Back to Game

Privacy Policy

Last updated: March 2026

This Privacy Policy describes how AdswedMedia Playtime ("we", "us", or "our") collects, uses, and protects information when you play Candy Garden: Match & Build ("the Game"). By using the Game, you agree to the practices described in this policy.

1. Information Collected Automatically

Device Identifier

When you first open the Game, a unique identifier (UUID) is generated and stored in your browser's localStorage under the key adsm_device_id. This Device ID is used to identify your player profile across sessions. It is not derived from your hardware or operating system and exists only within the browser where you play.

IP Address

Your IP address is collected server-side for rate limiting (up to 60 requests per minute) and security purposes. It is not stored long-term or used for advertising.

Session Data

While you play, the Game tracks your play duration in seconds, assigns session IDs, and records timestamps. This session data is transmitted to our servers approximately every 30 seconds to accurately calculate playtime rewards.

HMAC Signatures

Cryptographic signatures (HMAC-SHA256) are computed from your session data and sent alongside it. These signatures are used solely for data integrity verification and fraud prevention.

2. Information You Provide

Username -- You choose an in-game username (2 to 20 characters) used for multiplayer features such as the leaderboard, clans, and friend lists.
Telegram Chat ID -- Optionally, you may link your Telegram account to receive notifications when another player attacks your village. If linked, your Telegram Chat ID is stored on our servers.
Clan Chat Messages -- Messages you send within clan chat (1 to 200 characters) are transmitted to our servers. Messages are sanitized to remove potentially harmful content before storage.

3. Data Stored on Our Servers

We store the following information in our database (MySQL) to maintain your game progress and enable multiplayer features:

Device ID and username
In-game currency balances (coins, gems, spins)
Building levels (stored as JSON)
Shield status and shield expiration time
Attack statistics: total attacks sent, total attacks received, coins stolen, and coins lost
Telegram Chat ID (if you have linked your Telegram account)
Last synchronization timestamp
Account creation date

4. Data Stored Locally (Browser Storage)

The Game uses your browser's localStorage to keep a local copy of your profile so the Game loads quickly and can function during brief connectivity interruptions. Locally stored data includes:

Full player profile: coins, gems, spins, building levels, achievements, card collections, and pets
Playtime tracking: total seconds played and claimed milestone rewards
Game preferences: sound settings and tutorial completion status
A checksum value used to detect unauthorized modifications to local data

You can delete all locally stored data at any time by clearing your browser's site data or localStorage for this site.

5. SDK Data Transmission

The Game uses the AdswedMedia SDK to track playtime and deliver rewards. The SDK transmits the following data to AdswedMedia servers:

app_key -- Identifies this game within the AdswedMedia platform
user_id -- Your player identifier
Session tokens -- Used to authenticate active play sessions
elapsed_seconds -- The duration of your current play session
client_timestamp -- The current time on your device when data is sent
HMAC-SHA256 signatures -- Cryptographic signatures to verify data authenticity
device_id -- Your browser-generated UUID

6. How We Use Your Data

Provide, maintain, and improve the gameplay experience
Calculate and deliver playtime-based rewards accurately
Enable multiplayer features including attacks, raids, clans, friend lists, and leaderboards
Prevent fraud, abuse, and unauthorized data tampering
Enforce rate limiting to protect the security and stability of our API

7. Third-Party Services

The Game may interact with the following third-party services:

AdswedMedia Offerwall -- The Game includes an optional offerwall where you can complete ad offers to earn in-game rewards. Interaction with the offerwall is entirely voluntary. Any data collected through the offerwall is subject to AdswedMedia's own Privacy Policy.
Google Play Billing -- If the Game is accessed through a platform that supports in-app purchases via Google Play, those transactions are handled by Google and are subject to Google's Privacy Policy. We do not collect or store payment card details.

8. Data Sharing

We do not sell your personal data to any third party.
We share data only with service providers that are necessary for operating the Game (such as hosting and database infrastructure).
No data is shared with advertisers unless you voluntarily interact with the offerwall.

9. Data Retention

Your game data is retained on our servers for as long as your account remains active.
Accounts that have been inactive for 12 months or more may be permanently deleted.
You may request deletion of your data at any time by contacting us at support@adswedmedia.com.

10. Your Data Rights

Under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the following rights:

Right of Access -- You may request a copy of the personal data we hold about you.
Right of Correction -- You may request that we correct any inaccurate personal data.
Right of Deletion -- You may request that we delete your personal data from our servers.

To exercise any of these rights, contact us at support@adswedmedia.com. Deletion requests will be completed within 30 days.

To delete data stored locally in your browser, clear your browser's localStorage or site data for this site.

11. Children's Privacy (COPPA Compliance)

In compliance with the Children's Online Privacy Protection Act (COPPA), Candy Garden: Match & Build is intended for users aged 13 and older. We do not knowingly collect personal data from children under the age of 13. If we become aware that we have collected data from a child under 13, we will delete that information promptly.

Parents or guardians who believe their child has provided personal data to us may contact us at support@adswedmedia.com to request its deletion.

12. Security

We take reasonable measures to protect your data, including:

All data is transmitted over HTTPS using TLS encryption.
HMAC-SHA256 signatures are used to verify the integrity of data transmitted between the Game and our servers.
Rate limiting is enforced to prevent abuse of our API endpoints.
Client-side checksums are used to detect unauthorized tampering with locally stored game data.

While we strive to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will be revised. Material changes will be noted prominently. Your continued use of the Game after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact us:

Publisher: AdswedMedia Playtime

Email: support@adswedmedia.com

Website: adswedmedia.com