Privacy Policy for the Tape Quest app

This privacy policy explains which personal data is processed when you use the Tape Quest mobile app and when you visit the website tape-quest.com, for which purposes this happens, and which rights you have.

Tape Quest is a puzzle game for Android and iOS. There is no user account, no registration and no sign-in. Your saved game stays on your device.

In short: the app sends a summarised game report (progress, stars, shop, achievements, play sessions, app version, language, country) together with an anonymous player ID to our own server, in order to prevent cheating and to improve the game (legitimate interest, Art. 6(1)(f) GDPR). No IP address is stored, no advertising ID is involved and nothing is passed on to third parties. This data is deleted after 12 months, and you can object at any time by writing to app@tape-quest.com. Beyond that, data is processed for the leaderboards, for advertising and for the optional in-app purchase.

1. Controller

The controller for the processing of personal data in connection with Tape Quest is:

Martin Gebhardt
Plönzeile 40
12459 Berlin
Germany

Email: app@tape-quest.com

If you have questions about data protection or about the processing of your data, you can contact us at this address at any time.

2. Principles of data processing

We only process data that is necessary to operate Tape Quest, to provide the game functions you use, to finance the app through advertising and to protect the game against misuse.

Tape Quest does not ask for your name, postal address, telephone number or email address. There is no registration and no sign-in. Where data is stored on our server, it is assigned to a randomly generated player ID only — never to you as an identified person.

The app registers automatically with our server at tape-quest.com the first time it is started with an internet connection — without any input from you and without an account. All connections use HTTPS.

3. What we do not collect

On our own server we do not collect:

• no account, no email address, no real name, no password, no login
• no IP address in our database — an IP address is only used in hashed, non-reversible form for rate limiting, for at most one hour
• no advertising ID and no device identifier, and no precise location — the game report contains only the country, as described under “Game report”
• no purchase data — the “Remove ads” purchase runs entirely through Apple and Google

Tape Quest contains no third-party tracking and no third-party analytics services. Unity Analytics, crash reporting and performance reporting are switched off, and we do not use Firebase. We only evaluate the pseudonymous game report described below, on our own server. Push notifications are not sent via a server; the daily reminder is scheduled by your device itself, as described under “Daily reminder”.

4. Leaderboards: Endless and the Daily Quest

If you play Endless or the Daily Quest, your results are recorded on our server under the player ID described above, so that they can be placed in the leaderboards.

We store the following data:

• Player ID: a random ID (UUID) generated by the server, so we can recognise your entries and show you your own position in the leaderboard
• Access key: the SHA-256 hash of a random key. The key itself stays on your device. It prevents other people from submitting results in your name
• Display name: a name generated automatically, for example “TapePlayer-4821”. You cannot choose it, and it contains no personal information
• Results: your best Endless score and when you achieved it; for each Endless run its start, end, score and whether it was accepted; for each Daily Quest attempt the date, your time, whether it was a Perfect Board and whether it was accepted
• Timestamps: when your entries were created and last changed (UTC)

Which level belongs to which Daily Quest date is stored separately and contains no player data.

What is publicly visible: the leaderboards show other players only your generated display name, your position, your Endless score or Daily time, and whether the board was perfect. Nothing else about you is published.

Protection against misuse: to prevent overload and manipulation, we count requests per time window. The counter is not kept under your IP address but under a secret hash of it (HMAC-SHA-256) or under your player ID. These counters are deleted automatically after one minute to one hour.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to provide the leaderboard function you use, and Art. 6(1)(f) GDPR for protection against misuse. Our legitimate interest lies in fair leaderboards and in the secure operation of the service.

Storage period: we store leaderboard data until you request its deletion, as described under “Deleting your data and objecting”. There is no automatic deletion, because a leaderboard entry stays meaningful for as long as it stands.

5. Game report: statistics and saved game

So that we can detect and prevent cheating and can improve Tape Quest, the app regularly sends a summarised game report to our own server at our hosting provider netcup GmbH in Karlsruhe, Germany. This happens when the app starts, every five minutes while you play, and when the app moves to the background. Without an internet connection the app stores the report on your device and sends it as soon as a connection is available again.

