Tippy Capy by SambaZen plays offline and has no advertising. SambaZen does not create player accounts or collect email addresses, advertising identifiers or permanent device identifiers through its anonymous gameplay and challenge services. Platform services process their own data as described below. Progress, best distances, streaks, outfits, settings, saved challenges, dates of scored weekly rides and local counts of attempts and shares are stored on your device.
Apple App Store or Google Play handles optional cosmetic purchases and restores. We do not receive payment card details or operate a purchase-tracking server.
Optional leaderboards use Apple's Game Center or Google Play Games. Where available, their own screens show public weekly and all-time rankings, with an option to view friends. Apple or Google handles the platform account, player profile and scores under its own policies. Tippy Capy does not import or store those player names, account identifiers or profiles. Older saved names and imported leaderboard profiles are removed when this version first opens. Core play does not require a platform connection.
On Android, the Google Play Games SDK starts when the app opens. Google automatically collects service analytics and diagnostics to operate and improve Play Games. If you connect a Play Games profile, Google also processes your player name, player identifier and submitted gameplay scores for platform features such as rankings. Core play works without signing in. Tippy Capy keeps platform profiles out of its web game code and does not import friends lists.
Google's SDK processing is separate from SambaZen's anonymous counters. The game's anonymous statistics switch does not turn off Google's Play Games SDK processing. Google provides account and Play Games controls, including deleting Play Games data, under its own policies. See Google's Play Games SDK data disclosure, Google's Privacy Policy and Play Games data controls.
When you use purchases or restores, the native billing integration reads store purchase history and transaction details needed to check outfit ownership and acknowledge purchases with the store. This optional purchase processing is separate from gameplay statistics. SambaZen does not receive payment card details or send purchase history to its anonymous measurement services.
Clips and cards are saved temporarily in the app and passed to your phone's share sheet. Tippy Capy does not upload those files itself. The destination you choose handles them under its own policies.
Challenge links contain the week, distance and outfit. They can also include a recording of the shared ride's timing, position, lean and cargo, plus its game-rules version, so a challenger can race its shadow on iPhone or Android. Older long links keep this recording in the fragment (the part after #), which is not sent in the website's HTTP request. The recipient's app keeps the current challenge on their device until the week ends. Older or incompatible recordings remain distance challenges.
In app versions supporting short links, pressing Share sends only that challenge and optional ride recording to our separate short-link service. It returns a short tippycapy.com link that anyone with the link can open. The service keeps the shared content, its link code and an expiry time for 30 days. Identical content can reuse the same link without extending its expiry; the code identifies shared content, not a player. Expired records are removed from the active store. Cloudflare's storage recovery can retain earlier copies for up to another 30 days. If the service is offline or unavailable, sharing uses the existing long link instead.
The short-link service does not keep player names, accounts, IP addresses, cookies or records of who creates or opens a link. Application logging is disabled. This shared-content storage is separate from the anonymous counters below; no challenge or replay is sent to the counter service. This website support does not update installed apps: versions without short-link sharing continue to create long links.
These links contain no player name, participant code or account information. Names in older links are ignored and are not retained by the game. Anyone receiving the full link, including the messaging service used to share it, can read its values. Opening a website link sends the part before # to the website host, including any values already present in an older link. No ride recording or replay identifier is sent to the challenge counter service.
The app downloads validated difficulty settings and seasonal switches from www.sambazen.com at startup and when you return to it. These requests do not contain gameplay scores and omit cookies and account credentials. The hosting service receives the normal technical information needed to serve a request. Core play continues if a check is unavailable.
In version 1.0.2, the optional local reminder is scheduled for Sunday at 18:00 in your device's local time, with text in your selected game language. It asks for notification permission when enabled and can be turned off in the game or phone settings. Version 1.0.1 used a daily 23:00 reminder; version 1.0.2 cancels that old schedule at startup and replaces it with the Sunday reminder when enabled.
The separate challenge and offer counter service counts only nine actions. Six are challenge actions: opening a challenge link, attempting to open the app, receiving a challenge in the app, completing its warm-up, starting a weekly attempt from it, and sharing a challenge. Three are offers being shown in the app: the Boo-bara outfit offer at the Moonlit Hollow entrance, the button to see a fall as Chef, and the shop opening with the Capy Collection. A count sends only the action's name and adds one to its total. The counter service keeps nine running totals. It does not keep individual event histories, dates, scores, challenge links, prices, purchases, emails, names, account details, participant codes, advertising identifiers, permanent device identifiers or IP addresses.
We do not assign anyone an identifier or check whether they have been counted before. Repeating an action can add another count. These are action totals, not numbers of unique players. SambaZen cannot identify an individual player from these counters, follow their journey or connect their actions. There is no identity-to-code mapping. A share count means the phone or browser accepted the handoff, not that someone received or opened it. An offer count means the offer was shown, not that anyone bought anything. Offline or blocked requests may not be counted.
