Privacy Policy

for the game Chonky Merge (iPhone) · As of 29 September 2026 · Deutsche Fassung

This policy explains what data Chonky Merge processes, why, for how long, and what rights you have.

1. Controller

Steffen Thie, address in the legal notice (Impressum), e-mail: ysth08@gmail.com

2. Your year of birth

The game asks for your year of birth only where it is needed: in the EU, the UK and Switzerland on first launch, before Google asks for your consent to ads (section 6), and everywhere when you create an account (section 4). It stays on your device; we do not receive it. It decides:

• under 16: no account, no gameplay statistics, no consent prompts, limited ads only (section 6);
• 16 and over: an account if you want one, and the consent questions.

We ask because consent is only valid from a certain age (16 in Germany, Art. 8 GDPR) and children are specially protected in many countries.

3. Data on your device

Your progress, settings, your year of birth where given and — if you have an account — its access data are stored on your device. This is strictly necessary for the game (§ 25(2) no. 2 TDDDG). The data only leaves the device as described below and is deleted when you delete the app.

4. Account and server features (from 16, only if you want)

4.1 Account

An account is created only if you create one — through “Back up progress” with Sign in with Apple — and only from 16. It consists only of a random identifier; we know neither your name nor your e-mail address. It is used for the cloud backup, the leaderboard and for assigning purchases. Without an account, the game itself sends nothing to our server. Legal basis: Art. 6(1)(b) GDPR (providing the game).

4.2 Cloud backup

Your game state — progress, scores, in-game currency, unlocked content and redeemed purchases — is stored with your account so it survives a reinstall. Your year of birth, your consents and your device settings are not part of it. Legal basis: Art. 6(1)(b) GDPR.

4.3 Daily board leaderboard

When you play the daily board, we store your score, play time, longest chain and the date. On the leaderboard you appear only under a randomly generated animal name (such as “Cuddly Hedgehog 482”), which you can reroll in the settings — never under your real name. We automatically check entries for plausibility to keep the list fair; obviously manipulated entries are removed. Legal basis: Art. 6(1)(b) GDPR; for the plausibility check, our legitimate interest in a fair leaderboard (Art. 6(1)(f) GDPR).

4.4 Gameplay statistics — only with your consent

When you create an account, the game asks whether you want to send gameplay statistics. If you agree, it sends a few data points: start and end of a session (with duration) and the end of a round (with duration and score), each with a timestamp, the app version and your account's identifier. We use them only to improve the game — for example, to see whether rounds are too short. No sharing, no profile about you, no advertising.

Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the settings under “Privacy & legal”; data points not yet sent are then deleted on the device.

4.5 Sign in with Apple

You create your account with your Apple ID, so your progress survives a reinstall and moves to a new device. Apple (Apple Distribution International Ltd., Cork, Ireland) then sends us only an identifier that is valid for this game alone and a sign-in proof; we do not request your name or e-mail address. The first backup earns you 25 Prisms once. If you delete your account, we also revoke the sign-in with Apple. Legal basis: Art. 6(1)(b) GDPR.

4.6 Servers and hosting

The server features run at Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, as our processor (Art. 28 GDPR). The data is stored in Frankfurt am Main (EU). Where Supabase or its sub-processors can access it from outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses. When your device connects, Supabase necessarily processes your IP address; these logs are deleted after a few days. All connections are encrypted.

5. Purchases

In-game purchases are handled by Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). We never receive payment details. For each purchase, Apple gives us a transaction number, the product and the time — so we can credit the purchase, prevent double credits and detect refunds. If you have an account, we verify Apple's signed receipt on our server and link it to your account; without an account, everything stays on the device. Parents can control purchases through Apple's Family Sharing (Ask to Buy) and Screen Time; refunds are handled by Apple. Legal basis: Art. 6(1)(b) GDPR. Apple's privacy policy applies to the purchase itself.

6. Advertising

Chonky Merge is partly funded by ads: a banner on the title screen, an occasional ad after a round, and videos you start yourself for a reward. Ads are served by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

• Non-personalised ads only. The game does not read the advertising identifier (IDFA) and therefore never asks for permission to track you.
• To deliver ads, limit how often they appear, detect fraud and bill them, Google processes your IP address and device and app information.
• About the consent dialog: it comes from Google and is the same for all apps. It lists every purpose for which Google and its advertising partners ask for consent — including personalised advertising and profiles. Whatever you choose, Chonky Merge requests only non-personalised ads. Your consent mainly allows Google to store and read information on your device, for example to limit how often ads appear, detect fraud and measure ads.
• In the EU, the UK and Switzerland, the game asks for your year of birth on first launch. From 16, Google then asks for your consent before storing or reading information on your device (Art. 6(1)(a) GDPR, § 25(1) TDDDG). No ads load before that. You can change your choice at any time in the settings under “Privacy & legal”.
• Without consent and under 16, Google shows only limited ads, which according to Google store no information on your device for advertising purposes. The legal basis is then our legitimate interest in funding the free game through ads (Art. 6(1)(f) GDPR).
• In other countries, the game shows non-personalised ads for a general audience without asking for your age.
• If we know you are under 13, we additionally mark ad requests as child-directed, and only ads suitable for all ages appear.
• Google may transfer data to the USA; Google is certified under the EU-U.S. Data Privacy Framework. More: policies.google.com/technologies/partner-sites.

7. Retention

• On your device: until you delete the app.
• Account with cloud backup, leaderboard entries and purchase records: until you delete it — after 24 months without use we delete it automatically. The game state on your device is not affected.
• Gameplay statistics: 14 months; immediately together with the account.
• Server logs: a few days.
• Advertising: according to Google's retention periods.

8. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18) and data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent with effect for the future (Art. 7(3)),
• lodge a complaint with a data protection authority (Art. 77), in particular in the country where you live.

Deleting your data: in the game under Settings → “Privacy & legal” → “Delete my data”, you delete your account and all server data immediately; we also revoke the sign-in with Apple. Your game state on the device stays. For anything else, a short e-mail is enough.

9. Children

Chonky Merge is not directed at children. Accounts are available from 16 only; without an account — so always under 16 — we ourselves receive no personal data. We do not knowingly collect personal data from children under 13. Parents who believe we nevertheless hold data about their child can reach us by e-mail — we will delete it promptly.

10. Notes for specific countries

• USA / California: we do not sell personal information and do not share it for cross-context behavioural advertising.
• United Kingdom: you have the rights under the UK GDPR and can complain to the Information Commissioner's Office (ICO).
• Canada: you can request access to and correction of your data and complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.
• Other countries: you have the rights granted by the law of your country. Just write to us.

11. No automated decisions

We make no decisions based solely on automated processing that have legal effects on you, and we do not create profiles about you.

12. Changes

If the game changes, we update this policy. The current version is always available here; we will inform you in the game about significant changes.