Dasar privasi
Cargo Flow direka untuk keluarga, termasuk kanak-kanak kecil. Kami menyimpan pengecam akaun dan kemajuan untuk menyediakan dan melindungi permainan. Ibu bapa atau penjaga boleh meminta akses atau pemadaman. Sesetengah versi memaparkan iklan: iklan ganjaran pilihan dan, selepas tahap awal, iklan antara tahap, tidak sekali-kali semasa bermain. Untuk memadam akaun, buka Tetapan → Akaun → Padam akaun atau hubungi support@piagames.io tanpa memasang semula permainan. Kami menyemak pemilikan akaun. Jangan hantar kata laluan atau kod log masuk. Teks bahasa Inggeris menerangkan data, penyedia dan tempoh penyimpanan. Dalam versi dengan kedudukan automatik, setiap pemain dipaparkan dalam kedudukan awam sepanjang masa dengan nama yang dijana oleh pelayan kami: perkataan “Pemain” dalam bahasa anda dan kod rawak yang unik dalam Cargo Flow serta tidak diterbitkan daripada pengecam akaun, peranti, platform atau kedai; nama ini tidak mengandungi data peribadi. Pemain lain melihat nama kedudukan, jumlah skor dan tahap. Orang dewasa boleh menaip nama samaran sendiri yang ditapis oleh pelayan kami; paparan keluarga (kanak-kanak dan umur tidak diketahui) hanya membenarkan nama yang dijana dikekalkan atau nama cadangan dipilih daripada senarai. Bendera menunjukkan negara yang dikenal pasti oleh pelayan kami daripada sambungan anda: Cloudflare hanya memberikan kod negara; kami tidak menyimpan alamat IP anda dan tidak pernah menentukan lokasi tepat. Anda boleh membiarkannya automatik atau memilih negara lain, termasuk dalam paparan keluarga. Mana-mana pemain boleh menyembunyikan diri daripada kedudukan dalam Tetapan, termasuk kedudukan rakan; skor tetap dikira untuk kemajuan sendiri dan hanya pemain itu melihat kedudukannya. Pilihan ini disimpan bersama akaun di pelayan kami. Dalam versi dengan kedudukan rakan Android, membuka Rakan membolehkan pelayan kami mendapatkan senarai terkini daripada Google dengan izin platform anda. Pengecam khusus permainan dipadankan sementara hanya dengan profil kedudukan Cargo awam (pemain yang tidak menyembunyikan diri). Kami tidak menyimpan senarai atau meminta nama dan foto rakan di platform. Aplikasi menyimpan hasil hanya semasa skrin terbuka dan aktif. Anda boleh menarik balik akses dalam tetapan akaun platform; setiap bacaan baharu menyemak akses. Ini tidak mengubah sama ada anda dipaparkan dalam kedudukan awam. Versi tanpa aliran ini tidak meminta rakan. Dalam versi dengan kedudukan rakan iOS, GameKit pada peranti membaca rakan yang membenarkan akses ini. Pengecam mereka dalam skop pembangun dihantar sementara ke pelayan kami untuk dipadankan hanya dengan profil kedudukan Cargo awam dalam permainan ini. Kami tidak menyimpan senarai ini atau menggunakannya untuk memberikan ganjaran, dan tidak menggunakan nama atau foto rakan di platform. Peraturan yang sama tentang tempoh paparan dan penarikan balik akses terpakai. Diagnostik pilihan (Kongsi diagnostik dalam Tetapan) dimatikan secara lalai, hanya ditawarkan kepada orang dewasa dan tidak sekali-kali kepada kanak-kanak atau jika umur tidak diketahui. Jika dihidupkan, permainan menghantar kategori ralat, sambungan dan tamat tahap yang dipautkan kepada akaun, tanpa nama, skor, pembelian atau umur; ia dipadam selepas 30 hari, apabila dimatikan atau apabila akaun dipadam. Dalam versi yang membolehkan perkongsian