Hangstone Privacy Policy: App and Website

This privacy policy covers the iOS app “Hangstone” (the “app”) and the website hangstone.app with all its pages (Section 8). Deutsche Fassung: hangstone.app/datenschutz

1. Controller

Malte Schmidt
Rosenbergstraße 51, 70176 Stuttgart
Germany
Email: hangstonegame@gmail.com

I have not appointed a data protection officer because I am not legally required to.

2. Summary

You do not need an account. I run no servers of my own for the app and use no analytics or tracking tools of my own.
The app is free and funded by ads from Google AdMob. Through AdMob, AppLovin can also deliver ads, and possibly Unity Ads in the future (Section 4.1). These providers process data about your device to do so. In the EU, EEA, UK and Switzerland you only get personalized ads if you consent.
A one-time in-app purchase (“Remove Ads”) turns ads off. After that, the app no longer starts the ad software.
Your balance of chisels and Sky Charges (optional in-app purchases and gifts) is stored on your device and, if you use iCloud, in your iCloud account, so it is the same on all your devices. I have no access to it (Section 6.2).
Game Center is optional and run by Apple.
You can change or withdraw your consent at any time in the app under Settings > Privacy options.
The website hangstone.app uses no cookies and no tracking. It is hosted by Cloudflare (USA), which processes the access data technically needed to deliver it, such as your IP address (Section 8).
If you email me, your message is stored in my mailbox at Google (Gmail) (Section 9).

3. Data that stays on your device

The app stores on your device: your game progress and current run, best scores and statistics, settings (sound, haptics, theme, etc.), counters for ad frequency (e.g. number of runs and sessions, time of the last ad), whether you bought “Remove Ads”, your balance of chisels and Sky Charges with its bookings (Section 6), how many free chisels you have already received today, and your consent choices. In addition, the keychain of your device holds a random device marker (a random value with no link to you). It only tells whether the app runs on another device after a data transfer, so that the balance entries of two devices do not get mixed up.

This data is not transmitted to me. Storing it is strictly necessary for the features you use (Section 25(2) no. 2 of the German TDDDG). Deleting the app deletes it, except for the copy of your balance in your iCloud account (Section 6.2) and the device marker in the keychain, which iOS does not always remove when an app is deleted; it never leaves your device and is useless without the app.

4. Advertising

4.1 Providers

Google AdMob and the Google User Messaging Platform (UMP): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy. How Google uses information from apps that use its services: policies.google.com/technologies/partner-sites
AppLovin (bids for ad slots through AdMob mediation): AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA. AppLovin has appointed Prighter Group as its representative in the EU and UK (Art. 27 GDPR). Privacy policy: legal.applovin.com/privacy
Unity Ads (possible in the future, not yet integrated in the current app version, see below): Unity Technologies SF, 116 New Montgomery Street, Suite 200, San Francisco, CA 94105, USA. EU contact: Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark. Privacy policy: unity.com/legal/game-player-and-app-user-privacy-policy

With “mediation”, Google AdMob asks several ad networks for each ad. The network with the best bid serves it, so AppLovin also receives the data listed below. Unity Ads is already named as a partner in the consent message, but it is not yet integrated in the current app version and currently receives no data. If I integrate Unity Ads in an update, Unity will bid for ad slots through AdMob mediation like AppLovin and will then also receive the data listed below; the statements about Unity in Sections 4.2, 4.6 and 16 apply from that update on.

Responsibility: I am responsible, where applicable jointly with the respective provider, for integrating the ad software into the app and for the collection and transmission of data to the providers that this causes. Each provider is solely responsible for what it does with the data afterwards.

4.2 What data is processed

Depending on your consent and settings, the ad providers process in particular:

Device identifiers: your device’s advertising identifier (IDFA, only if you allow tracking, see Section 5) and app- or developer-scoped identifiers (e.g. IDFV);
IP address and the approximate location derived from it (e.g. country or city; no GPS);
Device and app information: device model, operating system and version, language, screen size, connection type, app version;
Advertising and usage data: which ads were shown, viewed or tapped, video plays, interactions with the app;
Purchase information (only once Unity Ads is integrated): Unity states that it collects information about in-app purchases for advertising and analytics;
Diagnostic and performance data of the ad software: e.g. load times, energy use, crashes;
Consent information: your choices in the consent dialog (IAB TCF string, Google’s “Additional Consent”, US privacy signals).

From the ad providers I only receive aggregated reports (e.g. number of impressions, revenue per country). They do not allow me to identify you.

