Privacy Policy
This Privacy Policy explains how Kacci Lab Inc. collects, uses, discloses, retains and protects information when you use the Toiii Worlds mobile application and related services.
Plain-language summary: Toiii Worlds uses the information needed to run your account, verify steps, place map discoveries, save collections, support social play, prevent reward abuse and process eligible rewards. Health step data is not sold or used to target advertising.
1. Who we are
Kacci Lab Inc. (“Kacci Lab,” “we,” “us,” or “our”) operates Toiii Worlds. Kacci Lab is the controller of personal information processed through the app, except where a third-party service acts as a separate controller under its own terms.
Registered address: 298 Jarvis Street, Toronto, Ontario M5B 2M4, Canada.
Email: contact.us@kaccilab.com
2. Scope
This Policy applies to the Toiii Worlds iOS and Android apps, our cloud functions, account services, public support and account-deletion pages, and related communications. It does not govern third-party websites, app stores, health platforms, mapping data, advertisements or reward providers that operate under their own notices.
3. Information we collect
| Category | Examples | Why it is needed |
|---|---|---|
| Account and profile | User ID, email, display name, username, profile image, sign-in provider, account dates and referral code. | Authentication, profile display, account recovery, friends and referrals. |
| Steps and health source | Today’s step total, health-day boundary, selected source and permission status from Apple Health or Health Connect. | Verify step-based Energy and daily progress. Toiii Worlds requests read access to step count; it is not a medical record service. |
| Location | Precise or approximate location while you actively use map features, collection distance and fixed map-location identifiers. | Show nearby tiles, verify that you are close enough to collect and reduce location abuse. We do not require continuous background location for the current map experience. |
| Gameplay and economy | Energy, Stars, Reward Credits, Keys, chests, tiles, duplicates, worlds, badges, streaks, game results, daily limits, wallet history and redemption requests. | Save progress, issue server-verified prizes, display history and maintain the game economy. |
| Social and community | Friend relationships, requests, blocks, Cheers, World Circle membership and contribution, piece wishes, gifts, referral activity and event participation. | Provide the social features you choose to use and prevent referral or gifting abuse. |
| Device, security and diagnostics | Device platform, model, OS/app version, installation identifier or one-way device hash, App Check signals, IP/network metadata, crash/performance data and suspected-abuse indicators. | Security, debugging, device compatibility, fraud prevention and redemption review. |
| Notifications and preferences | Push token, notification status, language, units, step source and other app preferences. | Respect your settings and send opted-in service notifications. |
| Support and content you provide | Support messages, category, email, attachments or profile pictures, and correspondence. | Respond to requests, troubleshoot and enforce our rules. |
| Advertising and analytics | Advertising identifier where permitted, ad interactions, consent status, app events, device details and coarse region. | Show and measure ads, fund free gameplay, understand feature use and improve reliability. |
Sources
We receive information directly from you, from your device and permitted health source, from other users who interact with you, and from service providers such as Firebase, Apple, Google and advertising or reward partners.
4. How we use information
- Create, authenticate and maintain your account.
- Read permitted step totals, calculate claimable Energy and preserve wallet history.
- Show fixed nearby discoveries and confirm collection distance.
- Randomize and grant tiles and prizes, complete Worlds, operate games, events, streaks, Vault and World Circles.
- Enable friends, referrals, Cheers, piece requests and duplicate gifting.
- Show ads and measure app performance where permitted.
- Send service, social and optional push notifications.
- Respond to support and account requests.
- Detect spoofed steps or location, duplicate-device abuse, automation, referral manipulation and fraudulent redemption.
- Comply with law, protect users and enforce our Terms.
We do not use Apple Health or Health Connect step information for targeted advertising, and we do not sell health information.
5. Legal bases
Depending on your location, we process information to perform our contract with you, with your consent (especially health, location, notifications and advertising choices), for legitimate interests such as security, fraud prevention and product improvement, and to meet legal obligations. You may withdraw consent through device or app settings, but a feature may stop working if its required permission is removed.
6. Advertising, analytics and similar technologies
Toiii Worlds uses Google AdMob to provide banner, interstitial and rewarded ads. Rewarded ads are shown when you choose an ad-supported play or benefit. Google and its partners may process device identifiers, ad interactions, approximate region and consent choices according to applicable law and their policies. We use Firebase Analytics and related Firebase diagnostics to understand product interaction, performance and failures.
