Sleepy Sheepy Privacy Policy

Last updated: 11 October 2026.

Sleepy Sheepy is operated by Milan Horn / PiknikApps. Contact us about privacy, including a child's data, at milan.horn86@gmail.com. You can play the basic game without a Google account.

Information we use

• Privacy choice and game settings: The game asks for a birth year to choose its adult or restricted experience. The year is used on your device and is not saved or sent to our server; only the category is stored locally. Skipping the question chooses restricted mode. Music, sound, volume and game-count preferences are also stored on your device. You can remove them by clearing this app's data or this site's browser storage.
• Optional Google sign-in: In adult mode, if you sign in, we receive a Google sign-in credential and use the verified Google account identifier and display name to identify your game account. We do not receive your Google password. A signed session cookie contains your account identifier, display name, session times and a random value. It is HttpOnly, Secure and SameSite=Lax and expires within 30 days; signing out clears it on that device. To prevent an old cookie from restoring a signed-out session, we also keep a SHA-256 fingerprint of that session on the server until its original expiry.
• Google Play purchases: If you buy or restore an item, our server checks its purchase token with Google Play to grant the correct content and detect refunds. Our purchase records contain a hash of the token, your game account identifier, product identifier, entitlement status and update time. Google Play, not the game, handles payment-card details. A hash used to stop a refunded token from being reused may still be personal data.
• Support and privacy requests: If you email us, we use your address, message and any information you choose to provide to answer and process your request. Please do not send passwords or payment-card details. We may need to verify identity or guardian authority before disclosing or deleting account information.
• Website operation: Our host, alwaysdata, receives technical connection information such as IP addresses to deliver and protect the website. Server and hosting logs may include request and device/browser details. We do not currently use a separate in-game analytics or crash-reporting service.

Advertising and other service providers

The Android app contains the Google Mobile Ads SDK. Version 13 uses Google's sample ad unit; version 14 uses our AdMob banner unit in release builds. The app requests a banner only after an age-category choice and when Google's consent system permits an ad request. Requests for children and other restricted users are marked as child-directed and under the age of consent; all ad requests have a G maximum ad content rating. No ad is requested while the age category is unknown. Even test ad requests can involve data processing. Google says its SDK automatically collects or shares IP address (which may indicate approximate location), app and ad interactions, diagnostic information, and certain device or account identifiers for advertising, measurement and fraud prevention. The app removes the Android advertising-ID permission, but this does not mean the SDK uses no other identifiers. Whether a live ad is served depends on AdMob's approval and availability.

Google also processes data when you use Google sign-in or Google Play purchases. We use alwaysdata for hosting and Gmail to receive support messages. See Google's Privacy Policy and Google's Mobile Ads SDK disclosure. These providers may process information in countries outside your own; contact us for information about the arrangements relevant to your request.

Why we use information

We use the information described above to run the game, keep your settings, provide optional sign-in and purchases, answer requests, secure accounts and purchases, and operate the website. Where European data-protection law applies, providing requested account and purchase functions is generally necessary to perform our agreement with you; security and fraud prevention support our legitimate interests; and we comply with applicable legal duties. Advertising processing and consent requirements depend on the released configuration and your location. The birth-year choice is not consent to advertising.

Retention and security

• Local settings remain until you clear app/site data. The game session cookie lasts up to 30 days. A fingerprint of a signed-out session stops matching after that session's original expiry (at most 30 days after creation). Expired fingerprints are deleted when the server starts and hourly while running.
• We keep account-linked records of active purchases while the entitlement remains valid or until you delete game-account data. When a purchase is revoked, its account- and product-linked details are removed after 365 days. A SHA-256 hash of the revoked purchase token remains for the life of the service to prevent that token from being reused. The cleanup runs when the server starts and hourly while it is running; a stopped server resumes cleanup on its next start. A token hash may still be personal data.
• Our host's log setting is 30 days. We may retain a specific record longer if necessary to investigate an incident or comply with law. Automatic host backups rotate over seven days; separately created database copies are subject to our seven-day limit. Deletion may therefore take the remaining backup cycle to remove a record from a backup.
• After game-account deletion, a hashed account marker is retained for 30 days to invalidate older sessions. A separate deletion journal contains a hashed account reference and deletion time and is scheduled for cleanup after 30 days; a backup may retain an older entry until it rotates. A hash is not necessarily anonymous.
• We handle support and privacy-request emails manually. We delete related received and sent messages and attachments 12 months after resolving the request, unless a specific ongoing dispute or legal obligation requires longer retention.

We use HTTPS for website and server communication. Session cookies are protected as described above, and purchase records and server credentials are intended to be kept outside the public website directory. No Internet service can guarantee absolute security.

Children and choices

The game is intended for children, including young children, and adults. A game account is not required to play. The restricted and unknown-age experiences do not offer in-game Google sign-in or purchases. Our birth-year question is not identity verification or parental consent. Parents and guardians can contact us using the email address above.

Deletion and your rights

Visit Privacy & data deletion to request help by email or delete your signed-in game-account data. Self-service deletion removes account-linked game purchase records and invalidates previous game sessions. It does not delete your Google account or Google Play transactions, issue refunds, erase already downloaded files, or instantly remove provider logs, support mail or backups. A later sign-in and restoration of a still-valid purchase may create new records. Contact us about these other data categories or if you cannot sign in.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your data, object to processing, or withdraw consent where processing relies on it. You may complain to a competent data-protection authority, including the Czech Office for Personal Data Protection. Contact us at the privacy email above; do not send a password.

Changes

We will update this page and its date when our practices change. A policy update alone does not replace any consent that applicable law requires.