Privacy

Playtime

Kid PaNer is provided by JLINVEST CO., LTD. for children and their parents. Six toys can be played offline without signing in. There are no advertisements, advertising networks, third-party analytics, behavioral tracking, or child profiles. We do not ask children for names, birthdays, email addresses, photos, or messages. The app does not request camera, microphone, location, contacts, or advertising-identifier access. Sounds play locally; we do not record audio.

On your device

Volume, scene, and timer settings stay on your device. Touch and motion information is used locally to move toys and is not uploaded. Browser demo unlocks stay in browser storage. Clearing app or browser data can remove local settings.

Parents and Apple purchases

Purchasing, restoring purchases, and account actions are protected by a parent check. Parents can use Sign in with Apple or Google. Sign in with Apple supplies an app-specific parent identifier saved in this device's Keychain. We do not request Apple name or email. We do not receive passwords or payment card details. Apple handles payment and purchase records. The app verifies StoreKit purchases and sends Apple an account code derived from the chosen provider and parent identifier to associate purchases with that account. Apple and Google are separate Kid PaNer identities; switching providers does not merge purchase ownership.

Deleting an Apple-linked Kid PaNer account

In Settings, open Account and choose Delete account. A fresh Apple sign-in supplies an identity token, one-time authorization code, and nonce (a request security value). Our account-deletion service verifies the request with Apple and revokes sign-in access. Apple credentials are processed in memory for this request, not stored in our database or application logs. The app removes the local Apple identifier only after revocation succeeds. Apple retains its own purchase records.

For abuse prevention, Apple deletion temporarily keeps the app-specific identifier, a request count, and an expiry in runtime memory. The rate-limit window is one minute. Expired entries are removed on a subsequent authenticated request or when the runtime ends. These entries are not written to a database or disk or used for analytics or marketing.

Android and Google Play

On Android, Google Play purchases and restoration use the Google Play account on the device. Optional Kid PaNer Google sign-in is separate and is not required for billing. Signing out or deleting the Kid PaNer account does not delete Google Play purchase records. Purchases do not transfer between the App Store and Google Play. See Android Privacy for Android purchase storage and age safeguards.

Optional Google account for parents

A parent can sign in to Kid PaNer with Google through the system browser. We request only the openid permission, not Google name, email, contacts, or profile permissions. Google displays its own account and consent screens. We receive a Google account identifier and use it only to authenticate the parent. We do not merge Google and Apple identities, match accounts by email, or share membership with other PaNer apps.

Our Neon database stores the Google identifier, an internal account identifier, account timestamps, an encrypted Google authorization credential, and hashed Kid PaNer session credentials with expiry times. The app stores its own session credential and identifier in protected device storage; Google access and refresh credentials are not sent to the app. Google credentials are encrypted with a server-only key. These records support sign-in, sign-out, session validation, and account deletion; they are not used for advertising, analytics, profiling, or AI training.

Temporary sign-in requests expire after ten minutes, one-time app handoff codes after one minute, and app sessions after thirty days. Expired records cannot authenticate and are removed when a subsequent sign-in request runs cleanup. Signing out invalidates that device's server session. The Google account record and encrypted authorization credential remain until the parent deletes the Kid PaNer account.

Deleting a Google-linked Kid PaNer account

In Settings, open Account and choose Delete account. Our service first revokes the Google authorization credential, then deletes the account record and all its app sessions and pending handoff codes. If revocation fails, the account is retained so the parent can retry. A one-way account fingerprint and deletion time are retained temporarily to block earlier sign-in requests from recreating the account. This marker expires after ten minutes and is removed during a subsequent sign-in cleanup. It contains no Google credential. Deletion does not delete the Google account, store purchase records, or an independently used Apple identity. Database backups and provider-managed security records follow the hosting provider's retention settings.

Service providers and storage

Apple or Google processes authentication and store transactions under its own policies. Our account service and database are hosted on Neon in AWS Singapore. Google sign-in, session checks, sign-out, and account deletion contact this service; ordinary offline play does not. Opening our public support and policy pages also uses Neon hosting. Our application does not log credentials, request bodies, or account identifiers.

Neon keeps customer-visible function invocation and application logs for three days. The operational records we use contain invocation start/end information, timestamps, service names, and severity, not child play events. They are used only for operation and security. Neon also processes provider-managed connection and security information under its platform terms; those records have separate retention practices for which its public documentation does not specify a fixed duration. Provider infrastructure and subprocessors may process this technical information outside Singapore.

Your choices

You can play the free toys without an account, sign out, delete your Kid PaNer account, or clear local app data. We do not sell personal data or use it for advertising, profiling, or cross-app tracking. Parents can contact eason@toponepapa.com.tw about privacy. Please do not send child information, passwords, or payment details.

Updated October 21, 2026.