Last updated: October 15, 2026
Who this policy covers
This Privacy Policy explains what ToyTown Island™, operated by BlunkWorks, LLC (doing business as Eshom Cabin Press), collects when an adult creates an account and plays the game, and what we do with it.
Where we are
ToyTown Island is operated by BlunkWorks, LLC, an Oklahoma company.
What we collect for your account
When an adult sets up an account, we store:
- The account holder's email address.
- A password hash (we never store your password itself).
- One-time links for email verification, password reset, and sign-in, which expire 30 minutes after they are sent. Until you finish setting up an account, the verification request also holds a hash of the password you chose.
- Hashed device connection tokens with an expiry date, used to recognize a game device that has been approved to sync your account.
- Player profiles: a nickname, a chosen picture, and an optional small avatar image the account holder uploads.
- Game save data for each player, with up to 30 retained online versions.
- Timestamps for account, device, and save activity.
- Rate-limit counters, used only to slow down abusive requests (such as repeated sign-in attempts). Counters are stored under a one-way hash of what they count, such as the IP address and, for sign-in and email requests, the email address entered.
Children do not need their own email address and do not create their own account. Only the account holder's email address is collected.
Game purchases and trial access
When purchase or trial features are enabled, the game stores trial play time and access sessions, checkout handoffs, purchase references, purchase email addresses, and purchase or refund status so it can determine which account has full access. Eshom Cabin Press handles checkout and payment; the game does not receive your payment-card details.
How long we keep it
Your account, its players and their saves (up to 30 retained online versions per player), its settings, and its device connection records are kept while the account exists, and are deleted when the account is deleted.
Verification, password reset, and sign-in links are deleted as soon as they are used, or when a password reset or the end of account setup makes them unusable. The password hash held during account setup is deleted with its verification request. Links that expire unused, pending device connection requests, and rate-limit counters are cleared out within two days.
How game saves work
The game stores saves on your device, in your browser's local storage, so play works offline. When your device is online, saves sync automatically to your account.
Support messages
If you contact support, we collect the name and email address you provide, your message, whether you were signed in, your account ID (if signed in), your browser's user agent string, and the time of the message. We use this only to answer your request.
Cookies
We set one cookie: __Host-tti_parent, a strictly necessary session cookie that keeps you signed in to your account. We do not set any advertising or analytics cookies. The site is served through Cloudflare, which may set its own security cookies and can see the IP address of each request as part of delivering the site; see Cloudflare's own privacy documentation for details on its handling of that data.
Account emails, such as verification, password reset, and sign-in links, are sent from noreply@eshomcabinpress.com. We do not send marketing email.
How we use your information
We use the information above only to operate the game: to sign you in, keep your players' saves backed up, connect your game devices, respond to support requests, and keep the game secure. We do not sell your information, and we do not use it for advertising.
Your choices: access, export, and deletion
You can request a copy of your account data, or request that your account and its data be deleted, by writing to support@play.eshomcabinpress.com from the account's email address.
A copy of your account data includes everything listed above that we store for the account, except passwords and connection tokens, which we keep only as one-way hashes. Deleting an account removes the account, its players, saves, settings, device connections, and pending links together. We keep our record of support actions on the account, including a record that the deletion happened; it identifies the account only by its internal ID.
Deleting an account also removes its linked trial, checkout, purchase, and purchase-event records, including pending purchases addressed to that account's current email. We keep limited keyed checks to prevent old purchase, store-event, and checkout-exchange references from being reused. These checks contain no account ID or email address. Contact support if you need help recovering access from an eligible purchase. The support-action records described above remain separate.
Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date above when we do.
Contact
Questions about this policy can be sent to support@play.eshomcabinpress.com.