. The Android advertising ID is read for Meta or TikTok campaign measurement (below) only for a known adult who allowed that recipient. Google Mobile Ads and its User Messaging Platform may process network/device diagnostics, app-scoped device identifiers (such as the Android app set ID or the iOS identifier for vendor), general location inferred from IP addresses and ad interaction data to deliver ads, prevent fraud and manage applicable privacy choices. Settings shows ad privacy choices when the provider requires them. To verify a reward, Google receives a one-view random alias and placement nonce, not the persistent Cargo account identifier. Our server links that nonce to the eligible reward and stores the signed transaction and verification time. The app cannot grant a reward from an unverified viewing claim. Earlier internal builds without this SDK do not make these ad requests. Versions that include Meta and TikTok campaign measurement on Android start them only for a known adult (an adult platform age signal or your own adult answer) and only after the shared ad privacy choice allows that recipient; children, players whose age is unknown and anyone who answered as a minor never start them, and losing that status withdraws the choice. Meta measurement then sends Meta (Facebook and Instagram), through our server, the Android advertising ID, app and device information, new installations and estimated ad revenue with its currency, to measure and improve our advertising; TikTok's SDK sends TikTok the advertising ID, the Google Play install referrer, app and device information, its own install and open events and the completed level. No name, player ID, score, purchase or email goes to either. Only a known adult's ad requests leave child treatment, so only a known adult can see the shared ad privacy message that allows these recipients; every other player's requests stay child-directed, non-personalized, and no advertising ID is read or shared for them. The app keeps unsent Meta events for up to 24 hours; on Android and in newer iOS versions our server also keeps unsent Meta events for up to 24 hours, clears identifying event data after delivery and keeps event IDs for 7 days to prevent duplicates; the consent record is removed with the account. Withdrawing the choice in the ad privacy options under Settings stops new sharing and deletes unsent events; data already sent is handled under Meta's and TikTok's own privacy policies. In earlier iOS versions, the Meta SDK sends the permitted advertising identifier (IDFA), app version, operating-system version, new-install and estimated ad-revenue events directly to Meta. The SDK starts only after the current shared Meta choice and Apple tracking permission are both granted. Automatic app events, purchases, screen metadata and product-improvement logging are disabled. Withdrawing consent cancels pending delivery and clears the app’s unsent events; a request already received by Meta cannot be recalled. Updating the game is not reported as a new install. Newer iOS versions send the same permitted identifier, app information and events through our server to Meta. The Meta SDK is not initialized for this delivery. Rewarded-ad events wait for Google’s signed completion verification; their monetary value remains an SDK-reported estimate, not verified payment income. Between-level ad events are not sent through this iOS route. Current Meta consent and Apple tracking permission remain required. Identifying data in the server queue is deleted after delivery or expiry; withdrawing consent removes pending server events when the device can reach our server.
Purchase-enabled builds offer consumable Diamonds through Apple App Store or Google Play. The store handles payment; we do not receive card details. We verify transaction identifiers, signed receipts or purchase tokens, product, quantity, price/currency when provided, purchase time, environment and an account-scoped purchase alias to deliver Diamonds to the correct Cargo depot and prevent duplicate grants. We keep delivery, refund and reversal records. A guest purchase belongs to that guest depot: link the depot before losing device data to recover remaining Diamonds on another device. Used Diamonds are not restored as new Diamonds. Refunds follow the platform process; verified refunds remove available Diamonds, and any spent shortfall is recovered from future Diamond earnings. Purchases may be held for account/support review. Cargo does not collect consent for or send Apple optional purchase-consumption reports. The parent challenge is not proof of age or legal parental consent.
Account and progress data stay while the account exists. Confirmed deletion removes them from the active game database and revokes game sessions. Technical logs expire within 7 days; database recovery history can persist for up to 30 days. A hash used to prevent reuse of a sign-in proof expires automatically and is not a player profile. Support correspondence is kept as needed to resolve the request and meet applicable legal obligations; ask us about the records relating to you. Ad verification receipts are removed with the account, or after 90 days beyond their settlement deadline. Deleting Cargo data does not automatically delete records held separately by Google under its policies. After account deletion, purchase, refund and audit records remain with their Cargo player reference removed to prevent transaction reuse and resolve payment disputes; store transaction identifiers can still be linked by the payment provider and are not claimed to be anonymous. Apple and Google retain their own payment records under their policies. Diagnostic records are deleted 30 days after receipt, or earlier when you turn Share diagnostics off or delete the account.
Contact support@piagames.io to request access, correction or deletion, object to processing, or withdraw any consent you have given. Your rights depend on applicable law, including the right to contact a data protection authority. We use information needed to deliver the requested game and protect the service; where consent is legally required, it must be obtained before that processing. We do not sell personal information. See アカウントの削除 for account removal.