punktdev.com

Privacy Policy for BayGleam

App and website · Last updated: 27 October 2026 · Deutsche Fassung

1. Controller and principle

This policy applies to the BayGleam app, the website baygleam.punktdev.com and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: baygleam@punktdev.com.

BayGleam works without an account. If you want, you can watch short ad videos from Google AdMob and get a reward for it (section 5). The app contains no other third-party analytics, tracking or crash reporting services. What the store integration technically transmits to Apple or Google is described in section 4. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is suitable for all ages but is not specifically directed at children under 13.

2. Your progress on your device and in your iCloud

The app stores unlocked levels, stars and best scores, diamonds and boosters, lives, the daily bonus, the current round, language and your settings (music, sound, haptics, hints) on your device (on iOS also as a copy in your iCloud, see below), together with the transaction IDs of your purchases (section 4). For the free diamonds in the shop it remembers today's date and how many of these videos you have already watched today, so that the limit of three per day holds (section 5). This information is not sent to any server of ours either. It also keeps the last 20 technical errors. After a crash you can copy this error list together with the app version and device details to your clipboard yourself, for example to send it to us; nothing is sent automatically.

“Delete progress” in the settings resets your game progress. If a real-money purchase has already been credited, your entire current diamond balance and the purchase identifiers are kept. The language and the error list (at most 20 entries) are not deleted.

This storage is necessary for the game (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). On the device, the data remains until you clear the app data or uninstall the app. The next paragraph covers backups.

So that progress and diamonds survive a reinstall or a new device, on iOS the app keeps a copy of your game progress (including settings, purchase IDs and the free-video counter) in the iCloud key-value storage of your Apple ID, provided iCloud is active on your device. The language and the error list are not included. Apple stores this copy for you; we have no access to it. When you start the app again or on another device with the same Apple ID, it uses whichever of the two saves is newer. “Delete progress” also overwrites the iCloud copy. After uninstalling, the copy may remain in your iCloud. On Android, Google's automatic backup can back up your progress to your Google account if you have turned backup on in your device settings. Such a backup is only updated at Android’s next backup run. Both backups are managed by Apple or Google, not by us. The legal basis is Art. 6(1)(b) GDPR.

3. Internet connection

Levels, graphics and music are included in the app, and the game also works without internet. The app only uses a network connection for program updates (next paragraph), for the store (section 4), for ad videos and Google's consent request (section 5) and when you open a link to these legal pages in the settings or the shop. On launch, it asks the App Store or Google Play for the prices of the diamond packs and for purchases that have not been completed yet. In addition, at every launch it asks Google for the status of your ad consent (section 5). When you return to the app, it only asks the stores again for purchases that have not been completed yet. Without internet there are no videos; everything else keeps working.

Program updates: From version 1.0.10, the app asks our update server updates.baygleam.punktdev.com at launch and when you return to it whether a new version of its game code is available. It downloads such a version in the background, stores it on your device and uses it the next time you leave the app. Your progress is kept. The app transmits only the app identifier, the platform (iOS/Android), the app version, the name of the game code currently in use, the update channel, the identifier of the public key the app uses to verify updates and, for technical reasons, your IP address and usual connection details (the requested update file, the byte range for resumed downloads, a fixed app name as user agent and, on iOS, the language and possibly region setting in the HTTP header). The app does not create or send a device identifier for this. These updates serve exclusively to fix security vulnerabilities and significant bugs that impair the intended operation of the game. New features and other changes come through the stores. This is our legitimate interest (Art. 6(1)(f) GDPR). The access to version information and the storing of these fixes on the device that this requires are based on Section 25(2) No. 2 TDDDG. The update server runs on Cloudflare (section 8). It does not store the requests and keeps no access log (Workers Logs are disabled), and the update function sends no statistics to third parties. Cloudflare processes technical operating data under its privacy policy. If the server cannot be reached, the app keeps running with its current version.

4. App Store, Google Play and purchases

You get BayGleam from Apple's App Store or Google Play. Apple and Google process account, download and, where applicable, payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be available. Depending on your permissions and settings, the platforms may provide technical crash reports. This does not give us full card or bank details.

We use personal order, transaction and crash information from the stores solely to handle purchase and support questions. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR; our legitimate interest is handling support requests. We delete our copies after the case is closed, once they are no longer needed to establish or defend legal claims. Where statutory retention obligations apply, we retain the required data under Art. 6(1)(c) GDPR until those obligations expire.

You buy diamond packs directly in the respective store. We do not receive any card, bank or account data. The app receives the product ID, a transaction ID and the purchase status from the store. Once the store reports the purchase as successful, it credits the diamonds and then confirms the purchase with the store. It stores the transaction ID with your game progress on your device so that no purchase is credited twice. Pending payments are only credited once the store confirms them. Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.

On Android, the app uses the Google Play Billing Library for this. When the app uses the store functions, this library may automatically send technical diagnostic and usage data to Google, such as device and operating system version, app version, network type, and the results and errors of store requests. We do not receive this data. Google's processing is governed by Google's privacy policy.

5. Ads with Google AdMob

In BayGleam you can voluntarily watch short ad videos and get a reward for it. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is integrated through the software package @capacitor-community/admob, which contains the Google Mobile Ads SDK.

