punktdev.com

Privacy Policy for Arrow Atelier

App · Last updated: 27 October 2026 · Deutsche Fassung

1. Controller and principle

This policy applies to the game Arrow Atelier for iOS and Android, to the browser version (section 8) and to these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany, represented by its managing director Johann Martens. Email: info@rm-analytics.de, phone: +49 231 58692861. Further details are in the legal notice (Impressum).

Arrow Atelier works without an account. Your progress stays on your device; the app does not transmit it. If you play in the browser, the server delivering the game receives technical connection data (section 8). The app shows ads from Google AdMob (section 6). It contains no other third-party analytics, tracking or crash reporting services. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is intended for adults aged 18 and over and is not directed at children.

2. Your progress stays on your device

The app stores the following as files in the app's documents folder on your device:

The app does not send these files to us. The app needs the game progress, store.json and reminder.json so that the game, your purchases and the reminder work (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). The app stores ads.json only so that it keeps to the breaks described in section 6 (no full-screen ad in the first 7 days, at most after every second archive puzzle, at least 4 minutes apart) and does not put a consent request over the game on the first start. Without the file the app would not know when you first opened it or when the last ad ran. The data is not used to select, deliver or measure ads. We therefore consider this storage strictly necessary to provide the game as described in section 6 (Section 25(2) No. 2 TDDDG). Where personal data is involved, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing ads rarely and only at fixed points. The data remains until you clear the app data or uninstall the app.

Backups: If you have turned on iCloud Backup (iOS) or Android's automatic backup to your Google account, the operating system includes these files. That way your progress carries over to a new device. These backups are managed by Apple or Google under their own terms, not by us. Uninstalling the app does not remove backups that already exist. You delete them in your iCloud or Google settings.

3. Content and app updates

All puzzles, images and fonts ship inside the app. The app does not download new daily puzzles. It only uses an internet connection for ads (section 6), for purchases (section 5), for updates of its program code (next paragraph) and when you open a link (section 9).

Program code updates: From iOS version 1.0.2 and Android version 1.0.3, the app asks updates.arrowatelier.punktdev.com on every cold start whether there is an update for its program code, such as a bug fix. An update can also replace puzzles, images and other files of the app. The app downloads it in the background from the same server, stores it in the app's storage on your device and uses it from the next cold start. This transmits: the platform (iOS/Android), app version, update channel, the identifiers of the built-in, the currently used and the requested code version, if any the identifiers of up to five updates that recently failed on your device, the requested file address, fixed technical protocol and signature details, the network client's technical identifier (user agent) and, for technical reasons, your IP address. These identifiers name code versions that are the same for every user, not your device. The app sends no device or installation identifier and no error reports. The purpose is to quickly fix bugs in the game you installed without waiting for a store update. Updates contain no ads and no analysis of your play. Storing the update on your device is necessary for the app to run in the corrected version you want to use by installing it (Section 25(2) no. 2 TDDDG). The legal basis for the requests is Art. 6(1)(f) GDPR; our legitimate interest is an app without bugs. The update server runs on Cloudflare (section 11). Our server does not store the requests; Workers Logs are turned off. As network operator, Cloudflare processes technical connection data to deliver the files and to protect against attacks.

4. Daily puzzle reminder

Once you have solved puzzles on three days, the app asks once whether it may send you notifications. If you allow it, the app schedules local reminders for the daily puzzle on your device, only for days that are still open. We run no push service for this and receive no device identifier. You grant the permission in the operating system and can withdraw it there at any time. The legal basis is Art. 6(1)(b) GDPR.

5. Purchases

In the app you can buy coin packs and, once, "Remove ads". Apple (App Store) or Google (Google Play Billing) handle these purchases, including payment. We do not receive payment data such as card or bank details.

After a purchase the store sends the app a purchase confirmation with a transaction ID and product ID. The app uses it to credit the coins or turn off ads and then confirms the purchase with the store. With "Restore purchases" the app asks the store which purchases belong to your store account and restores "Remove ads". We run no server of our own for purchases; nothing is sent to us.

