punktdev.com

Privacy Policy for Tiny Ship Defense

App and website · Last updated: 24 October 2026 · Deutsche Fassung

1. Controller and principles

This policy applies to the Tiny Ship Defense app, the website tinyshipdefense.punktdev.com and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (Legal notice). Contact: [email protected].

Tiny Ship Defense works without an account. If you want, you can watch short ad videos from Google AdMob and get a reward for it (section 5). You can buy gems in the App Store or on Google Play (section 4). The app contains no other third-party analytics, tracking or crash reporting services. We do not create usage profiles ourselves and we do not make automated decisions within the meaning of Art. 22 GDPR. The game is not aimed at children and teenagers under 16. If you are younger, please do not watch ad videos and do not agree to ads or app tracking.

2. Your progress stays on your device

The app stores your progress (levels, currencies including gems, upgrades, ships, lab, tasks and your daily bonus streak) and your settings for sound effects, music and graphics only on your device, together with a copy of the previous save as a fallback. The save also contains the transaction IDs of your most recent purchases (section 4) and, for the ad videos, today's date and how many videos you have watched today, so that the daily limits apply (section 5). For the daily bonus, the daily limits and the time you spend away from the game, the app uses your device's clock. Outside Europe, the app also remembers your choice in the ad dialog (section 5), separately from your progress, so a progress code does not carry it to another device.

To keep the game running smoothly on your phone, the app measures the frame rate while you play and reads the name of the graphics chip, the display's pixel density and, where available, a rough indication of the memory. From this it picks a suitable graphics level and remembers the result on your device. These values never leave your device.

This storage is necessary for the game (Section 25(2) no. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). The data stays until you clear the app data or uninstall the app. Purchased gems exist only in this save; if you delete it, they are gone and we cannot restore them. Depending on your device settings, operating system backups (iCloud backup or Google backup) may contain a copy; Apple or Google manage these, not us.

Save code: In the settings you can export your progress as a code to take it to another device. The code contains the full save including gems and purchase IDs. The app only copies it to the clipboard or hands it to your device's share menu when you ask it to; where it goes from there is up to you. If you paste a code, it replaces the save on the device. Nothing is sent to us.

3. Internet connection

Tiny Ship Defense does not connect to any server of ours. Graphics, music and sounds are included in the app, and the game also works without internet. The app only uses a network connection for ad videos and Google's consent request (section 5), for purchases through the store (section 4) and when you open a link to these legal pages in the settings. At launch and when you return to the app, it asks the App Store or Google Play for purchases that have not been completed yet. It loads the prices of the gem packs when you open the shop or tap your gems. Without internet there are no videos and no purchases; everything else keeps working.

4. App Store, Google Play and purchases

You download Tiny Ship Defense from Apple's App Store or Google Play. Apple or Google process account, download and, where applicable, payment data under their own responsibility in accordance with their privacy policy (Apple) or privacy policy (Google). For users in the EU, these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be accessible. Depending on your permissions and settings, the platforms may provide technical crash reports. We do not receive full card or bank details through this.

We use personal order, transaction and crash information from the stores only to handle purchase and support questions and to fix errors in the app. The legal basis is Art. 6(1)(b) GDPR for contract-related matters, otherwise Art. 6(1)(f) GDPR; our legitimate interest is a stable app and handling support requests. We delete our own copies once the matter is closed and we no longer need them for legal claims. Data we are required by law to keep is stored on the basis of Art. 6(1)(c) GDPR until the retention period ends.

You buy gem packs directly in the respective store. We do not receive any card, bank or account details. The app receives from the store the product ID, a transaction ID (a purchase token on Android), the purchase status and, depending on the platform, further details about the purchase, such as the purchase date, order number or the signed receipt. It processes these details only on your device. Once the store reports the purchase as paid, the app credits the gems, saves your progress and then completes the purchase with the store. Of these details, it only keeps the transaction IDs of the last 100 purchases in the save on your device, so that no purchase is credited twice. The app only credits pending payments once the store confirms them. Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.

On Android, the app uses the Google Play Billing Library for this. When the app uses the store functions, this library may automatically send technical diagnostic and usage data to Google, such as device and operating system version, app version, network type and the results and errors of store calls. We do not receive this data. Google's processing is governed by Google's privacy policy.