When ads appear: BayGleam shows no banners, no ads between rounds and no ads at launch. A video only plays when you tap for one yourself:

You only get the reward once AdMob confirms it. If you cancel the video or none loads, there is no reward. The app only allows ads rated G, that is, ads suitable for all ages.

Request at launch: At every launch the app first uses Google's User Messaging Platform (UMP) to ask whether consent is required in your region and what you have chosen so far. This tells the app whether it needs to show the "Ad consent" item in the settings. Google receives your IP address and technical information about the device and app. The app only starts the Google Mobile Ads SDK once Google reports that ads may be requested, that is, once you have consented or no consent is required in your region. Otherwise the SDK stays off. The app does not load any ads at launch. The legal basis for this request is Art. 6(1)(f) GDPR; our legitimate interest is to find out whether we need consent and then to obtain it properly.

Consent: When you tap a video for the first time, the app first shows Google's consent form, but only where Google requires it, that is, in the European Economic Area, the United Kingdom and Switzerland. The form follows IAB Europe's Transparency and Consent Framework (TCF). You can consent, not consent, or choose individual purposes and vendors under "Manage options". The SDK stores your choice on your device until you change it or uninstall the app. This storage is strictly necessary so that the app can respect your choice (Section 25(2) No. 2 TDDDG). Storing your choice as proof is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

What Google processes: For every video Google processes your IP address, device and app information (such as device type, operating system, app version and language) and how you interact with the ad (such as views, playback and clicks). The purposes are delivering the ad, limiting how often you see the same ad, preventing fraud and abuse, and measurement and billing. Depending on the platform and your consent, the SDK also collects app launches and other interactions, diagnostic and performance data about the app and the SDK, and device identifiers. Google describes the details in its data disclosure for the Google Mobile Ads SDK.

Personalisation: The app does not explicitly ask Google for non-personalised ads. If you consent, Google may select ads based on your interests and may also use data from other apps and websites for this. The legal basis is then your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you do not consent or consent only in part, Google, depending on your choice, serves non-personalised or limited ads, or none at all. In that case there is no video and no reward. Even for limited ads the SDK stores ad material and its own program code in the app's cache to play the video. If the "Programmatic limited ads" feature is active in AdMob, Google may also use local storage without consent to detect invalid traffic, fraud and abuse (Google Help on limited ads). Where Google serves ads without consent, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to give you the reward you asked for without a purchase.

Outside the European Economic Area, the United Kingdom and Switzerland the app shows no form. There Google may also serve personalised ads, as far as local law and your device settings allow. The legal basis for the transmission to Google is then Art. 6(1)(f) GDPR with the same legitimate interest.

Advertising ID: On iOS the app does not ask for permission to track (App Tracking Transparency). Apple's advertising identifier (IDFA) is therefore not available to the app or to Google. On Android the app does not request the advertising ID permission. From Android 13 onwards the SDK therefore receives no advertising ID; on older Android versions it may read it depending on your consent. On Android the SDK may also use the app set ID depending on your consent, an identifier that only applies within one developer's apps. You can reset or delete the advertising ID in the system settings.

Responsibility and third countries: We are responsible for integrating the SDK and for the transmission to Google. Google is itself responsible for any further processing. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). The ad and consent requests are encrypted via HTTPS. How long Google keeps the data and how Google uses it is described in How Google uses information from sites or apps that use our services and in Google's privacy policy.

Withdrawal and changes: Under Settings › Legal › "Ad consent" you can reopen the consent form. This item only appears where Google requires consent. There you can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). Processing that took place on the basis of your consent before the withdrawal remains lawful. If you do not tap any video, the app loads no ads.

6. Website

The website baygleam.punktdev.com is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. Cloudflare also processes technical operating data under its privacy policy.

The website baygleam.punktdev.com sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and images are served from our own server. If you open an external link, for example to a store, the privacy policy of that provider applies there. In Safari on iPhone and iPad, the browser shows a banner for the App Store listing based on a tag in the page code. Safari displays this banner itself; the website does not load any scripts or content from Apple for it.

These legal pages are hosted on punktdev.com, which is also delivered via Cloudflare. There the page reads any light/dark preference stored in your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.

7. Contact by email

If you email us, for example at baygleam@punktdev.com, the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.

8. Recipients and processing outside the EU

For the purposes described, these recipients receive data:

Apple and Google are independently responsible for the App Store and Google Play (section 4). You can request a copy of the safeguards at baygleam@punktdev.com.

9. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future (Art. 7(3) GDPR); for ads you can do this directly in the app (section 5). Processing carried out before the withdrawal remains lawful.

Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Because your game progress is stored only on your device and, where applicable, in your own iCloud or Google backup, we cannot view it, delete it for you or hand it over. You can delete it yourself: “Delete progress” resets it on the device and in the iCloud copy, while purchased diamonds are kept (section 2). You remove the data on the device completely by uninstalling the app; you manage backups in the settings of your Apple ID or Google account. Data that Google processes for ads is held by Google; you can also contact Google directly about it.

You are not obliged to provide any data. Without the technically necessary connection data, however, the app cannot load videos, process purchases or receive program updates from the update server; the game remains playable offline.

10. Changes and language versions

We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.