Privacy Policy

Controller

GreenVend UG (haftungsbeschränkt)
Bredtschneiderstr. 14
14057 Berlin, Germany
Email: hello@tinyappclub.com

1. The game

The game is a puzzle game: each level is solved by doing something with your phone, such as tilting it, covering a sensor, making a sound or going outside. To notice that, the game reads the sensors and system information a level needs, at the moment you play that level. Unless stated otherwise below, everything is processed only on your device, used only to decide whether the level is solved, and not stored beyond the level's progress. The legal basis is the performance of our contract with you, i.e. providing the game you asked for (Art. 6(1)(b) GDPR), and, for access to information on your device, § 25(2) no. 2 TDDDG (strictly necessary for the service you requested).

Permissions

The game asks for a permission only when you reach a level that needs it, not at first launch. If you decline, only that level waits; you can grant or withdraw a permission at any time in your phone's settings.

• Microphone. Used to measure how loud or quiet it is, and the pitch or rhythm of a sound, while a sound level is open. The audio is analysed in memory as it comes in. Nothing is recorded, stored or transmitted.
• Camera (front and back). Used while a camera level is open to detect, for example, whether you look at the screen, blink or smile, how bright it is, or whether the camera sees the sky, a number or a code. Camera frames are analysed in memory and discarded. No photo or video is taken, stored or transmitted. Face detection only finds whether and where a face is and its expression; it does not identify anyone.
• Location (only "while using", precise or approximate as you choose). Used to calculate the local time of sunset, how far you have moved from where a level was opened, and your speed. The calculation happens on the device; the starting point is stored only on your device until the level is solved. Your location never leaves your phone.
• Motion & fitness / physical activity. Used for the step counter and the barometer (height change). Read on the device only.
• Notifications. A few levels schedule a reminder, for example shortly before sunset. These are local notifications created on your phone; we don't run a push server and don't receive any device token.

Sensors and system information without a permission

Some levels read information that needs no permission: motion sensors (accelerometer, gyroscope, compass), the proximity and ambient light sensors, media volume, battery level and charging state, whether the phone is online, headphones connected, the system's light/dark mode, language and time zone, the time since the phone was restarted, whether a screen reader is on, and whether a screenshot was taken (the game is only told that one was taken, never what it shows). The game never reads your clipboard. All of this is used on the device only.

Google ML Kit (on-device)

Face detection, text recognition, barcode scanning and pose detection run with Google's ML Kit, entirely on your phone. No images are sent to Google. ML Kit may contact Google's servers from time to time to receive bug fixes, updated models and hardware compatibility information, and it sends Google metrics about the performance and use of these features (such as device model, operating system version, app identifier and timings). Google uses these metrics to maintain and improve ML Kit and to detect misuse. The legal basis is our legitimate interest in reliable on-device recognition (Art. 6(1)(f) GDPR).

Your progress — stored on your device

Your progress, the hints you have uncovered, the levels you solved without help, and your settings (language, sound) are stored locally on your phone. There is no account and no sync to a server of ours. Uninstalling the game removes this data. If backups are turned on in your phone's settings (iCloud or Google), they may include it under Apple's or Google's own policies.

Ads (only when you choose to watch one)

The game shows no banners and no ads between levels. When you ask for the second or third hint of a level and don't own unlimited hints, you can choose to watch a short rewarded video ad. These ads are delivered by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). To deliver an ad, measure it, cap how often you see it and prevent fraud, Google processes your IP address, device and app information (such as model, operating system, language and app version), your advertising ID (Apple IDFA / Google advertising ID) where available, and how you interact with the ad.

Consent. In the EU/EEA, the UK and Switzerland, the game shows Google's consent form before the first ad. Personalised ads, and reading or storing identifiers on your device for advertising, happen only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you don't consent, Google may still show non-personalised or limited ads, processing only what is needed to deliver the ad, count it and prevent fraud, based on our legitimate interest in funding a free game (Art. 6(1)(f) GDPR). You can change your choice at any time in the game's settings (privacy options). On iOS, the game asks for permission to track (App Tracking Transparency) before your advertising ID can be used; if you decline, it isn't.

Google may process this data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. Google acts as an independent controller for parts of this processing. See how Google uses data from apps that use its services and Google's privacy policy. If you never watch an ad, no ad is requested.

Purchases and subscriptions

The game offers optional in-app purchases: one-time purchases (such as unlimited hints) and, where offered, auto-renewing subscriptions. Payment is handled entirely by Apple (App Store) or Google (Google Play) under their terms; we never see your payment details, name or email address.

To check that a purchase is valid, unlock it, restore it on a new phone and keep a subscription's status up to date, we use RevenueCat (RevenueCat, Inc., USA) as our processor. For this, RevenueCat receives a random app user ID created by the game (not linked to your name or store account), the store's purchase receipt and transaction details (product, price, currency, store country, purchase, renewal, cancellation and refund dates), and technical data such as device type, operating system and app version, and the IP address of the request. The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR) and, for transaction records, our legal retention obligations (Art. 6(1)(c) GDPR). RevenueCat processes this data on our behalf under a data processing agreement with the EU Standard Contractual Clauses, and may process it in the United States. We keep transaction records as long as tax and commercial law require (up to 10 years in Germany), and delete or anonymise the rest when it's no longer needed for your purchases.

What the game does not do

The game has no account system and contains no analytics, crash-reporting or social SDK. It does not collect your name, email address or contacts, it does not build a profile of you, and it does not sell data. Apart from ads, purchases and ML Kit as described above, it works without an internet connection.

2. App Store and Google Play

The game is distributed through Apple's App Store and Google Play. Apple and Google process data about your download, your device and your purchases as independent controllers under their own privacy policies. From them we receive only aggregated, anonymous statistics (such as downloads and crash rates, if you have allowed sharing with developers) and the sales reports they provide to all developers.

3. This website

Hosting

When you open this site, our hosting provider processes your IP address, the page requested, the time, and your browser's user agent in order to deliver the page and keep it secure. These logs are kept only briefly. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

The playable demo

The four levels at the top of the page run entirely in your browser. On the fourth level, browsers that support it (mainly Chrome-based ones) let the page see whether your device is charging. This is read locally to solve the level and is never sent to us. Nothing you do in the demo is stored, except as anonymous analytics if you agree to them (below).

Analytics (only with your consent)

If you accept it in the consent banner, this site uses PostHog (PostHog Inc., data hosted in the EU, Frankfurt) for anonymized analytics: page views, how far visitors get in the demo, hints opened, and clicks on the store buttons. PostHog stores a random ID in your browser's local storage, not in cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can decline, or change your choice at any time with the cookie settings button at the bottom of the page, and clear the stored data in your browser settings.

The site has no advertising trackers, no user accounts and no forms. If you email us, we use your email address and message only to reply to you (Art. 6(1)(b) or (f) GDPR) and delete them when the conversation is over, unless we're required to keep them.

4. Your rights

Under the GDPR you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw any consent you've given at any time, with effect for the future. Because the game's data stays on your phone, uninstalling the game removes it. For ad data, use the privacy options in the game and your phone's advertising settings (reset or delete your advertising ID). For purchase data, contact us at hello@tinyappclub.com; it helps if you include the order number from your store receipt. For website analytics or anything you've sent us by email, contact us at the same address.

You also have the right to lodge a complaint with a supervisory authority, for example the Berlin data protection authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

5. Children

The game and this website are not directed at children under 16, and we do not knowingly collect their data. Ads are never personalised for users who tell the consent form, or their device's settings, that they are underage.