keputusan, anda boleh memilih untuk berkongsi tahap yang telah selesai. Pelayan kami kemudian mencipta halaman awam pada pautan rawak (piagames.io/cargo-flow/r/…) yang hanya memaparkan keputusan tahap itu yang telah disahkan oleh pelayan kami: tahap, bintang, masa, skor dan penghantaran tepat pada masanya. Selagi anda kelihatan dalam kedudukan, halaman itu juga memaparkan nama kedudukan anda; jika anda menyembunyikan diri daripada kedudukan, tiada nama dipaparkan. Halaman itu tidak sekali-kali mengandungi pengecam akaun atau peranti anda. Sesiapa yang mempunyai pautan boleh melihatnya. Dalam paparan keluarga, ibu bapa mesti meluluskan perkongsian terlebih dahulu. Keputusan yang dikongsi dialih keluar secara automatik selepas tempoh terhad yang ditetapkan oleh perkhidmatan kami dan apabila anda memadam akaun. Versi dengan pengukuran kempen Meta dan TikTok memulakannya hanya untuk orang dewasa yang diketahui dan selepas pilihan privasi iklan bersama; tidak sekali-kali untuk kanak-kanak atau apabila umur tidak diketahui; butirannya ada dalam teks bahasa Inggeris. Hanya orang dewasa yang diketahui (isyarat umur platform atau jawapan dewasa anda sendiri) menerima permintaan iklan biasa, diperibadikan hanya jika pilihan privasi iklan bersama membenarkannya; pemain lain kekal dengan layanan kanak-kanak tanpa ID iklan, dan umur hanya digunakan pada peranti untuk memilih layanan itu. Pengukuran sumber pemasangan hanya berjalan untuk orang dewasa yang diketahui: di Android, label kempen daripada perujuk pemasangan Google Play (sumber, medium, kempen); di iOS hanya “App Store”. Ia disimpan bersama akaun, tidak sekali-kali untuk kanak-kanak atau apabila umur tidak diketahui, tidak dikongsi dan dipadam bersama akaun; butiran dalam teks bahasa Inggeris. Versi dengan Google Analytics for Firebase hanya mengaktifkannya untuk orang dewasa yang diketahui yang telah membenarkannya dalam pilihan privasi iklan bersama; tidak sekali-kali untuk kanak-kanak atau apabila umur tidak diketahui. Kebenaran pemberitahuan diminta di menu, bukan semasa permainan dibuka; peringatan dijadualkan pada peranti. Pelayan kami menyimpan token Firebase Cloud Messaging bersama akaun dan satu nilai ya/tidak yang dihantar oleh aplikasi (ya hanya untuk orang dewasa yang diketahui), tetapi tidak menggunakannya untuk menghantar apa-apa: kami tidak menghantar pemberitahuan dari pelayan kami dan tiada pemberitahuan promosi; satu-satunya pemberitahuan ialah peringatan ganjaran laluan harian yang dijadualkan pada peranti. Butiran ada dalam teks bahasa Inggeris. Pada iOS, kebenaran penjejakan Apple juga diperlukan. Versi baharu menghantar pengecam dan peristiwa yang dibenarkan kepada Meta melalui pelayan kami; versi lama menggunakan SDK secara terus. Pelayan menyimpan peristiwa tertunda sehingga 24 jam, memadam data pengenalan selepas penghantaran dan menyimpan ID peristiwa selama 7 hari. Iklan ganjaran menunggu pengesahan lengkap bertandatangan Google; nilainya kekal anggaran. TikTok hanya digunakan pada Android. Diagnostik pilihan turut merekod langkah tutorial tahap pertama, jeda, latar belakang dan kembali, pilihan menu atau mula semula, penantian sambungan, kekalahan dan penyelesaian yang dikaitkan dengan akaun. Latar belakang atau peristiwa yang hilang tidak membuktikan penutupan atau ranap. Tiada pengecam penjejakan baharu dicipta.
