Privacy notice

1. Controller and contact

The operator is Jan Saurer, based in Germany. Acids Studio is the games brand of Acids Media. The operator’s full address and contact information are available in the Acids Media legal notice (German).

Jan Saurer / Acidsstudio
Privacy enquiries: acidsstudio@gmail.com

You can use this address for questions about this notice or processing by the operator. Information about independent processing by Google, PayPal and GitHub is also available in their privacy notices linked below.

2. Local saves and backups

The app uses shared_preferences to store data in local app storage. This includes:

• highscores, experience points and diamonds;
• mission stars, unlocks, talents, research and achievements;
• tutorial progress and language, audio and display settings;
• the status of the “Ad-free” option (unlocked, source of the unlock and time);
• dates and times, daily advertising limits and reward receipts that prevent duplicate credits.

These data support saved progress, settings and correct reward allocation. The audited app has no operator-run server receiving the complete game save. Transmission of Endless scores to Google Play Games is described in section 5.

Android/Google backups: Depending on your device, operating system and backup settings, Android or Google may back up app data or transfer it to another device. The app does not expressly disable these backups. We therefore cannot assure you that local data will always remain exclusively on the original device. You can manage backup settings through your device or Google account.

3. Advertising and privacy choices

QuaTD uses Google AdMob / Google Mobile Ads for optional rewarded ads. These may be offered for diamonds, talent respec, a Daily Case bonus or an additional reward after a Highscore Run. Watching an ad is not required for the basic game. The audited integration contains no banner, interstitial or app-open ads.

Builds configured for production use live rewarded ads from Google. Only builds explicitly created with test configuration use Google test ads. Distribution through an internal or closed testing track does not automatically disable live ads. Test ads may also involve data processing by the advertising SDK. While the “Ad-free” option (section 4) is active, the app requests no ads.

According to Google, the Mobile Ads SDK may in particular process:

• IP addresses, from which an approximate location may be inferred;
• interactions with the app and advertising, such as views, clicks and video views;
• technical diagnostic and performance data;
• advertising IDs, app set IDs and, where applicable, other device- or account-related identifiers.

Google identifies advertising, analytics and fraud prevention as purposes. Processing in an individual case depends in part on SDK, account and privacy settings. In the audited ad request, the app does not supply a separate QuaTD account ID. Starting with version 1.0.16 (23), it transmits the age-related protection signals described below to Google.

Age group from version 1.0.16 (23): Before the first ad request, you can optionally choose a group: under 16, 16–17, or 18 and over. The app does not ask for your date of birth. It stores the group, or your choice to continue without ad requests, in local app storage. It derives protection signals for Google: the stricter child treatment and the UMP under-age-of-consent flag for under 16, teen treatment for 16–17, and no additional age restriction for 18 and over. These signals are transmitted with the corresponding Google requests and may convey information about your age group. For all groups, the app limits requested ad content to Google’s G rating.

Without an age selection, the app requests no ads; the basic game remains playable, but optional video bonuses are unavailable. The purchased “Ad-free” option retains its direct rewards. In Settings → Ad privacy, you can change your selection or turn off further ad requests. This does not retroactively delete data already transmitted to Google. This choice concerns advertising; Play Games, purchases and externally opened services have separate flows.

Preloading: Ads may be requested when you open a related screen. Data processing therefore does not necessarily begin only when you tap “Watch ad”.

For live ads, the app uses Google User Messaging Platform (UMP): it requests consent information, displays the configured form when required and then checks whether ads may be requested. Whether a form appears and which form is shown depends in particular on your region, previously saved choices and the Google configuration. The form presents the privacy choices available to you. Whether ads may subsequently be requested and which ads are available depends on those choices and permission returned by UMP. Non-personalised and limited ads are different serving modes; both may still involve processing personal data. The form is only requested when a rewarded ad is requested. Explicit test ads use a separate flow without this UMP form. The audited ad request does not enforce a general “non-personalised ads only” setting.

When UMP requires additional privacy options, the app provides access in the relevant reward screens. You can reopen the available choices there. You can also manage the advertising ID through the applicable Android settings.

