Deutsch · English · Türkçe · Français · Italiano · Español
Privacy Policy
1. Controller
The controller responsible for data processing is:
UYDesign
Owner: Umut Yavuz
Unterer Markt 8
95469 Speichersdorf
Germany
Phone: +49 156 78999915
Email: hello@stickyleap.de
We have not appointed a data protection officer because there is no legal obligation to do so. For any questions about data protection, you can reach us at the email address above.
2. The key points in brief
- You do not need an account. We do not ask for your name, email address, location, contacts or photos.
- Your game progress (high score, coins, clothing, settings) is stored on your device.
- For the leaderboard, our server stores a random player ID, your freely chosen player name (a pseudonym), your high score and your outfit. Name, score and outfit are visible to other players.
- The app shows ads from Google AdMob. In the EU/EEA, the United Kingdom and Switzerland, we ask for your consent first. On iOS, Apple additionally asks whether you allow tracking.
- For "Duel with a friend", a connection is established between two devices; IP addresses are briefly visible during this (details below).
- We do not use any analytics, tracking or crash reporting services of our own.
3. Game progress on your device
What is stored? High score, coins, purchased and worn clothing, unlocked features, tutorial progress, your settings (e.g. sound, language, display), your player name, the randomly generated player ID together with the access key for the leaderboard, and whether you have bought "Ad-free". The data is stored in the app's local storage on your device. For safety, a copy is kept in the device's native app storage so that your progress is not lost if the system clears the browser storage.
Why? So that the game works and your progress is kept.
Legal basis: Art. 6(1)(b) GDPR (provision of the game). Access to your device is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)); consent is not required for this.
Deletion: Via "Settings → Delete account" or by uninstalling the app.
4. Leaderboard and player ID (our server)
What happens? As soon as you open the leaderboard for the first time (it is unlocked after your first round) and have confirmed the notice shown there with "Got it", the app creates an entry on our server (stickyleap.de); until then, no leaderboard data is sent to our server. After that, changes are transmitted automatically (new high score, changed name, changed outfit, changed visibility). The following is stored:
- a randomly generated player ID (no link to your device or to you as a person),
- a random secret access key – stored on the server only as a hash (SHA-256), so that nobody else can change your entry,
- your player name (default "Player", you can change it; letters and digits only, a maximum of 16 characters),
- your high score and the time when you achieved it,
- the outfit you are wearing (a selection from the game items),
- the setting whether you want to be visible in the leaderboard,
- where applicable, a block flag if we had to block an entry because of misuse.
We do not collect real names, email addresses, location data or device identifiers. Because the player ID and the name can be linked to a person (e.g. by you yourself), we treat them as personal data.
Who can see this? As soon as your score is greater than 0 and you are visible, the leaderboard shows all players your name, your score, your rank and your outfit. So do not choose a name that identifies you (no real name, no contact details). Via "Settings → Show in leaderboard" you can hide yourself at any time; your entry will then no longer appear to others and will not count towards their ranks.
Name filter and blocking: Player names are automatically checked in the app and on the server for insults, hate symbols and contact details. Unsuitable names are rejected or shown in the leaderboard as "Player". Anyone who misuses the leaderboard (e.g. manipulated scores via direct server requests) can be blocked; a blocked entry is no longer shown to others. No automated decision with legal effect takes place; blocks are reviewed and set manually by us.
Legal bases: Art. 6(1)(b) GDPR (provision of the leaderboard as a feature of the game). For the name filter, misuse protection and blocking: Art. 6(1)(f) GDPR (legitimate interest in a fair game free of insults and in the security of the service).
Deletion: You can delete your entry yourself at any time: "Settings → Delete account". This removes your leaderboard entry from the server and resets your game progress on the device. If we have blocked an entry, it remains stored even after an attempt to delete it (not publicly visible), so that the block cannot be circumvented by deleting and creating a new entry; the basis for this is our legitimate interest in a game free of misuse (Art. 6(1)(f) GDPR). We lift the block on request once the reason no longer applies, and then delete the entry. In addition, we review the data at least once a year and delete entries whose last high score is more than 24 months old; if you set a high score again after that, the entry is created anew. You can also request deletion by email to hello@stickyleap.de (please state your player name and high score).
