Privacy

Last updated 17 October 2026

Short version: no cookies, no accounts, no ads. We don't sell or share your personal data. While the game is being playtested, it can send us a few numbers about your runs, if you're 13 or over and leave Share Metrics on (see below).

This website

• The website sets no cookies, has no analytics, advertising or social-media trackers, and has no forms or sign-ups.
• Everything on it, including fonts and scripts, is served from our own server. Nothing is loaded from other companies' servers.
• Like any website, it can't be delivered without your device's IP address. The site is served through Cloudflare, which handles each request on our behalf to deliver the site and protect it from attacks. Our web server keeps standard access logs (IP address, date and time, the page requested, and your browser's name and version), used only to keep the site running and secure, and deleted when no longer needed for that.

The game

• Toon Onslaught sets no cookies and uses no advertising trackers or third-party analytics. There are no accounts.
• Your progress (points, upgrades, unlocks, achievements, stats and a record of your last 200 runs) and your settings (sound, controls, text size, ship colours) are saved in your browser's local storage, on your device only. Your saved game never leaves it, unless you export it to a file yourself (Export Save in Settings), which stays wherever you put it. Keeping them is strictly necessary for the game to remember your progress, so no consent is needed.
• If you install the game as an app, your browser keeps a copy of the game's files so it can start offline. That copy holds no personal data.
• Share Metrics (playtest): on the first start, the game asks whether to share metrics and the year you were born. If you're 13 or over and leave it on, then at the end of each run the game requests this website's metrics.html page with these numbers in the address: the run's score, kills, length, difficulty, mode, arena and the waves it started and ended on; your best score, total kills, runs, points earned, points spent in the skill web and points left; whether you play with touch or keys, and with the music and the sound effects on or off; whether developer cheats were on, and whether they were ever turned on for your save; what ended the run (the kind of enemy that last hit you) and how many bosses you beat in it; your answer if you tap how a run felt (too easy, just right or too hard), asked after each run only while sharing is on; the game's version and which copy of it you play (our site, its test copy, or itch.io); and a random ID the game made on your device, so your runs can be told apart from other players'. Your birth year isn't kept, only whether you're 13 or over. The numbers are recorded in our web server's access log, with the request's IP address, date and time and browser, and used only to balance and improve the game. You can turn sharing off at any time with the Share Metrics button under the game's main or pause menu. Your ID is shown on the game's Privacy & Cookies screen: email it to us to have the metrics sent under it deleted. If you play the game on itch.io, it asks again there, since its settings are kept separately on each site; itch.io hosts that copy, and itch.io's privacy policy covers its own pages.
• You can delete everything the game has saved at any time, with Delete Saved Data on the game's Privacy & Cookies screen or in your browser's settings.

Email

If you write to [email protected], we use your email address and message only to read and answer it, and don't add you to any mailing list. Mail to that address is forwarded through Cloudflare's email routing.

Your rights

Wherever you live, including under the GDPR and UK GDPR, the CCPA/CPRA, the LGPD, PIPEDA, the APPI and PIPL, you can ask what we hold about you, and have it corrected or deleted. In practice the only personal data we might hold is an email you sent us, server logs, and playtest metrics tied to a random ID rather than to you. For the metrics, tell us your ID from the game's Privacy & Cookies screen. We don't sell or share any of it.

Children

The game asks for a birth year before sharing any metrics, and sends none for players under 13. Apart from that, the site and game collect no personal data from anyone, children included.

Changes and contact

If this statement changes, the new version will be posted here with a new date. Questions about privacy, or anything else: [email protected].