LEGAL · APP

App privacy policy

Contents

1. 1. Controller
2. 2. Summary
3. 3. Data on your device
4. 4. Installation and crash reports via Google Play
5. 5. Advertising with Google AdMob (Play and iOS versions)
6. 6. In-app purchases (Play version, if offered)
7. 7. Update notice in the beta version
8. 8. Links and contact
9. 9. App permissions
10. 10. Children
11. 11. Data security
12. 12. Your rights
13. 13. iPhone version (iOS)
14. 14. Changes

Last updated: 19 October 2026

This policy applies to the game “RIFT HAUL: Salvage Protocol” for Android and iPhone, specifically:

• the version from the Google Play Store (“Play version”),
• the beta version that selected testers receive directly via rifthaul.home-it.site (“beta version”),
• the iPhone version from the App Store and from Apple's TestFlight beta programme (“iOS version”, section 13).

Our website is covered by the website privacy policy.

1. Controller

Kevin Bethge, Mittelweg 1A, 38268 Lengede, Germany
Email: kontakt@home-it.site

2. Summary

• No account, no sign-in. Your progress and settings are stored only on your device. We receive none of it.
• No analytics or tracking tools of our own. The optional game statistics stay on your device and are never uploaded. Data only goes to third parties in connection with Google Play and advertising (sections 4 to 6) and, for the iOS version, in connection with Apple and advertising (sections 5 and 13).
• No permissions for location, contacts, camera, microphone or files.
• Ads only if you want them: in the Play and iOS versions you can choose to watch short video ads to earn a reward. We use Google AdMob for this. In the Play version you decide in a consent dialog whether your data may be used for personalised advertising (section 5). The iOS version shows only non-personalised ads and no consent dialog (section 13).
• Purchases, if offered, are handled by Google Play. We do not receive any payment data (section 6).
• The beta version contains no ads and no purchases, but checks at start whether a newer beta exists (section 7).
• Like the Play version, the iOS version offers optional video ads (Google AdMob), but no purchases. It requests only non-personalised ads, does not use an advertising ID and does not track you across apps and websites of other companies (section 13).

3. Data on your device

The app stores locally on your device:

• your game progress, unlocked content and achievements,
• your settings (e.g. language, volume, controls),
• in the Play version, your choice in the consent dialog (section 5) and purchase confirmations (section 6),
• if you switch it on (Settings → Privacy), anonymous game statistics. These are simple counters only, e.g. how often missions were started or completed, with no identifiers and no timestamps.

This data is not sent to us and we have no access to it. In the Play version, the app passes only your choice in the consent dialog to the ads SDK so that Google respects it with every ad request (section 5); the iOS version passes none of this data to the ads SDK. It stays stored until you reset your progress in the app or uninstall the app. The app is excluded from automatic Android backup, so this data is lost when you uninstall the app or switch devices. You can unlock purchased content again via “Restore purchases” (section 6).

4. Installation and crash reports via Google Play

When you install the app from Google Play, Google processes data for this under its own responsibility, e.g. your Google account, your device and the installation. Google's privacy policy applies (https://policies.google.com/privacy).

If you have agreed in your Android settings to share usage and diagnostics data with Google, Google provides us with crash and performance reports in the Google Play Console. These contain things like the device model, Android version, app version and the error trace, but nothing that would allow us to identify you. We use them solely to fix bugs and do not store them outside the Play Console. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a bug-free app.

5. Advertising with Google AdMob (Play and iOS versions)

This section applies to the Play version and the iOS version. The iOS version shows no consent dialog and requests only non-personalised ads; details specific to it are in section 13. What this section says about the consent dialog and personalised advertising applies only to the Play version.

What happens: at certain points the app offers you an optional video ad:

• after a mission, for extra credits,
• after a defeat, for a rescue.

A video only starts if you tap it. There are no banners and no ads that appear on their own. No ads are offered during your first session or during the training.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Consent dialog (Play version): when the Play version starts, the app asks Google whether consent is required for you; this transmits your IP address to Google. In the European Economic Area, the United Kingdom and Switzerland the app then shows Google's consent dialog (User Messaging Platform, IAB Transparency and Consent Framework). There you decide whether, and for which purposes, Google and its partners may store or read information on your device and use your data, e.g. for personalised advertising. The list of partners is shown in the dialog. You can also decline there. Your choice is stored on your device until you change it or uninstall the app. You can change or withdraw it at any time under Settings → Privacy & consent options. The legal basis for the request and for storing your choice is Art. 6(1)(f) GDPR (our interest in obtaining consent properly and being able to prove it) and Section 25(2) no. 2 TDDDG.