Further information: Google Privacy Policy, Mobile Ads SDK data processing and Google UMP.

4. “Ad-free” purchase through Google Play

You can optionally buy the “Ad-free” option as a one-time in-app purchase. Purchase and payment are handled entirely by Google Play Billing. Payment details such as card or account information are not entered in QuaTD, and the app does not receive them. Google processes the data needed for the purchase under the Google Privacy Policy and the Google Play terms.

The app receives a purchase confirmation from Google Play, including a purchase identifier, and acknowledges the purchase to Google. Locally it stores only that the option is unlocked, where the unlock came from and when it was saved. The app checks purchase status with Google Play, including at startup, when returning to the app and when restoring a purchase. This allows it to restore a valid purchase after reinstallation or on another device and to reflect a loss of entitlement confirmed by Google. A connection failure alone does not remove the locally saved entitlement. QuaTD does not run its own server for purchases.

While the option is active, the app requests no ads and does not call up an advertising consent form. Rewards are credited directly; the daily limits stay the same. The Google Mobile Ads SDK remains part of the app. Test versions may use a clearly labelled simulated test purchase that charges nothing and has no connection to Google Play Billing.

More information: Google Privacy Policy and Google Play — purchases and refunds.

5. Google Play Games

On Android, Google Play Games Services v2 is integrated for sign-in and the Endless leaderboard. The SDK is initialised when the app starts, if available and configured. The app checks authentication status and offers sign-in through the leaderboard feature. Google sign-in is not required for normal gameplay.

The app uses the Play Games player ID for association and to detect an account change. After a valid completed Endless run, its final score is submitted to Google if connected. Completing missions or merely loading a saved local highscore does not trigger this submission. The leaderboard opens in Google's own interface.

QuaTD has no separate password-based account system. The audited flow does not read Google passwords, email addresses, friend lists or Google cloud game saves. Google additionally processes its own profile, analytics and diagnostic data for Play Games. Visibility of your profile and game information depends on your Google profile settings.

Deleting local progress does not remove leaderboard data already stored by Google. You can separately manage or delete your Play Games data through your Play Games profile or Google account. Further information: Google Play Games — data processing and deletion.

6. Voluntary support through PayPal

If you select the PayPal support link, the app opens PayPal through an external handler, such as your browser. There is no PayPal SDK, no payment processing within QuaTD and no in-game benefit in return. The app does not receive or store payment status or payment details through this flow.

When you visit PayPal and make a voluntary payment, PayPal processes data under its own terms. Outside the app, the recipient may receive information about the payment and the payer. The specific information depends on the PayPal transaction; this notice therefore does not claim that payments are anonymous. See the PayPal Privacy Statement.

7. Email support

After you choose the contact button, it opens a draft in an email application addressed to acidsstudio@gmail.com, with the subject “QuaTD Feedback”. QuaTD does not send this message itself and, in the audited flow, does not automatically attach game saves or diagnostic reports.

If you send the message, your sender address, message content and information you attach are processed by the email services involved and the recipient to handle your enquiry. You decide what further information to provide.

8. Permissions and technical data

The Android app has internet/network permissions and SDK permissions for advertising identifiers and Android advertising services, plus the Google Play Billing permission for the “Ad-free” purchase. The audited release manifest contained no access permissions for precise device location, contacts, camera or microphone. Approximate location may nevertheless be inferred from an IP address.

The app writes technical status and error messages, for example about ads, Google authentication and score submission, to local diagnostic output. No operator-run remote log upload or analytics backend was identified. Firebase, Firebase Analytics and Crashlytics are not present in the audited integration. This does not exclude diagnostic or analytics processing by the Google SDKs themselves.

Fonts and game media are distributed with the app. Automatic downloading of Google Fonts is disabled. The version display reads the running app's version and build number; it does not call a separate web service for this purpose.

9. Retention and deletion

Local progress remains stored for later play sessions. “Reset Progress” deletes the designated progress data; it does not remove all language, audio and other settings or external account connections. Android also provides functions to clear app data or uninstall the app. Existing backups and data held by external services may remain separately. The “Ad-free” purchase stays linked to your Google account; a local reset does not remove it, and Google Play continues to record it.

