Privacy⁠

1. Introduction and controller

This privacy policy explains which personal data the mobile game “Scale Match” (“the app”) processes, why it does so, and what rights you have. It applies to the Android version currently published on Google Play. We have deliberately kept data processing to a minimum: there is no user account, no login and no password. The app only connects to our own server in order to store your game progress and transmit pseudonymous usage statistics.

The controller responsible for the processing described here, within the meaning of the GDPR, is the operator of the app. Name, postal address and email address are set out in full in the legal notice.

The email address given there is also the right route for access and deletion requests. Section 8 explains how that works in practice.

No data protection officer has been appointed, as the legal requirements for doing so are not met. Please direct any concerns to the address given in the legal notice.

2. What data we process

The app processes only the data needed to store and verify your game progress and for simple usage statistics. There are five kinds:

• Pseudonymous device identifier (UUID): On first launch, the app generates a random identifier in UUID v4 format on your device. This identifier is not linked to your name, email address or any other identity data. It is, however, not anonymous but pseudonymous: because it stays the same, your device can be recognised on every contact with the server, and the stored progress can be chained into a coherent history. That is precisely why we treat it as personal data. If you delete and reinstall the app, a new UUID is generated.
• Game progress: For every completed level we store the world ID, the level number, the stars achieved (0 to 3) and the time of completion. For Endless mode we store the high score, best structure, number of runs and destroyed bodies, token balance, unlocked and selected designs, and the time of transmission. This information is stored on our server together with your UUID.
• Device and app details: platform (e.g. Android), app version and build number, the time of your first and last server contact, and the time and version of your confirmation of this privacy policy in the welcome dialog.
• Usage statistics: how often you started the app, how long it was open, how much of that time you played, how far you got in the introduction (e.g. “tutorial completed”), and on which days the app checked in, with that day's counters. The values are counted on your device and transmitted under your UUID. We do not record individual moves, taps or location data.
• IP address: When your app contacts our server, your IP address is transmitted for technical reasons. We use it solely to prevent abuse and to rate-limit requests, and it appears in short-lived server logs. The IP address is not stored permanently alongside your game progress and is not analysed in combination with your UUID.

We do not process:

• Real name, email address or phone number
• Precise location or GPS data
• Contacts or address book
• Photos or other media files
• Access to microphone or camera
• Your device's advertising ID
• User account, login or password – Scale Match has none of these

These statements match the “Data Safety” form in the Google Play Store: a device ID, app activity and app information are collected, the data is not shared with third parties, it is transmitted encrypted, and deletion is available on request.

3. What we use this data for

The data described in section 2 is processed for these four purposes only:

• Synchronising progress: So that your level progress does not exist only within the current session but is available again the next time you start the app.
• Preventing cheating: Completed levels are verified server-side. Without a stable identifier and a server-side copy of your progress, the saved game on the device could be manipulated at will.
• Enabling restoration: So that progress you have earned can be restored later.
• Improving the game: So that we can see where players drop out of the introduction, which app versions are in use and whether an update causes problems.

Advertising is currently not used.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. We analyse the usage statistics only to improve the game, not to evaluate you or make decisions about you.

4. Legal basis

We process the pseudonymous identifier, the game progress, the device and app details, the usage statistics and the IP address on the basis of our legitimate interest under Art. 6(1)(f) GDPR.

Our legitimate interest is in offering a functioning game: progress should be preserved, manipulation should be detectable, the server should be protected against abuse, and we want to make the game easier to understand. Your interests stand against this. We have weighed them and kept the processing as limited as possible – no identity data is collected, the identifier is generated on your device rather than assigned centrally, and the statistics contain only counters rather than individual moves. On that basis, we consider that your interests do not override ours. You nevertheless have the right to object to this processing at any time (see section 7).

Providing this data is neither a statutory nor a contractual requirement. It is, however, technically necessary in order to store, verify and restore progress on the server side.

