Privacy Policy

1. About this policy

This Privacy Policy applies to Crown & Hoof, also listed as Crown&Hoof-Horse Breeding Game on Google Play (Android package com.crownandhoof.app), and its associated online game services at smallbird.tech. “We”, “us” and “our” refer to the team operating Crown & Hoof.

For privacy questions or requests, contact [email protected].

2. Information we handle

Account and verification information

When you register or sign in, we process your email address and password. We store a password hash, rather than your readable password, together with an account identifier, stable name and account creation date. We also process login sessions, email verification status, verification-code hashes, expiry times, delivery status and attempt counters. Your selected language is used when you request a verification email.

Gameplay and virtual economy

We store your horses and their names, traits and pedigrees; stable capacity; training and breeding activity; race entries, tactics, results and replays; leaderboard statistics; market listings and bids; virtual-credit balances and transaction history; and which race notifications you have read. We also keep records of game requests needed to prevent duplicate actions and maintain consistent progress.

In-app purchases

When you buy virtual credits through Google Play, we process product identifiers, purchase tokens, Google Play order identifiers, purchase verification and delivery status, timestamps and the credits credited to your game account. We send Google Play an obfuscated identifier derived from your game account ID to associate a purchase with the correct account. Google processes payment details; the game does not receive or store your full payment-card number or card security code.

Technical information and support

Our hosting, network and security services process connection information such as IP addresses, request times, requested resources, response status and client information supplied with network requests. We use security counters and error records to protect and maintain the service. If you email us, we receive your email address, message and any attachments you choose to send.

Information stored on your device

The app stores language preferences and information needed to keep you signed in and safely retry pending game actions. Account-session information and the pending-action record are encrypted using an Android Keystore key.

The current game does not request access to your contacts, precise location, microphone, camera or personal photo library. It does not include advertising or third-party analytics SDKs, and we do not use your personal information for targeted advertising or sell it.

3. How we use information

• Create and authenticate accounts, verify email ownership and maintain sessions.
• Save progress and operate training, breeding, racing, markets, profiles and leaderboards.
• Verify purchases, deliver virtual credits and prevent duplicate purchase claims.
• Display race results and in-game notifications, and send account-verification emails.
• Respond to support and privacy requests, diagnose errors and prevent abuse.
• Meet applicable legal obligations and handle disputes.

Where applicable law requires a legal basis, we process information as necessary to provide the service you request, pursue legitimate interests in security and reliable operation, or meet legal obligations. Where consent is required for a particular use, we will seek it; it can be withdrawn for that use. Creating an account does not constitute blanket consent to unrelated uses.

4. What other players can see

Multiplayer features display your stable name and identifier, stable creation date and capacity, horse names and identifiers, horse attributes and pedigrees, race participation and results, rankings, wins and in-game earnings. Market features also show information needed for listings and transactions.

Your account email, password, login tokens and Google Play purchase tokens are not displayed in player profiles. Choose stable and horse names that do not reveal information you wish to keep private.

5. Service providers and disclosure

Information is processed by providers needed to deliver the game:

• Hosting and database providers: operate the servers that store accounts and game progress.
• Cloudflare: provides network delivery and security for our domain and processes traffic reaching those services. See Cloudflare’s Privacy Policy.
• Email providers: process recipient addresses, verification messages and delivery information to send account emails and handle support correspondence.
• Google Play: distributes the Android app, processes payments and supplies purchase-verification information. Google handles information under its own Privacy Policy.

We may also disclose information where required by law, in response to valid legal requests, or where necessary to protect users, investigate fraud or establish and defend legal claims. We limit such disclosures to information relevant to the purpose.

Our providers may process information outside your country. Applicable data-protection requirements and any required safeguards apply to those transfers. Contact us for information about the arrangements relevant to your request.

6. Storage and security

The app connects to our public service using HTTPS. We use password hashing, hashed server-side session tokens, encrypted account storage on the device, verification attempt limits and server-side purchase checks. Access to backend information is needed for service operation and support. No method of transmission or storage can guarantee absolute security.

This HTML policy contains no analytics scripts, tracking pixels or third-party fonts. The hosting and network services delivering it may still process connection information or use security-related technologies.

7. How long information is kept

Account and gameplay records are retained while needed to provide your account and ongoing game history. The current service does not automatically delete an account just because you stop playing. Signing out or uninstalling the app does not delete server-side records.

• Sessions and security counters: have expiry times; expired records are removed by routine server maintenance. Expiry prevents a session from being used even before cleanup.
• Email verification: codes expire after 15 minutes. Their hashes are cleared on successful verification or replaced when a new code is issued. Expiry alone does not mean every related verification record is deleted; verification status and abuse-prevention counters remain associated with the account.
• Purchase and transaction records: are retained while the account exists to verify delivery and prevent repeat credit claims. Automatic account deletion removes the game’s purchase receipts and private transaction ledger. Records independently held by Google are subject to Google’s policies.
• Support records and technical logs: are retained according to the support, operational, security or legal purpose for which they are needed. The appropriate period depends on the record and circumstances.

Automatic deletion removes account data from the active game database immediately when it succeeds. Shared race, pedigree and market history needed by other players may remain with the deleted account’s identity removed. Hosting logs, support correspondence, backups and records independently held by providers are outside that database operation. Contact us to request deletion of those records; we will explain any necessary retention reason and period. Backup copies, where present, are removed through the backup retention cycle and are not used to resume normal use of a deleted account.

8. Your rights and account deletion

You can contact us to request access to, correction of, or deletion of your personal information and game account. Depending on applicable law, you may also have rights to receive a portable copy, restrict or object to certain processing, withdraw consent where processing relies on it, and complain to your data-protection authority.

The app and account-deletion form delete account data automatically after successful authentication and confirmation. Requests sent by email are handled by our support team. We may request information reasonably necessary to verify ownership before disclosing or deleting account data. We respond within the time required by applicable law.

Account deletion covers account identifiers and credentials, personal information and associated gameplay data, subject to any limited retention described above. Shared race or market history may be preserved only where it is no longer linked to you, or where a disclosed lawful retention reason applies. Deletion removes access to the account, its horses, progress and virtual credits; it does not itself initiate a Google Play refund.

9. Children’s privacy

Users must meet the minimum age and any parental-permission requirements that apply to their use of the service in their country. A parent or guardian who believes a child has provided personal information without the required permission can contact us at [email protected] to request review and deletion. We will take appropriate steps where applicable children’s privacy requirements have not been met.

10. Changes to this policy

We may update this policy as the game or its data practices change. The date at the top identifies the latest update. We will provide any additional notice or obtain any consent required by applicable law for material changes.

11. Contact us

For Crown & Hoof privacy questions, access requests, corrections or account deletion:

Crown & Hoof team
Email: [email protected]
Website: smallbird.tech