Privacy Policy

1Who we are

Duckling Sort is made by one person: Thunyathep Santhanavanich (“Joe”), an independent developer. In this policy, “we”, “us” and “our” mean Joe. There is no company behind the game and no server of our own.

We are the controller of the personal data described here. That means we decide why and how it is used, and we are the one to ask about it.

• Controller: Thunyathep Santhanavanich
• Postal address: 6 Soi Sathon 11 Yaek 11, Sathon Tai Road, Yan Nawa, Sathon, Bangkok 10120, Thailand
• Email: support@joe.in.th

We have not appointed a data protection officer, because the law does not require one for the way we use data. Write to us directly about anything to do with your data.

What this policy covers

This policy covers the Duckling Sort app for iPhone and iPad and this website, ducklingsort.com.

The game runs on Apple’s services: iCloud, Game Center, the App Store and TestFlight. Where Apple collects data for its own services, such as your Apple Account, your Game Center profile or your payments, Apple’s own rules apply. You can read them in the Apple Privacy Policy and in Game Center & Privacy. This policy tells you what the game itself does and what reaches us.

Words we use on this page

• Name: the name you type when the game asks “What should we call you?”. Other players can see it if you share a public profile. It does not have to be your real name, and a made-up name is best.
• Player ID: the short ID, like @duckfan, that friends use to find you: 3–15 characters from a–z, 0–9 or _, starting with a letter. You can pick it yourself; otherwise the game makes one from your name (section 6).
• Public profile: the small record about you that the friends features publish in the public database, for other players to see.
• Public database: the game’s public CloudKit database. Apple stores and runs it for us. Any copy of the game can read what is in it.
• Mail: the friend requests, hearts and “accepted” notes (telling a player that their friend request was accepted) that players send each other. They show in the “Mailbox”.
• Pond ranking: the game’s three Game Center boards: the Daily Egg Race, the 30-day Pond Season and the Daily Challenge board.
• Private iCloud copy: the copy of your saved game kept in your own private iCloud storage.
• CloudKit identifier: a code that Apple’s CloudKit gives your Apple Account for this game only. It is the same on all your devices. It is not your email address or your Apple Account name.
• Game Center ID: the code Game Center uses for you in this game. It is not your player ID.
• Game Center link code: a one-way code made from your Game Center ID. It lets a ranking row open your farm.
• Pseudonymous data: codes like the CloudKit identifier and the Game Center link code don’t show your name, but each one points to one player. The player ID can show part of your name if the game made it for you. The law treats all of these as personal data, and so do we. They are not anonymous.
• [your name] in iOS paths: the row with your name at the top of the Settings app on your iPhone or iPad. Some screens call it “Apple Account”.

2What data the game uses, feature by feature

This table is the short version. Each feature has its own section below with the details.

What you have to give us, and what is optional

The only thing the game needs from you is a name to call you, typed at “What should we call you?” in the first-launch setup. You can’t finish the setup without one, but it can be any name you like, and a made-up name is best. You can change it later, but you can’t leave it empty.

Everything else is optional:

• Without iCloud, your progress stays on your device only and doesn’t follow you to your other devices.
• Without the ranking, you don’t appear on the Game Center boards and don’t earn rank rewards.
• Without a player ID, you can’t add friends, send hearts or let others visit your farm.
• Without buying anything, you can still play and clear every stage.
• Without writing to us, we never learn your email address, so we have no way to reach you and can’t help with a problem we don’t know about.

The optional features stay off until you switch them on. Our legal reason for running them is not your consent. When you switch a feature on, you ask us to provide it, and we run it as part of our agreement with you to provide the game (GDPR Art. 6(1)(b); PDPA s.24(3)). You can switch each one off again at any time, and it then stops.

Data that comes from Apple, not from you

Some data reaches the game from Apple rather than from you:

• your Game Center nickname and Game Center ID, but only after you join the ranking;
• your App Store country, or your device’s region, which becomes your flag;
• Apple’s signed time and the day you first downloaded the app, used to check the device clock;
• App Store transaction details, only if you buy something;
• your CloudKit identifier, when you are signed in to iCloud or use the friends features.

3Playing on your device

Duckling Sort plays offline. Everything you do in the game is saved on your device first, in the app’s own storage.

What the game saves

• You: your name, the avatar you picked and your buddy duck.
• Your progress: the stages you cleared, your stars and shields, and your fewest moves and fastest time on each stage.
• Your journal: your last 50 games, each with the date, the board number, moves, eggs, coins, rafts bought and playing time.
• The Daily Challenge: your results for the last 62 days, with moves, times and tries.
• Rewards: trophies, lucky-wheel spins, login gifts, missions, the monthly secret path and other rewards you collected, and your energy.
• Your farm: what you bought and placed, the eggs and coins you collected, and how you fed your ducks.
• Purchases: a record of anything you bought (see section 8).
• Hearts from friends: a short code for each friend whose heart you collected, so each heart counts once (see section 6).

Settings that stay on this device

Your language, sound and music, the tutorial, the farm view, and your answers about the ranking and friends features are kept on each device and never synced. The game also remembers how often it has invited you to the ranking, so it asks at most twice, and whether “Friends & farm sharing” is on or off, without any identifier, so a device restored from a backup keeps your choice (section 6).