The game report contains only totals and states, never individual moves:

• Identifier: the app's random, anonymous player ID and the generated leaderboard name (for example “TapePlayer-4821”). We know neither your name nor your email address nor a device or advertising ID.
• Progress: the highest level unlocked, the number of levels completed and solved perfectly, chapter rewards claimed, daily puzzles solved, your daily streak and streak protection, daily tasks completed, your best result and total number of runs in Endless mode, and the achievements you have unlocked.
• Stars and shop: your current star balance, the total stars collected by origin, stars spent, the designs unlocked in the shop and the one currently in use, whether “Remove ads” has been purchased, and the number of ads and rewarded videos you have seen.
• Play sessions: the start and the length of each session, that is from opening the app until you leave it.
• Technology and settings: app version, operating system (iOS or Android), the language you have set, and whether sound, vibration and the daily reminder are on or off.
• Country: the country set in your device settings (a region such as “DE”) and, where our hosting provider supplies it, the country derived from the connection. We do not collect a precise location.

We do not store your IP address. It is technically required to transmit the data. To prevent misuse (rate limiting) we use it only briefly in a hashed, non-reversible form, which is deleted after one hour at the latest. Our hosting provider keeps access logs containing IP addresses; see “Use of the website tape-quest.com”.

Purposes:

• Preventing cheating and protecting the leaderboards: we check whether a saved game is plausible — for example more stars than could ever have been found — and recognise manipulated saves.
• Improving the game: we can see which levels players get stuck on or stop at, which functions are used and how long people play, and we adjust difficulty and content accordingly.
• Troubleshooting: we can recognise whether problems are connected to particular app versions or systems.

We do not use this data for advertising, do not pass it on to third parties and do not sell it. No automated decision is made about you. The evaluations are visible only to us, through a password-protected administration access that can only read data.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in preventing cheating and manipulation, in operating the leaderboards fairly, and in improving the game and fixing errors. For this we process only pseudonymous data, without names, contact details or advertising IDs, and only aggregated values.

Storage period: play sessions and the daily history are deleted automatically after 12 months. The most recently reported saved game is deleted once no new report has arrived for 12 months.

Right to object: you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). Write to app@tape-quest.com and state your leaderboard name — you will find it in the app under “Settings → Legal & privacy”. We will then delete the data stored under that name.

6. Local storage on your device

Your saved game stays on your phone. It is not transferred anywhere, there is no cloud save and the app creates no backup of its own. It is removed when you delete the app.

Stored locally are in particular:

• progress, best times, Perfect Boards, stars, achievements and your Daily Quest calendar
• settings such as sound, vibration and haptics, language and whether the reminder is on
• whether “Remove ads” has been purchased (this can also be restored through the store)
• your player ID and the access key for the leaderboards
• the daily reminder, scheduled locally by your device
• your advertising consent, stored on the device by Google's SDK
• the status of the tutorial

Depending on your device and system settings, local app data may additionally be included in a backup of your device, for example via a backup function of Android or iOS. The privacy terms of the respective provider apply to such backups.

7. Advertising via Google AdMob

Tape Quest is free and financed through advertising. It shows occasional full-screen ads (interstitials) between selected completed levels — never during a puzzle — and optional video ads you can choose to watch to earn Daily Stars. Nothing forces you to watch a video ad.

For ad delivery we use Google AdMob and the Google Mobile Ads SDK. The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

According to Google, the SDK processes in particular the following data:

• the advertising ID of the device (Android Advertising ID, or IDFA/IDFV on iOS)
• IP address, and the approximate location derived from it
• device and usage data, for example device type, operating system version and how you interact with an ad
• diagnostic data
• information used to detect fraud and abuse

Google may use this data to deliver ads, to measure and bill their delivery and to prevent ad fraud. In the case of personalised advertising, interest profiles may also be created. Further information is available at policies.google.com/privacy and policies.google.com/technologies/ads.

Where consent is required, the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Beyond that, we base the financing of the app, which is offered free of charge, on Art. 6(1)(f) GDPR. Our legitimate interest lies in financing and economically operating the app.

If you purchase “Remove ads”, no more ads are shown to you and the advertising SDK no longer delivers ads for you.

8. Consent and consent management

In the EU and the EEA, in the United Kingdom and in Switzerland we ask for your consent before the first ad is shown. For this we use Google's consent form (User Messaging Platform, UMP), which follows the IAB Transparency & Consent Framework. Your choice is stored on your device.

If you do not consent, Google shows only non-personalised advertising. This does not affect your use of the rest of Tape Quest.

