Privacy Policy

In short

• This website sets no cookies, uses no analytics or trackers and loads nothing from other servers.
• The app needs a little data to run the game: a random player ID, your game progress and some device facts.
• The app asks for your birth month and year once. It keeps only your age group, never the date.
• Players under 13 see no ads and are not tracked. Personalised ads are only for adults who agree.
• Purchases go through Apple or Google. We never see your card details.
• You can delete your account in the app: Settings → Delete account.

Who is responsible

The controller for the website and the Hugstorm app is:

Managing director: Alexander Reiswich
Email: support@playhugstorm.com

For every privacy question or request, email support@playhugstorm.com.

This website

playhugstorm.com is a plain information page. It sets no cookies, stores nothing in your browser, has no analytics, no ads, no social media plug-ins and no embedded content from other servers. Fonts and images come from our own server.

The site is hosted by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). To deliver the pages and keep them safe from attacks, Cloudflare processes technical data of every request: IP address, date and time, the page requested, browser and device type (user agent) and the referring page. We do not use this data to identify you. Cloudflare acts as our processor.

Legal basis: Art. 6(1)(f) GDPR — our interest in a secure, working website. Storing or reading information on your device (§ 25 TDDDG) does not take place.

The app: what we process and why

Your player ID and game data

When you first start Hugstorm, the app creates a random player ID. It is not linked to your real identity. Players 13 and over can choose a player name; younger players get a generated one. With it the app keeps your progress: levels, the Grove, your Guardians and cards, coins, gems and other items, settings and your purchase history (so bought items are never lost). The app also reads technical facts about your phone — model, operating system version, app version, language and performance tier — to pick the right graphics quality and to fix problems.

Your progress is saved on your phone. To protect it and to run online features, a copy is kept on our servers at Google Firebase (Authentication, Cloud Firestore, Cloud Functions).

Legal basis: Art. 6(1)(b) GDPR — we need this data to provide the game you asked for.

Your age group

After the first few levels the app asks for your month and year of birth, with no pre-set answer. It keeps only your age group — under 13, 13 to 17, or 18 and over — and never stores the date. Where available, the app may also use the age range your phone shares (Apple Declared Age Range, Google Play Age Signals); the stricter result counts. We use the age group to protect younger players: no ads and no tracking for children, no personalised ads for teens, spending limits and a grown-up check before purchases.

Legal basis: Art. 6(1)(c) and (f) GDPR — protecting children and meeting our legal duties.

Purchases

In-app purchases and subscriptions are handled by the Apple App Store or Google Play under their terms. They process your payment; we never receive your card or bank details. To check that a purchase is real, to deliver it and to restore it on a new phone, we use RevenueCat (RevenueCat, Inc., USA) as our processor. RevenueCat receives your player ID, the store receipt (product, price, currency, date, transaction ID) and your platform.

Legal basis: Art. 6(1)(b) GDPR (delivering what you bought) and Art. 6(1)(c) GDPR (tax and accounting duties).

Ads (players 13 and over only)

Hugstorm shows optional reward videos: you choose to watch one, for example to double a reward. Adult players who have not bought anything may also see a short ad between levels from level 10 on. Ads are served by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA).

• Under 13: no ads at all. AdMob is not even started.
• 13 to 17: only non-personalised ads, marked as ads for younger users. No tracking prompt.
• 18 and over: in the EU, the UK and Switzerland, Google’s consent message asks you first. Personalised ads are shown only if you agree — and on iPhone only if you also allow tracking in Apple’s system prompt. In US states with privacy laws you can opt out at any time (see US state privacy rights).

AdMob may process your device’s advertising ID (IDFA on iPhone, only if you allow tracking; AAID on Android) and, on Android, the App Set ID; your IP address, which Google also uses to estimate your approximate location; device and app information; and how you interact with ads. Google also uses this to count views, limit repeats and prevent fraud. For personalised ads Google acts as an independent controller; see how Google uses information from apps that use its services.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, where the law requires consent; otherwise Art. 6(1)(f) GDPR (financing the free game). You can change your choice at any time in the app: Settings → Privacy choices.