Small technical records

To keep your saves safe, the game also keeps a few technical records on the device:

• A random code for each install. It is made up by the game and is not taken from your device. It lets two devices merge their saves without losing anything, so it also travels inside your iCloud copy.
• Apple’s app-vendor code (identifierForVendor). The game keeps it only in a small file next to each save on the device, left out of backups and never uploaded. Its only job is to notice when a save was restored or copied to another device, so that device gets a fresh random code.
• A one-way code for each iCloud account. When you sign in to iCloud, the game keeps separate saves for each account under a code made from your CloudKit identifier. The save folders use this code, not the identifier itself. (If you use the friends features, the friends file described in section 6 does hold your CloudKit identifier.) If you sign out or switch accounts, that account’s save stays on the device until you delete the app.
• Clock readings. Daily gifts depend on the date, so the game compares your device clock with times from Apple: the App Store’s signed time, the day you first downloaded the app, and the times iCloud puts on your saves. This stops rewards being claimed by changing the clock. The readings stay on the device.
• Spare copies. The game keeps the previous version of your save, and up to 20 copies of saves it could not read, so nothing is lost by accident.

What the game checks with Apple whenever you open it

Each time you open the game or come back to it, it asks the App Store for two things, whether or not you buy anything: your App Store country and Apple’s signed record of your download. The country is only kept in memory. It leaves your device only as your flag, and only if you join the ranking or share a public profile. Nothing from these checks is sent to us.

Other things on your device

• Accessibility: the game reads settings such as Reduce Motion, VoiceOver, Differentiate Without Color and text size, so it can adapt. It does not store them.
• Clipboard: the game puts your own player ID on the clipboard only when you tap “Copy” next to “My ID” (with Handoff on, your other Apple devices can paste it too). It never reads the clipboard.
• System log: like most apps, the game writes short technical messages to your device’s system log, such as a score it sent, your player ID, a friend’s player ID, or the CloudKit record names that contain your CloudKit identifier and other players’. They stay on your device unless you choose to share a diagnostic report with someone, such as Apple.
• Device backups: your save and settings are part of your normal iCloud Backup or computer backup, like any app’s data. The vendor-code file, the iCloud sync files and the friends file (section 6) are left out.

The game has no “delete my progress” button. To remove everything on a device, delete the app. To remove the iCloud copy too, see section 4.

Why

To run the game, save your progress and keep daily rewards fair.

Legal basis

Performing our agreement with you to provide the game (GDPR Art. 6(1)(b); PDPA s.24(3)). Checking the clock so daily rewards stay fair: our legitimate interests in a fair game for everyone (GDPR Art. 6(1)(f); PDPA s.24(5)).

How long

Until you delete the app. Your journal keeps 50 games and your challenge results 62 days. Copies in device backups follow your backup settings.

Your controls

Change your name in the game’s “Settings” › “My Profile” › “Name” › “Change”; switch sound, music and language in the game’s “Settings”; manage backups in Settings › [your name] › iCloud › iCloud Backup; delete the app to remove its data from the device.

4iCloud sync

When your device is signed in to iCloud, the game keeps a copy of your saved game in your own private iCloud storage, using Apple’s CloudKit. That is how the same progress appears on your iPhone and iPad.

What goes to iCloud

The whole saved game listed in section 3: your name, avatar and buddy duck, progress, journal, challenge results, rewards, farm, energy, purchase record and heart codes, together with the random install codes. Settings, clock readings and the vendor code stay on the device.

The save is uploaded as one encrypted field. Two small version numbers, which tell older versions of the game whether they can read the save, are stored next to it without encryption. The copy uses a small amount of your iCloud storage, less than 1 MB.

If you use the friends features, a second small record holds the players you blocked and the friend requests and notes you declined or cleared, each with the time, so all your devices apply them. It is encrypted the same way and is never part of your public profile. It stays when you turn sharing off, so your blocks still apply if you turn it on again. “Delete Data from iCloud” removes it together with your saved game.

Who can see it

The copy is kept in your private iCloud storage, in a space Apple sets aside for this game. It belongs to your Apple Account, not to us. Apple doesn’t let developers see inside their players’ private storage, so we can’t see it.

Apple encrypts your saved game. With iCloud’s standard protection, Apple holds the keys. If you turn on Advanced Data Protection for your Apple Account, your saved game is end-to-end encrypted and only your trusted devices hold the keys. Apple explains both in its iCloud data security overview.

To tell your other devices about a change, iCloud can send the game silent signals. You never see a notification, and the game never asks for notification permission.

Stopping sync and deleting the copy

• To stop syncing, open Settings › [your name] › iCloud, tap “See All” next to “Saved to iCloud” (on iOS 17: “Show All” under “Apps Using iCloud”), and turn Duckling Sort off. Signing out of iCloud also stops it. Your progress then stays on the device.
• Stopping sync does not delete the copy already in iCloud. To delete it, open Settings › [your name] › iCloud › Storage (on some versions: “Manage Account Storage”), choose Duckling Sort, then “Delete Data from iCloud”.
• After you delete it, the game keeps your progress on the device, stops uploading and shows “Your iCloud copy was deleted. Your progress is still on this device.” On that device, nothing goes up again unless you tap “Back up to iCloud again”.
• If you play on more than one device, delete the app or turn its iCloud switch off on the others first, so no device uploads your progress again.
• Deleting the iCloud copy and the app removes everything in your save, including coins you bought, which can’t be restored.

Apple’s wording for these screens changes between iOS versions, so a label on your device may read a little differently. The controls stay in the same places. The “iCloud save” card in the game’s “Settings” reminds you of the way: “To stop syncing or delete the iCloud copy: Settings › your name › iCloud.”

Deleting the app removes the save from that device only. The iCloud copy stays until you delete it in iOS Settings, and copies in older device backups stay until those backups are replaced or deleted.

Why

To keep your progress safe and the same on all your devices.

Legal basis

Performing our agreement with you to provide the game and the sync you use (GDPR Art. 6(1)(b); PDPA s.24(3)).

How long

Until you delete it with “Delete Data from iCloud”. The game never deletes it by itself. How long Apple keeps deleted data on its servers is set by Apple.

