Privacy Policy
We only collect the data needed to run the game. We do not collect your real name, phone number, address or date of birth, and we do not sell or share your data with anyone for advertising.
What we collect and how long we keep it
| Data | What it’s used for | How long we keep it |
|---|---|---|
| Account ID from Google, Facebook or Apple (a number that identifies the account, not your email or password — for Facebook, a number used only by this app) | Lets you sign in to the same account again | Until you delete your account |
| Pre-registration list (the same Google/Apple account ID as above and the time you registered — no email) | Delivers pre-registration rewards to your bag when the game opens, and counts registrations (shown on the website only as a total) | 90 days after you receive the rewards, or until you delete your account |
| Characters, levels, inventory, in-game settings, and the list of players you’ve blocked | Saves your progress in the game | Until you delete your account |
| The most recent IP address used to enter the game | Protects against password guessing and attacks on the system | Until you delete your account (only the latest value is kept) |
| Sign-in token remembered by your browser (stored with one-way encryption) | So you don’t have to sign in every time | 14 days |
| Logs of in-game trades and items received | Detecting cheating and duplicated items | 180 days |
| Anonymous gameplay statistics (play time, class, number of deaths, etc. — no names, no IP, no chat messages) | Balancing the game | 180 days |
| Chat messages | Delivering them to other players | Not written to disk — held only temporarily in server memory, except in the case below |
| Player reports (reporter’s name, reported player’s name, reason, and the reported player’s chat from the 30 minutes before the report) | Letting the team review misconduct | 365 days |
Chat and safety
Don’t type personal information (phone number, address, passwords, bank details) in chat — other players can see it.
You can block a player with /block name and report them with /report name reason.
The team reviews reports within 24 hours.
Children
This game is designed for players aged 13 and over. We do not knowingly collect data from children under 13.
Your rights
You can delete your account and all your data yourself at any time on the Delete Account page. Deletion removes your characters, items, storage and remembered sign-in tokens immediately and cannot be undone. Any remaining trade logs will contain only reference numbers, no names, and expire on their own within 180 days. If you have questions or want a copy of your data, contact admin@boxdesign.in.th.
Third-party services
Sign-in uses Google Sign-In, Facebook Login and Sign in with Apple, subject to those providers’ own policies. We receive only an account ID from the provider — never your password, email, friends list or posts. If you signed in with Facebook, you can also remove Toonda in Facebook’s “Apps and websites” settings and ask for your data to be deleted; Facebook notifies us and we delete the account (or remove Facebook from it if it also uses Google/Apple). See the Delete Account page.