littlekin.

Your little world, your privacy.

Privacy notice for Littlekin · Updated 26 October 2026

This notice describes information used by Littlekin to operate Littlekin, its community, and optional purchases.

Your account and community

For new registrations we store the Terms of Service version accepted, the acceptance time and whether registration used an email code, Google or X. We retain this account record to document the agreement; it is separate from optional email, advertising and analytics choices.

When you register with email, we verify ownership using a one-time code before creating your account. We store your email address and caretaker name. New email accounts do not have a password. Existing password hashes are retained for rollback compatibility but are not accepted for sign-in. Google and X sign-in continue to use provider identifiers. Email addresses and sign-in details are not shown on community profiles.

We store game progress, inventory, coins, care activity, favorites, playdates, and reports to provide the game and help maintain the community. The server also receives connection information, including IP addresses and request details, for serving pages, diagnostics, and abuse prevention.

At registration, we also save an approximate country with your account when it can be determined from your connection. This helps us understand where our community comes from. This country is not shown on public profiles and does not change when you sign in later.

Account recovery and email choices

We send six-digit sign-in codes and essential account emails through our configured SMTP provider. Codes expire after 10 minutes, work once in the requesting browser, and allow at most five guesses. A protected server key authenticates the stored code digest; raw codes are never stored in the database or application logs. Temporary challenge records contain the email, registration fields, expiry, attempts, and delivery status. On new code requests, bounded cleanup removes challenges that expired more than two days ago. If the service is idle, cleanup resumes with the next request. Existing recovery-email verification links for social accounts remain available. Password-reset links no longer change passwords.

Community emails are optional. In your caretaker profile, you can choose ratings, favorites, playdates, private messages, and comments, with either a daily summary or grouped alerts soon after activity. Daily summaries are selected by default when you register. You can uncheck this during registration or turn off community emails in your profile at any time. Email updates start after your email is confirmed. Unread activity is grouped; activity already marked read is skipped when the email is prepared. Private-message and comment text is not copied into these emails. In-app notifications remain available when community emails are off.

Every community email includes links to manage preferences or unsubscribe. Sign-in codes and essential account emails are separate from these choices. We keep a delivery queue with event references, status, and retry information. We do not add email-open tracking pixels. The operator’s scheduled cleanup removes expired links and completed delivery jobs older than 30 days.

Social sign-in connects to the provider only when you choose its sign-in button. We use the authorization to identify your account; we do not use it to post to X, read your X private messages, or access your Google mail. Provider access tokens are used during sign-in and are not kept in the account database. Existing connected sign-in methods remain available on the sign-in screen. If your provider does not supply an email address, you can add and verify a recovery email in your profile.

Sharing and invitations

You can choose to share a public littlekin profile or your invitation link. Shared previews include the creature’s name, species, level, picture, and public caretaker name. Links from a signed-in caretaker include a random invitation code. Choosing a social platform opens that provider’s sharing page; Littlekin does not publish posts or contact your friends automatically. Copying a link does not send it to a social platform.

When you follow a valid invitation while signed out, we remember the first invitation for up to 30 days using an HttpOnly first-party cookie and a corresponding server record. This can associate a new registration, including social sign-in, with the inviter. The inviter receives a one-time coin reward after the new account’s email is confirmed. Existing accounts do not qualify. We keep the inviter, invited account, registration method, and credit record to apply rewards once and prevent duplicate credits. The inviter sees totals and a notification linking to the new caretaker’s public profile; no email address is shared. Expired invitation-visit records are removed by scheduled cleanup.

Private activity reports count share-button activity, copied links, visits from shared links, and invitation registrations and rewards. Opening a sharing page does not tell us whether a social post was published.

Messages and comments

Private messages are stored on Littlekin’s server and are available in the app only to the sender and recipient. Pet comments and their authors are public on the pet’s profile. Commenters and pet owners can remove comments. Incoming messages and community notifications have unread counts. Our private activity reports count messaging and comment actions without copying message or comment contents into the metrics records.

Cookies and choices

A session cookie keeps you signed in and helps protect account actions. Advertising services can use cookies, local storage, and other identifiers for their own purposes, according to your applicable choices. Blocking essential cookies can prevent sign-in from working.