Your controls

Settings › [your name] › iCloud › See All (“Show All” under “Apps Using iCloud” on iOS 17) to stop syncing; Settings › [your name] › iCloud › Storage › Duckling Sort › Delete Data from iCloud to delete the copy; “Back up to iCloud again” in the game’s “iCloud save” card to start again.

5Pond ranking (Game Center, optional)

The pond ranking has three boards: the Daily Egg Race, the 30-day Pond Season and the Daily Challenge board. They run on Apple’s Game Center.

The ranking stays off until you join. There are two ways to join:

• tap “Join the ranking” on the “Join the pond ranking?” card, which appears on Home and in the “Pond Ranking” screen and lists what will be shared; or
• turn on the “Join the ranking” switch in the game’s “Settings” › “Pond Ranking”.

Until you join, the game doesn’t sign you in to Game Center and sends it nothing.

Joining also turns on sharing

Joining the ranking also switches on the friends features (section 6). If you don’t have a player ID yet, the game makes one for you from the letters a–z and any digits in your name, starting at its first letter and without spaces (up to 10 characters), and four random digits, or “duck” and four digits if your name has fewer than three such characters, as a Thai name does, or if the word filter refuses it. When the device is signed in to iCloud, it publishes your public profile, so players can open your farm from the boards. While you are in the ranking, your profile also carries your Game Center nickname and your Game Center link code.

The link code is the first 32 characters of a one-way code (SHA-256) made from your Game Center ID. It can’t be turned back into that ID. But any copy of the game can make the same code from a ranking row, and that is how a row finds your farm. So the code links your ranking entry to your public profile. It is pseudonymous personal data, not anonymous data.

What is sent to Game Center

Once you have joined and are signed in to Game Center, the game sends:

• Daily Egg Race: the eggs you collected today (the day runs on Bangkok time), added up across all your devices.
• Pond Season: the eggs you collected in the current 30-day season, also added up across your devices.
• Daily Challenge: the day’s result you chose to submit: your moves, your tries (the fresh starts you made that day, on all your devices) and your active playing time in seconds. If you don’t submit a day, nothing is sent for it.

Each score carries a small attachment with your avatar, the number of stages you cleared, your stars and shields, and your country flag. Egg scores also carry your coins, rounded (exact below 1,000, then in steps, and “1M+” above a million). Coins you bought, or collected from Duck Club (the monthly subscription, section 8), count too. Challenge scores carry no coins.

Game Center shows your Game Center nickname next to your scores.

Your country flag

Your flag comes from your App Store country. In test versions, or before the App Store answers, the game uses your device’s region from Settings › General › Language & Region instead. It never uses location services or GPS, and you can’t choose it.

Who can see it

• Every Game Center player who looks at a board sees your nickname and score.
• Other Duckling Sort players also see the details in the attachment, such as your avatar, flag, coins, tries and time, because their app reads and shows them.
• We can see the top 100 of each board in App Store Connect, and can remove scores or block players there.
• Apple runs Game Center under Game Center & Privacy.

For some Game Center friends, Game Center gives the game a real name instead of a nickname. Apple says this happens with friendships made before iOS 10, and never with children’s accounts. So a long-time Game Center friend may see your real name on their boards. That stays on their device and never reaches us. The game never reads your Game Center friends list, photo, email address or contacts.

What the game reads back

To draw the boards, your app reads the top 500 entries of each board and your own. To pay rank rewards, it reads the top 100 of the last finished day or season and works out your place. This stays in memory on your device. Only the rewards you collect and your trophies (their tier, your place and the number of players) are kept, in your saved game.

One switch per device

The “Join the ranking” switch works on each device separately, but your scores are totals from your whole saved game. A device that has joined also sends eggs and challenge results you earned on your other devices. To leave completely, switch it off on every device.

Leaving the ranking

Switch off “Join the ranking” in the game’s “Settings” › “Pond Ranking”. That device then stops sending scores, and rank rewards stop. The game removes your Game Center nickname and link code from your public profile. If the game made your player ID by itself when you joined, and on this device you have never picked or created an ID or switched on “Friends & farm sharing” yourself, leaving also switches “Friends & farm sharing” off and deletes that ID, your public profile and all the mail you sent, as “Stop sharing” does (section 6). If iCloud can’t be reached at that moment, sharing stays off and the game keeps trying until everything is deleted. If you picked your ID or switched sharing on yourself, your ID and public profile stay and “Friends & farm sharing” stays on: turn that switch off to remove them.

Leaving does not delete scores already sent, and it doesn’t sign you out of Game Center. Game Center keeps past days and seasons for a time Apple decides. If you want your scores taken off our boards, write to us and we will remove them as far as App Store Connect lets us. To sign out of Game Center, use Settings › Game Center › Sign Out.

Why

To run the ranking you joined and pay rank rewards.

Legal basis

Performing our agreement with you to provide the feature you switched on (GDPR Art. 6(1)(b); PDPA s.24(3)).

How long

A day board lasts a day and a season lasts 30 days. Apple keeps past boards and your entries in them for a time Apple decides. What the game reads back stays in memory until you close it. Trophies stay in your saved game.

Your controls

“Join the ranking” in the game’s “Settings” › “Pond Ranking” (switch it off to leave); Settings › Game Center to sign out; email us to remove your scores from our boards.

6Friends, player IDs and farm visits (optional)

Players can add each other as friends by player ID, send each other hearts (a little energy) and visit each other’s farms. This runs on the public database, which Apple stores and runs for us. It is not a server of our own.

When it starts

Sharing is off until you do one of these:

• tap “Use this ID” in the first-launch setup (you can tap “Not now” instead);
• tap “Create my ID” in the “Friends” tab of the “Pond Ranking” screen;
• turn “Friends & farm sharing” back on in the game’s “Settings” › “Pond Ranking” (this switch works only once you have joined the ranking; otherwise it points you to the “Friends” tab);
• join the ranking (section 5).