We store your Cargo player identifier, session credentials, level results, game currency, depot upgrades and active gameplay commands. We use them to provide your game, save progress and prevent cheating. Versions offering Play as Guest let you play without a platform account: the server saves your depot and a device-held credential controls access. Until you link an account, losing the device or app data can make that depot unrecoverable. On a fresh installation, the game attempts platform sign-in before offering guest entry. If platform sign-in succeeds or you link your guest depot, we also store the verified Game Center or Google Play Games identifier and account link. We do not receive your platform password or request your email address, address book, photos or precise location. In versions with automatic rankings, every player appears in the public all-time rankings under a pseudonymous name generated by our server: the word “Player” in your language followed by a random code. The code is unique within Cargo Flow and is not derived from your account, device, platform or store identifiers; the generated name contains no personal data. Other players see your ranking name, all-time score and level. Adults can replace the generated name with a nickname they type, which our server filters. In the family view, used for children and players whose age is unknown, you can keep the generated name or pick a suggested name from a list; typed names are not available. A flag shows the country our server reads from your connection: Cloudflare reports only the country code; we do not store your IP address and never determine a precise location. You can keep it automatic or choose another country; the country can change at most once in a period set by our service. This works the same in the family view. Any player can turn on the Settings option that hides them from rankings. Hidden players are not shown to other players, including in friends rankings; their scores still count for their own progress, and only they see their own rank. We store this choice with your Cargo account on our server. Earlier versions showed a ranking profile only after you joined, and leaving rankings removed it while keeping your depot progress. Builds with Share diagnostics in Settings offer it only when the platform signal or your own age answer indicates an adult; it is off by default and never offered to children or when age is unknown. If you turn it on, the game sends fixed categories to our server: app session start, first-delivery steps, level finishes (first or later level, won or lost, new or replay), connection and reconnection outcomes, and error types. These records contain no name, score, wallet, purchase, message text, device profile or age. They are linked to your Cargo account and a random installation identifier so they can be deleted. Turning the switch off stops collection and deletes this installation's diagnostic records; deleting the account deletes them all. No third-party analytics or crash-reporting service receives them. In versions with result sharing, you can choose to share a completed level. Our server then creates a public page at a random link (piagames.io/cargo-flow/r/…) that shows only results our server verified for that level: level, stars, time, score and on-time deliveries. While you are visible in rankings, the page also shows your ranking name; if you hide yourself from rankings, it shows no name. It never contains your account or device identifiers. Anyone with the link can view it. In the family view, a parent must approve sharing first. Shared results are removed automatically after a limited period set by our service, and when you delete your account. Optional diagnostics also records account-linked first-level tutorial steps, pauses, background/return events, menu and restart choices, connection waits, losses and completions. Backgrounding or missing events does not prove an app exit or crash. No new tracking identifier is created.
You can report a player from rankings or a shared result. We store the reporter and reported player identifiers, the displayed name at report time, reason, optional note, dates and review outcome for up to 365 days. These reports are reviewed by our team and are not public. Reporting replaces that player’s name with a generated name in your view; the personal hidden list stays with your account and can be undone from Rankings → Hidden players. Deleting your account removes your reports and hidden list. Reports made by others about your account are closed and retained for review until this retention period expires. Please do not include personal information in a report.
In Settings → Send feedback you can write to the team. We store the topic, your message, the game version, the platform and your Cargo player identifier, read it to support you and improve the game, and keep it for up to 365 days; deleting your account removes it sooner. Messages are not shown in the store or to other players. Please do not include personal details. The family view does not offer this option.
In versions with install-source measurement, the game records where it was installed from, and only for a known adult (the platform's age signal or your own adult answer); for children and when age is unknown nothing is read or sent. On Android it reads the Google Play install referrer once and keeps only four campaign labels (source, medium, campaign and content, for example “instagram / social / bio”); on iOS it only notes “App Store”. Our server stores these labels with your Cargo player identifier, the platform, whether this device started a new depot, the day the depot was created and whether you opened the game again on the next day and on the seventh day. We use this only to see which channels bring players who keep playing. It contains no advertising ID, click ID, IP address or device profile, is not shared with anyone and is kept for up to 395 days; deleting your account removes it sooner.
In versions with Google Analytics for Firebase, the game turns it on only for a known adult (the platform's age signal or your own adult answer) who allowed analytics in the shared ad privacy choices. It is never started for children or when age is unknown, and it stops collecting if that changes or you withdraw the choice. It measures app use, such as first open, sessions, completed levels and, on iOS, App Store purchases verified by Apple, to understand how the game is played and to measure our Google Ads campaigns. We do not give it your Cargo player identifier, name, score, age or email; on iOS it does not collect the advertising identifier (IDFA) or the vendor identifier, and ad personalization signals stay off. Google processes this data under its own policies and keeps it for the retention period set in our Google Analytics property. Deleting your account resets the app's local analytics identifier but does not erase data Google already holds; ask us for help with that. See Google Privacy.