Littlekin does not display a separate cookie or privacy popup. Essential first-party cookies keep you signed in. Browser privacy signals and Analytics opt-outs remain respected. Accepting the Terms of Service records the account agreement; it is not recorded as consent to optional tracking.

Littlekin activity metrics

We use first-party activity records to understand visits, registrations, creature care, shop purchases, playdates, and other game features. We record a random visitor identifier in the existing session, an account ID for signed-in activity, screen names, event times, general browser/device categories, referring website domains, and campaign labels. A small first-party script measures screen views and estimates active time while the game is visible and in use.

If you arrive through a campaign link before registering, a separate HttpOnly first-party cookie remembers your first campaign for up to 90 days. The cookie contains a random reference; the campaign labels are kept on our server. At registration we link that campaign to your account and remove the temporary browser reference, so later visits and coin purchases can be measured against the original campaign even after you sign out or change devices. This account record remains while your account exists. We also keep a first-party campaign journey record so visits, registration, a first pet, care, and completed coin orders can be counted together. Anonymous campaign records may remain in campaign statistics after the browser cookie expires. We distinguish server arrivals from browser-confirmed visits using a signal sent when the page is visible, and separately count observed homepage interactions. These signals do not prove that a visitor is human. This does not change your choices about Google Analytics or advertising pixels.

When our local geolocation database is configured, we use the connection IP address to estimate country, region, and city. The metrics records retain those approximate locations, not the raw IP address or precise location. These records stay on Littlekin’s server and are available to the operator through a private reporting command. They are separate from any advertising or Google Analytics services; the operator can delete older records using the reporting tool.

Google Analytics

When enabled, Littlekin uses Google Analytics 4 to understand which screens people visit, how they arrive, and how they use the game. This includes registrations and sign-ins, creature care and adoption, shop browsing and purchases, item use, playdates, ratings, favorites, and rewards. Analytics can use cookies or browser identifiers to measure visits and engagement, along with browser/device information. Google receives connection information, including an IP address, when the service is used.

When enabled, the Analytics tag loads in the background without waiting for a Google advertising-consent callback. Littlekin respects browser Global Privacy Control and Do Not Track signals for this tracking, as well as an explicit Analytics opt-out. Game features work independently of the tag. Google may apply its own configured privacy choices.

Littlekin’s events use general screen names, care types, catalogue item and species codes, quantities, levels, ratings, and coin amounts. For real coin-package checkouts and confirmed payments, events can include the package, amount, currency, and Littlekin’s random purchase reference. A small browser-session record prevents repeated payment checks from counting the same purchase twice. Virtual care coins are recorded separately from real payment revenue.

These events do not include your email, password, account ID, caretaker or creature names, creature IDs, biographies, search text, PayPal tokens, or payment-card details. Named campaign labels may be included to measure the campaigns that brought visitors here. Google Signals and advertising personalization are disabled for this Analytics integration.

Learn more about Google’s use of information from partner sites and Google’s Analytics opt-out browser add-on.

Advertising from Google and other vendors

Littlekin uses Google AdSense on public reading pages. Display ads are not placed inside the signed-in game, private messages, account pages or checkout. Google and other advertising vendors may use cookies or identifiers to serve ads based on visits to Littlekin and other websites or apps, measure advertising, and prevent fraud. Ad requests can include IP address, browser or device information, and the public page URL.

Google’s advertising and consent software connects to Google to load the relevant messages and serving controls. Littlekin requests its public display placement after Google’s consent data is available. Google applies your choices and its serving requirements, which may permit personalized, non-personalized or limited ads. We do not grant advertising consent when you accept the Terms of Service. The placement is requested once per page visit and is not refreshed when the forum feed updates. Where applicable, use Privacy choices in the public page footer to change your decision, or Google’s Do not sell or share my personal information link.

You can manage personalized Google ads in My Ad Center, and review other participating vendors’ opt-out options at YourAdChoices. These settings are separate from your Littlekin sign-in and do not necessarily remove all advertising. Read how Google uses information from sites that use its services.

