punktdev.com

Privacy Policy for Pumlet Orbit

App · Last updated: 12 October 2026 · Deutsche Fassung

1. Controller and principle

This policy applies to the game Pumlet Orbit for iOS and Android and to these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany, represented by its managing director Johann Martens. Email: [email protected], phone: +49 231 58692861. Further details are in the legal notice.

Pumlet Orbit works without an account. Your progress stays on your device, and our servers receive nothing while you play. We run no server of our own for the app and no cloud storage for game progress. Operating system backups may still contain app data (section 2). If you choose to, the app can show video ads from Google AdMob (section 5). It contains no other third-party analytics, tracking or crash reporting services. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is not directed at children under 13. If you are under 16, you may only consent to ads (section 5) with your parents' permission.

2. Your progress stays on your device

The app stores the following in an SQLite database in the app's private storage on your device:

The app calculates on your device how much you earned while it was closed, using these timestamps. The app does not send the database to us. It needs this information so that the game, your settings and your purchase work (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR).

Deleting: Settings › "Delete progress" resets your game progress. Your settings and the "Bonuses without ads" status are kept. To delete everything, clear the app data or uninstall the app.

Backups: If you have turned on iCloud Backup (iOS) or Android's automatic backup to your Google account, the operating system includes the database. That way your progress can carry over to a new device. These backups are managed by Apple or Google under their own terms, not by us. Uninstalling the app does not remove backups that already exist. You delete them in your iCloud or Google settings.

3. Content without a server

Graphics, sounds and fonts ship inside the app. The app makes no server requests for game content. It sends no notifications, uses neither the microphone nor the camera nor your location, and has no sharing feature. It only uses an internet connection to talk to the App Store or Google Play (section 4), for video ads (section 5) and when you open a link (section 6).

4. Purchase "Bonuses without ads"

In the app you can buy "Bonuses without ads" once. Apple (App Store) or Google (Google Play Billing) handle the purchase, including payment. We do not receive payment data such as card or bank details.

Every time the app starts, it connects to your device's store and loads the current price so it can show it in the settings in your currency. If you have not yet unlocked "Bonuses without ads", it also asks whether such a purchase already belongs to your store account and restores it if so. The same happens when you tap "Restore purchases". After a purchase the store sends the app a purchase confirmation. The app confirms the purchase with the store and only stores on your device that "Bonuses without ads" is unlocked. Nothing is sent to a server of ours. For the purchase, its confirmation and restoring it, the legal basis is Art. 6(1)(b) GDPR. For loading the price it is Art. 6(1)(f) GDPR; our legitimate interest is showing you the correct price before you buy.

You get Pumlet Orbit from Apple's App Store or Google Play. Apple and Google process account, download and payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Limited, both in Ireland. The stores provide us with aggregated download and sales figures. For purchases we can see individual order and transaction details there. This information comes from Apple or Google (Art. 14 GDPR). We use it only for as long as a purchase or support question requires (Art. 6(1)(b) GDPR). We keep the stores' statements as accounting records for eight years (Section 257 HGB, Section 147 AO; Art. 6(1)(c) GDPR).

5. Video ads with Google AdMob

Pumlet Orbit is free. You can get some bonuses in exchange for a short video ad. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is integrated through the software package react-native-google-mobile-ads.

When ads appear: only as rewarded videos and only when you tap for one yourself. There are two places for this: to double what you earned while the app was closed, and for a "Boost", which is 15 minutes of double production. The app shows no banners and no full-screen ads in between. It only allows ads up to content rating PG.

Consent: At start-up the app uses Google's User Messaging Platform (UMP) to ask Google whether consent is required in your region. Google receives your IP address and technical information about the device and app. In the European Economic Area, the United Kingdom and Switzerland the app then shows a consent form based on IAB Europe's Transparency and Consent Framework (TCF) when needed: at the first start and again when Google requires a new choice, for example because the old one has expired. The SDK stores your choice on your device until you change it or uninstall the app. This storage is strictly necessary so that the app can respect your choice (Section 25(2) No. 2 TDDDG). The legal basis for the request to Google is Art. 6(1)(f) GDPR; our legitimate interest is to find out whether we need consent and then to obtain it properly. Storing your choice as proof is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. Only after this request, and only if Google then allows ads, does the app initialise the ads SDK. The SDK's measurement feature also starts only then.

