Android Privacy

Playtime

Kid PaNer is provided by JLINVEST CO., LTD. for children and their parents. Six toys can be played offline without signing in. There are no advertisements, advertising networks, third-party analytics, behavioral tracking, or child profiles. We do not ask children for names, birthdays, email addresses, photos, or messages. The app does not request camera, microphone, location, contacts, or advertising-identifier access. Sounds play locally; we do not record audio.

On your device

Volume, scene, and timer settings stay on your device. Touch and motion information is used locally to move toys and is not uploaded. Browser demo unlocks stay in browser storage. Clearing app or browser data can remove local settings.

Google Play purchases

Parents use the Google Play account on the device to buy and restore optional toys. A separate Kid PaNer sign-in is not required for these purchases. Google processes payments; we do not receive a Google name, email address, password, or payment card from Google Play Billing. The app checks signed purchase records, purchase status, and acknowledgement. Google Play Billing may process purchase history, device and app information, diagnostics, and an account identifier under Google's privacy policy. Google controls its own account and payment records.

Verified Google Play purchase records are encrypted with a device-specific Android Keystore key in private app storage. No receipt or play setting is uploaded to a Kid PaNer server. Previously verified toys can work offline for up to 24 hours before another purchase check is needed. Successful checks replace old records; clearing app data or uninstalling removes them. Backup and device transfer of this app data are disabled.

Age protection

Google Play may ask a user or parent whether to share an age range through the Play Age Signals service. Kid PaNer uses the range and app-approval status only to provide age-appropriate safeguards. The app does not store this information, send it to a server, read the service's install identifier, or use it for advertising, profiling, marketing, or analytics. It retains the same child-safe experience and parent purchase check for every age and for users who do not share their age. A required verification or parental approval must be completed in Google Play before new purchases. Technical failures leave free play and restoration available but pause new purchases. Google Play controls its own age verification and sharing settings.

Android and Google Play

On Android, Google Play purchases and restoration use the Google Play account on the device. Optional Kid PaNer Google sign-in is separate and is not required for billing. Signing out or deleting the Kid PaNer account does not delete Google Play purchase records. Purchases do not transfer between the App Store and Google Play. See Android Privacy for Android purchase storage and age safeguards.

Optional Google account for parents

A parent can sign in to Kid PaNer with Google through the system browser. We request only the openid permission, not Google name, email, contacts, or profile permissions. Google displays its own account and consent screens. We receive a Google account identifier and use it only to authenticate the parent. We do not merge Google and Apple identities, match accounts by email, or share membership with other PaNer apps.

Our Neon database stores the Google identifier, an internal account identifier, account timestamps, an encrypted Google authorization credential, and hashed Kid PaNer session credentials with expiry times. The app stores its own session credential and identifier in protected device storage; Google access and refresh credentials are not sent to the app. Google credentials are encrypted with a server-only key. These records support sign-in, sign-out, session validation, and account deletion; they are not used for advertising, analytics, profiling, or AI training.

Temporary sign-in requests expire after ten minutes, one-time app handoff codes after one minute, and app sessions after thirty days. Expired records cannot authenticate and are removed when a subsequent sign-in request runs cleanup. Signing out invalidates that device's server session. The Google account record and encrypted authorization credential remain until the parent deletes the Kid PaNer account.

Deleting a Google-linked Kid PaNer account

In Settings, open Account and choose Delete account. Our service first revokes the Google authorization credential, then deletes the account record and all its app sessions and pending handoff codes. If revocation fails, the account is retained so the parent can retry. A one-way account fingerprint and deletion time are retained temporarily to block earlier sign-in requests from recreating the account. This marker expires after ten minutes and is removed during a subsequent sign-in cleanup. It contains no Google credential. Deletion does not delete the Google account, store purchase records, or an independently used Apple identity. Database backups and provider-managed security records follow the hosting provider's retention settings.

Accounts and purchases are separate

Optional Google sign-in provides a Kid PaNer parent account; it does not change the Google Play account used for billing or move purchases between store accounts. Signing out or deleting the Kid PaNer account does not remove Google Play purchase history. Restore toys with the Google Play account that bought them. App Store purchases do not transfer to Android. Android does not call our Apple account-deletion endpoint.

Service providers and storage

Apple or Google processes authentication and store transactions under its own policies. Our account service and database are hosted on Neon in AWS Singapore. Google sign-in, session checks, sign-out, and account deletion contact this service; ordinary offline play does not. Opening our public support and policy pages also uses Neon hosting. Our application does not log credentials, request bodies, or account identifiers.

Neon keeps customer-visible function invocation and application logs for three days. The operational records we use contain invocation start/end information, timestamps, service names, and severity, not child play events. They are used only for operation and security. Neon also processes provider-managed connection and security information under its platform terms; those records have separate retention practices for which its public documentation does not specify a fixed duration. Provider infrastructure and subprocessors may process this technical information outside Singapore.

Your choices

You can play the free toys without an account, sign out, delete your Kid PaNer account, or clear local app data. We do not sell personal data or use it for advertising, profiling, or cross-app tracking. Parents can contact eason@toponepapa.com.tw about privacy. Please do not send child information, passwords, or payment details.

Updated October 21, 2026.