Games Privacy Policy

The short version

1. Which games this covers

This policy applies to every game Sheesh Solutions publishes on the Apple App Store and on Google Play. Games differ in what they need, so the table below says, game by game, which of the practices described in section 5 apply. Anything not listed for a game does not happen in that game.

This website has its own, separate privacy policy.

2. Who is responsible

The controller within the meaning of Art. 4 (7) GDPR is:

The name, postal address and email are loaded after an invisible check that keeps address harvesters from collecting them in bulk. It asks nothing of you. The same details are printed on every game's App Store and Google Play listing.

We have not appointed a data protection officer. Given the size of the business and the kind of processing described here, Art. 37 GDPR and § 38 BDSG do not require one. Write to the address above with any question about this policy. That is also the way to reach us for every request in section 9.

3. What stays on your device

Your progress, unlocked levels, high scores and settings are stored by the game on your device. They are never sent to us. This is not data we protect carefully: it is data we do not have.

Storing this on your device is strictly necessary to provide the game you asked to play (§ 25 (2) no. 2 TDDDG), so no consent is asked for it. Deleting the game deletes all of it. We cannot restore it, because we never had it.

4. What is processed, and why

The following describes everything a game of ours can do with data beyond your device. Each item says which games it applies to. Where it says none, no game does it.

4.1 Cloud saves (iCloud, Google Play)

None of our games does this at the moment.

4.2 Game Center and Google Play Games

None of our games does this at the moment.

4.3 In-app purchases

Applies to: Curve Impact

Purchases are processed entirely by Apple or Google. We never receive your name, card number or billing address. The game receives a confirmation from the store, with a transaction ID, the product bought and the date, so it can unlock what you paid for and restore it on a new device.

Legal basis: Art. 6 (1)(b) GDPR, performing the purchase contract.

4.4 Downloading game content

None of our games does this at the moment.

4.5 Crash reports

None of our games does this at the moment.

4.6 Analytics

None of our games does this at the moment.

4.7 Advertising

None of our games does this at the moment.

4.8 Notifications

None of our games does this at the moment.

4.9 What we never do

• Sell or rent your data, or share it with data brokers.
• Read your contacts, photos, location, microphone or camera.
• Make automated decisions about you, or build profiles of you (Art. 22 GDPR).
• Make you provide any personal data to play. Every game works without it.

5. Third parties and SDKs

Apple and Google distribute our games and handle downloads, purchases, Game Center and Google Play Games. They do this as independent controllers under their own privacy policies: Apple, Google.

Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) delivers content our games download and protects our server from attacks. It is our processor under Art. 28 GDPR.

Hosting: our servers are run by netcup GmbH, Daimlerstraße 25, 90441 Nürnberg, Germany and Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, both processors under Art. 28 GDPR, in Germany.

No other third-party SDKs that collect data are built into our games: no ad networks, no analytics, no attribution or tracking libraries.

We only use service providers who are contractually bound to protect your data at least as well as this policy describes.

6. Children

Our games can be played by children. Because they collect no personal data for themselves, show no ads and contain no tracking, there is nothing a child could disclose to us by playing. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, for example by email, write to us and we will delete it.

7. Transfers outside the EU

Apple, Google and Cloudflare are based in the USA. Transfers to them are covered by the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which all three are certified, and additionally by the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR).

8. Retention and deletion

• Data on your device: until you delete the game.
• Cloud saves, Game Center, Google Play Games: in your Apple or Google account until you delete them there.
• Crash reports, if a game sends them: 90 days.
• Emails you send us: until your request is settled, then deleted, unless tax or commercial law requires us to keep them (up to 6 or 10 years under § 147 AO, § 257 HGB).

How to delete your data

Since there are no accounts, there is no account to delete. To remove everything a game holds:

1. Delete the game from your device. This removes all local data.
2. Remove cloud saves and game-service data in your Apple ID (Settings → your name → iCloud → Manage Storage) or in Google Play Games (Profile → Settings → Delete Play Games account & data).
3. For anything else, write to us at the address in section 2. We confirm deletion within one month (Art. 12 (3) GDPR).

9. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on legitimate interest, at any time (Art. 21),
• withdraw any consent at any time, with effect for the future (Art. 7 (3)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de .

10. Security

Every connection from our games to our servers is encrypted with TLS. Servers are in Germany, and administrative access is limited to the people who run them, by key only. We keep what we store to the minimum described above, because data that does not exist cannot leak.

11. Changes to this policy

When a game starts doing something this policy does not describe yet, we update this page before the update reaches the stores, and change the date at the top. The previous version is available on request.