Privacy Policy for Arrow Atelier
1. Controller and principle
This policy applies to the game Arrow Atelier for iOS and Android and to these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany, represented by its managing director Johann Martens. Email: [email protected], phone: +49 231 58692861. Further details are in the legal notice (Impressum).
Arrow Atelier works without an account. Your progress stays on your device, and our servers receive nothing while you play. The app shows ads from Google AdMob (section 6). It contains no other third-party analytics, tracking or crash reporting services. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is intended for adults aged 18 and over and is not directed at children.
2. Your progress stays on your device
The app stores the following as files in the app's documents folder on your device:
- Game progress: tutorial progress, solved daily puzzles with stars, your streak, coins, hints and your settings.
store.json: whether you bought "Remove ads", purchased coins not yet added to your progress, and the transaction IDs of your most recent coin purchases (at most 50) so that no purchase is credited twice. Once a purchase has been credited, the app removes it from the queue. Older IDs are deleted as new ones are added.ads.json: the date you first opened the app, the time of the last ad and a counter of solved archive puzzles. The app uses these to keep to the ad limits in section 6, so you see fewer ads. The app sends this file neither to us nor to Google. It contains no advertising identifier and only serves our own rules that limit ads.reminder.json: whether the app has already asked for permission to send notifications, the reminder time, and how many daily puzzles you have solved up to which day (section 4).
The app does not send these files to us. The app needs the game progress, store.json and reminder.json so that the game, your purchases and the reminder work (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). ads.json is part of the game as we offer it for free: without this information the app could not keep to the promised gaps between ads (Section 25(2) No. 2 TDDDG). Where personal data is involved, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing ads rarely and only at fixed points. The data remains until you clear the app data or uninstall the app.
Backups: If you have turned on iCloud Backup (iOS) or Android's automatic backup to your Google account, the operating system includes these files. That way your progress carries over to a new device. These backups are managed by Apple or Google under their own terms, not by us. Uninstalling the app does not remove backups that already exist. You delete them in your iCloud or Google settings.
3. Content without a server
All puzzles, images and fonts ship inside the app. The app makes no server requests for game content, not even for new daily puzzles. It only uses an internet connection for ads (section 6), for purchases (section 5) and when you open a link (section 8).
4. Daily puzzle reminder
Once you have solved puzzles on three days, the app asks once whether it may send you notifications. If you allow it, the app schedules local reminders for the daily puzzle on your device, only for days that are still open. We run no push service for this and receive no device identifier. You grant the permission in the operating system and can withdraw it there at any time. The legal basis is Art. 6(1)(b) GDPR.
5. Purchases
In the app you can buy coin packs and, once, "Remove ads". Apple (App Store) or Google (Google Play Billing) handle these purchases, including payment. We do not receive payment data such as card or bank details.
After a purchase the store sends the app a purchase confirmation with a transaction ID and product ID. The app uses it to credit the coins or turn off ads and then confirms the purchase with the store. With "Restore purchases" the app asks the store which purchases belong to your store account and restores "Remove ads". Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.
You get Arrow Atelier from Apple's App Store or Google Play. Apple and Google process account, download and payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Limited, both in Ireland. The stores provide us with aggregated download and sales figures. For purchases we can see individual order and transaction details there, which we use only for purchase and support questions.
6. Ads with Google AdMob
Arrow Atelier is free and is funded by ads. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is integrated through the software package react-native-google-mobile-ads.
When ads appear:
- Rewarded videos only when you tap for one yourself: to continue after losing a round, for a free hint or to double your coins.
- Occasionally a full-screen ad after you solve an older puzzle from the archive. Never after the daily puzzle and never in the first 7 days after you first open the app. At most after every second archive puzzle and no sooner than 4 minutes after the last ad.
The app only allows ads up to content rating PG.
Consent: At start-up the app uses Google's User Messaging Platform (UMP) to ask Google whether consent is required in your region. Google receives your IP address and technical information about the device and app. In the European Economic Area, the United Kingdom and Switzerland the app then shows a consent form based on IAB Europe's Transparency and Consent Framework (TCF). The SDK stores your choice on your device until you change it or uninstall the app. This storage is strictly necessary so that the app can respect your choice (Section 25(2) No. 2 TDDDG). The legal basis for the request to Google is Art. 6(1)(f) GDPR; our legitimate interest is to find out whether we need consent and then to obtain it properly. Storing your choice as proof is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
The SDK may only access information on your device, such as the advertising ID or device storage, to the extent you have consented (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, Google, depending on your choice, serves only limited ads without an advertising ID and without personalisation, or none at all. We have turned off in AdMob the option in which Google uses cookies or local storage for fraud detection even without consent (programmatic limited ads). To play an ad, however, the SDK still stores ad material and its own program code in the app's cache.