5. Server access and hosting
Our website and the server for the leaderboard and event times are hosted by Plambee.de Webhosting (Denis Ardelmann), Germany. We have a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.
Server logs. Each time the server is accessed (leaderboard, event times, website), the web server processes technically necessary data, in particular your IP address, date and time, the requested address, the server's response and information about the program or device (user agent). The app accesses the server, for example, at startup (event times, leaderboard sync) and when you open the leaderboard.
Misuse protection. To prevent anyone from overloading the server, our server counts the write requests per minute for each connection. For this, only a shortened hash of the IP address is stored together with timestamps and removed again after one minute at the latest.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the operation, stability and security of the server). Storage period: The hosting provider automatically deletes server logs after a short time in accordance with its own rules (usually after a few days to weeks).
The website itself does not use cookies and does not embed any external scripts, fonts or trackers.
6. Advertising (Google AdMob)
What is shown? A banner in the main menu, full-screen ads between individual rounds and optional videos to continue playing (rewarded video). If you have bought "Ad-free", banners and full-screen ads are removed; the optional video remains optional.
Who processes data? The ads are delivered by Google AdMob (for the EEA and the United Kingdom: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; otherwise Google LLC, USA). For this, we integrate the "Google Mobile Ads SDK". Google may process the following: your IP address (from which an approximate location can be derived), device identifiers (e.g. advertising ID, on iOS the IDFA, on Android the Android advertising ID), data about ads shown and interactions (e.g. taps, video views) and diagnostic and performance data. The purposes are delivering and billing ads, measuring and improving advertising, fraud prevention and – if you consent – personalised advertising. Google explains how it processes data from apps that use its services here: policies.google.com/technologies/partner-sites. General privacy information: policies.google.com/privacy.
Consent. In the EU/EEA, the United Kingdom and Switzerland, the app shows a consent request at startup (Google "User Messaging Platform"). Without your consent, no ads are requested there. On iOS, Apple first asks whether the app may "track" you across apps and websites owned by other companies (App Tracking Transparency). If you decline, Google cannot use the advertising ID (IDFA).
Legal basis: Art. 6(1)(a) GDPR (consent) and Section 25(1) TDDDG (access to your device). Outside the regions mentioned, ad delivery is governed by the rules applicable there.
Withdrawal. You can withdraw or change your consent at any time with effect for the future: in the app under "Settings → Change ad consent" (visible where Google requires this option), as well as on iOS under "Settings → Privacy & Security → Tracking" and on Android under "Settings → Google → Ads" (reset or delete advertising ID). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Third country. Google may also transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); in addition, Google uses standard contractual clauses.
7. Duel with a friend
The duel works via a direct connection between your device and your friend's device (WebRTC, "PeerJS" software). It is only established when you start a duel or follow an invitation.
- Signalling: To establish the connection, the app contacts the freely available PeerJS signalling service (0.peerjs.com). This involves processing your IP address, a random connection ID and the six-character room code. According to the operator, this data is held only in the server's memory and is removed approx. 60 seconds after the last contact.
- Connection assistance: To determine a reachable address, the software uses a STUN service from Google (stun.l.google.com) and – if a direct connection is not possible – a relay server of the PeerJS service (turn:…turn.peerjs.com; based on the server names, in the EU and in the USA). Your IP address is visible there too.
- Your opponent, for technical reasons, sees your IP address and receives your game position, score, player name and outfit during the duel.
Legal basis: Art. 6(1)(b) GDPR (the duel feature you requested). Third country: The operator of the PeerJS service does not provide binding information on the server location; processing outside the EU/EEA (e.g. USA) is possible. Google LLC is DPF-certified (see above). If you do not want this, do not use the duel feature; the rest of the game does not depend on it. The connection is closed when the duel ends or you leave it.
Protection from strangers: The first time you open the duel, the app points out this exchange of data. Room codes have six characters, and the host must confirm a joining player before the duel starts.
8. "Ad-free" purchase
The purchase is handled by Apple (App Store) or Google (Google Play). We do not receive any payment or account data. Using the respective store's interface, the app only checks whether you have bought "Ad-free" (also with "Restore purchases") and stores this information on your device in order to hide ads and unlock the purchased features. The privacy policies of Apple or Google apply. Legal basis: Art. 6(1)(b) GDPR.