The purchase data the app stores stays on your device only, and we have no access to it: whether you bought "Remove ads", coins from purchases not yet credited, and the transaction IDs of your most recent coin purchases (section 2). The app needs them so that every purchase is credited exactly once. The legal basis is Art. 6(1)(b) GDPR. The app deletes older transaction IDs as new ones are added. Everything else remains until you clear the app data or uninstall the app.

You get Arrow Atelier from Apple's App Store or Google Play. Apple and Google process account, download and payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Limited, both in Ireland. The stores provide us with aggregated download and sales figures. For purchases we can see individual order and transaction details there. We use them only to resolve purchase and support questions, for example about refunds, and where necessary for our accounting. The legal basis is Art. 6(1)(b) GDPR, and for accounting Art. 6(1)(c) GDPR. Where we look into abuse or disputes, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is handling purchases correctly and resolving claims. Apple and Google store this data; they decide how long it remains visible there. Where we take data into our accounting, we keep it as long as Section 147 of the German Fiscal Code (AO) and Section 257 HGB require (up to ten years) and delete it afterwards.

6. Ads with Google AdMob

Arrow Atelier is free and is funded by ads. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is integrated through the software package react-native-google-mobile-ads.

When ads appear:

The app only allows ads rated G, that is, ads suitable for all ages.

Consent: On the first start the app requests nothing and loads no ads. From the second start onwards it uses Google's User Messaging Platform (UMP) at start-up to ask Google whether consent is required in your region. If you tap a rewarded video during the first start, it makes this request at that moment. Google receives your IP address and technical information about the device and app. In the European Economic Area, the United Kingdom and Switzerland the app then shows a consent form based on IAB Europe's Transparency and Consent Framework (TCF). The SDK stores your choice on your device until you change it or uninstall the app. This storage is strictly necessary so that the app can respect your choice (Section 25(2) No. 2 TDDDG). The legal basis for the request to Google is Art. 6(1)(f) GDPR; our legitimate interest is to find out whether we need consent and then to obtain it properly. Storing your choice as proof is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

The SDK only accesses your device's advertising ID to the extent you have consented (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, Google, depending on your choice, serves only limited ads without an advertising ID and without personalisation, or none at all. Even for limited ads the SDK stores ad material and its own program code in the app's cache to play the ad. If the "Programmatic limited ads" feature is active in AdMob, Google may also use local storage without consent to detect invalid traffic, fraud and abuse (Google Help on limited ads).

Non-personalised ads only: Every ad request from the app asks for non-personalised ads only. Google then does not select ads based on your behaviour in other apps or on websites. Even for non-personalised ads Google still processes data: your IP address, device and app information (such as device type, operating system, app version and language), how you interact with the ad (such as views and clicks) and, where permitted, your device's advertising ID. The purposes are delivering the ad, limiting how often you see the same ad, preventing fraud and abuse, and measurement and billing.

Depending on the platform and your consent, the Google SDK also collects app launches and other interactions such as taps and video views, diagnostic and performance data about the app and the SDK, and device identifiers, on Android for example the advertising ID and the app set ID. Google describes the details in its data disclosure for the Google Mobile Ads SDK.

On iOS the app does not ask for permission to track (App Tracking Transparency). Apple's advertising identifier (IDFA) is therefore not available to the app or to Google. On Android you can reset or delete the advertising ID in the system settings.

The app starts the measurement feature of the Google SDK only when the SDK is initialised after the consent request. Where Google serves limited ads without consent, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to offer the game for free. If you have consented, the legal basis is your consent (Art. 6(1)(a) GDPR). Outside the European Economic Area, the United Kingdom and Switzerland the app shows no form. There it also loads non-personalised ads only; the legal basis is then Art. 6(1)(f) GDPR with the same legitimate interest.

Responsibility and third countries: We are responsible for integrating the SDK and for the transmission to Google. Google is itself responsible for any further processing. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). The ad and consent requests are encrypted via HTTPS. How long Google keeps the data and how Google uses it is described in How Google uses information from sites or apps that use our services and in Google's privacy policy.

Withdrawal and changes: Under Settings › "Ads and privacy" you can reopen the consent form where it is required. There you can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). Processing that took place on the basis of your consent before the withdrawal remains lawful.