You can change your choice at any time with effect for the future. In the app settings you will find “Privacy options” for this, where the consent management provides it for your region.

On iOS devices, Apple additionally asks whether Tape Quest may track you across apps and websites (App Tracking Transparency). Without your permission, Google does not receive the advertising identifier. You can change this setting at any time in the iOS system settings.

On Android devices you can reset or delete the advertising ID in the Android system settings.

9. Remove ads – optional in-app purchase

Tape Quest offers a one-time in-app purchase that permanently removes advertising. It is not a subscription.

Depending on your device, the purchase is processed entirely via Google Play or the Apple App Store. The privacy terms and terms of use of the respective provider apply in addition:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

We receive no payment data such as credit card numbers or bank details, and we store no purchase data on our own server. The app only learns whether a valid purchase exists, so that it can unlock the ad-free version on your device and restore it on request.

The legal basis is Art. 6(1)(b) GDPR. The processing is necessary in order to provide the function you acquired.

10. Unity In-App Purchasing

For the technical handling of the in-app purchase we use the software module “Unity In-App Purchasing” (Unity IAP), provided by Unity Technologies.

Unity IAP is part of the app and, for technical reasons, processes additional data as part of the purchase flow. According to Unity, the following categories of data may be processed in particular:

• approximate location (processed only briefly)
• email address of the platform account used (processed only briefly)
• personal or user identifiers
• purchase history, including product identifier, purchase token and time of purchase
• crash logs and diagnostic data of the purchase module
• device and other identifiers

According to Unity, this data is used to provide the purchase function, to verify purchases and for the stability of the purchase module. The provider is Unity Technologies. Further information can be found in Unity's privacy policy. Unity may also process data outside the European Economic Area, in particular in the USA.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary to provide the in-app purchase, and Art. 6(1)(f) GDPR for crash logs and diagnostic data of the purchase module. Our legitimate interest lies in the stability of the purchase function.

11. Rating prompt

From time to time the app shows the rating dialog provided by Apple or Google. This dialog belongs to the respective store. We do not learn through the app whether you rate Tape Quest or what you rate it.

12. Daily reminder

You can have Tape Quest remind you about the Daily Quest. The reminder is scheduled locally by your device and is not sent via a server. No push service is involved and no data leaves your device for this.

Depending on the operating system version, your device asks for permission to show notifications. You can switch the reminder off at any time in the app or change the notification permission in your device's system settings.

13. Retrieving version information from tape-quest.com

On start-up, Tape Quest retrieves a small file from our server to check whether a newer version of the app is required. The app sends no data of yours in this request and we store nothing about it, apart from the hosting provider's access logs described in section 14.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to be able to point users to required updates and to provide the app reliably.

14. Use of the website tape-quest.com

When you visit the website, the hosting provider processes technical access data in server log files. This may include in particular: IP address, date and time of access, the page or file requested, the amount of data transferred, the referrer URL, and browser type and operating system. The same applies when the app contacts our server, for example to retrieve the leaderboards or the version file or to send the game report.

This processing is necessary to deliver the website and the service and to keep the server infrastructure secure. The legal basis is Art. 6(1)(f) GDPR. Server log files are generally deleted after 30 days, unless longer storage is required because of a specific security incident.

The website does not set cookies for analytics, tracking or advertising purposes. No analytics services, social media plugins or external advertising services are embedded.

The typeface used is not loaded from an external service but delivered directly from our own server. Visiting the website therefore does not establish a connection to Google Fonts.

15. Hosting

The website tape-quest.com, the leaderboard service, the game report and the associated database are operated at the following hosting provider:

netcup GmbH
Daimlerstraße 25
76185 Karlsruhe
Germany

The hosting provider processes technical data on our behalf as part of providing the server infrastructure. Where required, a data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.

16. Disclosure of data

As a rule, personal data is not passed on to third parties unless this is necessary to provide a function, unless there is a legal obligation to do so, or unless there is another corresponding legal basis.

Processing by third parties takes place in particular in connection with the delivery of advertising by Google AdMob, with the consent form provided by Google, with the handling of the in-app purchase via Google Play or the Apple App Store, with the Unity IAP purchase module, and through our hosting provider as part of data processing on our behalf.

Within Tape Quest, your generated display name and your results are visible to other players in the leaderboards, as described under “Leaderboards”. The game report is not passed on to anyone; it is evaluated only by us.

