punktdev.com

Privacy Policy for LaneLume

App and website · Last updated: 29 October 2026 · Deutsche Fassung

1. Controller and principle

This policy applies to the LaneLume app, the website lanelume.punktdev.com and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: lanelume@punktdev.com.

LaneLume works without an account. We do not build in any analytics or tracking services of our own. From version 1.2.0 there is an optional ad video to keep going via Google AdMob (section 4), whose software also sends diagnostic data to Google, and a one-time purchase (section 5). We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is suitable for all ages but is not specifically directed at children under 13.

2. Your progress stays on your device

The app stores your best score, the level you reached, the crystals collected across all runs, unlocked and selected looks, your daily challenge progress and streak, whether you have played the tutorial, the number of runs, whether you own LaneLume Plus, your answer to the age question before the ad video (section 4), when the app last asked for a rating, and your settings for difficulty, graphics, music, sound effects and mute only on your device.

This storage is necessary for the game (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). The data remains until you clear the app data or uninstall the app. Depending on your device settings, operating system backups (iCloud or Google) may contain a copy; these are managed by Apple or Google, not by us.

3. Internet connection and app updates

Graphics, music and sounds are included in the app, and the game works entirely without internet. Only the check for bug fixes (see below), the ad consent check at launch, the optional ad video and buying LaneLume Plus need a connection (sections 4 and 5).

When your device is online, the app asks our update server at updates.lanelume.punktdev.com whenever it is opened or brought back to the foreground whether a new version of the game code is available, for example a bug fix. If so, it downloads it in the background and activates it the next time you send the app to the background, never during a running round. The server runs on Cloudflare (section 9). With this request it receives your IP address, the operating system (iOS or Android), the app identifier, the app version, the version of the game code currently running and the update channel. As usual for internet connections, the request's user agent also contains the app identifier, the version of the update function and the operating system version. The app does not send a device, account or advertising identifier, and it does not send your game progress. The device identifier field contains the same zero value on every device.

The server uses the operating system, app version, running game code and channel to pick the matching update. It does not evaluate the user agent details. It stores none of this. Access logs (Workers Logs) are turned off for it. What Cloudflare itself processes when delivering the response is described in section 7 and applies here in the same way. Downloaded updates are stored on your device, and the app deletes older versions itself. If an update does not start properly, the app returns to the previous version and keeps the failed update marked as faulty so that it does not download it again. Deleting the app data or the app removes all of it. If the server cannot be reached, you keep playing with the version you have.

We use this function only for bug fixes without which the installed version does not work properly, for example when a level gets stuck, a button does not respond or progress gets lost. New content, features and visual changes still come as a new version through the App Store or Google Play. For this the server picks the fix matching your app version based only on the operating system, app version, running game code and channel, and the app stores the updates on your device. This is strictly necessary for the game you use (Section 25(2) no. 2 TDDDG). The legal basis for processing the IP address and these details on the server is Art. 6(1)(f) GDPR. Our legitimate interest is fixing bugs quickly and keeping the game working. In our assessment your interests do not override this: the server receives no identifier that recognises you or your device, it stores nothing, and no profile is created. If you do not want this, you can play offline; the game then keeps running with the version you have.

4. Video to keep going (Google AdMob)

From version 1.2.0 you can choose to watch an ad video after a crash to continue your run. A video only starts when you tap “Keep going” yourself. LaneLume has no banners and no ads that appear on their own. With LaneLume Plus (section 5) you don't need videos.

The videos are provided by Google AdMob, a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Every time the app starts, it uses Google's consent service (User Messaging Platform) to ask Google whether consent is required in your country and whether your stored choice is still valid. This happens even if you never watch a video, and also with Plus, but not if you answered No to the age question. Google receives your IP address, technical device and app information such as operating system and app ID, and the state of your stored choice. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to request ads only within your choice and to obtain the required consent properly. Storing your choice on the device is strictly necessary for this (Section 25(2) No. 2 TDDDG).

The app only shows the consent dialog when you want to watch a video and no valid choice is stored: the first time, and again when Google asks for your choice anew after some time. Google's software stores your choice on your device until you change it, clear the app data or Google asks again. In the EEA, the UK and Switzerland you can change or withdraw it at any time in the app under Pause, Info, “Ad privacy”. The app then discards any video already loaded; it loads the next one according to your new choice.

In the EEA, the UK and Switzerland the app only starts the ad software and loads a video when you tap “Keep going”. Where no consent is required, it loads one in the background in advance so it is ready right after a crash: when the app starts, when a run starts and after a video you watched. With Plus the app loads no videos. When loading and playing a video, Google processes your IP address (and an approximate location derived from it), device and app information such as model, operating system and app version, device identifiers, information about the ad shown and how you interact with it (for example whether you tap or close it), app launches and interactions in the app, app performance data, and diagnostic and crash data of the ad software. Google uses this data to deliver and measure ads, for analytics and to prevent fraud.

On Android the identifiers are the device's advertising ID, where your device and privacy settings allow it, and the app set ID, which only applies to one developer's apps. On iOS it is an identifier that only applies within our apps. Google may also create and store on the device its own identifier that only applies within one developer's apps (publisher first-party ID). The app does not read Apple's advertising identifier (IDFA) and does not ask for permission to track across apps. LaneLume only requests non-personalised ads on all devices. Google then picks the video based on context, such as the app and approximate location, not on a profile of you. If you decline, Google may show limited ads, for which Google says it uses no advertising identifiers, or no video may be available. The game carries on either way.