Once sharing is on, the game makes a player ID for you if you don’t have one yet, from the letters a–z and any digits in your name, starting at its first letter and without spaces (up to 10 characters), and four random digits, or “duck” and four digits if your name has fewer than three such characters, as a Thai name does, or if the word filter refuses it. Publishing needs an iCloud account on the device.

While you pick an ID in the first-launch setup, the game asks the public database whether the suggested or typed ID is free. That is only a lookup: nothing is saved until you choose “Use this ID”.

What your public profile shows

While sharing is on, the game publishes and updates your public profile. It holds:

• your player ID and your name (left empty if the word filter doesn’t accept the name);
• your avatar and your country flag (see section 5);
• how many stages you cleared, your stars and shields, and your coins, including any you bought;
• your farm: its level, land, buildings, ducks and their levels, decorations, floors, nests and whether you built the bridge to the secret island;
• your friends list and the friend requests you sent, each with the time;
• for 60 days: who you sent hearts to and whose hearts you collected (with the day), and the friends you removed and requests you cancelled;
• when you were last online, and the app’s build number;
• while you are in the ranking, your Game Center nickname and Game Center link code.

Your blocks, and the requests and notes you declined or cleared, are not in your public profile. They are kept in your private iCloud storage (section 4), where only your own devices read them.

Last online is the time the game last updated your profile. It updates when you open the game, when you come back to it (at most every two minutes), when you leave it, shortly after your farm, stages, avatar, name or ID change, and after anything you do in the friends features. So it shows roughly when you last played. The game shows it only to mutual friends, in rough steps like “Online now”. But the exact time is in the record, where anyone who reads it can see it.

Your coins in the profile don’t show which ones you bought.

Mail: friend requests, hearts and notes

Mail is a small record sent to one player: a friend request, a heart (a little energy), or a note saying a friend request was accepted. Each one carries your CloudKit identifier, player ID, name, avatar and flag, the other player’s CloudKit identifier and the time it was sent. A heart also carries the game day it belongs to. Like your public profile, anyone who reads the public database can read your mail.

The “Mailbox” hides old mail (requests after 60 days, notes after 7 days, hearts after 7 game days), but the records stay until the sender’s app deletes them.

Who can see it

Your public profile and your mail are public by design. Any copy of Duckling Sort can read them, even without an iCloud account, and so can anyone who has access to the public database. We can see them in Apple’s CloudKit Console, and Apple stores them.

Everything is filed under your CloudKit identifier. It is the same on all your devices, and it is not your email address or your Apple Account name. It is pseudonymous personal data, not anonymous data.

Only share what you’re happy for any player to see. Use a made-up name, not your real name, and pick a player ID that doesn’t give away who you are.

What stays on your device

The game keeps a small file with your CloudKit identifier, your player ID and your friends, requests and blocks, which includes other players’ CloudKit identifiers. The file is left out of device backups. When you turn sharing off, your player ID and the other players’ identifiers are removed from it at once: it keeps only your CloudKit identifier, the fact that sharing is off, and anything the game still has to delete from the public database. If your blocks and declined requests haven’t reached your private iCloud yet, they stay in the file until they do. The game’s settings on the device, which backups do keep, note only whether sharing is on or off, without any identifier. So a device restored from a backup keeps your choice, and reads the rest back from your public profile and your private iCloud. Backups made with earlier test versions of the game may still hold an older copy of the file until they are replaced. Other players’ profiles and your mail are only held in memory while the game is running, and are never written to the device. When you tap “Copy” next to “My ID”, your ID goes to the clipboard.

Turning sharing off

Turn off “Friends & farm sharing” in the game’s “Settings” › “Pond Ranking”, then confirm “Stop sharing”. Sharing stops on that device at once, and the game deletes from the public database:

• your public profile, your current player ID, and an earlier player ID still waiting to be released;
• all the mail you ever sent, to anyone: friend requests, hearts and “accepted” notes.

Your player ID, friends and requests are removed from the device too. Hearts waiting for you are lost, and friends no longer see you.

If iCloud can’t be reached, sharing stays off and the game keeps trying (when you open the game, when you come back to it, and every so often while it is open) until everything is deleted. Until your profile and ID are gone, the switch says “Sharing is off. Your profile is still on the server, and the game deletes it as soon as it can reach iCloud.” The game never turns sharing back on by itself.

Some things stay after you turn sharing off:

• mail other players sent you (only the sender’s app can delete it);
• reports you made, or that were made about you (section 7);
• your CloudKit identifier in other players’ friend and request lists;
• your blocks, and the requests and notes you declined or cleared, in your private iCloud storage, so they still apply if you turn sharing on again. They are never public, and “Delete Data from iCloud” removes them (section 4).

Write to us and we will delete what we can, such as mail addressed to you, or anything an earlier test version of the game left behind. Reports stay until their time limit runs out (section 7). Your CloudKit identifier in another player’s lists is part of their public profile. It goes when they remove you or turn sharing off, and we can’t always remove it for them.

Good to know

• The switch works per device. A device that has published before turns sharing off when it sees your profile is gone. But another device where you joined the ranking, or chose an ID, can publish a new profile. Turn sharing off on each device.
• Joining the ranking again turns sharing back on, and makes a new player ID if you have none.
• Deleting the app does not delete your public profile. Deleting the game’s data in iOS Settings is not a reliable way to delete it either. Turn sharing off first, or write to us.
• We can remove a public profile, with its player ID, that breaks the rules in section 7. When your device finds your profile gone, it turns sharing off, and it may say “Your profile was removed, so sharing is off here.”
• Changing your ID in the “Friends” tab with “Edit” claims the new ID and releases the old one.