4.3 Purposes

To serve and bill ads, limit how often you see them, prevent fraud and abuse, and measure reach and ad performance. Only with your consent: personalized ads, i.e. ads selected on the basis of a profile built from data from other apps and websites.

4.4 Legal bases (EU, EEA, UK, Switzerland)

Storing and accessing information on your device by the ad software (e.g. advertising ID, device identifiers), personalized ads and ad measurement: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Storing your consent choice on your device: Section 25(2) no. 2 TDDDG and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent).
If you decline, you get no personalized ads. Google then only serves limited ads (“Limited Ads”). Processing that is permitted for this and for fraud prevention without consent is based on my legitimate interest in funding the free app and preventing abuse (Art. 6(1)(f) GDPR).

4.5 Consent dialog (Google UMP, IAB TCF)

If you are in the European Economic Area, the United Kingdom or Switzerland, the app shows a consent dialog from Google after your first run (the first launch starts with a short tutorial). You can consent, decline, or choose individual purposes and vendors. The app only starts the ad software after this dialog. If you decline, you can still play the full game.

Withdrawing or changing consent: at any time in the app under Settings > Privacy options. This item appears where consent or an opt-out right applies in your region. Withdrawal applies to the future.

4.6 International transfers

The ad providers may transfer data to the USA and other countries outside the EU.

Google LLC and AppLovin Corporation are certified under the EU-U.S. Data Privacy Framework (checked on 9 November 2026 at dataprivacyframework.gov/list). The European Commission’s adequacy decision applies to them (Art. 45 GDPR). Both are also listed for Switzerland (Swiss-U.S. DPF) and the UK (UK Extension).
Unity Technologies (only once Unity Ads is integrated, see 4.1) is not listed there. According to Unity, it relies on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.7 Retention

The ad providers keep data according to their own retention periods (see their privacy policies; for Google also policies.google.com/technologies/retention). Your consent choice stays on your device until you change it or delete the app.

4.8 Remove Ads

Once you buy “Remove Ads”, the app stops loading ads immediately and no longer starts the ad software from the next launch on. It also no longer shows the consent or tracking dialogs. The libraries remain part of the app binary but are not run. You can change an earlier consent under Settings > Privacy options as long as this item is shown.

5. App Tracking Transparency (advertising identifier / IDFA)

At the earliest on the second launch of the app and after at least three runs, the app asks once, through Apple’s system dialog, whether it may track you across apps and websites owned by other companies. A short in-app note explains what this is about first. The ad providers can only receive your device’s advertising identifier (IDFA) if you agree there. In the EU, EEA, UK and Switzerland they also only use it if you consented in the consent dialog (Section 4.5). If you declined everything there, the app does not ask at all. Players who bought “Remove Ads” are not asked.

Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time in iOS: Settings > Privacy & Security > Tracking. The game works the same either way, and you see the same number of ads.

6. In-app purchases (Apple) and your balance in iCloud

6.1 Purchases

All purchases (“Remove Ads” and the packs of chisels and Sky Charges) are processed solely by Apple through the App Store. I receive no payment data and no name. For “Remove Ads”, the app only asks Apple (StoreKit) whether your Apple Account holds a valid purchase. That keeps the app ad-free after reinstalling and on your other devices (also via Family Sharing). For a pack, Apple tells the app about the purchase or a refund, and the app adds its contents to your balance or takes them back. Apple only gives me aggregated sales reports.

Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR). Apple’s privacy policy: apple.com/legal/privacy

6.2 Your balance in your iCloud account

So that your balance of chisels and Sky Charges survives a reinstall and is the same on all your devices, the app also stores it in the iCloud key-value storage of your Apple Account. It stores a ledger: which packs were credited (with Apple’s transaction number and the product identifier), gifts, refunds, how many chisels and Sky Charges were earned and used, and a random identifier per installation so that your devices' entries do not overwrite each other. It contains no name, email address, game progress or advertising identifiers.

The data is kept by Apple in your iCloud account and only synced between your devices. I have no access to it and do not receive it. If you are not signed in to iCloud, the balance stays on the device only. The data stays in your iCloud account even if you delete the app; I can neither see nor delete it.

Legal basis: performance of the purchase contract, because purchased chisels and Sky Charges should stay yours (Art. 6(1)(b) GDPR); for gifts, my legitimate interest in showing you the same balance on all your devices (Art. 6(1)(f) GDPR). Apple’s privacy policy, including iCloud: apple.com/legal/privacy

7. Apple Game Center

Leaderboards and achievements use Apple Game Center. Using it is optional and requires you to be signed in to Game Center in iOS. The app then sends your ranked scores, depths and achievements to Game Center, together with a technical context value (whether a continue, a chisel or a Sky Charge was used in that run before the score was submitted). Your Game Center nickname may be visible to other players on leaderboards. Apple processes this data. I do not store it on servers of my own.