Personal data is not sold.

17. Transfers to third countries

The leaderboard data and the game report described above are stored on a server in Germany.

The third-party providers used may also process personal data outside the European Economic Area, in particular in the USA. Where a transfer to a third country takes place, it is based on the safeguards provided by the respective provider, in particular an adequacy decision of the European Commission or standard contractual clauses pursuant to Art. 46 GDPR. The respective providers make further information available in their privacy information.

18. Storage periods

Leaderboard data is stored until you request its deletion, as described under “Deleting your data and objecting”.

From the game report, play sessions and the daily history are deleted automatically after 12 months. The most recently reported saved game is deleted once no new report has arrived for 12 months. The counters used for rate limiting are deleted automatically after one minute to one hour.

Locally stored game and settings data remains on your device until you delete the app data or uninstall the app.

For data processed by Google, Apple or Unity in connection with ad delivery or purchase handling, the storage periods of the respective provider apply.

Technical server log files are deleted according to the periods stated under “Use of the website tape-quest.com”. Data that has to be stored longer due to statutory retention obligations is deleted once the respective period has expired.

19. Data security

We take appropriate technical and organisational measures to protect the data processed in connection with Tape Quest against loss, manipulation and unauthorised access.

All communication between the app and our server is encrypted via HTTPS. Entries in the leaderboards are protected by an access key that only exists on your device; the server stores nothing but its hash. Rate limiting protects the service against overload and automated misuse. The administration access we use to look at the game report is password-protected, not publicly reachable and can only read data.

20. Deleting your data and objecting

Data on our server: you can have the data stored under your player ID deleted at any time — this covers both your leaderboard entries and your game report. Write to app@tape-quest.com and state your leaderboard name (for example “TapePlayer-4821”). You will find it in the app under “Settings → Legal & privacy”. Since Tape Quest uses no account, we need this name to identify your entries and to make sure we do not delete another player's data.

Objection: where we process data on the basis of our legitimate interest — in particular the game report — you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Use the same address and the same leaderboard name. We will then delete the data stored under that name.

Data on your device: you can remove app data stored locally via your device's system settings, by clearing the app data or uninstalling the app. This also removes your level progress, your best times and your stars. Please note that deleting the app does not automatically delete the data already stored on our server.

An ad-free purchase you have already made is not affected by this and can usually be activated again via the app's restore function, as long as the purchase can still be assigned to the Google or Apple account you used.

For the deletion of data processed by Google, Apple or Unity, please also contact the respective provider.

21. Your rights under the GDPR

Where the statutory requirements are met, you have in particular the right to information about the personal data we process.

You also have the right to rectification of inaccurate data, erasure of your data, restriction of processing and data portability.

Where processing is based on Art. 6(1)(f) GDPR — in particular the game report — you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, you can contact us at app@tape-quest.com. As Tape Quest stores no contact details, please state your leaderboard name so that we can assign your request; you will find it in the app under “Settings → Legal & privacy”.

22. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint about the processing of your personal data with a data protection supervisory authority. In particular, you may contact the supervisory authority responsible for our place of business or a supervisory authority at your habitual residence.

23. Obligation to provide certain data

The campaign levels of Tape Quest are played locally on your device. Taking part in the leaderboards for Endless and the Daily Quest, displaying advertising and handling or restoring the in-app purchase require the processing of technical data; without it, the functions concerned cannot be provided.

The game report is sent automatically whenever the app has an internet connection; there is no separate setting for it in the app. If you do not wish this processing to continue, you can object as described under “Deleting your data and objecting”.

24. Use by children

Tape Quest is not directed at children. We do not knowingly collect personal data from children beyond the processing described in this privacy policy.

25. Automated decision-making and profiling

We do not use automated decision-making within the meaning of Art. 22 GDPR. Leaderboard positions are calculated solely from the results submitted, and the plausibility checks on the game report serve only to protect the leaderboards; neither has a legal or similarly significant effect on you.

In the case of personalised advertising, the advertising provider may evaluate usage information for advertising purposes. Where required under applicable law, this processing depends on your consent, which you can withdraw at any time with effect for the future.

26. Changes to this privacy policy

We may adapt this privacy policy if Tape Quest, the services used or the legal requirements change. The current version is published on this page.

In the event of material changes to the processing of personal data we will, where necessary, additionally point this out inside the app.

Version of this privacy policy: 27 September 2026