9. Cloud backup of your game progress
iOS (iCloud): If you turn on "Cloud backup" in the settings (off by default), the app stores your high score, coins, purchased items, outfit, player name and leaderboard ID together with the access key in your own iCloud storage, so that they are available again after reinstalling or on a new device with the same Apple ID. The data is held by Apple in your iCloud account and we cannot see it. When you turn it off, the copy in iCloud is deleted. Legal basis: Art. 6(1)(a) GDPR (your consent by turning it on) or point (b).
Android: The app allows Android's standard backup ("Auto Backup"). If device backup is enabled in your Google account, Android may back up app data in accordance with Google's rules. You control this in the Android settings under "Google → Backup".
10. External links
Via "Settings → Privacy/Legal notice", the app opens our pages in your device's browser. The website's privacy rules then apply (section 5).
11. Contact by email
If you write to us, we process your email address and the content of your message in order to handle your request (Art. 6(1)(f) GDPR, or point (b) if it concerns the game contract). We delete them as soon as the request has been dealt with and no statutory retention obligations prevent this.
12. Overview of recipients and third countries
- Hosting provider (processor): Plambee.de Webhosting, Germany.
- Google (AdMob, STUN service): Google Ireland Limited (EEA/UK) and Google LLC (USA, DPF-certified).
- Apple and Google as operators of the app stores, payment processing and iCloud or Android backup (each as an independent controller).
- PeerJS service (signalling and relay for the duel, location not stated bindingly).
- Your opponent in the duel (for technical reasons: IP address, name, outfit, game position).
- All players of the leaderboard (name, score, rank, outfit) – only if you are visible.
We ourselves do not pass on your data for advertising purposes; ads are delivered by Google (see section 6).
13. Overview of storage periods
- Game progress on the device: until you reset it via "Delete account" or uninstall the app.
- Leaderboard entry: until you delete it (in the app or by email), at the latest 24 months after your last high score (annual clean-up). Blocked entries: until we lift the block.
- Server logs: briefly with the hosting provider (see section 5). Misuse protection counter: less than one minute.
- Duel signalling: according to the operator, approx. 60 seconds in memory.
- Advertising: in accordance with Google's rules (see section 6).
- iCloud copy: until you turn off cloud backup.
14. Your rights
Under the GDPR, you have the following rights, provided the respective conditions are met:
- access to your stored data (Art. 15),
- rectification of incorrect data (Art. 16),
- erasure (Art. 17) – in the app under "Delete account" or by email,
- restriction of processing (Art. 18),
- data portability (Art. 20),
- objection to processing that we base on legitimate interests (Art. 21). You can object at any time on grounds relating to your particular situation.
- withdrawal of consent at any time with effect for the future (Art. 7(3)), e.g. for advertising (see section 6).
To exercise these rights, write to us at hello@stickyleap.de and state your player name and your high score so that we can find your entry. Because we do not store real names, we can only provide information if you can show us that the entry belongs to you (e.g. by stating your name, high score and outfit; if in doubt, we will ask you to give us the ID from the app).
Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (Bavarian State Office for Data Protection Supervision), Postfach 1349, 91504 Ansbach (street address: Promenade 18, 91522 Ansbach), email: poststelle@lda.bayern.de, online complaint form. You can also contact the authority where you live.
15. Obligation to provide data, automated decision-making
You are not obliged to provide personal data. Without the leaderboard data, you can play the game offline; the leaderboard and the duel are then not available. Without consent, the app does not show ads in the regions mentioned, which does not restrict the game. We do not carry out any solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR. (As part of advertising, Google may create profiles for personalised ads if you consent.)
16. Children and young people
The app is intended for people aged 16 and over. If you are younger, please only use the app with the consent of your parents or legal guardians; in particular, consent to personalised advertising is then not valid without their approval. If you notice that a child has provided data, write to us and we will delete it on request.
17. Security and changes
The connection to our server is encrypted via HTTPS. Access keys are only stored as a hash. We update this policy when the game or the legal situation changes; the current date is shown at the top. You can find the current version in the app under "Settings → Privacy" and at stickyleap.de/datenschutz.html.