5. Ads with Google AdMob

In Tiny Ship Defense you can voluntarily watch short ad videos and get a reward for it. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is integrated through the software package @capacitor-community/admob, which contains the Google Mobile Ads SDK.

When ads appear: Tiny Ship Defense shows no banners, no ads between levels and no ads at launch. A video only plays when you tap it yourself:

You only get the reward once AdMob confirms it. If you close the video early or none loads, there is no reward. The app only loads a video when you tap it. The app only allows ads with content rating G, that is, ads suitable for all ages.

Request at launch: At every launch the app uses Google's User Messaging Platform (UMP) to ask whether consent is required in your region and what you have chosen so far. This tells the app whether it needs to show the "Ads and privacy" item in the settings. The app repeats this request on the first video of each launch and after you have changed your choice. Google receives your IP address and technical information about the device and app. The app only starts the Google Mobile Ads SDK when you tap a video for the first time and Google reports that ads may be requested. That is the case if you made a choice in the form that allows ads (depending on your choice, possibly only limited ads) or, where no form is required, if you agreed to ad videos in the app's dialog (see “Outside Europe”). The legal basis for this request is Art. 6(1)(f) GDPR; our legitimate interest is to find out whether we need consent and then to obtain it properly.

Consent: When you tap a video for the first time, the app first shows Google's consent form, but only where Google requires it, that is, in the European Economic Area, the United Kingdom and Switzerland. The form follows IAB Europe's Transparency and Consent Framework (TCF). You can consent, not consent, or choose individual purposes and vendors under "Manage options". The SDK stores your choice on your device until you change it or uninstall the app. This storage is strictly necessary so that the app can respect your choice (Section 25(2) no. 2 TDDDG). Storing it as proof is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

What Google processes: For each video, Google processes your IP address (from which your approximate location can be derived), information about the device and app (such as device type, operating system, app version and language) and how you interact with the ad (such as request, playback and click). The purposes are serving the ad, limiting how often you see the same ad, preventing fraud and abuse, and measurement and billing. Depending on the platform and your consent, the SDK also records app launches and other interactions, diagnostic and performance data about the app and SDK, and device identifiers. Google describes the details in the data disclosure for the Google Mobile Ads SDK.

Personalisation: In the European Economic Area, the United Kingdom and Switzerland, personalisation follows your choice in the form. If you consent, Google may select ads based on your interests and may also use data from other apps and websites for this. The legal basis is then your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you do not consent or consent only in part, Google, depending on your choice, serves non-personalised or limited ads or none at all. In that case there is no video and no reward. Even for limited ads, the SDK stores ad material and its own program code in the app's cache to play the video. If the "Programmatic limited ads" feature is active in AdMob, Google may also use local storage without consent to detect invalid traffic, fraud and abuse (Google help on limited ads). Caching is strictly necessary to play the video you explicitly requested (Section 25(2) no. 2 TDDDG). We consider the storage for fraud detection necessary for the same reason, because otherwise we could not protect the reward from abuse; Google leaves this assessment to the app provider. Where Google serves ads without consent, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to be able to give you the reward you asked for without a purchase.

Outside Europe: Outside the European Economic Area, the United Kingdom and Switzerland, Google shows no form. There, the app itself asks the first time you tap a video whether you want ad videos: “Tailored to me”, “General ads only” or “No videos”. The SDK only starts after you agree. With “General ads only”, the app only requests non-personalised ads from Google; Google then uses your data only to deliver ads, to limit repeats, to prevent fraud and for measurement, including with identifiers of your device. With “Tailored to me”, Google may also select ads based on your interests; on iOS this additionally requires your tracking permission (see below). In both cases the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). With “No videos”, the app does not load any ads. The app stores your choice only on your device; you can change or withdraw it at any time under Settings › “Ads and privacy”.

Advertising ID on iOS: If ads may be requested, the app asks on iOS for your permission for app tracking (App Tracking Transparency), outside Europe only if you chose “Tailored to me”, only with the first video for which the request applies, and only as long as you have not decided yet and iOS allows the request. If you allow it, Google receives Apple's advertising identifier (IDFA) and can use it to select and measure ads across other companies' apps and websites. The legal basis is then your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, neither the app nor Google gets the IDFA; you still get videos. You can change your decision at any time on your iPhone under Settings › Privacy & Security › Tracking.