The websites count valid challenge openings and taps on the app-opening action. In-app counts depend on the installed app version; website changes do not update installed apps. The three offer counts are sent only by the app, from version 1.0.3. Short-link creation and lookup do not add new measurement events.
From version 1.0.4, the app sends separate anonymous gameplay statistics so we can understand actual play, where attempts stop and whether players return. Version 1.0.3 and earlier do not send these statistics.
That feature groups counts by UTC calendar day, game mode and chapter. It counts approximate active installations, first observed play, first entry into a stage, first completion, falls, immediate retries, explicit navigation away from a ride, background pauses and inferred abandoned attempts. First observed play is grouped into installations with no recorded progress and those with existing progress. Day-one and day-seven returns mean a ride starts on the UTC day one or seven days after first observed play, using the same progress group. Existing progress is not proof of a new player, and an installation is not a person.
Local flags remember which installation days, first entries, completions and returns have already been counted. No installation identifier is created or uploaded. Only grouped totals are sent: day, event name, mode, chapter, progress group where applicable and count. We do not upload names, accounts, advertising or device identifiers, raw event histories, IP addresses, scores, challenge links, replays or purchase details to this service. It cannot identify a player or connect their individual actions. Background pauses and inferred abandonment are separate from explicit exits and do not prove why someone stopped playing.
In versions supporting this feature, you can turn anonymous gameplay statistics off in Settings. Turning it off clears the local statistics flags and unsent queue and stops new statistics. It cannot remove a person's earlier contribution from anonymous combined totals because there is no identity mapping. A grouped batch is dispatched at most once; offline limits, blocked requests, resets and failed or ambiguous delivery can cause undercounting. Reinstalling or resetting local storage can count an installation again.
The separate gameplay service keeps these dated aggregate counts for up to 90 days, then deletes expired daily buckets. It does not keep per-player records, access histories or application logs. Cloudflare may retain earlier copies for storage recovery under its separate backup practices; active-store expiry does not mean immediate deletion from those copies. Cloudflare also processes connection and security information separately as described below. These statistics are separate from the nine running counters and from temporary shared-ride storage.
In app versions supporting campaign measurement, Android can read a shared advertising campaign label locally from Google Play. The app discards raw referral data and sends only grouped UTC-day totals for that fixed campaign: first observed store-app opening and first actual play. An observed opening is not proof of a new download or a distinct person. iOS is not assigned an Android campaign.
This separate service receives no advertising click identifiers, device or player identifiers, accounts, raw referral strings, URLs, scores, replays or individual event histories. It keeps daily combined totals for up to 90 days, with application logging disabled. Cloudflare may separately retain recovery backups and process network/security information. Existing app versions without this feature do not gain it from a website update.
The anonymous play statistics switch in Settings also stops campaign measurement and clears pending campaign totals. Small local once-only flags prevent an already observed first open or first play being counted again after switching it back on. Reinstalling, resetting storage, unavailable referral information, blocked requests and delivery loss may affect totals. We cannot identify or match an individual ad click to a download or play from these anonymous sums.
App versions whose published configuration offers earned coins keep a pseudonymous ledger so that installation can keep its balance, equipment unlocks and friend challenge rewards. The device creates a P-256 public signing key. The economy service stores that public key, an opaque wallet id, the integer coin balance, owned equipment ids, claimed reward keys and the minimum facts needed to pay a reward only once. It does not store a name, email, platform account, advertising identifier or the private key. The private key stays on the device.
Coins are earned inside the game. They are not real money. There is no cash-out, no purchase of coins and no gambling. The ledger is not used for advertising and it is not used to identify a person. It is stored only to preserve earned coins, equipment unlocks and friend challenge rewards. Deleting the wallet in the game removes that balance and those unlocks from the ledger.
This ledger is separate from the anonymous counters, gameplay statistics and campaign totals. Those services do not receive wallet ids, public keys, balances or equipment. Older apps keep working when the published configuration omits the economy block. Publishing the worker source does not by itself turn the ledger on.
Cloudflare hosts the websites, the short-link service, the counter service, the separate gameplay-statistics and campaign-total services and, when the earned-coin service is enabled, that ledger. Delivering a request requires it to process network information, including the connection's IP address. Our counter code does not read or store IP addresses or other identifying request information, and logging for the counter service is disabled. This does not prevent Cloudflare from separately processing and retaining network or security information under Cloudflare's privacy policy. We do not add that information to the counters or use it to identify players.
The nine totals have no scheduled deletion. Cloudflare can also retain earlier states of those totals for up to 30 days for storage recovery. These recovery states contain no player records. Website visits and app configuration requests are also subject to Cloudflare's processing and retention practices. Device and platform diagnostics are separately controlled by your device and platform settings.
If you choose to email support@sambazen.com, we receive your email address and the information you include so we can reply. This voluntary support correspondence is separate from the game and its anonymous counters. The SambaZen privacy policy explains privacy rights and contact options.