Where required, we request consent before personalized advertising or use non-personalized/limited ads. You can change platform advertising controls in iOS or Android settings. Blocking ads may affect optional ad-supported gameplay, but does not remove your rights under this Policy.
7. When we share information
We do not sell personal information. We may disclose the minimum necessary information to:
- Cloud and app providers: Google Firebase services for authentication, database, storage, Cloud Functions, App Check, analytics, messaging, Remote Config and diagnostics.
- Platform providers: Apple and Google for app distribution, sign-in and permitted health-source access.
- Map and content providers: OpenStreetMap-related map tile or geographic data services used to display the map.
- Advertising providers: Google AdMob and its authorized partners, subject to consent and platform controls.
- Reward and verification providers: gift-card, payment, SMS, identity/fraud-review or fulfilment services, but only when the relevant reward feature is offered and you request it.
- Other users: your chosen public-facing username/avatar and information necessary for Friends, gifting, World Circles, events and Cheers. We do not display your email to other users.
- Authorities or successors: where required by law, needed to protect rights and safety, or as part of a merger, financing or sale subject to appropriate protections.
8. Rewards, redemption and verification
Reward Credits may be redeemable for options displayed in the app, subject to country availability, thresholds, inventory, fraud review and the Terms. When redemption options are enabled, we may collect your country/region, reward selection, delivery email or address, and verification information. SMS verification may require a telephone number and one-time-code status. A provider may process that information on our behalf.
We keep redemption and anti-fraud records as reasonably necessary to fulfil requests, resolve disputes, reverse improper rewards, comply with tax/accounting or legal duties, and protect the reward program. We do not collect full payment-card numbers for a reward request.
9. Permissions and your choices
- Health: disconnect or change permissions in Apple Health or Health Connect. Without step access, step-to-Energy features cannot verify walking.
- Location: allow while using the app, choose approximate location where supported, or turn it off in device settings. Map collection requires sufficient location accuracy.
- Notifications: optional; turn them off in app or device settings.
- Advertising: use the consent prompt and platform privacy controls where available.
- Profile/social: edit your username, manage Friends and blocks, and choose whether to send gifts, Cheers or requests.
10. Retention
We retain account and gameplay data while your account is active and as needed to provide the service. Some daily activity is stored in aggregated daily records to reduce unnecessary data. Temporary map, event and notification records may expire automatically. Support, security, referral, wallet and redemption records may remain longer where reasonably necessary for troubleshooting, fraud prevention, dispute resolution, accounting or law.
When you delete your account, we delete or de-identify account data as described below, except information we must retain or may lawfully preserve for security, fraud, legal claims or compliance. Backups may take additional time to cycle out.
11. Security and international transfers
We use reasonable administrative, technical and organizational safeguards, including authenticated access, server-side reward decisions, App Check and access rules. No service can guarantee absolute security. Data may be processed in Canada, the United States or other countries where our providers operate. Where required, we use legally recognized transfer safeguards.
12. Your privacy rights
Depending on your jurisdiction, you may request access, correction, deletion, portability, restriction or objection, or withdraw consent. You may also appeal or complain to your privacy regulator. We may verify your identity before fulfilling a request. Authorized agents may be required to provide proof of authority.
California notice: we do not sell personal information. We do not use health and precise-location information for purposes beyond providing requested app features, security and legal compliance. Advertising disclosures are governed by your consent and applicable opt-out rights.
13. Account deletion
You can request deletion inside Toiii Worlds through Settings → Your information → Delete account. Re-authentication may be required. You can also submit a web deletion request at kaccilab.com/toiii-worlds/account-deletion/ or email us.
Deletion removes access to your account and forfeits virtual items, unredeemed balances, collections, social memberships and pending benefits, subject to records we lawfully retain. Deleting an account may reverse unvested or abusive referral rewards as described in the Terms.
14. Children’s privacy
Toiii Worlds is not directed to children under 13, or the higher minimum age required in their country without valid parental authorization. We do not knowingly collect personal information from a child in violation of applicable law. If you believe a child has provided information improperly, contact us so we can review and delete it.
15. Changes and contact
We may update this Policy as the app, providers or law change. We will revise the “last updated” date and provide additional notice for material changes where required.
Questions or requests may be sent to contact.us@kaccilab.com.
Kacci Lab Inc., 298 Jarvis Street, Toronto, Ontario M5B 2M4, Canada.