Legal basis: providing the feature you chose (Art. 6(1)(b) GDPR). You can sign out of Game Center in iOS: Settings > Game Center (on some iOS versions Settings > Apps > Game Center). Apple’s privacy policy: apple.com/legal/privacy

8. The website hangstone.app

8.1 Visiting the website

This section covers all pages under hangstone.app (home page, support, press, imprint and this privacy policy).

Access data: When you open a page, my host Cloudflare (Section 8.2) automatically processes information your browser sends, in particular your IP address, date and time, the address requested (page or file), the page you came from (referrer, if your browser sends it), the status code of the response, and browser and operating system (user agent). Cloudflare derives an approximate location from the IP address (such as country or city), not your precise location. I do not combine this data with other data and do not analyze it to recognize individual visitors.

Purpose: to deliver the pages, keep the website running and secure (e.g. fend off denial-of-service attacks), and detect errors and abuse. For this, Cloudflare automatically protects the website against denial-of-service attacks (DDoS protection) and rejects requests that clearly look like an attack. Legal basis: my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Retention: On Cloudflare’s free plan I do not get complete access logs with IP addresses, and I have switched off the logging feature for my Worker (Workers Logs). In my Cloudflare account I see aggregate statistics without IP addresses (e.g. number of requests, countries of origin). When Cloudflare rejects requests, it shows me samples of them with the IP address; they are available there for at most 31 days. According to Cloudflare, it keeps its own logs only as long as needed to provide its services, keep them secure and meet legal obligations, and deletes them afterwards. Cloudflare does not state a fixed period.

No cookies, no tracking: The website sets no cookies, stores nothing in your browser (no local storage), contains no ads and uses no analytics or tracking tools, including Cloudflare’s own (no Cloudflare Web Analytics, no bot protection with challenge pages). Fonts, images and videos come from the same server as the pages. No content from other providers is loaded (e.g. no Google Fonts, no YouTube, no external scripts). That is why there is no cookie banner.

The only exception can occur during an attack: if Cloudflare detects a denial-of-service attack, it can put an automatic check in front of individual suspicious requests. If you pass it, Cloudflare sets a cookie (cf_clearance) that records the passed check for a short time and nothing else. It is strictly necessary to deliver the website securely and therefore needs no consent (Section 25(2) no. 2 TDDDG).

Links to the App Store: The “Download on the App Store” button and the “Get Hangstone on the App Store” links are ordinary links. They lead to the App Store through the redirect hangstone.app/app. Only when you tap one does the App Store or apps.apple.com open. From then on, Apple’s privacy policy applies: apple.com/legal/privacy

8.2 Hosting provider: Cloudflare

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages through a worldwide network of data centers (content delivery network), protects them against attacks and also runs the name resolution (DNS) for hangstone.app. Your request is usually answered by a data center near you, but Cloudflare may also process the data in the USA and in other countries. Cloudflare’s privacy policy: cloudflare.com/privacypolicy

Cloudflare processes the data on my behalf under its data processing agreement under Art. 28 GDPR (Data Processing Addendum), which under Cloudflare’s terms also applies on the free plan: cloudflare.com/cloudflare-customer-dpa Where Cloudflare also uses connection data for its own purposes, such as detecting and fending off attacks on its network, Cloudflare is responsible for that itself; see Cloudflare’s privacy policy for details.

Transfers to the USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, also for Switzerland (Swiss-U.S. DPF) and the UK (UK Extension), checked on 11 November 2026 at dataprivacyframework.gov/list. The European Commission’s adequacy decision therefore applies to Cloudflare (Art. 45 GDPR). If the certification lapses, the EU Standard Contractual Clauses that the data processing agreement provides for this case apply (Art. 46(2)(c) GDPR).

9. Email contact, support and “Report an ad”

9.1 Email contact

You can reach me at hangstonegame@gmail.com: directly, in the app under Settings > Contact support, or through the support page hangstone.app/support. The app and the website only open your email app for this. They send nothing to me themselves.

What data: your email address, your name if your email app sends it, the content of your message including attachments, and the technical details of the email (e.g. date and time).

Purpose and legal basis: I process the data to answer your request. If it concerns using the app or your purchase, the legal basis is Art. 6(1)(b) GDPR. For all other requests it is my legitimate interest in answering messages sent to me (Art. 6(1)(f) GDPR).

