Privacy Policy — Zendeca

1. Controller

Patrick Böttge, Ferdinand-Rhode-Str. 5, 04107 Leipzig, Germany. Email: [email protected]. No data protection officer has been appointed; there is likely no legal obligation to do so for this service. For privacy questions, use the email address above.

2. Summary

Zendeca works without an account or login. There are no ads, no third-party tracking, and no sale of data for advertising. Most data (settings, progress, daily counter, purchase status) stays only on your device.

3. In-App Purchase ("Full Version")

The one-time purchase is handled by Apple (App Store / StoreKit). Apple is the seller and a separate controller for payment processing; we receive no payment or card data, only whether a purchase exists. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Apple’s privacy policy also applies: https://www.apple.com/legal/privacy/

4. Anonymous Usage Statistics

To balance and improve the game we collect anonymous, non-personal facts about a run, e.g.: chosen variant and difficulty, stage reached, result (win/loss), a coarse score range, the formulas used, plus app and config version and a coarse date.

• No device or installation identifier is created, stored, or transmitted for the statistics (App Attest abuse prevention is separate — see below).
• The data cannot identify you and is not combined with other sources.
• This is not "tracking" under Apple’s App Tracking Transparency, so no ATT prompt is shown.

In our assessment this involves no personal data and therefore needs no consent. You can still turn it off anytime in the app settings under "Send anonymous statistics." If any of it were deemed personal, we rely on our legitimate interest in improving the product (Art. 6(1)(f) GDPR).

Daily challenge: if you play the optional daily challenge, we additionally transmit — to validate your result on the server — the challenge date, that day’s fixed variant and difficulty, the stage reached, your score, and the round-by-round outcome (passed/failed). No device, installation, or other identifier is included. This transmission is likewise controlled by the "Send anonymous statistics" switch and does not happen when it is off.

Abuse prevention (App Attest)

To prevent automated abuse of our servers (e.g. mass fake submissions), the app uses App Attest by Apple. Your device creates a key secured in the Secure Enclave; a key identifier and a public key are sent to and stored on our server so we can verify that requests come from a genuine, unmodified copy of the app. This data is used solely for security / fraud prevention (Art. 6(1)(f) GDPR — legitimate interest), is not combined with the anonymous usage statistics, and is not used to identify you or for advertising. App Attest is app-specific and enables no cross-app tracking.

5. Processor / Hosting

Anonymous statistics are hosted on Supabase (Supabase, Inc., 3500 S Dupont Hwy, Dover, DE 19901, USA), EU hosting region, under a Data Processing Agreement (Art. 28 GDPR). Where personal data is transferred to the USA, this is based on appropriate safeguards (the EU-US Data Privacy Framework or the EU Standard Contractual Clauses, Art. 46 GDPR).

6. Local Data

Settings, progress and unlocks, the daily run counter, and purchase status are stored locally on your device and not sent to us. Delete the app to remove them.

7. Retention

Anonymous statistics are kept in aggregated form to improve the product. As they have no personal reference, they cannot be attributed to an individual.

8. Your Rights

Where personal data is processed, you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21) under the GDPR. Note: because we store no personal identifiers, we may be unable to attribute records to a person and therefore may not be able to fulfil such requests (Art. 11 GDPR). You also have the right to lodge a complaint with a supervisory authority, e.g. the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden (www.datenschutz.sachsen.de).

9. Changes

We update this policy when the app or the law changes. The version published in the app and at https://madebypb.com/zendeca/privacy applies.

Contact

Questions about privacy in Zendeca? Email us at [email protected].