Why

To let you add friends, send hearts and visit farms, and to let others find yours.

Legal basis

Performing our agreement with you to provide the features you switched on (GDPR Art. 6(1)(b); PDPA s.24(3)). Other players’ identifiers in your lists and in mail sent to you: our legitimate interests in making the friends features work for both players (GDPR Art. 6(1)(f); PDPA s.24(5)).

How long

Your profile and ID stay until you turn sharing off or we remove them. Mail stays until its sender’s app deletes it, or until we delete it on request. We may delete a public profile, with its player ID, that has not been updated for 24 months.

Your controls

“Friends & farm sharing” in the game’s “Settings” › “Pond Ranking”; “Edit”, “Remove friend”, “Cancel request”, “Block” and “Unblock” in the “Friends” tab; email us for anything the app can’t do.

7Keeping the pond friendly: filter, block, report

Names and player IDs are chosen by players and shown to others, so the game has three tools to keep the pond kind. There is no chat, and players can’t send each other messages of their own.

The word filter

A word list built into the game checks your name and every player ID you choose or are offered. If it refuses a name, you see “Please pick a kinder name.” It also checks other players’ names and IDs before they are shown, and hides the ones it refuses behind a stand-in like “Duck 4821”. If an older name of yours is refused, your public profile shows no name at all.

The filter runs entirely on your device. Nothing is sent anywhere to be checked. It only stops a name from being used or shown; it makes no other decision about you.

Blocking

Tap “Block” in the ⋯ menu of a friend row or in the “Mailbox”. The player leaves your friends list, their hearts and friend requests no longer reach your “Mailbox”, and the mail you sent them is deleted.

A block is kept in your private iCloud storage (section 4), with the time, not in your public profile. Other players can’t see whom you blocked, and the blocked player isn’t told: a friend request they send simply stays unanswered. Your devices share your blocks through that private copy. You can lift a block with “Unblock”. A lifted block stays in the private copy for 60 days.

Reporting

Tap “Report” in the ⋯ menu of a friend row or in the “Mailbox”, then pick “Rude name or ID”, “Spam” or “Something else”. There is no box for your own words. A report holds your CloudKit identifier, the other player’s CloudKit identifier, the reason and the time.

Reports are kept in the public database, but they are locked. Other players can’t read them, and the player you report can’t see the report or who made it. We read reports in Apple’s CloudKit Console. Your own Apple Account can technically read the reports you made, but the app never shows them.

After you see “Thanks. We’ll take a look.”, we look at the report as soon as we can. If a name or player ID breaks the rules, we may remove that player ID or public profile. Turning off “Friends & farm sharing” does not delete reports.

Why

To keep players, including children, safe from rude names and spam, and to stop abuse of the friends features.

Legal basis

Our legitimate interests in keeping the pond safe and friendly for everyone and in meeting the App Store’s rules for shared content (GDPR Art. 6(1)(f); PDPA s.24(5)). You can object to this (section 17).

How long

A block lasts until you lift it, then stays in your private iCloud for 60 days. Reports: 12 months after we review them.

Your controls

“Block”, “Unblock” and “Report” in the “Friends” tab and the “Mailbox”; email us about a report or a decision we made.

8In-app purchases (optional)

Duckling Sort can offer four coin packs and Duck Club, a monthly subscription that gives you daily coins, a bigger energy battery, faster energy and a supporter badge. Some versions of the game don’t show the “Coin Shop” yet. In those versions, none of this section happens.

Apple takes care of payment

Every payment, renewal and refund goes through Apple’s App Store. We never see your card or other payment details, your Apple Account, your name or your email address. The game only gets Apple’s signed record of each purchase: a transaction number, the product, the dates, and whether it was refunded or will renew. If Ask to Buy is on for a child’s account, the purchase waits until a parent approves it.

What the game keeps

• In your saved game (so on your device and in your private iCloud copy): the transaction number and the coins given for each coin pack, the numbers of any refunded packs, and the days whose Duck Club coins you collected. This makes sure every purchase counts exactly once.
• On the device only: when your Duck Club membership started and ends, and whether it will renew. The game checks this with Apple when you open it.

If Apple refunds a coin pack, the game takes those coins back, even if that puts your purse below zero, and tells you on Home.

“Restore Purchases” asks Apple to sync your purchases, and Apple may ask you to sign in. Only Duck Club can be restored. Coins from coin packs live in your saved game, on your device and in your private iCloud copy. If you delete both, the coins you bought are gone and can’t be restored. “Manage Subscription” opens Apple’s own subscription screen.

Where your coins show

Your coin total, including coins you bought or collected from Duck Club, appears on your ranking entries if you joined the ranking, and in your public profile if you share one. Nobody can tell from it which coins you bought. Your purchase record itself is never sent to Game Center or to the public database.

What we see

App Store Connect shows us sales and subscription reports. They include the country or region and the type of device, and, for subscriptions, a random subscriber number Apple creates. They never include your name or email address.

Why

To deliver what you bought, exactly once, and to handle refunds and renewals.

Legal basis

Performing our agreement with you to provide what you bought (GDPR Art. 6(1)(b); PDPA s.24(3)).

How long

As long as your saved game exists, on the device, in device backups and in iCloud. Apple keeps its own purchase records under its policy.

Your controls

Buy only if you want to; “Restore Purchases” and “Manage Subscription” in the game’s “Settings” › “Purchases”; cancel in Settings › [your name] › Subscriptions; turn on Ask to Buy for a child with Family Sharing; ask Apple about refunds at reportaproblem.apple.com.

