Privacy Policy for Endless TD
Infinite Retry Studio ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under applicable privacy laws, including the GDPR, CCPA/CPRA, and other U.S. regulations.
By installing, accessing, or playing Endless TD, you agree to this Privacy Policy and our End User License Agreement.
1. Information We Collect
A. Information You Provide
We automatically create a player account when you first launch the game through a supported platform. Your platform identity (Steam ID or Google Play ID) is linked to this account to enable cross-platform features and progress synchronization across devices.
We may collect the following information when you create an account or play the game:
- Display name / username
- Email address (if provided through authentication)
- Steam account information (Steam ID, Steam name, avatar)
- Google Play account information (Google Play ID, display name)
- Game preferences and settings
- Support messages, chat reports, and feedback
- Newsletter subscription email (if you subscribe to dev updates)
B. Gameplay & Progression Data
We collect gameplay-related data to operate core game features, including:
- Match history (game mode, duration, waves completed, outcomes)
- Wins, losses, PvP results
- Enemies killed, towers built, damage dealt
- Archetypes, talents, upgrades, and progression
- Leaderboard rankings and statistics
- AI or co-op participation data
This data is tied to your player account and is used for gameplay functionality, balance, and competitive systems.
C. Purchases & Transactions
If you make purchases, we collect:
- Transaction IDs and order references
- Purchased items (e.g., gem packs)
- Transaction status (approved, failed, refunded)
- Currency and amount
- Platform provider (e.g., Steam)
We do not store full payment card information. Payments are processed by third-party providers such as Steam.
D. Technical & Security Data
Collected automatically:
- IP address
- Device and browser information
- User agent
- Login timestamps
- Error logs and crash data
- Anti-fraud and abuse prevention signals
E. Analytics & Usage Data
We may use analytics tools such as Google Analytics or similar services to collect:
- Session duration
- Feature usage
- Navigation behavior
- Aggregate gameplay trends
Analytics data is used only to improve the game and user experience.
2. How We Use Your Data
We use your data to:
- Provide and operate Endless TD
- Enable multiplayer, matchmaking, and leaderboards
- Track progression, achievements, and cosmetics
- Process purchases and deliver in-game items
- Detect cheating, abuse, or fraud
- Improve performance, balance, and gameplay systems
- Communicate important updates about the game or your account
- Respond to support requests and feedback
- Send newsletter emails about dev updates and patch notes (only with your consent; you may unsubscribe at any time)
- Comply with legal obligations
We do not sell your personal data.
3. Legal Basis for Processing (GDPR)
Under GDPR, we process data based on:
- Contractual necessity - to provide the game and services you requested
- Legitimate interests - security, analytics, game improvements, and fraud prevention
- Legal obligations - compliance with applicable laws and regulations
- Consent - where required, such as optional analytics or marketing communications
4. Data Sharing
We may share limited data with:
- Platform providers (e.g., Steam) for authentication and purchases
- Payment processors for transaction processing
- Analytics providers for aggregated usage insights
- Hosting and infrastructure providers for game servers and databases
- Legal authorities when required by law or to protect our rights
All third parties are contractually obligated to protect your data and use it only for specified purposes.
5. Data Retention
We retain personal data:
- As long as your account is active
- As required for legal, security, or operational purposes
- Transaction records may be retained for up to 7 years for accounting and tax compliance
- Aggregated or anonymized data may be retained indefinitely for analytics
You may request deletion of your personal data as described below.
6. Your Rights
A. GDPR (EU/UK Users)
You have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion ("Right to be Forgotten")
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority
B. CCPA / CPRA (California Residents)
You have the right to:
- Know what personal data is collected and how it's used
- Request deletion of personal data
- Opt out of the sale or sharing of personal data (we do not sell your data)
- Non-discrimination for exercising your privacy rights
- Correct inaccurate personal information
- Limit the use of sensitive personal information
We do not sell personal data. To opt out of analytics data sharing, click the "Do Not Sell or Share My Personal Information" link in the website footer, or use the Cookie Settings.
