Privacy policy

1. Who is responsible

This policy covers pocketpaths.mysnacky.de and the Pocket Paths app (Android package: de.mysnacky.pocketpaths). The controller for the processing we initiate is:

Contact this email or postal address about privacy or your rights. “We” means mySnacky Florian Fritzsche.

2. The short version

• No Pocket Paths account is needed. We do not operate a progress server or our own cloud save.
• Progress and preferences are stored locally. Drawn routes are not saved permanently.
• The app integrates Google AdMob and UMP consent management. Demo and non-personalized ads can still involve personal data.
• This website has no ads, analytics tags, remote fonts, embedded videos or social pixels.
• Email to us is forwarded through Cloudflare to our Gmail inbox.

3. Website & Cloudflare

Cloudflare Pages serves this static website. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Page requests involve IP address, time, requested URL, browser/device information and connection data for delivery and attack prevention.

Our basis is the legitimate interest in secure, available hosting (GDPR Article 6(1)(f)). Cloudflare processes service data on our behalf; its own processing is additionally described in its provider notices. We have no visitor database or independently configured long-term access-log archive.

Technical logs may be retained according to the service, security needs and legal requirements. See Cloudflare’s privacy policy and data processing terms.

Our website code does not set cookies or use local/session storage. Images and styles load from this website. Necessary browser caching and hosting security mechanisms are separate from this. We do not add consent-requiring website tracking.

4. Your local save

The app saves unlocked levels, level stars, hint inventory, daily streak and last daily-puzzle date. Preferences include language, music/effects volume and mute, vibration and colorblind mode. Purchase entitlements and hashes of processed transaction identifiers prevent duplicate rewards.

This file stays in your device’s private app storage; our code does not upload it. Your current route stays in memory only for the current game. Daily puzzles use the device date. Music and sounds are bundled, not supplied by an external music service.

We process these data to provide the requested game functions (GDPR Article 6(1)(b)); necessary device storage is covered by section 25(2)(2) of the German TDDDG. Without storage, progress and settings cannot persist.

Use Settings → “Delete Local Data” or clear the app’s data in Android to reset the save. Unspent purchased hints will be lost. A genuine store purchase of Remove Ads can be restored using the same store account. Google/Apple device backups depend on your operating-system settings, not a mySnacky cloud service.

5. AdMob & consent

The app uses Google Mobile Ads (AdMob) and the User Messaging Platform (UMP). Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is a relevant Google provider for EEA users. Google LLC and service partners may also be involved.

AdMob can process IP address and approximate location derived from it, advertising/device identifiers (including Android advertising ID and app-set ID), ad views, taps and video interactions, plus diagnostics. Purposes include ad delivery, measurement, reliability and fraud prevention. Pocket Paths does not request GPS access. Android includes the SDK’s advertising-ID and Ad Services permissions.

Our code requests non-personalized ads and disables Google’s publisher first-party ID. This does not mean identifiers are never processed. We do not request Apple ATT tracking permission. No additional ad-network SDKs or mediation adapters are integrated. Where Google involves other advertising partners, the available consent form explains their purposes and choices.

UMP refreshes consent status at launch, presents a form where required and permits ad requests only when its status allows them. Consent-requiring storage and processing rely on your consent (TDDDG section 25(1); GDPR Article 6(1)(a)). Without consent, ads may be unavailable or limited where legally and technically permitted. Necessary security and fraud prevention not requiring consent may rely on legitimate interests.

Reopen “Privacy Choices” in Settings when UMP makes this available to change your choices. Withdrawal applies going forward. Android also provides controls to reset/delete the advertising ID. Ordinary puzzle play does not require consent to personalized advertising.

Optional rewarded ads can provide hints. Occasional interstitials are intended only after eligible campaign wins, never while drawing. Remove Ads suppresses forced interstitials, but does not itself switch off the SDK or optional rewarded ads.

Details: Google SDK data disclosure, Google on partner services and Google privacy policy.

6. Stores & purchases

Purchases in Android internal test 0.5.2 are simulated. That version does not initiate paid store purchases. This section describes genuine purchases when enabled in an appropriate release.

Unity In-App Purchasing (IAP 5.3) is prepared for Remove Ads and 10-/35-hint packs, using Google Play Billing on Android or Apple StoreKit on iOS. The store processes account, payment and purchase information under its terms. The app receives product, status, transaction identifier and receipt for fulfillment and validation, not your full card or banking details.

Our code validates receipts locally and stores a SHA-256 transaction-ID hash and fulfillment result. Raw receipts are not written to our save file; there is no custom validation server. The basis is contract performance (GDPR Article 6(1)(b)) and legal obligations for required business records (Article 6(1)(c)).

We do not enable Unity Gaming Services Analytics or separate Unity purchase analytics. Unity IAP is not an advertising network here. Stores can process their own purchase, security and diagnostic data. Local hints and entitlements remain until used or reset. Local deletion does not erase store records subject to legal retention.

Provider information: Google, Apple and Unity. This notice does not announce iOS availability.

7. Diagnostics & testing

Our own event and error outputs are local development logs. Firebase Analytics, Crashlytics, Unity Ads and separate cloud crash reporting are not enabled. AdMob and stores may independently process diagnostics.

Google Play can provide technical or aggregate reports through testing and Android Vitals, and feedback you submit. Screenshots or logs you send us are handled as support requests. Remove personal details not needed to investigate. We use this information for troubleshooting (GDPR Article 6(1)(f)).

8. Contact: Cloudflare & Gmail

Email to florian@mysnacky.de passes through Cloudflare Email Routing to our Gmail inbox. Cloudflare handles sender/recipient addresses, email headers and message content for forwarding and spam prevention. Google stores the delivered email in Gmail. There is no website contact form.

We use your email address, name if supplied, message and attachments to handle the request and necessary follow-up. Our basis is contract-related communication (GDPR Article 6(1)(b)) or our legitimate interest in answering other requests (Article 6(1)(f)).

We retain correspondence while needed for the inquiry, follow-up or related claims. Business/tax records may require statutory retention; otherwise information is deleted when no longer needed. Gmail copies and backup processes also follow Google’s terms. Do not email passwords, full payment details or sensitive personal information.

More: Cloudflare Email Service, Cloudflare privacy, Gmail privacy and Google retention.

9. Recipients & international transfers

Depending on use, Cloudflare receives website/forwarded-email data; Google receives AdMob, UMP, Gmail and Play data; Apple handles store data in an iOS release. Processing outside the EEA, including the US, is possible. We do not promise EU-only processing.

Covered transfers may rely on adequacy decisions such as the EU-US Data Privacy Framework, or standard contractual clauses and safeguards. The applicable basis depends on the service and recipient. See Cloudflare’s terms, Google’s frameworks and Apple’s policy; ask us for applicable safeguards. Deleting your local save does not shorten providers’ independent retention periods.

10. Your rights

Subject to legal conditions, you may request access, correction, deletion, restriction and portability. Withdraw consent for future processing at any time. You may object to legitimate-interest processing on grounds relating to your particular situation.

Contact florian@mysnacky.de. We cannot remotely retrieve or delete a local-only save, but can explain the device controls.

You can complain to a supervisory authority, particularly where you live. Our local authority is the Data Protection Commissioner of Saxony-Anhalt. We do not make solely automated decisions producing legal or similarly significant effects about you.

11. Age & changes

Pocket Paths is intended for a general audience aged 13+, not specifically for children. This does not replace parental authorization where law requires it for consent or purchases. Contact us about suspected unlawful processing of a minor’s information.

We update this policy when services or data flows change. Updating a notice does not replace a necessary legal basis or consent. The date above identifies this version.