隐私政策

We store your Cargo player identifier, session credentials, level results, game currency, depot upgrades and active gameplay commands. We use them to provide your game, save progress and prevent cheating. Versions offering Play as Guest let you play without a platform account: the server saves your depot and a device-held credential controls access. Until you link an account, losing the device or app data can make that depot unrecoverable. On a fresh installation, the game attempts platform sign-in before offering guest entry. If platform sign-in succeeds or you link your guest depot, we also store the verified Game Center or Google Play Games identifier and account link. We do not receive your platform password or request your email address, address book, photos or precise location. In versions with automatic rankings, every player appears in the public all-time rankings under a pseudonymous name generated by our server: the word “Player” in your language followed by a random code. The code is unique within Cargo Flow and is not derived from your account, device, platform or store identifiers; the generated name contains no personal data. Other players see your ranking name, all-time score and level. Adults can replace the generated name with a nickname they type, which our server filters. In the family view, used for children and players whose age is unknown, you can keep the generated name or pick a suggested name from a list; typed names are not available. A flag shows the country our server reads from your connection: Cloudflare reports only the country code; we do not store your IP address and never determine a precise location. You can keep it automatic or choose another country; the country can change at most once in a period set by our service. This works the same in the family view. Any player can turn on the Settings option that hides them from rankings. Hidden players are not shown to other players, including in friends rankings; their scores still count for their own progress, and only they see their own rank. We store this choice with your Cargo account on our server. Earlier versions showed a ranking profile only after you joined, and leaving rankings removed it while keeping your depot progress. Builds with Share diagnostics in Settings offer it only when the platform signal or your own age answer indicates an adult; it is off by default and never offered to children or when age is unknown. If you turn it on, the game sends fixed categories to our server: app session start, first-delivery steps, level finishes (first or later level, won or lost, new or replay), connection and reconnection outcomes, and error types. These records contain no name, score, wallet, purchase, message text, device profile or age. They are linked to your Cargo account and a random installation identifier so they can be deleted. Turning the switch off stops collection and deletes this installation's diagnostic records; deleting the account deletes them all. No third-party analytics or crash-reporting service receives them. In versions with result sharing, you can choose to share a completed level. Our server then creates a public page at a random link (piagames.io/cargo-flow/r/…) that shows only results our server verified for that level: level, stars, time, score and on-time deliveries. While you are visible in rankings, the page also shows your ranking name; if you hide yourself from rankings, it shows no name. It never contains your account or device identifiers. Anyone with the link can view it. In the family view, a parent must approve sharing first. Shared results are removed automatically after a limited period set by our service, and when you delete your account. Optional diagnostics also records account-linked first-level tutorial steps, pauses, background/return events, menu and restart choices, connection waits, losses and completions. Backgrounding or missing events does not prove an app exit or crash. No new tracking identifier is created.

You can report a player from rankings or a shared result. We store the reporter and reported player identifiers, the displayed name at report time, reason, optional note, dates and review outcome for up to 365 days. These reports are reviewed by our team and are not public. Reporting replaces that player’s name with a generated name in your view; the personal hidden list stays with your account and can be undone from Rankings → Hidden players. Deleting your account removes your reports and hidden list. Reports made by others about your account are closed and retained for review until this retention period expires. Please do not include personal information in a report.

In Settings → Send feedback you can write to the team. We store the topic, your message, the game version, the platform and your Cargo player identifier, read it to support you and improve the game, and keep it for up to 365 days; deleting your account removes it sooner. Messages are not shown in the store or to other players. Please do not include personal details. The family view does not offer this option.

In versions with install-source measurement, the game records where it was installed from, and only for a known adult (the platform's age signal or your own adult answer); for children and when age is unknown nothing is read or sent. On Android it reads the Google Play install referrer once and keeps only four campaign labels (source, medium, campaign and content, for example “instagram / social / bio”); on iOS it only notes “App Store”. Our server stores these labels with your Cargo player identifier, the platform, whether this device started a new depot, the day the depot was created and whether you opened the game again on the next day and on the seventh day. We use this only to see which channels bring players who keep playing. It contains no advertising ID, click ID, IP address or device profile, is not shared with anyone and is kept for up to 395 days; deleting your account removes it sooner.

In versions with Google Analytics for Firebase, the game turns it on only for a known adult (the platform's age signal or your own adult answer) who allowed analytics in the shared ad privacy choices. It is never started for children or when age is unknown, and it stops collecting if that changes or you withdraw the choice. It measures app use, such as first open, sessions, completed levels and, on iOS, App Store purchases verified by Apple, to understand how the game is played and to measure our Google Ads campaigns. We do not give it your Cargo player identifier, name, score, age or email; on iOS it does not collect the advertising identifier (IDFA) or the vendor identifier, and ad personalization signals stay off. Google processes this data under its own policies and keeps it for the retention period set in our Google Analytics property. Deleting your account resets the app's local analytics identifier but does not erase data Google already holds; ask us for help with that. See Google Privacy.