9What Apple shares with us

The game has no analytics or crash-reporting tools of its own. Apple does give every developer some information through App Store Connect and Xcode:

• App Analytics: totals that don’t identify anyone. Usage numbers such as installs, sessions, active devices and crashes come only from people who turned on sharing with app developers. App Store numbers such as page views and downloads count everyone. Apple hides numbers that are too small.
• Crash reports: a technical report when the app crashes, with the device model, iOS version and app version. Again only from people who allow sharing with app developers.
• TestFlight: if you test a beta version, Apple always shares crash reports with us. Whichever way you joined, we see details such as your device, iOS version, language, sessions and crashes. If we invited you by email, we also see your name and email address. If you send feedback, we see your comments and screenshots and technical details such as battery level, free space and network type. If you joined through a public link, we don’t see your name or email address, unless you add your email address when you send feedback.
• Sales reports: see section 8.
• Game Center boards: see section 5.

We use this only to find and fix problems, improve the game, run the beta and understand how the game is doing. We don’t combine it with other data to find out who you are.

Why

To fix crashes and bugs, improve the game, run beta tests and understand sales.

Legal basis

Our legitimate interests in a game that works and keeps getting better, a smooth beta, and knowing how the game is doing (GDPR Art. 6(1)(f); PDPA s.24(5)).

How long

As long as Apple keeps it in App Store Connect and Xcode. Apple says TestFlight feedback is kept for about a year (TestFlight & Privacy).

Your controls

Turn off “Share With App Developers” in Settings › Privacy & Security › Analytics & Improvements; leave a beta in the TestFlight app, and don’t send feedback if you’d rather not.

10When you write to us

The app has no contact form and no mail button. If you email support@joe.in.th, we receive your email address, the name your mail app shows, your message and anything you attach. Our mailbox is hosted by Apple’s iCloud Mail.

We use your email only to answer you and to deal with what you asked, such as a privacy request or a report. We never add you to a mailing list.

Please don’t send us passwords, payment details or anything we don’t need to help you. For a privacy request about a child, a parent or guardian can write for them (section 18).

Why

To answer your questions, help with problems and handle privacy requests.

Legal basis

Our legitimate interests in answering you and helping players (GDPR Art. 6(1)(f); PDPA s.24(5)). Keeping a record of privacy requests and how we handled them: our legal obligations and our legitimate interests in being able to show we handled them properly (GDPR Art. 6(1)(c) and (f); PDPA s.24(5) and (6)).

How long

We delete support emails 12 months after the conversation ends. We keep a short record of each privacy request (what was asked, when and what we did) for 3 years after we close it, in line with the main time limit for claims under Thai law: 3 years from when a person learns of the harm and who is responsible (PDPA s.78). Then we delete it.

Your controls

You decide what to send; ask us at any time to delete our emails with you.

11This website

This website is a set of plain pages. Its public pages (the home page and this policy, in English and Thai) set no cookies, keep nothing in your browser’s storage, have no analytics and no ads, and load nothing from other companies. Fonts and pictures come from this site itself. The little pond game on the home page lives only in the page and is gone when you leave. A password-protected page for our own use is not meant for visitors; if you open it, your browser keeps the password you type only until you close the tab, and once it is unlocked the page loads fonts and code from Google Fonts and jsDelivr, which then receive your IP address.

What our web host sees

The site is hosted by Vercel. Like every web host, Vercel receives what your browser sends with each visit: your IP address, your browser and device type, the page you asked for, the page you came from and the time. Vercel uses this to deliver and protect the pages, and it can work out a rough location from the IP address. We can look at recent request logs in Vercel’s dashboard. Vercel answers from data centres around the world, usually one near you (section 14). Vercel explains its role and its general rules for keeping data in the Vercel privacy notice; it publishes no fixed period for request logs.

Links to Apple

If you open this site in Safari on an iPhone or iPad, Safari may show Apple’s own banner for the app. If you tap an App Store badge or a link to Apple, Apple’s website receives your visit under the Apple Privacy Policy.

Why

To deliver this website and keep it secure.

Legal basis

Our legitimate interests in running a working, secure website (GDPR Art. 6(1)(f); PDPA s.24(5)).

How long

We can see logs for a short time set by our hosting plan; Vercel keeps its own logs as long as it needs them under its privacy notice, which sets no fixed period.

Your controls

There’s nothing to switch off, because there are no cookies. You can ask us about any request data we can see.

12What we never do

• No ads. The app contains no advertising code, no banners and no reward videos.
• No tracking. The game doesn’t use Apple’s advertising identifier (IDFA), never asks to track you, and doesn’t follow you across other apps or websites.
• No selling or sharing for advertising. We do not sell your personal data, and we don’t share it with anyone for advertising.
• No outside tools. The app contains no code from other companies: no analytics, crash-reporting, advertising or social-media kits. It has no networking of its own and talks only to Apple’s services.
• No device permissions. The game never asks for your camera, microphone, photos, location, contacts, Bluetooth, Game Center friends or notification permission, and doesn’t read them.
• No clipboard reading. It only puts your own player ID there when you tap “Copy”.
• No personal details. It never asks for your email address, phone number, birthday or real identity. The name it asks for can be any made-up name.
• No marketing messages. We don’t send newsletters or promotional emails.
• No automated decisions that affect your rights. We make no decisions about you by automated means that have legal or similarly significant effects. The word filter only stops a name from being used or shown, and rank rewards follow the same fixed rules for every player.

13Who receives data

Apple, in several roles:

• As our service provider for CloudKit. Apple stores your private iCloud copy and the public database for us. Under the Apple Developer Program License Agreement, Apple may use this data only to provide and improve iCloud and to act on our instructions. It protects the data with industry-standard measures, and tells us if it learns that the data was altered, deleted or lost through unauthorised access.
• As an independent company for its own services. Apple runs your Apple Account, iCloud and iCloud Backup, Game Center, the App Store and payments, TestFlight, App Analytics and the iCloud Mail service that hosts our mailbox. For these, Apple decides how data is used under the Apple Privacy Policy and Game Center & Privacy.