Non-personalised ads also store and read information on your device, for example for frequency capping, fraud prevention and ad reporting. In the EEA, the UK and Switzerland this only happens with your consent (Section 25(1) TDDDG), and Google's subsequent processing is also based on it (Art. 6(1)(a) GDPR). Without consent, we use Google's programmatic limited ads there. In this mode Google caches the video on the device for technical reasons and, according to Google, uses cookies or local storage only to prevent fraud and abuse. Because in this case the app only loads the video when you request it yourself, and Google does not deliver ads in this mode without this protection, we rely on Section 25(2) No. 2 TDDDG. The legal basis for the processing is then Art. 6(1)(f) GDPR; our legitimate interest is funding the free game through videos people choose to watch and protecting ad delivery against fraud. Outside these regions Google shows no consent dialog, and the app loads the video in advance. Where the GDPR applies to this, we also rely on Art. 6(1)(f) GDPR with the same legitimate interest.

Before the consent dialog appears for the first time, the app asks whether you are 16 or older. It stores the answer only on your device (Section 25(2) No. 2 TDDDG). If you choose No, the app shows no consent dialog, no longer checks with Google at launch and loads no videos. You can then only keep going with LaneLume Plus. To change your answer, clear the app data or reinstall the app.

Google processes this data as an independent controller, including in the USA (certified under the EU-US Data Privacy Framework). How long Google keeps advertising data depends on its type. According to Google, it anonymises advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months. Details are in “How Google retains data”, “How Google uses information from apps” and the Google Privacy Policy. Withdrawing consent applies to the future. Google deletes what it has already received according to its own retention periods. We only receive aggregated figures on videos and revenue, no data about you.

5. LaneLume Plus (one-time purchase)

From version 1.2.0, LaneLume Plus is available as a one-time purchase in the App Store or on Google Play. Apple or Google handle the purchase as independent controllers (section 6). We do not receive your payment method or information about your store account. The app does receive purchase data from your device's purchase interface: product ID, purchase status, purchase time, transaction ID and, on Android, also the purchase token and order number. It only evaluates this on the device to unlock Plus and, on Android, to acknowledge the purchase to Google, and sends it to no server of ours. This is how it checks at launch and when you return to the app whether you own Plus, so purchases come back after a reinstall and refunds are taken into account. The app also remembers on your device that Plus is active so it works offline. The legal basis is Art. 6(1)(b) GDPR; storing this on your device is necessary for the service you bought (Section 25(2) No. 2 TDDDG).

In the Google Play Console we can see individual orders with order number, date, product, amount and status; Apple only shows us aggregated sales figures. We only use order data for refunds, support requests and our accounting (Art. 6(1)(b) and (c) GDPR) and keep it as long as statutory retention obligations require.

6. App Store, Google Play

You get LaneLume from Apple's App Store or Google Play. Apple and Google process account, download and, where applicable, payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated download and usage figures. Depending on your permissions and settings, the platforms may provide technical crash reports. We do not receive data about your store account or payment method; what we see about purchases is described in section 5.

We use crash reports from the stores only to find and fix errors in the app and to answer support questions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a stable app and handling support requests. We delete our copies once the error is fixed or the request is closed and they are no longer needed to establish or defend legal claims.

After a new best score the app may call the system rating feature (StoreKit on Apple devices, the Google Play In-App Review feature on Android), at most once every 120 days. To do this it remembers on your device when it last asked. The call goes to Apple or Google; the platform decides whether a dialog appears. If you submit a rating there, it goes directly to Apple or Google and is processed under their responsibility. We do not learn whether the dialog was shown or whether you rated; we see public reviews in the store like everyone else.

7. Website

The website lanelume.punktdev.com is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. We therefore do not store this data ourselves. Cloudflare processes it to deliver the page and keeps technical operating and security data only as long as necessary to run and protect the service; details are in Cloudflare's privacy policy.

The website lanelume.punktdev.com sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts, images and videos are served from our own server. In Safari on iPhone and iPad, a banner pointing to the app in the App Store may appear at the top; Safari loads the app name and icon for it directly from Apple, and we receive no data from this. If you open an external link, for example to a store, the privacy policy of that provider applies there.

These legal pages are hosted on punktdev.com, which is also delivered via Cloudflare. There the page reads any light/dark preference stored in your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.

8. Contact by email

If you email us, for example at lanelume@punktdev.com, the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. Where we are legally required to retain a message, for example as a business letter under Section 257 of the German Commercial Code (HGB), the legal basis is Art. 6(1)(c) GDPR. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.

9. Recipients and processing outside the EU

We use these service providers for the purposes described:

Apple and Google are independently responsible for the App Store and Google Play (section 6). You can request a copy of the safeguards at lanelume@punktdev.com.

10. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future.

Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Because your game progress is stored only on your device, we cannot view it, delete it for you or hand it over. You can do that yourself in the app or on your device.

11. Changes and language versions

We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.