Last Updated: September 24, 2026
This policy covers one game: Taco Rain: Catch the Tacos, on iPhone, iPad, Mac and Android. Our other apps are covered by the general Illumination Development privacy policy, which does not apply here. That policy describes accounts, email addresses, reward balances and redemption records that this game does not have.
The short version
There is no account, no rewards, and nothing for sale. The game never learns who is playing. Every score, star and badge is written to storage on the device and stays there.
Every advertisement is non-personalized, for every player, in every country. The game does not ask for Apple's advertising identifier and contains no code that could, and on Android the advertising-ID permission is stripped out of the app entirely.
There are two advertising networks, not one, and one of them is switched off entirely in Europe. Both are described in full below, along with the anonymous game telemetry and crash reports the game sends.
What stays on the device
Everything you play. The game keeps its records in local storage on the device, in five separate stores:
- Your round history — the most recent hundred finished rounds.
- Lifetime totals: rounds played, tacos caught, and your best streak.
- Your best score on each of the fifty levels, how far up the ladder you have reached, and today's daily challenge score.
- Which badges you have earned, and which basket you have chosen.
- Your settings — sound, vibration, reduced motion and assist mode.
None of it is transmitted anywhere. There is no leaderboard, no cloud save and no profile. If the device backs itself up to iCloud or to Google, that copy is governed by Apple's or Google's terms and your own backup settings, and we have no access to it.
Delete my data in Settings erases all five stores permanently, clears the analytics identifiers described below, and deletes the anonymous account the game uses for telemetry. Deleting the game does the same thing to the records on the device.
The daily challenge needs no server, and keeps no history
One round a day, the same for every player everywhere. It is not fetched and it is not sent: the game works it out from the calendar date on the device, so two people comparing scores are comparing the same round without anything about either of them traveling anywhere. There is no shared leaderboard and no way to see another player's score.
Exactly one day is ever stored — today's, overwritten each day rather than accumulated. The game keeps no record of which days you played, and there is no streak, by design.
What the game does send
Three things leave the device besides advertising, and this is all of them. None is linked to a real-world identity, because the game never collects one.
An anonymous identifier
On first launch the game signs in anonymously to Google Firebase. This produces a random identifier — not a name, not an email address, not a phone number, and nothing you typed — which exists so that a player's crash reports and gameplay statistics have a stable key from one session to the next. There is no password, nothing to sign up for, and no way to use it to find out who anyone is. Delete my data deletes it.
Gameplay analytics
The game reports what happens in it to Google Analytics: a round starting and ending, the score and the reason it ended, a badge unlocked, a personal best, a power-up caught, which screen is open. Alongside those, Google Analytics collects its own app-instance identifier and coarse device information such as the model, the operating system version and the app version.
No free text ever reaches analytics, because the game has nowhere to type any. Every value reported is a number or the name of one of the fifty levels. We use it to see which levels are too hard and which go unplayed, and for nothing else.
Crash and diagnostic reports
If the game crashes or hits a handled error, Google Crashlytics sends a report: the stack trace, the app version, the device model and operating system, and the anonymous identifier above. This is how bugs get found. Analytics and crash reporting are both switched off entirely in development builds.
Advertising
The game is free and carries advertising. There are two placements and that is the entire inventory: a banner on the menu screens, and one full-screen advertisement that only ever appears if you tap a button in Settings asking to see one. There is never an advertisement during a round, and none on the playfield at all — it is a surface the player is dragging a thumb across.
Two networks, and which one you see where
The banner is filled by Kidoz first, and Google AdMob behind it when Kidoz has nothing to show. The full-screen advertisement is Google AdMob only. There is no other advertising network in the app.
Kidoz does not run in the EEA, the UK or Switzerland at all. It is a direct, unmediated network on its own account, so nothing you agree to through Google's consent form reaches it — and rather than ask you a second question, the game simply does not start it where a consent regime applies. Players there see AdMob only.
Where Kidoz does run, it collects three things automatically: a truncated IP address, which can estimate the city a device is in but not a precise location; advertisement interactions such as views, clicks and video playback; and diagnostic information about advertisements loading and playing. It collects no advertising identifier at all — there is none for it to read, and none to switch off. Its use of what it collects is governed by Kidoz's own privacy policy.
To serve AdMob advertisements, the Google Mobile Ads SDK contacts Google and may collect device and advertising information — device signals, coarse device and app data, and the request, impression and click itself. Google's use of it is governed by Google's own privacy policy.
The optional advertisement grants nothing
The Settings entry reads "Watch an ad to help out". It is not a rewarded advertisement: watching it gives you no coins, no power-up, no level and no advantage of any kind, because there is nothing in this game to give. Nothing is locked behind it and declining it costs you nothing, which is the whole reason it is shaped that way rather than as a reward.
There are no rewarded advertisements anywhere in the game, and there is nothing to buy: no in-app purchases of any kind are on sale, and no purchase screen is reachable. Power-ups are caught by playing.