Data processed: according to Google, the Google Mobile Ads SDK processes in particular:

• the IP address, from which an approximate location can be derived,
• device and advertising identifiers (on Android, the advertising ID and the app set ID; for the iOS version, see section 13),
• device and app information (model, operating system, language, app version),
• ad interactions (impressions, clicks, whether a video was watched to the end),
• SDK diagnostic data, e.g. on app performance.

We only receive aggregated statistics from Google, e.g. the number of impressions and the revenue, but no data that identifies you.

Purposes and legal bases (Play version; for the iOS version, see section 13):

• With your consent: if you consent, the app starts the ads SDK after your choice and preloads one video in the background so it is ready when needed. Google and its partners may then, within the scope of your consent, store and read information on your device and use your data for personalised advertising and its measurement. Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
• Without consent: if you decline, Google may still serve non-personalised or limited ads. In that case Google only processes the data required to deliver ads, limit how often they are shown and detect fraud and abuse. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is financing the free game through voluntarily watched ads.

Responsibility: we are responsible for integrating the SDK into the app and for the resulting transmission of your data to Google. Google alone is responsible for any further processing. How Google uses data from apps that use its services is explained at https://policies.google.com/technologies/partner-sites. How long Google retains data is explained at https://policies.google.com/technologies/retention.

Transfer to the USA: data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is covered by the European Commission's adequacy decision (Art. 45 GDPR).

Resetting or deleting the advertising ID (Android): you can do this in your Android settings, usually under Privacy → Ads (the name may differ depending on the device).

6. In-app purchases (Play version, if offered)

If you buy optional content in the app, Google Play handles the purchase and payment under its own responsibility. Google's terms and privacy policy apply. We do not receive your payment data.

The app receives a purchase confirmation from Google Play (product, order number, purchase token). It uses this to unlock the content and to unlock it again via “Restore purchases”. The app stores this confirmation only locally on your device; it is not sent to us. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

For accounting purposes, Google provides us with details of each purchase in the Play Console, e.g. order number, product, price, date and country. We keep these for as long as tax and commercial law requires (usually up to ten years, Section 147 of the German Fiscal Code, AO). Legal basis: Art. 6(1)(c) GDPR.

7. Update notice in the beta version

Each time it starts, the beta version loads a small version file from rifthaul.home-it.site to tell you about newer beta versions. This also happens when you tap “Check for updates” in the settings.

• No identifiers, save data or device data are transmitted.
• Our server only records the usual technical access data (including IP address, time, requested file and the app identifier in the user agent). It deletes this data after 7 days.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is informing testers about bug fixes.
• If you tap “Download”, the tester area of our website opens in your browser. There, the website privacy policy applies (section “Beta test”).

The Play version does not contain this check.

8. Links and contact

If you tap a link in the app, e.g. to this policy, your browser opens. The pages you visit there are covered by the privacy policy of their respective provider; our website is covered by the website privacy policy.

If you send us an email, e.g. with a question about the game or a purchase, the section “Contact by email” of the website privacy policy applies.

9. App permissions

Google's libraries bring further technical permissions, e.g. for scheduling background tasks. The app does not use them to collect any further data.

The table refers to Android. The iOS version does not request any permissions (section 13).

10. Children

The app is not directed at children under 13. Personalised advertising exists only in the Play version and only with consent. For users under 16, this consent must be given or authorised by their parents under Art. 8 GDPR. If you are under 16 and your parents have not agreed, please choose “Do not consent” in the consent dialog. You can still play everything and watch video ads voluntarily. The iOS version shows only non-personalised ads anyway and does not ask for consent (section 13).

11. Data security

• All of the app's connections (ads, consent dialog, purchases, beta update notice) are encrypted (HTTPS/TLS).
• We do not operate a server of our own for the Play version or the iOS version; the app does not send any data to us.
• Data on your device is kept in the app's protected storage, which other apps cannot access.
• Access to the Google Play Console, AdMob and App Store Connect is used only by the controller and protected by Google's 2-Step Verification or Apple's two-factor authentication.

12. Your rights

You have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20).

You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). For advertising in the Play version, you can do this directly in the app under Settings → Privacy & consent options; the iOS version does not ask for consent.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). For advertising in the iOS version, it is enough not to tap any video ads: unless you tap one, the app loads no ads and no data is transmitted to Google for this purpose (section 13).

To exercise these rights, contact kontakt@home-it.site.

We do not receive any data from the app itself that identifies you. We can therefore mainly provide information about the purchase details in the Play Console (section 6; please tell us your order number), the beta access data (section 7) and emails you have sent us. For data that Google or Apple process under their own responsibility (sections 4 to 6 and 13), please contact Google or Apple directly.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen (Data Protection Commissioner of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

Further information: you are not legally or contractually obliged to provide us with any data. However, video ads cannot be shown and purchases cannot be processed without transmitting your IP address to Google. No automated decision-making within the meaning of Art. 22 GDPR takes place. If you have consented to personalised advertising in the Play version, Google may use your data to build interest profiles (section 5).