For storage on and access to your device that is not strictly necessary, such as access to the advertising ID, the SDK needs your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, Google, depending on your choice, serves only limited ads without an advertising ID and without personalisation, or none at all. We have turned off in AdMob the option in which Google uses cookies or local storage for fraud detection even without consent (programmatic limited ads). Solely to play a video, the SDK still stores ad material and its own program code in the app's cache. Without these files the video you chose could not be played (Section 25(2) No. 2 TDDDG).

Non-personalised ads only: Every ad request from the app asks for non-personalised ads only. Google then does not select ads based on your behaviour in other apps or on websites. Even for non-personalised ads Google still processes data: your IP address, device and app information (such as device type, operating system, app version and language), how you interact with the ad (such as views, clicks and whether you watched the video to the end) and, where permitted, your device's advertising ID. The purposes are delivering the ad, limiting how often you see the same ad, preventing fraud and abuse, and measurement and billing. The app preloads a video as soon as the SDK is ready so that it starts without delay when you tap. This preload request therefore reaches Google even if you never watch a video.

On iOS the app does not ask for permission to track (App Tracking Transparency). Apple's advertising identifier (IDFA) is therefore not available to the app or to Google. On Android you can reset or delete the advertising ID in the system settings.

Where Google serves limited ads without consent, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to offer the game for free. If you have consented, the legal basis is your consent (Art. 6(1)(a) GDPR). Outside the European Economic Area, the United Kingdom and Switzerland the app shows no form if Google does not require consent there. There, too, it requests non-personalised ads only. Google may then, however, use your Android device's advertising ID, for example to limit how often you see the same ad, and store data in the app's storage, to the extent the rules applicable to this processing allow this without consent. For the transmission to Google the legal basis is Art. 6(1)(f) GDPR with the same legitimate interest.

Responsibility and third countries: We are responsible for integrating the SDK and for the transmission to Google. Google is itself responsible for any further processing. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). The ad and consent requests are encrypted via HTTPS. How long Google keeps the data and how Google uses it is described in How Google uses information from sites or apps that use our services and in Google's privacy policy.

Withdrawal and changes: Where Google requires it, the app shows an "Ad consent" row in the settings. There you can reopen the consent form and withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). Processing that took place on the basis of your consent before the withdrawal remains lawful.

Bonuses without ads: Once you have bought "Bonuses without ads", the app shows no more videos and you get the bonuses right away. If the app already knows about the purchase at start-up, because it is stored or has just been restored, it requests no consent and does not initialise the ads SDK. If you buy while playing, this applies from the next start.

6. Links and these legal pages

The app opens the links to the privacy policy and the legal notice in your default browser outside the app. As with any page visit, the website receives your IP address and technical request data. What your browser itself processes is governed by its provider's terms.

These legal pages are hosted on punktdev.com. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, delivers them on our behalf (Cloudflare Pages). With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. We do not keep access logs ourselves and do not analyse this data. What Cloudflare itself briefly retains for delivery and security is governed by Cloudflare's privacy policy.

punktdev.com sets no cookies and uses no analytics, tracking or advertising services. If you chose light or dark mode there, the page reads this setting (pdev-theme) from your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.

7. Contact by email

If you email us at [email protected], the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. Where we are legally required to retain a message, for example as a business letter under Section 257 of the German Commercial Code (HGB, usually six years), the legal basis is Art. 6(1)(c) GDPR. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.

8. Recipients and processing outside the EU

Apple and Google are independently responsible for the App Store, Google Play and the handling of purchases (section 4). We only share data with recipients who process it in line with the GDPR and protect it at least as well as described in this policy. You can request a copy of the safeguards at [email protected].

9. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); for ads you can do this directly in the app (section 5). The withdrawal does not affect the lawfulness of processing carried out before it.

Objection: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Your progress is stored only on your device. We therefore cannot view it, delete it for you or hand it over. You delete it in the app under Settings › "Delete progress", or together with all other app data by clearing the app data or uninstalling the app. You delete backups in iCloud or your Google account there. Data that Google processes for ads is held by Google; you can also contact Google directly about it.

You are not obliged to provide any data. Without the technically necessary connection data, however, the app cannot load video ads or process purchases. You can play without an internet connection.

10. Changes and language versions

We update this policy when the app or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.