Privacy policy

Effective from 1 November 2026

This page describes what personal data the Toulky game (the app on your phone and our server) processes, why, for how long we keep it, and what rights you have. The Czech version is the main one; this is a translation.

1. Who processes your data

The controller of your personal data is Tomáš Otta ("we"). For anything about your data, write to toulkygame@gmail.com. We have not appointed a data protection officer.

2. What data we process and why

2.1 Account and sign-in

• E-mail address and Google account. You sign in to the game with your Google account; we have no passwords. From Google we receive only your verified e-mail address and your Google account identifier (we ask only for the "openid" and "email" scopes), not your name, photo or contacts.
• Year of birth. You enter it when you create an account. We do not create an account for anyone younger than 15 by year of birth. We also use it to leave anyone who may be a minor out of the anonymous statistics (2.6). Neither other players nor the team see it in the game.
• Nickname and profile: the nickname you choose and the look of your profile card (avatar, banner, border, title, cards on show). A nickname must not be offensive; we may change an inappropriate one.
• Player identifier: a random number our server knows you by.
• Device identifier: a shortened hash of the phone's system identifier. It binds a sign-in to your phone, so a stolen sign-in token cannot be used elsewhere. Each time the sign-in is renewed (about once an hour of play) the time is recorded with it.
• App version, so we can ask an old version to update.
• Invite code, if one was needed when the account was created.

Why: to run your account and sign you in (performance of the contract, i.e. the game's terms) and to protect accounts from misuse (our legitimate interest).

2.2 Location and movement

• Your phone's precise location (GPS) with its accuracy, speed, heading and time, about every 2 seconds while the game is open on the screen. The game does not work without it: it counts kilometres from it, shows the map around you, and cards, places and gardens work only when you are at them. The app also uses your location to download the map and the explored roads around you. You grant location permission in your phone and can withdraw it at any time.
• Activity type and steps. With each location we send whether the phone recognises walking, running, standing still or riding in a vehicle, and the step count from its step counter (the "Physical activity" permission). They make sure only walking and running count, and help detect cheating. We do not store them as a history.
• Pocket walk. When you leave the game open and it goes to the background (you turn the screen off or switch to another app), the phone can keep recording the walk, one location every 5 seconds or 5 metres. Android shows an ongoing notification with a Stop button meanwhile. The recording ends when you return to the game, tap Stop, stand still for 15 minutes, after 12 hours, or below 15 % battery. It stays encrypted on the phone and is sent when you open the game again. The server counts kilometres and cards from it and keeps only a summary (start, end, metres, newly discovered streets, cards found), never the individual locations. Before the first system location prompt the game explains pocket walks and offers a switch; later you change it in Settings → Pocket walk (Automatic, Button, Off). The game does not ask for background location access: a recording always starts from the open game.
• What we keep from your location and play:
  • kilometres per day and the road segments you have walked (the explored roads map),
  • the places you visited and your stamps (with the day of the visit, and for the first 13 months the exact time and GPS accuracy too),
  • the cards you collected: when, and in which area (about 0.1 km²), and at which place you first found a card,
  • the area (about 5 km²) where your daily goals were made, and the spot of the first card of your first walk,
  • what you did at places and when: puzzles solved, legends and chronicles read, events, card boxes, watering and planting in gardens, meetups.
  We do not store the sequence of locations of your walks (the route).
• Your latest location while playing. While the game is connected, the server holds your latest location (written at most once every 15 seconds) and deletes it when you disconnect. Moderators and team members responsible for safety see the locations of connected players on a map, never older than 2 minutes, to deal with cheating and dangerous situations. Opening a particular player's details is logged.
• Protection against cheating. When the server finds a suspicious location (a faked location, a jump of kilometres in seconds, an unnaturally "clean" track, steps that do not match the distance), it stores a record of it, with the coordinates.

Why: location is the core of the game (performance of the contract); protection against cheating and players' safety are our legitimate interest.

2.3 Playing with others

• What we store: your friends (added only in person, with a one-time code) and since when, blocking, club membership and the club's chronicle, card trades (who gave which card to whom, when and in which town), card boxes (who put a card in and who took it, when), gifts, watering and planting in shared gardens.
• What others see about you:
  • your friends and club members: your profile card (nickname, level, kilometres, card and stamp counts, cards on show, club), whether you played this week, and your kilometres and places this month,
  • anyone: your nickname, avatar, banner and title in a town's monthly mosaic leaderboard (top 10), which shows the town you play in,
  • anyone at a card box: your nickname and the time on a card you put in it; when you take a card from a card box, the player who put it there learns your nickname, the town and the time,
  • the player you trade with: your nickname, and on the card "From:" your nickname, the town and the date of the trade; someone you give a gift to sees your nickname,
  • if you support the game (paid items are not open yet), your nickname and avatar appear among your town's supporters' thanks only if you leave "Show my nickname in the thank-you list" on.
  Other players never see where you are, nor your e-mail or year of birth.
• Reports. When you report something ("Report a problem"), we store what you reported and why (you pick a reason from a list; there is no free text). Team members review reports; their decisions (e.g. a warning, a suspension) are recorded.
• Messages from the team. The Toulky team can send you a short message in the game. Players cannot write to each other.

Why: these features are part of the game (performance of the contract); moderation and protecting players are our legitimate interest.

