for the UnArrow app (iPhone and iPad) and its server · Last updated: 15 October 2026
This is a translation. The German version is the binding one.
In short
Write to this address with questions about privacy or to exercise your rights. Please include your support code (in the app under Settings and in your profile) so we can find your account. We never ask for passwords or access keys.
Legal basis: providing the game (Art. 6(1)(b) GDPR); App Attest to protect against fraud and tampering (Art. 6(1)(f) GDPR).
We store which levels you solved, with the sequence of moves and the time between them, the duration, mistakes, stars and points, along with the time, time zone and app version. We also store your items (such as hints and scissors) and how you used them, your designs, daily puzzles, festival puzzles, daily gifts and days played. This keeps your progress safe and brings it to all your devices, lets us check solutions for fairness and lets us give rewards.
Legal basis: Art. 6(1)(b) GDPR; fraud checks Art. 6(1)(f) GDPR.
The app sends pseudonymous, purely numeric game events, such as how often a level is started or abandoned. From them we compute statistics to balance the levels' difficulty. Figures summed up per day are anonymous.
Legal basis: our legitimate interest in a well-balanced game (Art. 6(1)(f) GDPR). You can object (section 7).
Legal basis: the league is part of the game (Art. 6(1)(b) GDPR); moderation, reports and the name history to protect players (Art. 6(1)(f) GDPR).
If you link your account with "Sign in with Apple", Apple gives us an identifier. The app does not ask for your name or e-mail address. We store a token from Apple, encrypted, so we can revoke the link when you delete your account. If the Apple ID already belongs to another UnArrow account, we merge your guest account into it.
Legal basis: Art. 6(1)(b) GDPR.
Purchases go through Apple's App Store; we never see your payment details. We store the transaction data (transaction identifiers, product, time, status and the receipt signed by Apple) and receive notifications from Apple, for example about refunds.
Legal basis: Art. 6(1)(b) GDPR; keeping the receipts Art. 6(1)(c) GDPR together with the retention duties of German commercial and tax law (§ 147 AO, § 257 HGB).
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) for personalised ads and access to your device; for limited ads our legitimate interest in financing the free game (Art. 6(1)(f) GDPR); rewards Art. 6(1)(b) GDPR.
Both notifications are off until you turn them on. The app schedules the daily reminder on your device and sends nothing to us for it. For the league note ("The league ends soon") we store your device's push token with its time zone, language and app version, and send the note through Apple's push service.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app under Settings › Notifications.
Achievements go through Apple's Game Center. Your Game Center data stays with Apple; our server receives nothing of it.
For photo puzzles you choose a photo from your library or take one with the camera. The photo and the puzzle made from it are processed and stored only on your device and never leave it, except in your own device backup. Our server only learns how many puzzles of your own you solved, for rewards.
For each request the server logs the method, path, status and duration and your network with a shortened IP address (IPv4 cut to its first three parts, IPv6 to its first three blocks). We delete these logs after 7 days. To limit requests and fend off overload and abuse, the server evaluates your full IP address, but only in memory and for at most one hour; it is not stored.
Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
We keep no access logs when you visit this page. It sets no cookies and loads nothing from third parties.
We pass on no other data unless the law requires us to.
Our server is in Germany. Google and Apple may also process data in the USA. They rely on the EU-US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) and on the Commission's standard contractual clauses.
| Data | Kept |
|---|---|
| Account, progress, league, reports and blocks | until you delete your account (section 6) |
| Previous own names | 90 days |
| Game events for analysis | 365 days |
| Daily activity for internal statistics | 35 days |
| Push registration | until you turn the league note off, at most 90 days after the device was last used |
| Signed-out sessions | 30 days |
| Server logs with shortened IP addresses | 7 days |
| Purchase receipts | 10 years (legal retention), after an account deletion no longer linked to the account |
| Backups | 30 days |
In the app under Profile › Delete account. At once we lock your account, end all sessions, delete push registrations, blocks and your current league memberships, and revoke the link with Apple. After 28 days we delete the account with all game data for good; from the backups the data disappears at most 30 days later. Purchase receipts are kept for the legal period without a link to your account, and reports you filed remain without any reference to you. On your device the app deletes all local data, your photo puzzles included.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)).
Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR; Art. 21 GDPR).
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: the data protection authority of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
We make no automated decisions with legal effects for you (Art. 22 GDPR).
If you are under 16, you may consent to personalised ads and tracking only with your parents' permission. Please ask them to answer the consent question together with you.
The app connects to our server only over encrypted connections (TLS). There are no passwords; we store access keys only as hashes. The server can only be reached for administration with an SSH key. Backups run daily to storage at Hetzner that can only be reached over SSH.
We update this policy when the app or the law changes. The version published here applies.