The confirmation in the welcome dialog serves as a notice of this policy; it is not consent. There is no advertising, no third-party analytics and no tracking.

5. Recipients and hosting

Your data is not shared with third parties, not sold, and not used for advertising purposes. The app integrates no third-party analytics SDKs, no ad networks and no tracking services.

The server storing your UUID, game progress and usage statistics is our own backend built with Symfony. It runs self-hosted in Docker containers (managed via Coolify) on servers in Germany.

Processor: a provider of server infrastructure, hosting the servers in a data centre in Germany. It processes the data solely on our instructions, under a data processing agreement pursuant to Art. 28 GDPR, and does not use it for its own purposes.

The connection between app and server is encrypted (HTTPS/TLS). Server access is restricted to the operator. We apply appropriate technical and organisational measures to protect the data against unauthorised access, loss and misuse.

6. How long we keep data

Your level progress stays stored for as long as you keep playing. If your device does not contact our server for three months, we delete the corresponding record automatically. Please note what this means: if you pause for longer than three months, your progress is gone for good and cannot be restored. Independently of that, you can request deletion yourself at any time (section 8). The usage statistics are deleted together with your saved game.

The same period resolves a case we could not otherwise handle: if you delete and reinstall the app, you get a new UUID. The old record can then no longer be attributed to anyone – not even to you, because you no longer have the old UUID. It does not sit there forever, though: after three months without server contact it falls under the same automatic deletion.

Server logs containing IP addresses are deleted after three months.

If you uninstall the app, all data stored locally on your device is removed immediately – including the UUID. The record on the server initially remains and is deleted automatically after three months without server contact. If you want it gone sooner, section 8 explains how to request that.

7. Your rights

As a data subject you have the following rights under the GDPR. Section 8 explains how to exercise them in practice.

• Access to the data stored under your UUID (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your stored progress (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability, i.e. receiving your data in a common format (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one where you live, where you work, or where the alleged infringement took place. For us, the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach is responsible.

One honest note: under Art. 11 GDPR we are not obliged to collect additional data purely in order to identify you for the purpose of these rights. Without your UUID we simply cannot attribute a record to you – we would not know which of many pseudonymous entries is meant.

8. Access and erasure in practice

Because all we hold about you is a pseudonymous UUID, that UUID is the key to your rights. The app therefore displays your UUID directly, so that you can identify your device to us unambiguously.

Send us a message at the email address given in the legal notice and include your UUID. Let us know whether you want information about the stored data or its deletion. Without the UUID we cannot match your request to a record.

For a deletion request we remove the corresponding record completely and irreversibly, within 30 days at the latest. As we keep no backup copies, the record then exists nowhere any more. Access requests are answered within the same period. Both are free of charge for you.

Please note: once deleted, the progress is gone and cannot be restored. Also keep your UUID safe – anyone who knows it can request information about the associated game progress.

9. Use outside the EU

Scale Match is available internationally via Google Play. Regardless of where you are, your data is processed on our servers in Germany. We do not transfer data to third countries outside the European Economic Area.

So if you use the app from outside the EU, your data is transferred into the EU and processed there according to GDPR standards. Depending on your country you may have additional rights under your local data protection law; for those, please also use the contact address in the legal notice.

Distribution of the app itself happens through the Google Play Store. Google, not we, is responsible for the data processing connected with your store account and the download. Google's privacy terms apply to that.

10. Children and young people

Scale Match is not specifically directed at children. The age rating stated in the Google Play Store applies: rated for ages 0 and up (USK 0). Since the app neither collects identity data nor serves advertising, no data other than that described in section 2 is processed for younger players either.

Parents and guardians can request deletion of the progress at any time via the route described in section 8.

11. Changes to this policy

If the app changes and processes different data as a result, we will update this policy. The version published here is always the authoritative one; the date at the bottom of the page shows how current it is.

For material changes – for instance if advertising, analytics tools or sharing with third parties were added in future – we will additionally point this out in the app or in the store listing before the change takes effect.