In versions with notifications, the game asks for permission on the menu after you have completed some levels, never at launch. You can turn notifications off in Settings or in your phone settings. The only notification is the reminder that today's delivery route reward is ready: it is scheduled on your device and sends nothing to us. We do not send notifications from our server, and there are no promotional notifications. The app still registers a Firebase Cloud Messaging token with our server, together with your Cargo player identifier, platform, app language, app version and one yes/no value about promotional announcements, which the app sets to yes only for a known adult. No age or age group is sent. We do not use the token or this value to send anything. The token is deleted when you turn notifications off, when you delete your account, or after 270 days without use.

Cloudflare hosts the service and database and processes network information, including IP addresses, request URLs and technical error logs, for delivery and security. Google Firebase App Check and Apple or Google platform services process app/device verification and sign-in information. Connections are encrypted in transit. These providers may process data outside your country under their applicable safeguards and privacy policies. Google Analytics for Firebase and Firebase Cloud Messaging are described below; versions without them do not use them. If you email support, we receive your email address and the information you choose to send. Google Play Games also processes your gamer tag/avatar when you create or update its profile, and usage and diagnostic information to maintain and improve its services. In versions with Android friends rankings, opening Friends uses your platform permission to fetch a fresh friends list from Google on our server. We temporarily match game-scoped identifiers only to public Cargo ranking profiles (players who have not hidden themselves). We do not store the friends list or request friends’ platform names or photos. The app keeps ranking results only while the screen is open and active. You can withdraw friends access in your platform account settings; the next read checks access again. This does not change whether you appear in the public Cargo rankings. Versions without this flow do not request friends. Google-held Play Games data can be managed or deleted through your Play Games profile or Google account; deleting Cargo does not automatically erase that separate data. See Google Privacy and Google Play Games data deletion. In versions with iOS friends rankings, GameKit on your device reads the friends who have allowed this access. Their developer-scoped identifiers are sent temporarily to our server to match only public Cargo ranking profiles in this game. We do not store this list or use it to grant rewards, and we do not use friends’ platform names or photos. The same screen lifetime and access-withdrawal rules apply.

Cargo Flow is intended for families, including children aged five and under. In builds with age screening, Game Center or Google Play may provide an age signal for account guidance and age-appropriate store access. If no signal is available, you can choose an age group or skip. Only your manual choice is remembered locally for this depot. No age answer or age group is sent to our server, analytics, Google or anyone else. On the device it decides the ad treatment described below (child treatment for everyone except a known adult) and which optional sharing and measurement are offered; the only value derived from it that reaches our server is the yes/no value stored with the notification token, which we do not use to send anything (see notifications). A parent or guardian should manage a young child's platform account and privacy requests. We use game identifiers for gameplay, recovery and security, not to build advertising profiles of children. Earlier builds may ask everyone a parent question. With age-based store access, adults and players whose age remains unknown can open the store directly. A minor signal, an under-18 answer or required store verification keeps the parent question. The platform handles payment approval. Purchases and advertisements are described below. Parents can contact support@piagames.io to ask about, access or request deletion of their child's data.