Other players, only for what you choose to share:

• your ranking entries, which all Game Center players can see, with details shown to Duckling Sort players (section 5);
• your public profile and the mail you send, which anyone using the app, or with access to the public database, can read (section 6).

Vercel, which hosts this website and receives the request data described in section 11. Vercel handles it to deliver and protect the site. For its own purposes, such as keeping its network secure, Vercel decides for itself under its own privacy notice.

Authorities, only when the law requires it, for example a valid court order. We check every request and share no more than we must.

A new owner, only if the game itself ever passes to someone else. The data needed to keep the game running would go with it, and we would tell you on this page and in the App Store release notes before that happens.

Apple handles the game’s CloudKit data for us under the Apple Developer Program License Agreement, which limits what Apple may do with it. Vercel handles this website’s request data under its own privacy notice.

No one else receives data from the game, and nobody buys it. The game’s data never goes to advertisers, data brokers or analytics companies.

14Data stored outside your country

We run no servers. Everything that leaves your device goes to Apple, and this website runs on Vercel.

• Apple stores iCloud, Game Center and App Store data, and our mailbox, in data centres it chooses. Apple says personal data is generally stored by Apple Inc. in the United States. For people in the European Economic Area, the United Kingdom and Switzerland, Apple Distribution International Limited in Ireland is responsible for the data Apple handles for its own services. For its own services, Apple says transfers of data from the European Economic Area, the United Kingdom and Switzerland are governed by standard contractual clauses, and you can ask Apple for a copy at apple.com/legal/privacy/contact. For the game’s CloudKit data, Apple’s developer agreement says data from the European Economic Area or Switzerland goes only to countries with adequate protection or under standard contractual clauses (for Switzerland, the Swiss Transborder Data Flow Agreement), and that encrypted data may be stored in whichever country Apple chooses. Apple also says its practices comply with the Global Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) systems.
• Vercel serves this website from a worldwide network, so your request is usually answered by a data centre near you (when we checked, in Singapore), and Vercel processes data in the United States and other countries where it operates. Vercel says it protects transfers with standard contractual clauses or other legal mechanisms, and that it takes part in the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework.
• Your public profile and ranking entries can be read by players anywhere in the world, because that is what they are for.

These countries may protect data differently from the law where you live. As of September 2026, Thailand’s regulator has not published a list of countries with adequate protection. For the game features you switch on, the transfer is needed to give you what you asked for (PDPA s.28(3); Swiss FADP Art. 17(1)(b)). Emails you send us and visits to this website also reach Apple’s and Vercel’s servers abroad, because that is how the mail and the pages get through. Apple and Vercel protect this data under their own commitments described above; their standard contractual clauses cover data from the European Economic Area, the United Kingdom and Switzerland. Write to us if you would like a copy of these safeguards or more information about them.

15How long data is kept

We keep data only as long as it’s needed for the feature it belongs to. The game has no automatic clean-up of its own beyond the limits below, so wherever you see “until you delete”, the choice is yours.

16Keeping data safe

• We keep very little. The game has no accounts, no servers and no databases of our own, so there is little that could leak from us.
• Your private iCloud copy is stored in an encrypted field. With Advanced Data Protection it is end-to-end encrypted, so even Apple can’t read it. We can’t see it at all.
• The public database is run by Apple. Only your own Apple Account can change or delete the records you create, and we can remove them when needed. Reports are locked so that other players can’t read them. But the public profile is public by design, so share only what you’re happy for everyone to see.
• Our own access. Only we, and anyone we authorise to help us, can reach player data in App Store Connect, the CloudKit Console and our Vercel account. Our Apple developer account is protected with two-factor authentication, as Apple requires.
• Connections to Apple’s services and to this website are encrypted (HTTPS).

No system is perfectly secure. If a data breach puts your personal data at risk, we will report it to the data protection authorities as the law requires. In Thailand that is the PDPC, within 72 hours of learning of it where we can. If the risk to you is high, we will also tell you without delay on this website and in an update of the app, because we have no other way to reach most players. Apple has promised to tell us if it learns that CloudKit data was altered, deleted or lost through unauthorised access.

17Your choices and rights

What you can do yourself, right now

Switching off a feature never costs you your progress. Your game keeps working, offline too.

Your rights under the law

Depending on where you live, data protection law gives you rights over your personal data. We honour the requests below from every player, wherever you live, as far as the law and the technology allow.

Thailand (Personal Data Protection Act B.E. 2562 (2019), PDPA)

• to see your data and get a copy, and to ask how we obtained data about you that we hold without your consent (s.30);
• to receive your data in a common, machine-readable format, or have it sent to someone else, where that is possible (s.31);
• to object to what we do based on our legitimate interests (s.32);
• to have your data deleted, destroyed or made anonymous (s.33);
• to have its use restricted (s.34);
• to have it corrected and kept accurate and up to date (s.35–36);
• to withdraw consent at any time, if we ever ask for it (s.19);
• to complain to the regulator (s.73).

For a minor, a parent or guardian can use these rights for them (s.20, and section 18).

European Union and EEA (GDPR), and the United Kingdom (UK GDPR)

• to access your data (Art. 15), and have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18);
• to data portability for data we process to provide the game (Art. 20);
• to object to what we do based on our legitimate interests, such as safety reports (Art. 21);
• not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Art. 22);
• to withdraw consent at any time, if we ever ask for it (Art. 7(3));
• to complain to a data protection authority, especially in the country where you live or work (Art. 77).