How the game is played and crash reports

To balance levels and fix what isn’t fun, the app records game events — for example level started or won, gates chosen, items earned or spent, shop visits, ad views, performance numbers and load times.

• Players 13 and over, after you agree where consent is needed: the events go to Google Analytics for Firebase (Google Ireland Limited / Google LLC), our processor, with a Firebase app-instance ID (on Android also the App Set ID). Google estimates your approximate location (country or region) from your IP address and does not store the IP address in Analytics. If you say no, no events are sent.
• Players under 13, before the age question and while a consent choice is still open: the app only sends anonymous counts to our own server — the event name and small numbers such as the level, with no player ID, device ID or advertising ID and no third-party analytics.

If the app crashes for a player 13 or over, Firebase Crashlytics receives a technical crash report (device model, OS version, app version, the part of the code that failed, a short error code). Crash reports contain no free text you typed. Players under 13 send no crash reports.

Legal basis: Art. 6(1)(f) GDPR — our interest in a working, well-balanced game; your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG where the law requires it.

Game settings, events and tests

The app downloads game settings and the event calendar from Google Firebase Remote Config. This uses a Firebase installation ID and your app version, country and language. Legal basis: Art. 6(1)(b) GDPR.

Sometimes we try small changes with some of the players (A/B tests), for example the size of a reward or when a hint appears. Which version you get is worked out from your player ID. Players under 13 only take part in tests of the first tutorial levels, never in tests of prices, ads or offers, and their results stay anonymous counts. Legal basis: Art. 6(1)(f) GDPR — our interest in improving the game.

Game Center, Google Play Games and leagues

You can link your game to Apple Game Center or Google Play Games. Then we receive the player ID from that service to keep your progress across devices. Apple and Google are responsible for their own services.

If you’re 13 or older and signed in, the app sends your highest level and your Bloom Stars (all-time and this week) to Game Center or Google Play Games leaderboards. Other players can see them there under your Game Center or Play Games name, according to Apple’s and Google’s settings. Players under 13 never send scores.

In the weekly Garden League, other players in your group see your player name, avatar, level and weekly score. Players under 13 get a generated name (for example “Sunny Otter 42”) and cannot change it. We check scores on our server to keep the league fair.

Legal basis: Art. 6(1)(b) GDPR.

Notifications

If you allow it, the app schedules reminders on your phone (for example “Your bakery is full”) — at most one a day and never at night. They are created on your phone; no push token is sent to us. You can turn them off in the app or in your phone’s settings.

Offers for adults

Adult players may see shop offers chosen from how they play (for example the level reached or items owned). This helps us show offers that fit. It has no legal or similarly significant effect on you. Children and teens don’t get these offers. Legal basis: Art. 6(1)(f) GDPR.

Store ratings

Now and then the app may ask your phone to show Apple’s or Google’s rating prompt. We never learn whether or how you rated.

When you contact us

If you email us, we use your email address, your message and any details you send (such as your player ID) to answer you. Settings → Send feedback opens your mail app with your app version, phone model and player ID filled in; you decide whether to send it. Our email is handled by Cloudflare, Inc. (receives and forwards the mail) and Google Ireland Limited (Gmail, stores the mail and sends the replies). Legal basis: Art. 6(1)(b) or (f) GDPR.

Children

Hugstorm is made for everyone, including children. For players who tell the app they are under 13:

• no ads of any kind, and the ad system is not started;
• no tracking prompt and no advertising ID;
• only anonymous usage counts, without device IDs;
• no personalised offers and no countdown offers;
• a grown-up check (a parental gate) before any purchase, subscription or link out of the app, plus a weekly spending limit of $10;
• a generated player name in leagues.