Ad-supported builds show Google advertisements: optional rewarded ads and, after the early levels, full-screen ads between levels. Between-level ads appear only after the player chooses to continue, never during play or at launch. Every player who is not a known adult, including when age is unknown, receives child age treatment, general-audience content filtering and non-personalized ad requests, and no advertising ID is used for them. A known adult (an adult platform age signal, or your own adult answer on the neutral age screen) receives ordinary ad requests: Google Mobile Ads may then read the Android advertising ID or, on iOS, Apple's identifier for vendor and, if Apple tracking permission is granted, its advertising identifier, and whether ads are personalized is governed by the shared ad privacy choice shown by its User Messaging Platform where that applies; if that choice does not allow personalized ads, requests are non-personalized. The age result is used only on your device to choose this treatment; it is never sent to us, Google or anyone else. On iOS, versions with Meta measurement request Apple tracking permission only after a known adult allows Meta in the shared privacy choice; denial or an unanswered request keeps Meta measurement off. The Android advertising ID is read for Meta or TikTok campaign measurement (below) only for a known adult who allowed that recipient. Google Mobile Ads and its User Messaging Platform may process network/device diagnostics, app-scoped device identifiers (such as the Android app set ID or the iOS identifier for vendor), general location inferred from IP addresses and ad interaction data to deliver ads, prevent fraud and manage applicable privacy choices. Settings shows ad privacy choices when the provider requires them. To verify a reward, Google receives a one-view random alias and placement nonce, not the persistent Cargo account identifier. Our server links that nonce to the eligible reward and stores the signed transaction and verification time. The app cannot grant a reward from an unverified viewing claim. Earlier internal builds without this SDK do not make these ad requests. Versions that include Meta and TikTok campaign measurement on Android start them only for a known adult (an adult platform age signal or your own adult answer) and only after the shared ad privacy choice allows that recipient; children, players whose age is unknown and anyone who answered as a minor never start them, and losing that status withdraws the choice. Meta measurement then sends Meta (Facebook and Instagram), through our server, the Android advertising ID, app and device information, new installations and estimated ad revenue with its currency, to measure and improve our advertising; TikTok's SDK sends TikTok the advertising ID, the Google Play install referrer, app and device information, its own install and open events and the completed level. No name, player ID, score, purchase or email goes to either. Only a known adult's ad requests leave child treatment, so only a known adult can see the shared ad privacy message that allows these recipients; every other player's requests stay child-directed, non-personalized, and no advertising ID is read or shared for them. The app keeps unsent Meta events for up to 24 hours; on Android and in newer iOS versions our server also keeps unsent Meta events for up to 24 hours, clears identifying event data after delivery and keeps event IDs for 7 days to prevent duplicates; the consent record is removed with the account. Withdrawing the choice in the ad privacy options under Settings stops new sharing and deletes unsent events; data already sent is handled under Meta's and TikTok's own privacy policies. In earlier iOS versions, the Meta SDK sends the permitted advertising identifier (IDFA), app version, operating-system version, new-install and estimated ad-revenue events directly to Meta. The SDK starts only after the current shared Meta choice and Apple tracking permission are both granted. Automatic app events, purchases, screen metadata and product-improvement logging are disabled. Withdrawing consent cancels pending delivery and clears the app’s unsent events; a request already received by Meta cannot be recalled. Updating the game is not reported as a new install. Newer iOS versions send the same permitted identifier, app information and events through our server to Meta. The Meta SDK is not initialized for this delivery. Rewarded-ad events wait for Google’s signed completion verification; their monetary value remains an SDK-reported estimate, not verified payment income. Between-level ad events are not sent through this iOS route. Current Meta consent and Apple tracking permission remain required. Identifying data in the server queue is deleted after delivery or expiry; withdrawing consent removes pending server events when the device can reach our server.

Purchase-enabled builds offer consumable Diamonds through Apple App Store or Google Play. The store handles payment; we do not receive card details. We verify transaction identifiers, signed receipts or purchase tokens, product, quantity, price/currency when provided, purchase time, environment and an account-scoped purchase alias to deliver Diamonds to the correct Cargo depot and prevent duplicate grants. We keep delivery, refund and reversal records. A guest purchase belongs to that guest depot: link the depot before losing device data to recover remaining Diamonds on another device. Used Diamonds are not restored as new Diamonds. Refunds follow the platform process; verified refunds remove available Diamonds, and any spent shortfall is recovered from future Diamond earnings. Purchases may be held for account/support review. Cargo does not collect consent for or send Apple optional purchase-consumption reports. The parent challenge is not proof of age or legal parental consent.

Account and progress data stay while the account exists. Confirmed deletion removes them from the active game database and revokes game sessions. Technical logs expire within 7 days; database recovery history can persist for up to 30 days. A hash used to prevent reuse of a sign-in proof expires automatically and is not a player profile. Support correspondence is kept as needed to resolve the request and meet applicable legal obligations; ask us about the records relating to you. Ad verification receipts are removed with the account, or after 90 days beyond their settlement deadline. Deleting Cargo data does not automatically delete records held separately by Google under its policies. After account deletion, purchase, refund and audit records remain with their Cargo player reference removed to prevent transaction reuse and resolve payment disputes; store transaction identifiers can still be linked by the payment provider and are not claimed to be anonymous. Apple and Google retain their own payment records under their policies. Diagnostic records are deleted 30 days after receipt, or earlier when you turn Share diagnostics off or delete the account.

Contact support@piagames.io to request access, correction or deletion, object to processing, or withdraw any consent you have given. Your rights depend on applicable law, including the right to contact a data protection authority. We use information needed to deliver the requested game and protect the service; where consent is legally required, it must be obtained before that processing. We do not sell personal information. See 删除账号 for account removal.