Advertising measurement

When enabled, Littlekin loads the X Pixel in the background to measure advertising campaigns without waiting for a Google advertising-consent callback. X receives website visits and selected actions such as registration, adoption, active play, returns, sharing and confirmed coin purchases. Purchase events include the package, real payment amount and currency. The pixel uses cookies and click identifiers to connect these actions with advertising interactions, and its requests expose ordinary browser and connection information to X. Our conversion events do not include your caretaker name, email, password, messages or Littlekin account ID. Littlekin also keeps a campaign click identifier in the session for up to 30 days after an allowed visit so that signing in or returning from checkout does not lose attribution. Littlekin respects browser Global Privacy Control and Do Not Track signals for this tracking. Game features, sign-in and checkout do not wait for the pixel. See X’s privacy policy.

Optional payments

For billing, we retain the payer name, email address, available postal address and phone, country, PayPal account and payment references, payment date, and invoice status. At checkout, we also save the account email, the account's registration country, and the approximate country estimated from the connection when available. We keep the source and time of these observations, any card-issuer country PayPal supplies, and the resulting VAT decision. We do not store card numbers, security codes, or the raw connection IP in these billing records. Country observations may be incomplete or disagree and do not establish tax residency.

When automatic invoicing is enabled, Morning (Green Invoice / חשבונית ירוקה) receives the available customer billing details, country observations, payment details, and purchased package to issue an invoice for Millworx Ltd. The billing email and country evidence are recorded on the invoice; email delivery is separately optional. These details are private and are not shown on community profiles. Billing records are kept separately from community email preferences and account activity.

If you purchase coins or physical merchandise, PayPal processes the payment. Littlekin stores purchase details such as the product, amount, currency, payment identifiers, and transaction status to verify the purchase and arrange delivery. We do not collect your full payment-card number in the game. PayPal processes information under its own privacy statement.

Personalized merchandise

Where merchandise is available, Littlekin can use your own creature's illustration and name to prepare a product preview. Your caretaker name is added to a design only if you select that option. Printify receives the artwork and printed names to generate product images and fulfill orders. Loading those product images also connects your browser to Printify's image service. Your private messages and biography are not used in merchandise designs.

For a shipping quote, Printify receives the delivery details you enter. After a verified payment, we send the selected product and the recipient's name, postal address, email and any delivery phone number to Printify and its fulfillment partners to make and deliver the order. Littlekin keeps the quote, order, payment and shipment records privately; they are not added to your community profile. Billing information may also be sent to Morning to issue an invoice, as described above.

Our own merchandise cards can suggest products featuring a creature from your account. We record which product and feed were shown, qualified views, clicks, dismissals and purchases in private merchandise reports. Dismissing an item saves a preference so that the same product category is not suggested again. These records do not by themselves send a conversion event to an external advertising service.

Account deletion removes unused personalization and recommendation records and detaches retained purchase records from the game account. Information needed to complete paid orders, handle delivery or refund issues, and maintain financial records may be retained separately. Deleting your Littlekin account does not automatically erase records already held by payment, invoicing or fulfillment providers. Contact us about an outstanding order or a request concerning those records.

Community return emails

If your email is verified and you have chosen community emails, Littlekin may replace daily summaries with up to three return reminders after you become inactive. Reminder images and return links record estimated opens, visits and subsequent sign-in and play, including activity on days 1, 7 and 30 after returning. Image loading does not reliably show whether an email was read. You can turn community email off in account settings or use the unsubscribe link in each email. Returning stops further reminders. Account deletion removes the link to your identity; anonymous campaign totals may remain.

Contacting Littlekin

You can email contact@littlekin.world about any question or concern. Signed-in caretakers can also use Contact us in the game. We store the message, subject, reply address and account identifier to handle your request, and send them privately to our support inbox through our email provider. They are not shown on your public profile. Completed delivery records are removed by our regular mail cleanup after 30 days; support correspondence may be kept as needed to resolve your request.

Service providers and fonts

Hosting providers process information needed to run the website. Game pages may request fonts from Google Fonts, which receives ordinary connection information such as an IP address. Providers may process information in countries outside your own; their privacy notices explain their practices.

Your information

You can change your caretaker name in your profile and use “Let go” to remove a creature. Removing a creature does not delete your account or purchase records. Information is kept as needed to operate your account and the community, resolve issues, prevent abuse, and meet applicable record-keeping obligations. Backups may retain records for longer than the live service.

For privacy questions or requests to access, correct, or delete your information, contact Littlekin at contact@littlekin.world. We may need to verify account ownership before acting on a request.