2.4 Progress in the game

Level, experience points, Shimmer (Třpyt) and its movements, cards, stamps, the diary, purchases in the game, notification settings (e.g. your home town) and your choice about anonymous statistics. Why: the game does not work without them (performance of the contract).

2.5 Technical data and security

• IP address. We limit the number of sign-in attempts and requests from one network; the server keeps these limits in memory only. During a Google sign-in we remember the network the game started the sign-in from (an IPv4 address, or the /64 block of an IPv6 address), to tell whether the browser comes back from the same network; we delete it by the next day at the latest.
• Sign-in tokens are stored only as hashes, never in readable form.
• Server logs (errors and operation); they may contain a player identifier.
• Trust score. From records of suspicious locations and the account's history we compute an internal rating that only the team sees. A low score automatically and temporarily switches off some shared features (e.g. your contribution to kindling a Heart, or a place on the mosaic leaderboard). Sanctions (warning, suspension, restriction, ban) are always decided by a team member.

Why: the security of the service and fair play (our legitimate interest).

2.6 Anonymous footfall statistics

Once a day we count how many different players visited each place that day, and how many were in each area (hexagons of about 0.7 km²) each hour. Groups smaller than 20 players are never stored, and the team sees only numbers with random noise added, so nobody can be recognised in them. Anyone who may be a minor is not counted. For now only we use the statistics, to know where the game is played and to improve it. If we ever wanted to share them with towns or partners, it would be these anonymous numbers only, and we would update this policy first.

You are counted until you turn it off: Settings → Privacy → Anonymous statistics. Turning it off applies to the days not counted yet. Why: our legitimate interest; turning it off is how you exercise your right to object.

3. What stays on your phone

• Your sign-in token (encrypted), your settings, stored parts of the map and photos of places and cards, planned notifications.
• Pocket walk recordings not sent yet (encrypted; deleted once sent).
• The game uses the camera only to scan the QR codes of friends, clubs and card trades. It asks for the permission when you first open the scanner. The image is processed on the phone and never sent anywhere.
• Notifications are scheduled by your phone from a plan our server sends. We use no third-party push notification service.
• Uninstalling the app deletes this data from the phone.

4. Who receives data

• Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) rents us the server the game runs on, in a data centre in Germany (Düsseldorf). It processes data only for us and on our instructions.
• Google: when you sign in, Google verifies your identity and passes us your e-mail and account identifier (see 2.1). Google handles its own data as an independent controller under its policy (policies.google.com/privacy). The app is distributed through Google Play, and on Android your location and activity type are determined by the system's Google Play services, which you control in your phone's settings.
• Authorities, only where the law requires us to.

We do not sell data to anyone, we do not use it for advertising, and we do not track you in other apps or on the web. The game contains no third-party advertising or analytics tools. The server is in the European Union. Where a recipient processes data outside the EU (e.g. Google), it does so under the safeguards the GDPR requires (an adequacy decision or standard contractual clauses).

5. How long we keep data

Account, profile, progress and play history

For as long as the account exists, including where and when you collected cards and visited places (2.2). After you ask for deletion you can keep the account for 14 more days; then we delete it (Account deletion).

Latest location while playing

Only while connected; deleted on disconnect (if the server crashes, within an hour).

Places visited

The exact time of the visit and the GPS accuracy for 13 months, then only the day of the visit.

Detailed log of collected cards and play sessions

13 months, then only daily totals not linked to any player.

Records of suspicious locations

Coordinates for 90 days after the last occurrence, then, for as long as the account exists, only the kind, day and count.

IP addresses

By the next day at the latest (2.5).

Sign-ins on a device (token and device identifier)

A sign-in lasts 60 days from the last use of the app; we delete the record 7 days after it expires or you sign out.

Age refusals

Only a hash of the identity for 24 hours, to recognise a repeated attempt. Nothing else is stored.

Reports, team decisions and records of the team's actions

Also after the account is deleted, to handle repeated problems and to check the team's work; once the account is deleted they no longer hold your e-mail or nickname. This includes the texts of messages the team sent you.

Server logs

At most 14 days.

Database backups

At most 1 year; deleted data disappears from a backup when the backup is deleted.

Anonymous statistics

Not personal data; kept without a limit.

6. Security

The app talks to the server over encrypted connections only (HTTPS). We have no passwords; sign-in tokens are stored only as hashes. Pocket walk recordings are encrypted on the phone (AES-256). Only the team can reach the server, with SSH keys. Team members' access to data is limited by their roles, and their actions are logged.

7. Your rights

Under the GDPR you have the right:

• of access to your data and a copy of it, also in a machine-readable form (portability): download it in the app, Profile → Download my data (a JSON file with your game data); we send the records of suspicious locations and of the team's decisions on request,
• to rectification of inaccurate data,
• to erasure: delete your account yourself in the app (Profile → Delete account) or write to us (Account deletion),
• to restriction of processing,
• to object to processing based on our legitimate interest; for the anonymous statistics the switch in Settings is enough,
• to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz), in Slovakia with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk), or with the authority of the EU country where you live.

Write to us at toulkygame@gmail.com from the e-mail address of the Google account you sign in with, so we can tell the account is yours. We answer within a month at the latest.

8. Age limit

Toulky is for people aged 15 and over. We do not create accounts for younger people. If we find that an account belongs to someone younger, we delete it. Parents can write to us at toulkygame@gmail.com.

9. Changes to this policy

When we change this policy, we update the date at the top. We announce significant changes in the game in advance.