C. CCPA Notice at Collection
The following table summarizes the categories of personal information we collect, our purposes for collection, and how long we retain it:
| Category (CCPA) | Examples | Purpose | Retention |
|---|---|---|---|
| Identifiers | Username, email, Steam ID, Google Play ID, IP address | Account management, authentication, security | While account is active |
| Commercial information | Transaction IDs, purchased items, currency amounts | Processing purchases, delivering items | Up to 7 years (tax/legal) |
| Internet/electronic activity | Session duration, page views, navigation behavior, gameplay stats | Analytics (with consent), game improvements, leaderboards | While account is active; aggregated data indefinitely |
| Geolocation (coarse) | IP-derived approximate location | Security, fraud prevention, analytics | While account is active |
We do not collect sensitive personal information as defined by CCPA/CPRA.
D. Other Jurisdictions
If you reside in other jurisdictions with privacy laws (such as Brazil's LGPD, Canada's PIPEDA, or Australia's Privacy Act), you may have similar rights. Contact us to exercise your rights under applicable local laws.
7. How to Exercise Your Rights
To make a privacy request, contact us at:
Please include:
- Your username or account identifier
- The specific right you wish to exercise
- Any relevant details to help us locate your data
We may verify your identity before fulfilling requests. We will respond within 30 days (or as required by applicable law).
To request deletion of your data: You can submit a data deletion request directly through our website at Request Data Deletion. You will receive an email confirmation before any data is removed.
8. Cookies & Tracking Technologies
We use the following types of cookies:
A. Essential Cookies
These cookies are required for the website to function and cannot be disabled. They include:
- Session cookies for authentication and login state
- CSRF protection tokens for form security
- Cookie consent preference storage
B. Analytics Cookies (Requires Consent)
We use Google Analytics (GA4) to understand how visitors interact with our website. These cookies are only activated after you provide consent via the cookie banner displayed at the bottom of the page. Analytics cookies include:
_ga— Distinguishes unique visitors. Duration: 2 years._ga_*— GA4 measurement ID cookie used to maintain session state. Duration: 2 years._gid— Distinguishes unique visitors within a 24-hour period. Duration: 24 hours._gat— Used to throttle request rates. Duration: 1 minute.
All analytics cookies are first-party cookies set on the endlesstd.com domain. GA4 automatically anonymizes IP addresses; full IP addresses are never stored.
C. Managing Your Cookie Preferences
When you first visit our site, a consent banner allows you to Accept All or Reject All non-essential cookies. Your preference is stored locally and will be remembered for 365 days.
You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer, which will re-display the consent banner so you can update your choice.
We also honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a request to opt out of analytics tracking.
You can also manage cookies through your browser settings. Note that disabling essential cookies may affect website functionality.
9. Children's Privacy
Endless TD is not intended for children under 13 (or 16 in certain jurisdictions).
We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.
10. Security
We implement reasonable technical and organizational safeguards, including:
- Access controls and authentication
- Encrypted data transmission (HTTPS/TLS)
- Database security policies
- Regular security assessments
- Separation of development, staging, and production environments
No system is 100% secure. While we take data protection seriously, we cannot guarantee absolute security. Please use strong passwords and keep your account credentials confidential.
11. International Data Transfers
Your data may be processed outside your country of residence, including in the United States.
When transferring data internationally, we use appropriate safeguards such as:
- Standard contractual clauses approved by the European Commission
- Data processing agreements with third parties
- Compliance with applicable data protection frameworks
12. Third-Party Links and Services
Our game and website may contain links to third-party services (such as Steam, Discord, or social media platforms). This Privacy Policy does not apply to those services. We encourage you to review their privacy policies.
13. Do Not Track & Global Privacy Control
Some browsers offer a "Do Not Track" (DNT) feature. While we do not currently respond to DNT signals automatically, we do honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will automatically opt you out of analytics tracking and will not load analytics cookies.
You can also manage tracking through the cookie consent banner (accessible via the "Cookie Settings" link in the footer), browser settings, and cookie preferences.
14. Changes to This Policy
We may update this Privacy Policy as the game evolves or as required by law.
Changes will be posted on this page with an updated effective date. For significant changes, we may notify you through the game or via email (if you've provided one).
Continued use of Endless TD after changes constitutes acceptance of the updated policy.
15. Contact
For privacy questions, concerns, or requests, contact:
Infinite Retry Studio
Email: admin@endlesstd.com