This Privacy Policy explains how the mobile game MUTALIX (the “Game”) handles information. The Game is developed and published by Hafenente, a sole proprietorship registered to Swen Grünwald, Grindelallee 110, 20146 Hamburg, Germany (“we”, “us”). By installing or using the Game you agree to this Policy.
The short version
- We keep data collection to what the Game needs to run, save your progress, show ads, and stay stable.
- Your game progress is backed up to the cloud automatically, under an anonymous, device-generated ID — you never create an account, and we never ask for your name, email, or a login.
- The Game uses Google AdMob for ads and Google Firebase for cloud save, analytics, crash reporting, and remote configuration.
- Analytics and crash reporting default to OFF. In the EEA/UK you see a consent dialog before they turn on; elsewhere they default on as permitted in those regions, and you can turn them off anytime in Settings. On iOS you also see Apple’s tracking prompt, which governs ad personalization.
- The Game is a general-audience app, not primarily directed to children — see Section 9.
Data we process, and why
| Purpose | Data | Processor | Legal basis (GDPR) |
|---|---|---|---|
| Run the Game & save progress on your device | Levels/stars, wallet, cosmetics, settings, consent choices | On device only | Contract (Art. 6(1)(b)) |
| Automatic cloud backup / restore of progress | Save data tied to an anonymous, device-generated user ID (no name/email/login) | Firebase Authentication (Anonymous) + Cloud Firestore | Contract (Art. 6(1)(b)) |
| Show ads to keep the Game free | Advertising identifier (e.g. IDFA), IP address, approximate (IP-based) location, device/app info, ad interactions | Google AdMob | Consent for personalized ads (Art. 6(1)(a)); legitimate interest for non-personalized/fraud prevention (Art. 6(1)(f)) |
| Understand and improve gameplay | Gameplay/funnel events, coarse device info, an app-instance ID, and the amount/currency of completed in-app purchases | Firebase Analytics (Google Analytics for Firebase) | Consent (Art. 6(1)(a)) |
| Diagnose crashes and stability | Crash stack traces, device/OS info, session breadcrumbs | Firebase Crashlytics | Consent (Art. 6(1)(a)) |
| Tune game balance without an update | No personal data (config values fetched to the device) | Firebase Remote Config | Legitimate interest (Art. 6(1)(f)) |
| In-app purchases (Remove Ads, DNA packs, Pass, cosmetics) | Purchase receipt / transaction (payment handled by Apple; we never see card data) | Apple App Store | Contract (Art. 6(1)(b)) |
| Leaderboards & achievements | Your score and Game Center player identity (managed by Apple) | Apple Game Center | Consent / your Game Center settings |
Advertising (Google AdMob)
To keep the Game free we display ads through Google AdMob. To serve, cap, and measure ads, Google’s SDK may process your device’s advertising identifier, IP address, approximate (IP-based) location, device/app information, and ad-interaction events. Whether ads are personalized depends on your consent and tracking choices (Section 5). We also cap the ad content itself to AdMob’s General audience content rating, so the ads served are appropriate regardless of who is playing. For details see the Google Privacy Policy and How Google uses information from AdMob apps.
Cloud save (Firebase)
So your progress survives a reinstall or new device, we automatically store it in Google Firebase (Firestore) under an anonymous ID generated on your device. This backup contains game progress only — no name, email, or login. Analytics and Crashlytics send diagnostic data only in line with the consent rules in Section 5. Firebase is a Google service; see the Firebase Privacy and Security page.
Your consent & tracking choices
- EEA / UK (GDPR): on first launch we show a Google-certified consent dialog (Google’s User Messaging Platform) covering ads and analytics. You can re-open it anytime via Settings → Privacy & Legal → Manage Consent.
- iOS App Tracking Transparency: the Game asks for tracking permission. If you decline, ads are non-personalized. Change it in iOS Settings → Privacy & Security → Tracking.
- Analytics & crash reporting: in the EEA/UK, collection begins only after you actively consent via the dialog above. Outside the EEA/UK, consent is treated as given by default, as permitted in those regions. Either way you can withdraw consent anytime via Manage Consent — collection stops going forward.
Data retention & deletion
On-device data is removed when you uninstall the Game. To delete your cloud backup, use Settings → Privacy & Legal → Request Data Deletion in the Game itself — this wipes your local progress and, on the next sync, your cloud backup too, automatically. No ID or account details need to be provided. If you can no longer access the Game (e.g. it’s been uninstalled) and still want your cloud backup removed, contact us — we can locate and delete it from the device/session details in your request. Analytics data is retained by Google for up to 14 months. For ad-related data use the controls in Section 5 and Google My Ad Center.
Your rights
Under the GDPR (EEA/UK) you have rights to access, rectify, erase, restrict, and port your personal data, and to object to processing and withdraw consent; under the CCPA/CPRA (California) you may access, delete, and opt out of “sharing” for personalized ads. Exercise these via the in-app controls above or by emailing us. You also have the right to lodge a complaint with a supervisory authority — in our case the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).
International transfers
Google and Apple may process data in countries outside the EEA, including the United States, under the safeguards described in their policies (e.g. EU Standard Contractual Clauses / the EU–US Data Privacy Framework).
Children
The Game is a general-audience app and is not primarily directed to children. Because the Game has no accounts or sign-up, it never asks for or collects a birthdate, age, name, email, or login from any player — so we cannot and do not apply different ad or data rules based on a player's age. Every player sees the same general-audience-rated ad content (Section 3) and the same consent-driven ad-personalization settings (Section 5), regardless of who is playing. If you believe a child has used the Game and have concerns about their data or the ads shown to them, contact us and we will address it.
Changes to this Policy
We may update this Policy as the Game evolves or as required by law. Material changes are reflected by the “Last updated” date above.