Retention: I delete your emails once your request is resolved and no follow-up questions are expected, at the latest 12 months after the last message. I only keep them longer where statutory retention obligations require it (e.g. under commercial or tax law).

Email provider Google: My mailbox is hosted by Gmail. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google stores your message on its servers and scans incoming email automatically, e.g. for spam and malware. Google is therefore a recipient of your data. The legal basis is my legitimate interest in a reliable and secure email service (Art. 6(1)(f) GDPR). Google may also process the data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR, checked on 9 November 2026, see Section 4.6). Google’s privacy policy: policies.google.com/privacy

Email is usually encrypted in transit between servers (TLS), but not end-to-end encrypted. Please do not send me sensitive data such as passwords or payment details. I do not need them for support.

9.2 “Report an ad”

Under Settings > Report an ad you can report an inappropriate ad. The item appears as long as you have not bought “Remove Ads”. The app opens your email app with a pre-filled text containing the technical name of the ad network that served the last ad. Whether and what you send is up to you. If no email app is set up on your device, the app opens the support page instead.

I use your report to review and block the ad in the ad network concerned. Legal basis: my legitimate interest in keeping inappropriate ads out of the app (Art. 6(1)(f) GDPR). Retention and email provider: see Section 9.1.

10. Sharing and app ratings

On the results screen you can use Share to pass on a short text with your score, depth and longest chain. The app opens the iOS share sheet for this. You decide where to share it; the app itself sends nothing to me.

Occasionally (for example after a new best score) the app shows Apple’s rating dialog. Ratings are handled entirely by Apple. I only see the stars and reviews you publish on the App Store.

11. Data provided by Apple

Through App Store Connect, Apple gives me aggregated statistics such as downloads, sales and usage. If you allowed sharing analytics with app developers on your device (Settings > Privacy & Security > Analytics & Improvements > Share With App Developers), I also receive anonymized crash reports. I cannot link this data to a person.

12. What the app does not do

No sign-up, no analytics or tracking tools of my own (e.g. no Firebase), no access to contacts, photos, microphone, camera or precise location, no push notifications. I do not sell data for money. Passing data to ad providers may still count as “selling” or “sharing” under some US state laws (Section 16).

13. Children

Hangstone is rated 4+ on the App Store. The rating describes the content, not the audience: the app is aimed at teenagers and adults, is not directed at children, and is not listed in the App Store’s Kids category. Ads are limited to content suitable for all ages (Google rating “G”).

If you are under 16 and in the EU or EEA, you may only consent in the consent dialog with your parents' approval (Art. 8 GDPR). Without consent you get no personalized ads. I do not knowingly collect personal information from children under 13. If you are a parent and learn that this happened, contact me at hangstonegame@gmail.com.

14. Your rights (EU, EEA, UK, Switzerland)

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

Apart from emails you send me, I do not hold data that would let me identify you. That is why I often cannot answer requests about advertising data myself (Art. 11 GDPR). Please contact the ad providers directly (links in Section 4.1). You can also manage personalized Google ads at myadcenter.google.com.

For any request, contact me at hangstonegame@gmail.com.

No obligation, profiling: You are not legally or contractually required to provide any data. You can use the full app without consent. With your consent, the ad providers may build a usage profile for personalized ads. There is no automated decision with legal effect under Art. 22 GDPR.

15. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live. The authority responsible for me is: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

16. Notice for users in the United States

Several US states (e.g. California, Colorado, Connecticut, Virginia) give you the right to opt out of the “sale” or “sharing” of personal information and of targeted advertising. The ad providers in this app receive the data listed in Section 4.2 to serve and measure ads. Under these laws, that may count as selling or sharing.

How to opt out:

in the app under Settings > Privacy options (this item appears in the states concerned). Your choice is stored on your device as a signal under the IAB Global Privacy Platform (GPP) standard. Google honors it directly. The app passes your opt-out on to AppLovin before it starts the ad software, and again whenever you change your choice; it will do the same for Unity once Unity Ads is integrated (Section 4.1). If the app cannot read the signal clearly, it treats it as an opt-out.
through the iOS tracking setting (Section 5). Without your permission, the providers do not receive the advertising identifier.

I do not knowingly sell or share personal information of consumers under 16. I will not discriminate against you for exercising your rights. Send access or deletion requests to the ad providers (Section 4.1) or to me at hangstonegame@gmail.com.

17. Changes

I update this privacy policy when the app, the website or the law change. The version published here applies.

Privacy Policy for the App “Hangstone” and the Website hangstone.app