In versions with notifications, the game asks for permission on the menu after you have completed some levels, never at launch. You can turn notifications off in Settings or in your phone settings. The only notification is the reminder that today's delivery route reward is ready: it is scheduled on your device and sends nothing to us. We do not send notifications from our server, and there are no promotional notifications. The app still registers a Firebase Cloud Messaging token with our server, together with your Cargo player identifier, platform, app language, app version and one yes/no value about promotional announcements, which the app sets to yes only for a known adult. No age or age group is sent. We do not use the token or this value to send anything. The token is deleted when you turn notifications off, when you delete your account, or after 270 days without use.
Cloudflare hosts the service and database and processes network information, including IP addresses, request URLs and technical error logs, for delivery and security. Google Firebase App Check and Apple or Google platform services process app/device verification and sign-in information. Connections are encrypted in transit. These providers may process data outside your country under their applicable safeguards and privacy policies. Google Analytics for Firebase and Firebase Cloud Messaging are described below; versions without them do not use them. If you email support, we receive your email address and the information you choose to send. Google Play Games also processes your gamer tag/avatar when you create or update its profile, and usage and diagnostic information to maintain and improve its services. In versions with Android friends rankings, opening Friends uses your platform permission to fetch a fresh friends list from Google on our server. We temporarily match game-scoped identifiers only to public Cargo ranking profiles (players who have not hidden themselves). We do not store the friends list or request friends’ platform names or photos. The app keeps ranking results only while the screen is open and active. You can withdraw friends access in your platform account settings; the next read checks access again. This does not change whether you appear in the public Cargo rankings. Versions without this flow do not request friends. Google-held Play Games data can be managed or deleted through your Play Games profile or Google account; deleting Cargo does not automatically erase that separate data. See Google Privacy and Google Play Games data deletion. In versions with iOS friends rankings, GameKit on your device reads the friends who have allowed this access. Their developer-scoped identifiers are sent temporarily to our server to match only public Cargo ranking profiles in this game. We do not store this list or use it to grant rewards, and we do not use friends’ platform names or photos. The same screen lifetime and access-withdrawal rules apply.
Cargo Flow is intended for families, including children aged five and under. In builds with age screening, Game Center or Google Play may provide an age signal for account guidance and age-appropriate store access. If no signal is available, you can choose an age group or skip. Only your manual choice is remembered locally for this depot. No age answer or age group is sent to our server, analytics, Google or anyone else. On the device it decides the ad treatment described below (child treatment for everyone except a known adult) and which optional sharing and measurement are offered; the only value derived from it that reaches our server is the yes/no value stored with the notification token, which we do not use to send anything (see notifications). A parent or guardian should manage a young child's platform account and privacy requests. We use game identifiers for gameplay, recovery and security, not to build advertising profiles of children. Earlier builds may ask everyone a parent question. With age-based store access, adults and players whose age remains unknown can open the store directly. A minor signal, an under-18 answer or required store verification keeps the parent question. The platform handles payment approval. Purchases and advertisements are described below. Parents can contact support@piagames.io to ask about, access or request deletion of their child's data.
Ad-supported builds show Google advertisements: optional rewarded ads and, after the early levels, full-screen ads between levels. Between-level ads appear only after the player chooses to continue, never during play or at launch. Every player who is not a known adult, including when age is unknown, receives child age treatment, general-audience content filtering and non-personalized ad requests, and no advertising ID is used for them. A known adult (an adult platform age signal, or your own adult answer on the neutral age screen) receives ordinary ad requests: Google Mobile Ads may then read the Android advertising ID or, on iOS, Apple's identifier for vendor and, if Apple tracking permission is granted, its advertising identifier, and whether ads are personalized is governed by the shared ad privacy choice shown by its User Messaging Platform where that applies; if that choice does not allow personalized ads, requests are non-personalized. The age result is used only on your device to choose this treatment; it is never sent to us, Google or anyone else. On iOS, versions with Meta measurement request Apple tracking permission only after a known adult allows Meta in the shared privacy choice; denial or an unanswered request keeps Meta measurement off. The Android advertising ID is read for Meta or TikTok campaign measurement (below) only for a known adult who allowed that recipient. Google Mobile Ads and its User Messaging Platform may process network/device diagnostics, app-scoped device identifiers (such as the Android app set ID or the iOS identifier for