This Privacy Policy describes how Tooston ("we", "us", "our") collects, uses and shares information when you visit this website or play any of our games (together, the "Service").
Our games are published on their own domains, playairhockey.com, playsnakeonline.com and playonlineludo.com and this policy applies to all of them as well as to this site.
1. The short version
- There are no accounts. We never ask for your name, email address or phone number.
- No analytics cookie is set until you press "Accept analytics". Rejecting, or ignoring the banner entirely, leaves the site running with no cookies at all.
- Your preferences live in your own browser and are never sent to us.
- We do not sell, rent or trade data to anyone, for any purpose.
- We serve no advertising, so there are no advertising or retargeting trackers.
2. Information we collect
2.1 Information you provide
- Display name (nickname): In games with online play you may type any name you like. We do not require your real name. During an online match this name is shown to the other players for the duration of that match. It is stored only in your browser's local storage and is not linked to any account or persistent identity.
- Anything you email us: If you contact us, we hold your message and email address for as long as it takes to deal with it.
2.2 Information collected automatically
- Usage and analytics data: Only if you consent, we use Google Analytics 4 to collect aggregate information about how visitors use the site: pages visited, session duration, device type, browser, operating system and approximate geographic location at country or region level. It is not linked to any personal identity.
- IP address: Your IP address is necessarily visible to our host and, in online matches, to our realtime provider, for delivery and security purposes. Any server you connect to sees this; it is a property of how the internet works rather than a choice we made.
- Local storage: We store your chosen nickname, game settings, local scores or match history, and your cookie-banner answer in your browser. This never leaves your device. See our Cookie Policy for the full list of keys.
- Multiplayer connection data: During an online match, game state such as positions, moves and scores passes through our realtime infrastructure. It is transient: it exists for the duration of the match and is not stored afterwards.
3. How we use it
- To run the game and match you with an opponent
- To remember your preferences between sessions
- To understand which games and guides are actually used, and improve them
- To detect and prevent abuse
- To comply with legal obligations
4. Legal basis for processing (GDPR Article 6)
If you are in the EEA or the UK, we rely on the following legal bases:
- Consent (Art. 6(1)(a)) for analytics cookies, and only for those. Nothing analytics-related loads until you accept the banner, and you can withdraw at any time via Cookie Settings in the footer, as easily as you gave it. Withdrawing does not affect the lawfulness of processing carried out beforehand.
- Contract (Art. 6(1)(b)) to run the match you asked to play, including passing your chosen nickname and moves to the other players in it.
- Legitimate interests (Art. 6(1)(f)) to keep the Service secure and available and to prevent abuse. We do not rely on legitimate interests for analytics or for any form of tracking.
Preferences held in your browser's local storage never reach our servers, so no legal basis is engaged for them.
5. Third-party services
We share data with the following processors only as far as necessary to run the Service:
- Vercel Inc.: website hosting and edge delivery. vercel.com/legal/privacy-policy
- Ably Ltd: real-time multiplayer data transport, used only during online matches. ably.com/privacy
- Google LLC: Google Analytics, loaded only if you consent. policies.google.com/privacy
We do not sell, rent or trade personal information to any third party for marketing purposes, and we run no advertising network.
6. Children's privacy
Tooston is a general-audience service. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). Our games have no chat of any kind, and the display name a player types is chosen freely and stored on their own device.
If you are a parent or guardian and believe your child has provided personal information to us, email support@velovid.net and we will investigate and delete it promptly. See our full COPPA notice.
7. Your rights (GDPR / CCPA)
Depending on where you live, you may have the right to:
- Access: request a copy of any data we hold about you
- Correction: have inaccurate data corrected
- Deletion: have your data deleted
- Objection: object to certain kinds of processing
- Portability: receive your data in a portable format
- Withdraw consent: switch analytics back off at any time via Cookie Settings in the footer. One click, no email needed, and the analytics cookies are deleted.
- Complain to a supervisory authority: if you are in the EEA or the UK, you may lodge a complaint with your national data protection authority.
To exercise any of these, email support@velovid.net. We respond within 30 days (GDPR) or 45 days (CCPA). In practice, because we hold almost nothing about you, most requests are answered in full by this policy.
8. Data retention
Analytics data is retained for up to 14 months. Local storage stays in your browser until you clear it. Multiplayer session data is not persistently stored by us at all. Emails you send us are kept for as long as needed to resolve the matter and a reasonable period afterwards.
9. Security
All traffic is served over HTTPS with HSTS, and we apply a strict Content Security Policy and a full set of hardened response headers. No system is completely secure, which is a further reason we hold so little: the safest data is the data that was never collected. We do encourage you not to use your real name as an in-game nickname.
10. International transfers
The Service is hosted in the United States, and our providers process data internationally. By using the Service from outside the US you consent to that transfer. Where GDPR requires it, we rely on Standard Contractual Clauses.
11. Changes
We may update this policy as the Service changes. The "Last updated" date above reflects the most recent change, and continued use after an update constitutes acceptance. If we ever add a new non-essential technology, we will re-ask for consent rather than rely on an answer given before it existed.
12. Contact
Privacy enquiries: support@velovid.net