Every advertisement is non-personalized
This is the part that differs from most free games, and it is deliberate. The app sets three things on every Google request before the first advertisement is ever asked for:
- Child-directed treatment, which tells Google to treat the audience as children and forbids personalization.
- A maximum content rating of "G", so the creatives shown are the ones Google rates suitable for general audiences.
- Non-personalized ads, set explicitly on the request as well, so that a configuration failure cannot quietly turn personalization back on.
Kidoz keeps the same promise by construction rather than by configuration: it is a contextual network that reads no advertising identifier, so there is nothing for it to personalize against.
On Android the advertising-ID permission is removed from the app. The Google Mobile Ads SDK declares it by default; this app strips it back out, so the advertising ID cannot be read at all rather than merely going unused.
There is no tracking prompt, and that is the point
On iPhone, iPad and Mac, most free games show Apple's App Tracking Transparency prompt asking for permission to track you. Taco Rain does not, and cannot. The permission framework is not built into the app, there is no usage description for it in the app's configuration, and no code requests Apple's Identifier for Advertisers. Because it never asks, it never receives it, and there is nothing for anyone to decline.
If you go looking for this game under iOS Settings → Privacy & Security → Tracking, you will not find an entry for it. That is correct and not a fault.
In the EEA, the UK and Switzerland
Google's consent message is shown before any advertisement is requested, gathering consent for the storing of and access to information on the device as Google's EU user consent policy requires. The request is flagged as coming from a user below the age of consent for data processing, so the choices offered are the reduced set appropriate to that, and declining is offered as plainly as accepting.
You can change your answer at any time — Settings → Ad privacy options reopens the same choices. That entry appears only where a consent regime applies, which is why players elsewhere will not see it.
Consenting does not turn on personalized advertising here. It cannot: the child-directed setting above overrides it, and the game asks for non-personalized advertisements regardless of the answer. What you are actually deciding is whether information may be stored on and read from your device. Your decision is stored on your device by Google's consent SDK, and clearing it clears with the app's data.
Withdrawing consent stops Kidoz as well as Google, because Kidoz was never started there in the first place.
What the game does not do
- No account, sign-in, username, profile or email address. It never asks who you are.
- No rewards, no coins, no balance and no payouts. Nothing in this game is worth anything outside it.
- No in-app purchases, nothing for sale, and no way to spend money.
- No contact or support form. There is no way to send us text from inside the game.
- No text field of any kind, anywhere.
- No chat, no voice, no leaderboard and no user-generated content.
- No multiplayer of any kind, and no way to reach another person through the game.
- No precise location, and no location permission is requested. Kidoz's truncated IP address can estimate a city and nothing finer, and only outside Europe.
- No access to contacts, photos, camera, microphone, health or motion data.
- No advertising identifier requested on iPhone, iPad or Mac, and none readable on Android.
- No personalized advertising, for anyone, anywhere.
- No rewarded advertising.
- No advertising network other than Kidoz and Google AdMob.
- We do not sell personal information, and we do not share it for cross-context behavioral advertising, in the specific senses the CCPA and CPRA give those terms.
Children
Taco Rain is rated 4+ on the App Store and Everyone by the ESRB / PEGI 3 on Google Play. It is not in Apple's Kids Category — it is a game plenty of children play, rather than a children's product, and we would rather say so than claim a badge it does not carry.
It is built to the child-directed standard anyway, because that is the protection that actually matters and it does not depend on a store category. Every advertising request is flagged child-directed and capped at the "G" content rating, no advertising identifier is requested or readable, no advertisement is ever personalized, there is nothing in the game to buy, and there is no way for a player to type anything or to reach a stranger. Kidoz is a network built for children's apps and certified for it.
The general Illumination Development policy states that our services are not intended for children under 13. That statement is about our reward apps and does not apply to this game, which is why this page exists.
We do not knowingly collect personal information from children, and the game collects no personal information from anyone. If you believe a child has somehow provided us with personal information through this game, write to privacy@illuminationdevelopment.com and we will delete it.
Your rights
Under the GDPR, the UK GDPR, the CCPA and CPRA, and comparable laws elsewhere, you have rights to access, correct, port and delete the personal information a company holds about you. We hold no name, email address or other real-world identifier from this game, so most of those rights have nothing here to be exercised against — and you can exercise the deletion right yourself, immediately and without asking us, using Delete my data in Settings.
Two things sit outside that. Information held by Google and by Kidoz from serving advertisements, running analytics and receiving crash reports, which is subject to Google's privacy policy and Kidoz's and the controls described above. And anything you have sent us by email, which you can have deleted by writing to privacy@illuminationdevelopment.com.
A note about this web page
The game does not display this page — tapping Privacy Policy in Settings opens it in the device's browser, and this website, unlike the game, does use Google Analytics to see which pages people find useful. That is described in the general policy, and it applies to your visit to this page, not to your use of the game.
Changes to this policy
If any of this stops being true, this page changes before the version that changes it reaches either store, and the App Store privacy label and Google Play Data safety form change with it. Revisions are posted here with an updated date.
Contact
Email: privacy@illuminationdevelopment.com
You can also reach us through our contact and support page.