Privacy Policy

Code to the Castle is a game for children, so we built it the way we would want a game on our own kids' iPad to work: it collects nothing, it shows no advertising, it contains no analytics or tracking of any kind, and it never sends us anything about the child playing it.

This policy explains that in full, and covers both the app and this website. It is written to be readable rather than lawyerly — if anything in it is unclear, please just ask.

Code to the Castle is made by Marcell Tóth, an independent developer trading as codetwice, based in Malta. For the purposes of the EU General Data Protection Regulation (GDPR), that is the data controller for this website.

You can reach us about anything on this page at privacy@codetwice.eu .

The app saves a small amount of information so a player can pick up where they left off. All of it is written to the app's own storage area on the device:

• the profile name and picture chosen in the app — a nickname is perfectly fine, the game never asks for a real name;
• which levels have been finished, and the trophies and best results for each;
• the coin balance and which cars, paints and accessories have been unlocked;
• which level packs have been purchased;
• app settings such as sound on or off.

None of this is transmitted to us. Deleting the app removes it from the device.

So that progress survives a lost iPad and follows a family to a second one, the app can copy that same profile information into the private part of the iCloud account signed in on the device. This uses Apple's CloudKit service.

A private iCloud database belongs to the account holder, not to us: we have no access to it, cannot read it, and receive no copy of it. Apple stores and protects it under Apple's own privacy policy . Sync only happens when an iCloud account is signed in and iCloud Drive is enabled; turning iCloud off in iPadOS Settings stops it, and the game keeps working entirely offline.

Extra level packs are optional in-app purchases sold through the App Store. The whole transaction happens inside Apple's payment sheet: we never see or receive a name, an e-mail address, a card number or a billing address. The app only learns whether a given pack has been unlocked.

In-app purchases live behind a parental gate, and iPadOS itself asks for Face ID, Touch ID or an Apple Account password before any money moves. Parents who would rather rule it out entirely can turn purchases off in Settings → Screen Time → Content & Privacy Restrictions.

Apple gives us anonymous, aggregated sales and download reports. They contain totals by country, never individual customers.

The app is designed for children and takes part in the App Store Kids Category. In practice that means:

• no personal data is collected from anyone, of any age;
• no advertising, no ad networks, and no third-party analytics or attribution software;
• no chat, no comments, no user-generated content and no way for players to contact each other;
• no links out of the app anywhere a child can reach — the only external link, to the App Store, sits behind the parental gate;
• purchase opportunities sit behind the same parental gate.

Because we collect nothing, there is nothing for a parent to request, correct or have deleted — but if you have a question about your child's data, write to us at privacy@codetwice.eu and we will answer it.

This site is a handful of plain pages. It runs no analytics, sets no advertising or tracking cookies, embeds no social media trackers, and loads its fonts and images from its own server rather than from a third-party network — so simply reading it tells nobody anything about you.

Two things do happen, as on any website:

• Server logs. Our web server records each request with the IP address it came from, the page requested, the time, and the browser's user-agent string. These logs exist to keep the site running and to spot abuse. They are kept for a short period and then deleted, and are never used to profile visitors.
• A strictly necessary cookie. The site's framework sets a single session cookie so that pages are served securely. It carries no identifying information, is not shared with anyone, and expires by itself. There are no optional cookies, which is why you are not asked to consent to any.

If you send us an e-mail we will of course have your address and whatever you put in the message. We use it to reply to you and for nothing else, we do not add anyone to a mailing list, and we delete correspondence once it is no longer needed.

Where we do process the limited data described above, we rely on our legitimate interest in operating and securing the website (Article 6(1)(f) GDPR), and on taking steps at your request when you contact us (Article 6(1)(b) GDPR).

We do not sell data, we do not share it with advertisers or data brokers, and we run no profiling or automated decision-making. The only companies involved at all are Apple, which operates the App Store, the payment flow and iCloud, and the hosting provider that runs this website on our behalf.

Under the GDPR you have the right to ask what data we hold about you, to have it corrected or erased, to restrict or object to its use, and to receive a copy of it. Write to privacy@codetwice.eu and we will respond within one month. In most cases the honest answer will be that we hold nothing.

If you are not satisfied with our answer you can complain to your national data protection authority. In Malta this is the Office of the Information and Data Protection Commissioner .

If the app or the site ever starts doing something this page does not describe, we will update the page and change the date at the top before that change goes live. This policy was last updated on 29 August 2026.