Non-personalised ads only: Every ad request from the app asks for non-personalised ads only. Google then does not select ads based on your behaviour in other apps or on websites. Even for non-personalised ads Google still processes data: your IP address, device and app information (such as device type, operating system, app version and language), how you interact with the ad (such as views and clicks) and, where permitted, your device's advertising ID. The purposes are delivering the ad, limiting how often you see the same ad, preventing fraud and abuse, and measurement and billing.
On iOS the app does not ask for permission to track (App Tracking Transparency). Apple's advertising identifier (IDFA) is therefore not available to the app or to Google. On Android you can reset or delete the advertising ID in the system settings.
The app starts the measurement feature of the Google SDK only when the SDK is initialised after the consent request. Where Google serves limited ads without consent, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to offer the game for free. If you have consented, the legal basis is your consent (Art. 6(1)(a) GDPR). Outside the European Economic Area, the United Kingdom and Switzerland the app shows no form. There it also loads non-personalised ads only; the legal basis is then Art. 6(1)(f) GDPR with the same legitimate interest.
Responsibility and third countries: We are responsible for integrating the SDK and for the transmission to Google. Google is itself responsible for any further processing. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). The ad and consent requests are encrypted via HTTPS. How long Google keeps the data and how Google uses it is described in How Google uses information from sites or apps that use our services and in Google's privacy policy.
Withdrawal and changes: Under Settings › "Ads and privacy" you can reopen the consent form where it is required. There you can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). Processing that took place on the basis of your consent before the withdrawal remains lawful.
Remove ads: Once you have bought "Remove ads", the app no longer loads any ads. From the next start it no longer initialises the ads SDK and no longer requests consent. Rewards such as hints or double coins are then granted without a video.
7. Sharing a result
If you share a result, the app creates the image on your device, stores it in the app's cache and opens your device's share sheet. The app replaces the image the next time you share; at the latest it is removed when you uninstall the app. Nothing is sent until you choose a destination. You decide what you send to whom. We receive nothing.
8. Links and these legal pages
The app opens links to the legal pages in a browser window inside the app (SFSafariViewController on iOS, Custom Tabs on Android). As with any page visit, the website receives your IP address and technical request data. For rm-analytics.de the privacy policy there applies.
These legal pages are hosted on punktdev.com. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, delivers them on our behalf (Cloudflare Pages). With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. We do not keep access logs ourselves and do not analyse this data. What Cloudflare itself briefly retains for delivery and security is governed by Cloudflare's privacy policy.
punktdev.com sets no cookies and uses no analytics, tracking or advertising services. If you chose light or dark mode there, the page reads this setting (pdev-theme) from your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.
9. Contact by email
If you email us at [email protected], the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. Where we are legally required to retain a message, for example as a business letter under Section 257 of the German Commercial Code (HGB, usually six years), the legal basis is Art. 6(1)(c) GDPR. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.
10. Recipients and processing outside the EU
- Google Ireland Limited (Ireland) and Google LLC (USA): ads via AdMob and the consent request (section 6), as independent controllers. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).
- Cloudflare, Inc. (USA): hosting of these legal pages as our processor under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Details are in the Cloudflare DPA.
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365, our email mailbox, as our processor under a data processing agreement (Art. 28 GDPR). Data is generally stored in the EU; transfers to Microsoft Corporation (USA) are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Apple and Google are independently responsible for the App Store, Google Play and the handling of purchases (section 5). We only share data with recipients who process it in line with the GDPR and protect it at least as well as described in this policy. You can request a copy of the safeguards at [email protected].
11. Your rights
Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); for ads you can do this directly in the app (section 6). The withdrawal does not affect the lawfulness of processing carried out before it.
Objection: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Your progress is stored only on your device. We therefore cannot view it, delete it for you or hand it over. You delete it by clearing the app data or uninstalling the app. You delete backups in iCloud or your Google account there. Data that Google processes for ads is held by Google; you can also contact Google directly about it.
You are not obliged to provide any data. Without the technically necessary connection data, however, the app cannot load ads or process purchases.
12. Changes and language versions
We update this policy when the app or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.