Privacy Policy for BayGleam
1. Controller and principle
This policy applies to the BayGleam app, the website baygleam.punktdev.com and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: [email protected].
BayGleam works without an account. The app contains no ads and no third-party analytics, tracking or crash reporting services. What the store integration technically transmits to Apple or Google is described in section 4. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is suitable for all ages but is not specifically directed at children under 13.
2. Your progress stays on your device
The app stores unlocked levels, stars and best scores, diamonds and boosters, lives, the daily bonus, the current round, language and your settings (music, sound, haptics, hints) only on your device, together with the transaction IDs of your purchases (section 4). It also keeps the last 20 technical errors. After a crash you can copy this error list together with the app version and device details to your clipboard yourself, for example to send it to us; nothing is sent automatically.
“Delete progress” in the settings resets your game progress. If a real-money purchase has already been credited, your entire current diamond balance and the purchase identifiers are kept. The language and the error list (at most 20 entries) are not deleted.
This storage is necessary for the game (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). The data remains until you clear the app data or uninstall the app. Depending on your device settings, operating system backups (iCloud or Google) may contain a copy; these are managed by Apple or Google, not by us.
3. Internet connection
BayGleam does not connect to any server of ours. Levels, graphics and music are included in the app, and the game also works without internet. The app only uses a network connection for the store (section 4) and when you open a link to these legal pages in the settings or the shop. On launch, it asks the App Store or Google Play for the prices of the diamond packs and for purchases that have not been completed yet. When you return to the app, it only checks again for purchases that have not been completed yet.
4. App Store, Google Play and purchases
You get BayGleam from Apple's App Store or Google Play. Apple and Google process account, download and, where applicable, payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be available. Depending on your permissions and settings, the platforms may provide technical crash reports. This does not give us full card or bank details.
We use personal order, transaction and crash information from the stores solely to handle purchase and support questions. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR; our legitimate interest is handling support requests. We delete our copies after the case is closed, once they are no longer needed to establish or defend legal claims. Where statutory retention obligations apply, we retain the required data under Art. 6(1)(c) GDPR until those obligations expire.
You buy diamond packs directly in the respective store. We do not receive any card, bank or account data. The app receives the product ID, a transaction ID and the purchase status from the store. Once the store reports the purchase as successful, it credits the diamonds and then confirms the purchase with the store. It stores the transaction ID with your game progress on your device so that no purchase is credited twice. Pending payments are only credited once the store confirms them. Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.
On Android, the app uses the Google Play Billing Library for this. When the app uses the store functions, this library may automatically send technical diagnostic and usage data to Google, such as device and operating system version, app version, network type, and the results and errors of store requests. We do not receive this data. Google's processing is governed by Google's privacy policy.
5. Website
The website baygleam.punktdev.com is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. Cloudflare also processes technical operating data under its privacy policy.
The website baygleam.punktdev.com sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and images are served from our own server. If you open an external link, for example to a store, the privacy policy of that provider applies there. In Safari on iPhone and iPad, the browser shows a banner for the App Store listing based on a tag in the page code. Safari displays this banner itself; the website does not load any scripts or content from Apple for it.
These legal pages are hosted on punktdev.com, which is also delivered via Cloudflare. There the page reads any light/dark preference stored in your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.
6. Contact by email
If you email us, for example at [email protected], the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.
7. Recipients and processing outside the EU
We use these service providers for the purposes described:
- Cloudflare, Inc. (USA): hosting of the website as our processor under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Details are in the Cloudflare DPA.
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365, our email mailbox, as our processor under a data processing agreement (Art. 28 GDPR). Data is generally stored in the EU; transfers to Microsoft Corporation (USA) are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Apple and Google are independently responsible for the App Store and Google Play (section 4). You can request a copy of the safeguards at [email protected].
8. Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future.
Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.
You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Because your game progress is stored only on your device, we cannot view it, delete it for you or hand it over. You can do that yourself in the app or on your device.
9. Changes and language versions
We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.