13. iPhone version (iOS)

This policy applies to the iPhone version from the App Store and from TestFlight (“iOS version”), with the following specifics.

Advertising: Like the Play version, the iOS version offers optional video ads in the same places. Since version 1.1.0 (build 42) it shows no consent dialog from Google and requests only non-personalised ads; the setting “Privacy & consent options” does not exist in the iOS version. The app loads no ads and does not start the ads SDK when the game starts: an ad is only requested and shown after you tap a video ad; before that, no data is transmitted to Google for this purpose. A consent stored by earlier test versions is deleted by the app at start. Because the app does not send Google any consent, Google states that in the European Economic Area, the United Kingdom and Switzerland it serves only so-called limited ads. For these, Google uses no identifiers on your device and does not use your data for personalised advertising; to detect fraud and abuse, Google may store and read information on your device. The legal basis for delivering the requested video is Art. 6(1)(f) GDPR; our legitimate interest is financing the game free of charge through voluntarily watched ads. Where information is stored on or read from your iPhone for this, this is based on Section 25(2) no. 2 TDDDG, because it is necessary for the video you requested. Outside these areas, Google may also use information on your device for non-personalised ads, for example to limit how often an ad is shown.

No tracking request, no advertising ID (IDFA): The iOS version does not ask for permission to track you across apps and websites owned by other companies (“App Tracking Transparency”). For this reason, neither the app nor Google has access to your iPhone's advertising identifier (IDFA). There is no personalised advertising in the iOS version. The SDK also processes the other data listed in section 5 on the iPhone (IP address and the approximate location derived from it, details of the device and app, interactions with ads, and the SDK's diagnostic and performance data).

No purchases, no update notice: The iOS version offers no purchases and does not contain the beta version's update notice. Sections 6 and 7 do not apply to it. Apart from advertising, the iOS version makes no internet connections. It contains no analytics or tracking tools of our own.

Data on your iPhone: As described in section 3, the app stores your progress, your settings and, if switched on, the anonymous game statistics only in your iPhone's protected app storage. This data is not sent to us. It is deleted when you reset your progress in the app or delete the app. If you made a choice in the consent dialog in an earlier test version, the app deletes it when you start version 1.1.0 (build 42). If iCloud Backup is turned on for your iPhone, Apple backs up this app storage to your iCloud account. Apple does this under its own responsibility; we have no access to it. You can manage what is kept in your iCloud Backup in your iPhone's iCloud settings.

Installation via the App Store and TestFlight: When you install the app from the App Store or via TestFlight, Apple processes data for this under its own responsibility, e.g. your Apple Account and details of your device. Apple's privacy policy applies (https://www.apple.com/legal/privacy/).

Crash reports from Apple: If you have switched on “Share With App Developers” on your iPhone under Settings → Privacy & Security → Analytics & Improvements, Apple provides us with crash reports and aggregated usage statistics. These include, for example, the device model, iOS version, app version and the error trace, but nothing that would allow us to identify you. We use them only to fix bugs. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a bug-free app. You can switch this off at any time in the same place.

TestFlight (testers only): If you take part in a test via TestFlight, Apple provides us with details of your participation, for example the device model, iOS version, installs, sessions and crashes of the test version. If you join via our public link, Apple does not tell us your name or email address; you appear to us as “anonymous”. Only if we invited you to TestFlight by email do we also see your name and email address. They also include any feedback and screenshots you send via TestFlight, and your email address if you provide it there. We use these details only to run the test and fix bugs, and we only access them via App Store Connect and Xcode. These details remain there for as long as you take part in the test. If you leave the test or it ends, we remove you as a tester and delete your feedback once we no longer need it to fix bugs. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the app before its release. You can leave the test at any time in the TestFlight app. If we invited you by email, you can also ask us to remove you (kontakt@home-it.site).

Permissions: The iOS version does not request any permissions, e.g. for location, contacts, photos, camera, microphone or tracking. Haptic feedback in the game needs no permission.

Links and your rights: Section 8 applies to links in the app and section 12 to your rights. We do not receive any data from the iOS version itself that identifies you. We can therefore mainly provide information about TestFlight details and emails you have sent us. If you joined via the public link, we usually cannot link the TestFlight details to you (Art. 11 GDPR).

14. Changes

If the app changes in a way that means different data is processed, we will update this policy. This applies, for example, when new features or providers are added. The version published here applies; its date is shown at the top.