Last updated: August 14, 2026
The German version is the authoritative one. This translation is provided for convenience. In case of any discrepancy, the German privacy policy prevails.
The controller within the meaning of the GDPR is:
RegSus Consulting GmbH
Cosimastr. 121, 81925 München, Germany
Email: [email protected]
A data protection officer is not legally required given the company's size (§ 38 BDSG).
When you visit this website, the hosting provider automatically processes information your browser transmits (server log files): page requested and time of access, data volume transferred and status, browser type and version, operating system, referrer URL, and IP address.
The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in operating the website securely and without errors. This data is not merged with other data sources.
Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (server location Helsinki, EU). Cloudflare, Inc. sits in front as a content-delivery and DDoS-protection service, routing requests before they reach our server. We have a data processing agreement under Art. 28 GDPR with both, based on each provider's standard terms.
This website loads all fonts from our own server. There is no connection to Google Fonts or any other external provider, and no IP address is transmitted to third parties.
When you choose a language on the start page, we store that choice locally in your browser (localStorage, key od-lang) so that your next visit lands in your language directly. This information never leaves your device and is not transmitted to us. You can delete it at any time via your browser settings.
No cookies are set, no tracking takes place, and no profiles are built.
The pre-registration buttons link to the Google Play Store. Clicking takes you to Google; from that point, Google's privacy policy applies. We do not transmit personal data to Google ourselves — the connection is created by your click.
If you pre-register on Google Play, Google is the controller for that processing: policies.google.com/privacy
This website itself does not use any analytics or tracking tool. (The app measures usage via Firebase Analytics — see section 3.)
Your progress is stored locally on your device. No registration with an email or password is required to play.
So your progress survives a lost device, the app also backs it up via Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland):
eur3. Access rules ensure only your device can read or write that record.Legal basis is Art. 6(1)(b) GDPR (performing the contract for using the app — not losing progress across devices is part of the expected service).
The app uses two further Firebase services, also from Google Ireland Limited:
Legal basis is our legitimate interest in a working, stable game (Art. 6(1)(f) GDPR).
The app shows ads via Google AdMob (Google Ireland Limited). This may process a device-level advertising ID to serve ads and measure their performance.
On first launch, a consent form (Google User Messaging Platform, UMP) asks whether personalised or only non-personalised ads may be shown. Without your consent, only non-personalised ads are shown. You can withdraw or change your choice at any time via the privacy options in the game menu.
Details on Google's processing, including a possible transfer to the US, are in Google's privacy policy: policies.google.com/privacy and the ad partner list: support.google.com/admob/answer/9012903.
Legal basis for non-personalised ads is our legitimate interest in funding the free game (Art. 6(1)(f) GDPR); for personalised ads, your consent (Art. 6(1)(a) GDPR).
An optional in-app purchase removes the ad break on city transitions (see Clean Money). Purchases are handled entirely through Google Play Billing: Google processes payment data (e.g. payment method), not us. We only receive confirmation from Google that a purchase succeeded, and unlock the content in response.
A rating around 12+ is targeted (no blood, no realism, abstracted game systems). The final rating only results from the IARC questionnaire at store submission. If that means the app (also) targets children, additional requirements apply (Google Play Families Policy, Art. 8 GDPR on children's consent).
You have the right at any time to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interests (Art. 21), and withdraw consent with future effect (Art. 7(3) GDPR).
To exercise these, contact [email protected].
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). Usually this is the authority of your place of residence or the authority responsible for the controller — for us (based in Munich, Bavaria) that is:
Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de
We will update this policy whenever the processing changes — in particular at the store launch, once the final age rating and the consent flow are confirmed against the real build. The current version is always on this page.