vendor), general location inferred from IP addresses and ad interaction data to deliver ads, prevent fraud and manage applicable privacy choices. Settings shows ad privacy choices when the provider requires them. To verify a reward, Google receives a one-view random alias and placement nonce, not the persistent Cargo account identifier. Our server links that nonce to the eligible reward and stores the signed transaction and verification time. The app cannot grant a reward from an unverified viewing claim. Earlier internal builds without this SDK do not make these ad requests. Versions that include Meta and TikTok campaign measurement on Android start them only for a known adult (an adult platform age signal or your own adult answer) and only after the shared ad privacy choice allows that recipient; children, players whose age is unknown and anyone who answered as a minor never start them, and losing that status withdraws the choice. Meta measurement then sends Meta (Facebook and Instagram), through our server, the Android advertising ID, app and device information, new installations and estimated ad revenue with its currency, to measure and improve our advertising; TikTok's SDK sends TikTok the advertising ID, the Google Play install referrer, app and device information, its own install and open events and the completed level. No name, player ID, score, purchase or email goes to either. Only a known adult's ad requests leave child treatment, so only a known adult can see the shared ad privacy message that allows these recipients; every other player's requests stay child-directed, non-personalized, and no advertising ID is read or shared for them. The app keeps unsent Meta events for up to 24 hours; on Android and in newer iOS versions our server also keeps unsent Meta events for up to 24 hours, clears identifying event data after delivery and keeps event IDs for 7 days to prevent duplicates; the consent record is removed with the account. Withdrawing the choice in the ad privacy options under Settings stops new sharing and deletes unsent events; data already sent is handled under Meta's and TikTok's own privacy policies. In earlier iOS versions, the Meta SDK sends the permitted advertising identifier (IDFA), app version, operating-system version, new-install and estimated ad-revenue events directly to Meta. The SDK starts only after the current shared Meta choice and Apple tracking permission are both granted. Automatic app events, purchases, screen metadata and product-improvement logging are disabled. Withdrawing consent cancels pending delivery and clears the app’s unsent events; a request already received by Meta cannot be recalled. Updating the game is not reported as a new install. Newer iOS versions send the same permitted identifier, app information and events through our server to Meta. The Meta SDK is not initialized for this delivery. Rewarded-ad events wait for Google’s signed completion verification; their monetary value remains an SDK-reported estimate, not verified payment income. Between-level ad events are not sent through this iOS route. Current Meta consent and Apple tracking permission remain required. Identifying data in the server queue is deleted after delivery or expiry; withdrawing consent removes pending server events when the device can reach our server.
Purchase-enabled builds offer consumable Diamonds through Apple App Store or Google Play. The store handles payment; we do not receive card details. We verify transaction identifiers, signed receipts or purchase tokens, product, quantity, price/currency when provided, purchase time, environment and an account-scoped purchase alias to deliver Diamonds to the correct Cargo depot and prevent duplicate grants. We keep delivery, refund and reversal records. A guest purchase belongs to that guest depot: link the depot before losing device data to recover remaining Diamonds on another device. Used Diamonds are not restored as new Diamonds. Refunds follow the platform process; verified refunds remove available Diamonds, and any spent shortfall is recovered from future Diamond earnings. Purchases may be held for account/support review. Cargo does not collect consent for or send Apple optional purchase-consumption reports. The parent challenge is not proof of age or legal parental consent.
Account and progress data stay while the account exists. Confirmed deletion removes them from the active game database and revokes game sessions. Technical logs expire within 7 days; database recovery history can persist for up to 30 days. A hash used to prevent reuse of a sign-in proof expires automatically and is not a player profile. Support correspondence is kept as needed to resolve the request and meet applicable legal obligations; ask us about the records relating to you. Ad verification receipts are removed with the account, or after 90 days beyond their settlement deadline. Deleting Cargo data does not automatically delete records held separately by Google under its policies. After account deletion, purchase, refund and audit records remain with their Cargo player reference removed to prevent transaction reuse and resolve payment disputes; store transaction identifiers can still be linked by the payment provider and are not claimed to be anonymous. Apple and Google retain their own payment records under their policies. Diagnostic records are deleted 30 days after receipt, or earlier when you turn Share diagnostics off or delete the account.
Contact support@piagames.io to request access, correction or deletion, object to processing, or withdraw any consent you have given. Your rights depend on applicable law, including the right to contact a data protection authority. We use information needed to deliver the requested game and protect the service; where consent is legally required, it must be obtained before that processing. We do not sell personal information. See Padam akaun for account removal.