Remove ads: Once you have bought "Remove ads", the app no longer loads any ads. From the next start it no longer initialises the ads SDK and no longer requests consent. Rewards such as hints or double coins are then granted without a video.

7. Sharing a result

If you share a result, the app creates the image on your device, stores it in the app's cache and opens your device's share sheet. The app replaces the image the next time you share; at the latest it is removed when you uninstall the app. Nothing is sent until you choose a destination. You decide what you send to whom. We receive nothing.

8. Playing in the browser

Arrow Atelier can also be played in the browser. The browser version has no account, no purchases, no ads from us, no reminders and no analytics or tracking services. Sections 2 to 7 describe the app; for the browser version this section applies instead.

Progress: Your browser stores your progress (tutorial progress, solved daily puzzles with stars, your streak, coins, hints, your settings and the puzzle you are currently playing, with mistakes, hearts and time so far) in local storage (localStorage) under the key arrow-fever-proto:v1. If saved progress can no longer be read, the game stores it unchanged under arrow-fever-proto:v1:damaged and starts over. It does not leave your device and does not expire. The game needs it so you can continue where you left off (Section 25(2) no. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). You delete it by clearing this site's data in your browser. The browser may also delete it itself, for example after a private window. Your progress is then gone.

Your progress is stored for the domain the game is loaded from. On another domain you start with new progress. If the game is embedded in another website, for example on a game platform, browsers may separate this storage by the website you play on or block it entirely. If the browser blocks it, the game saves nothing and your progress ends when you close it.

Game files: Your browser loads the game, the puzzles and the music from the server hosting the game, some puzzles shortly before you open them. For technical reasons this server receives your IP address and request data such as time, requested file and browser information. Which domain delivers the game depends on where it is embedded. If the game is hosted on punktdev.com, Cloudflare delivers it as described in section 9. Fonts and images are part of the game; it contacts no other servers.

Game platforms: If you play Arrow Atelier on a game platform's website, the platform embeds the game. Whatever the platform itself processes, for example for its account, ads or statistics, is the platform's responsibility; its privacy policy applies.

Sharing: When you tap "Share", your browser creates the image on your device. Depending on your device, the share sheet opens, the image is copied to your clipboard or it is downloaded. You decide where it goes. We receive nothing.

Links: Links to these legal pages open in a new tab.

9. Links and these legal pages

The app opens links to the legal pages in a browser window inside the app (SFSafariViewController on iOS, Custom Tabs on Android). As with any page visit, the website receives your IP address and technical request data.

These legal pages are hosted on punktdev.com. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, delivers them on our behalf (Cloudflare Pages). With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. We do not keep access logs ourselves and do not analyse this data. What Cloudflare itself briefly retains for delivery and security is governed by Cloudflare's privacy policy.

punktdev.com sets no cookies and uses no analytics, tracking or advertising services. If you chose light or dark mode there, the page reads this setting (pdev-theme) from your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.

10. Contact by email

If you email us at info@rm-analytics.de, the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. Where we are legally required to retain a message, for example as a business letter under Section 257 of the German Commercial Code (HGB, usually six years), the legal basis is Art. 6(1)(c) GDPR. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.

You can also reach us at hi@punktdev.com or via the contact form in the legal notice. How we process these messages is described in the punktdev.com privacy policy (German).

11. Recipients and processing outside the EU

Apple and Google are independently responsible for the App Store, Google Play and the handling of purchases (section 5). We only share data with recipients who process it in line with the GDPR and protect it at least as well as described in this policy. You can request a copy of the safeguards at info@rm-analytics.de.

12. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); for ads you can do this directly in the app (section 6). The withdrawal does not affect the lawfulness of processing carried out before it.

Objection: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Your progress is stored only on your device. We therefore cannot view it, delete it for you or hand it over. You delete it by clearing the app data or uninstalling the app. You delete backups in iCloud or your Google account there. Data that Google processes for ads is held by Google; you can also contact Google directly about it.

You are not obliged to provide any data. Without the technically necessary connection data, however, the app cannot load ads or process purchases.

13. Changes and language versions

We update this policy when the app or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.