Privacy Policy

Dino Simulator · Mibbon · effective 5 September 2026

Dino Simulator is a browser game. This page says what it stores, what it sends, where that goes and for how long. It is written to be read rather than to be long.

Who we are

The game is made and published by Mibbon. For anything about your data, write to team@mibbon.com.

In short

• The game has no accounts of its own and asks you for nothing: no name, no email, no age.
• Your progress and settings are stored in your own browser, on your own device. That storage is the kind of thing the law treats like a cookie, and it is there only so the game can remember you.
• When you play with others, a made-up name, your dinosaur and where it is standing go straight to the other players in your room. We run no server for it, and nothing of it is written down anywhere.
• The game is paid for by advertising. On Poki, where it is published, Poki and its advertising partners show ads around and inside the game and set cookies to do that; the rewarded ads the game offers are theirs too. All of that runs under Poki's privacy policy.
• We ourselves run no analytics, advertising or tracking of our own, and we sell nothing to anybody.

What is stored on your device

The game keeps its save in your browser's local storage, under the address it is played from. Nothing in it identifies you as a person:

• your progress — which dinosaur you play, how grown it is, its health, food and water, the coins, missions, skins and power-ups you have;
• your settings — sound, effects, graphics quality, language;
• the display name you picked from the game's own two word lists, and the emotes you used most recently;
• one random identifier the game made up on your device, so the same made-up name is dealt to you on each visit.

Local storage is not a cookie in the technical sense, but the law treats it the same way: it is information kept on your device by a website. Ours holds nothing but the game, is strictly necessary for the game to remember you between visits, and is never sent anywhere by itself — which is why the game itself shows no consent banner for it. You can remove it by clearing this site's data in your browser, and the game will start you again from an egg.

Playing with others

The game can put you on an island with other dinosaurs, and when it does your devices talk to each other directly. We run no multiplayer server. What introduces the players is netlib, Poki's networking library, which hands out the four-letter room codes, tells the players in a room how to reach one another, and then gets out of the way. While you are connected your game sends the others in your room, several times a second:

• where your dinosaur is on the island, which way it faces, and what it is doing — walking, swimming, eating;
• which dinosaur it is, how grown it is and how you have painted it;
• your display name and the emotes you send;
• an attack on another player's dinosaur, and a bite taken out of one that has died.

The other players in your room see your name, your dinosaur and where it is — that is what playing together is. A dinosaur that dies lies on the island for the others for a minute or two, then is gone. None of it is stored anywhere: it lives in the connection between the players for as long as they are connected, and there is no server of ours to keep a history of who was in a room.

Poki's netlib is told less than the other players are: the room's four-letter code, which island the room is on and which version of the game it is, and an identifier made up for that one connection. Not your name, and nothing out of your save. Like any service a device connects to, it also sees that device's internet address (IP address).

Two devices talking directly means each end can see the other's internet address. That is how a connection between two computers works and there is no way round it in a game played this way. Where a direct connection cannot be made, netlib relays the traffic through Poki's servers instead, and the business of working out how two devices can reach each other also asks a public address service run by Google. Both of those are parts of netlib rather than of the game, and they run under Poki's privacy policy rather than this one.

If you are logged in to a Poki account while playing on Poki and choose to use it, your Poki username is the name shown. Otherwise it is the made-up one.

When the game is played on Poki

Dino Simulator is published on Poki, and that is where most people play it. The game is free because it carries advertising there. The page around the game and the Poki software inside it are Poki's, and they:

• show advertisements before and during play, and the rewarded ads the game offers in exchange for coins, power-ups or another life. Poki and its advertising partners set cookies and process information such as your IP address and device details to serve and measure those ads, and where the law requires it they ask for your consent through Poki's own consent screen, not ours;
• collect gameplay analytics — how far people get, what they buy in the game, how long they play;
• record anonymised gameplay sessions during playtests, to see how the game is being played;
• tell the game your Poki username, if you are logged in and ask the game to use it.

What Poki collects and how it is used is set out in Poki's privacy policy, not in this one. Poki B.V. is based in Amsterdam, the Netherlands.

The game's page loads Poki's script from Poki's servers wherever it is served, which means a request to Poki that carries your IP address, as every request on the web does.

What we do not do ourselves

• We do not ask for, and do not have, your name, email address, date of birth or anything else about you.
• Beyond the local storage described above, we set no cookies of our own, and we use no analytics, advertising or tracking services of our own. The advertising and analytics in the game are Poki's, where the game is played on Poki.
• We do not sell, rent or trade any data, and we do not build profiles of players.
• The game asks for no permissions on your device beyond what a web page has.

Children

The game is suitable for children and collects no personal data from anybody, of any age. The one thing other players can see is a display name, and by default that is two words the game picked. A child who chooses to use a Poki account's username will be shown to others by it; parents who would rather not have that should keep the made-up name, which is the default.

Where your data goes, and the law we work under

We run no game server at all. We work under the General Data Protection Regulation (GDPR). What little we process, we process because it is needed to run the shared island you chose to take part in — which the GDPR calls a legitimate interest. The storage on your device is strictly necessary for the game to remember you, which is why the game itself has no cookie banner; the consent for advertising cookies on Poki is asked for by Poki.

Your rights

You may ask us what we hold about you, ask for it to be corrected or deleted, and object to our processing it. In practice, nothing we hold outlives your visit: what you send to the other players is gone with the connection that carried it, and we keep no copy of it. Your save on your own device is yours to delete at any time.

If you think we have handled your data wrongly, you can complain to the data protection authority in your country.

Changes to this policy

If the game starts doing something this page does not describe, this page changes first. The date at the top is the date of the version you are reading.