Switzerland (Federal Act on Data Protection, FADP)

• to access your data (Art. 25) and receive it in a common format (Art. 28);
• to object, and to have data corrected or deleted (Art. 30 and 32);
• to have a person review an automated decision (Art. 21).

United States

Parents of children under 13 have extra rights over their child’s data (see section 18). We don’t sell your personal information, and we don’t share it for targeted (cross-context behavioural) advertising, which is what US state privacy laws mean by “selling” and “sharing”. So there is nothing to opt out of. What you choose to show other players is described in sections 5 and 6.

How to ask

Email support@joe.in.th. It helps if you include:

• what you would like us to do (for example “send me a copy” or “delete my profile”);
• your player ID, if you have one, or your Game Center nickname for ranking requests;
• the country you live in, so we apply the right law.

Checking it’s you. The app has no accounts or email addresses, so we need a way to be sure a profile is yours before we act. We will usually ask you to change your in-game name for a moment to a short code we send you, so we can see the code appear on your public profile. Only your own devices can do that, and you can change the name back afterwards. If you don’t share a profile, we may ask you to write from the address you used to write to us before. We only ask for what we need to check, and we delete it once the request is done.

What we can reach. We can find and copy or delete what is in the public database: your profile, player ID, mail and reports. We can remove your scores from our Game Center boards, as far as App Store Connect lets us. We cannot see your private iCloud copy or the save on your device. You already have those in your app, and you can delete them yourself as described above. We send copies as a file in a common, machine-readable format (JSON). The game has no export button for your saved game, and we can’t reach the copies on your device or in your private iCloud, so we can’t send those as a file. For data that Apple holds for its own services, such as your Apple Account or Game Center profile, you can ask Apple through privacy.apple.com.

When and how much. We answer within 30 days of receiving your request, or by the same date the next month if that comes sooner, and it is free. Only for players covered by the GDPR or the UK GDPR, if a request is very complex, we may take up to two more months, and we will tell you why within that first period. If we can’t do what you ask, for example because the law requires us to keep something, we will tell you why, and we keep a record of that decision.

If you want to complain

Please tell us first, at support@joe.in.th with the subject “Privacy complaint”. We will confirm we received it within 30 days and tell you what we decided.

You can also complain to a data protection authority at any time:

• Thailand: Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th, online complaints at complaint.pdpc.or.th
• European Union and EEA: the authority in your country, listed by the European Data Protection Board at edpb.europa.eu
• United Kingdom: Information Commissioner’s Office (ICO), ico.org.uk/make-a-complaint
• Switzerland: you can report to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch

18Children and families

Duckling Sort is rated 4+ on the App Store, so people of any age can play it, children included. We’ve tried to make it safe for them by default.

What the game does for young players

• It doesn’t ask anyone’s age. It asks for a name to call you, and nothing else about who you are.
• A made-up name is best. The name you type can be read by other players if you share a public profile, so children should never use their real name. The game suggests a player ID made from the name, so pick a different one if the name is real. Numbers in the name, such as a birth year, can end up in the player ID too.
• Sharing starts switched off. The ranking and the friends features stay off until someone switches them on, and they can be switched off again at any time.
• No chat. Players can’t write messages to each other. They can only send friend requests and hearts.
• Kind names only. The word filter checks names and IDs on the device, and players can block and report others (section 7).
• No ads, no tracking and no data sold, for anyone (section 12).

For children: please ask a parent or guardian before you join the ranking or pick a player ID, because other players can see your name and your farm.

For parents and guardians

• Watch the first-launch setup. It suggests a player ID. Tap “Not now” to keep sharing off. A player ID can be picked later.
• Turn features off in the game’s “Settings” › “Pond Ranking”: switch off “Join the ranking” and “Friends & farm sharing”.
• Use Screen Time to limit purchases and Game Center: Settings › Screen Time › Content & Privacy Restrictions, then “App Store, Media, Web & Games” (on iOS 17: “iTunes & App Store Purchases”). With Family Sharing, Ask to Buy lets you approve every purchase. Game Center also applies Apple’s own limits to children’s accounts.
• Ask us. A parent or guardian can act for their child. You can ask us to review your child’s data, delete it (such as the public profile, player ID, mail and reports) or stop further sharing. Write to support@joe.in.th. We may check that the profile belongs to your child, as described in section 17.

What the law says about children

• Thailand: where the law asks for consent, a child aged 10 or under always needs a parent’s or guardian’s consent. A minor who has not yet come of age (generally under 20) needs it too, unless Thai civil law lets them do that act alone. Parents and guardians can use their child’s rights for them (PDPA s.20).
• European Union and United Kingdom: children’s data gets special protection. Where a service relies on consent, a child can give it alone only from a set age: between 13 and 16 depending on the EU country, and 13 in the UK.
• United States: parents of children under 13 can review their child’s data, have it deleted and refuse further collection.

The game’s optional features are not based on consent (section 2), but we still take extra care with children’s data and act on every request from a parent or guardian.

19Changes and languages

This policy was last updated on 28 September 2026 and applies from that day.

We update this page before any version of the app or website changes how data is handled, and we change the date at the top. If a change is significant, for example a new kind of data or a new use, we will say so on this page and in the App Store release notes of that version before it takes effect, and ask for your consent in the app first where the law requires it (PDPA s.21). Earlier versions of this policy are available on request.

This policy is published in English and in Thai, and we keep the two in step. Both versions have the same standing. If they ever differ, the one that protects the player more applies.

20Contact

• Controller: Thunyathep Santhanavanich, independent developer of Duckling Sort
• Postal address: 6 Soi Sathon 11 Yaek 11, Sathon Tai Road, Yan Nawa, Sathon, Bangkok 10120, Thailand
• Email: support@joe.in.th

We answer privacy requests within 30 days at most, free of charge.