Advertising ID on Android: On Android, the SDK may read Google's advertising ID and the app set ID, an identifier that only applies within one developer's apps. In the European Economic Area, the United Kingdom and Switzerland, this only happens as far as your choice in the form allows. Outside these regions, this only happens if you agreed to ad videos in the app's dialog; with “General ads only”, Google uses them without personalisation, only for the purposes named above. You can reset or delete the advertising ID in the system settings.

Responsibility and third countries: We are responsible for integrating the SDK and the transfer to Google. Google is responsible for any further processing. Depending on the settings in our AdMob account, Google may also pass ad requests to Google-certified ad partners who bid on the video; you can see which providers these are in the consent form under "Manage options" and in Google's list of ad technology providers. These partners may also be located outside the EU; the safeguards that apply to a transfer there (such as an adequacy decision or standard contractual clauses) are named by each partner in its privacy information, which you can reach via the list. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). Ad and consent requests are encrypted via HTTPS. How long Google keeps the data is described under How Google retains data; how Google uses it is described under How Google uses information from sites or apps that use our services and in Google's privacy policy.

Withdrawal and changes: Under Settings › "Ads and privacy" you can reopen the consent form. In Europe, the item appears when Google requires consent and opens Google's form. Outside Europe, it opens the app's dialog. There you can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). Processing that took place on the basis of your consent before the withdrawal remains lawful. If you do not tap any video, the app does not load any ads.

6. Website

The website tinyshipdefense.punktdev.com is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it from disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. So we do not store this data ourselves. Cloudflare processes it for delivery and keeps technical operating and security data only as long as necessary to run and protect the service; details are in Cloudflare's privacy policy.

The website tinyshipdefense.punktdev.com sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and images come from our own server. If you open an external link, such as to a store, that provider's privacy policy applies there.

These legal pages are on punktdev.com, which is also delivered via Cloudflare. There, the page reads a light/dark preference from your browser's local storage, if one has been saved, so that your chosen appearance is kept (Section 25(2) no. 2 TDDDG). Nothing is transmitted to us.

7. Contact by email

If you send us an email, for example to [email protected], it arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email with its content and attachments as a processor on the basis of a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. Microsoft bases transfers to Microsoft Corporation in the USA, for example for support or security, on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

We process your address, the content and any information you provide voluntarily in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. If we are required by law to keep a message, for example as a business letter under Section 257 HGB (German Commercial Code), the basis is Art. 6(1)(c) GDPR. We delete the message no later than twelve months after the request has been dealt with. If it is a business letter, we keep it for six years from the end of the calendar year in which it was received (Section 257(4) and (5) HGB) and delete it afterwards. Providing data is voluntary; without a reply address we cannot answer.

8. Recipients and processing outside the EU

For the purposes described, these recipients receive data:

Apple and Google are independently responsible for the App Store and Google Play (section 4). You can request a copy of the safeguards at [email protected].

9. Your rights

Under the statutory conditions, you have the right to access, rectification, erasure, restriction of processing and data portability, and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR), for ads directly in the app and for app tracking in the iOS settings (section 5). Processing before the withdrawal remains lawful.

Objection: Where we process personal data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing for direct marketing at any time without giving reasons (Art. 21(2) GDPR). Email us at [email protected]. Outside Europe, the app stops loading ads as soon as you choose “No videos” under Settings › “Ads and privacy”. In Europe, the same item opens Google's form; if you decline there, Google may still show limited ads (see “Personalisation”). You stay completely ad-free anywhere if you do not tap a video: without a tap, the app does not load any ads.

You have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Because your progress is stored only on your device, we cannot view it, delete it for you or hand it over. You can do that yourself on your device by clearing the app data or uninstalling the app; you manage backups in the settings of your Apple ID or Google account. Data that Google processes for ads is held by Google; you can also contact Google directly about it.

You are not obliged to provide any data. Without the technically necessary connection data, however, the app cannot load videos or process purchases.

10. Changes and language versions

We update this policy when the app, the website or the law changes. The version published here applies. This is a translation; the German version is authoritative.