What we collect from children, and why

Only what the game needs to run: a random player ID, game progress and settings, the age group, technical facts about the phone (model, system and app version, language) and, if a grown-up approves a purchase, the purchase record. We use this only for the internal operations of the game: saving and restoring progress, delivering purchases, keeping the game working and secure, and counting how the game is played without any ID. The player ID and the Firebase installation ID are persistent identifiers; we use them only for these internal operations — never for ads, profiling or contacting a child. Our service providers (Google Firebase, RevenueCat, and Apple and Google for the stores) process this data for us. We don’t sell or share it.

How long we keep it

As long as the child plays. After the account is deleted, we delete the data as described under How long we keep data. An account that nobody has opened for 24 months is deleted from our servers. Purchase records are kept for tax law, apart from game data.

Parents

You can ask to see your child’s data, have it deleted, or stop any further collection (deleting the account stops it). Email support@playhugstorm.com with your child’s player ID (Settings → Player ID). We may ask a few questions to make sure the request comes from the child’s parent or guardian. We do not knowingly collect more from children than the game needs.

Service providers

We have data processing agreements with our processors. We do not sell your personal data for money. For the US, see US state privacy rights.

Data outside the EU

Some providers above are in the USA or may access data from there. Transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR), and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

How long we keep data

• Game account and saves: as long as you play. After you delete your account, we delete it from our servers within 30 days; backup copies are gone within another 30 days.
• Game analytics: up to 14 months, then deleted.
• Crash reports: 90 days.
• Purchase records: up to 10 years, because tax and commercial law requires it (§ 147 AO, § 257 HGB). They are kept apart from your game data.
• Emails: until your request is settled, unless the law requires us to keep them longer.
• Website request data at Cloudflare: only as long as Cloudflare needs it for delivery and security.

Your rights

You have the right to:

• get a copy of your data (Art. 15 GDPR);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• limit how we use it (Art. 18);
• receive your data in a common format (Art. 20);
• object to use based on our legitimate interests (Art. 21);
• withdraw consent at any time, for the future (Art. 7(3)).

To use a right, email support@playhugstorm.com and include your player ID (in the app: Settings → Player ID), so we can find your data. We answer within one month.

You can also complain to a data protection authority, for example where you live, or the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de).

Your right to object

Your choices in the app

• Ads and consent (also to opt out of selling or sharing in the US): Settings → Privacy choices.
• Tracking on iPhone: iPhone Settings → Privacy & Security → Tracking.
• Advertising ID on Android: Android Settings → Privacy → Ads (reset or delete the ID).
• Notifications: Settings → Notifications, or your phone’s settings.
• Delete everything: Settings → Delete account. How deleting works.

US state privacy rights

If you live in a US state with a consumer privacy law (for example California, Colorado, Connecticut, Virginia or Utah), this also applies:

• What we collect (in the last 12 months): identifiers (the player ID, Firebase IDs and, only for adults who allow it, the advertising ID); game activity and ad interactions; purchase records; device information; approximate location from the IP address; and what we infer for shop offers (adults only). We don’t collect sensitive personal information. Why we use it and how long we keep it is described above.
• Selling and sharing: we don’t sell personal information for money. When an adult allows personalised ads, Google AdMob uses data for ads based on activity across apps and websites. Some state laws call this “sharing” or “targeted advertising”. We never do this for players under 18.
• Your rights: to know what we collect and get a copy, to correct it, to delete it, to opt out of selling, sharing and targeted advertising, and not to be treated differently for using these rights. You can also ask through an authorised agent. If we turn a request down, you can appeal by replying to our answer.

Do Not Sell or Share My Personal Information

To opt out, open Settings → Privacy choices in the app and turn off personalised ads. On iPhone you can also turn off tracking in iPhone Settings → Privacy & Security → Tracking. Or email support@playhugstorm.com with the subject “Do not sell or share” and your player ID. This website collects nothing that could be sold or shared.

Security

This website is only served over encrypted connections (HTTPS). The app talks to our servers over encrypted connections too. Access to player data is limited to the people who need it to run the game.

Changes

If the app or the law changes, we update this policy and change the date at the top. For important changes we will also tell you in the app.