Data independently processed by Google, PayPal or GitHub is subject to their respective retention and deletion procedures. The app cannot erase all such data through a local reset.

Support correspondence: Resolved support emails are deleted no later than six months after the request is closed. If a message is still needed for an open case or to meet a statutory retention obligation, only the content necessary for that purpose is retained until that reason no longer applies.

Payment records: Payment and accounting records available to the operator are retained separately from ordinary support correspondence where and for as long as statutory retention obligations apply. The retention period depends on the type of record and the applicable tax and commercial-law requirements. The data are then deleted unless another statutory retention requirement applies. For access and erasure requests, use the privacy contact in section 1.

10. Legal bases and your rights

The operator is based in Germany. Processing by the operator relies in particular on the following legal bases under the General Data Protection Regulation (GDPR):

• Gameplay, saved progress and settings: Article 6(1)(b) GDPR where necessary to provide the game functions you request.
• Ad-free purchase, purchase acknowledgement and restoration: Article 6(1)(b) GDPR to carry out the purchase and provide the purchased feature.
• Requested Play Games functions: Article 6(1)(b) GDPR for associating your player profile and submitting an Endless score to the selected leaderboard. Google also processes SDK and account data as an independent controller under its privacy notices; technical SDK data may be processed during initialisation before an explicit sign-in.
• Consent-dependent advertising: Article 6(1)(a) GDPR for processing for which the privacy form requests your consent. You can change choices through the available privacy options. Processing by Google and advertising partners also depends on the purposes and legal bases identified in that form. Selecting non-personalised advertising does not mean that no data are processed.
• Support: Article 6(1)(b) GDPR where your request concerns a purchase or provision of the service; Article 6(1)(f) GDPR for general enquiries. The legitimate interest is answering enquiries and resolving problems.
• Voluntary support and accounting: Article 6(1)(b) GDPR for handling a contribution you initiate, insofar as the operator receives data; Article 6(1)(c) GDPR for legally required record retention.
• Secure operation and provision of this website: Article 6(1)(f) GDPR. The legitimate interest is reliably providing information and preventing abuse and technical attacks.

Storing information on or accessing information from your device is also governed by section 25 of the German TDDDG. Technically necessary operations to provide explicitly requested functions fall within its exceptions; operations requiring consent need your consent. Google, PayPal and GitHub explain their independent processing and legal bases in the linked privacy notices.

Where the GDPR applies and its statutory conditions are met, you may have rights of access, rectification, erasure, restriction, data portability and objection. Where processing is based on your consent, you may withdraw it for the future. This does not affect the lawfulness of earlier processing. You may also lodge a complaint with a competent data protection supervisory authority.

For requests about processing by the operator, contact acidsstudio@gmail.com. Controls and contact channels provided by Google, PayPal and GitHub are also available for data they hold independently.

11. International processing

The integrated services may process data outside the European Economic Area, particularly in the United States. Recipients include Google for advertising, Play Games, purchases and email communication, PayPal for externally initiated payments, and GitHub for hosting this website.

• Google: Google Ireland Limited is responsible for many services in the EEA; other Google entities may be involved depending on the service. Google describes reliance on the EU-US Data Privacy Framework for covered certified recipients and, where applicable, standard contractual clauses for international transfers. Details and contacts for copies of safeguards: Google data transfer frameworks.
• GitHub: The GitHub Privacy Statement describes processing, including in the United States, and standard contractual clauses for relevant transfers. Its privacy contacts provide further information about safeguards.
• PayPal: For EU users, PayPal identifies PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal describes transfers based on adequacy decisions, appropriate contractual safeguards including standard contractual clauses, or statutory exceptions. Details and contacts: PayPal Privacy Statement.

The relevant recipient entity may depend on your location and the service used. Information about providers and their transfers is drawn from their linked privacy notices.

12. Children

QuaTD is not specifically directed at children. This statement does not establish a particular age rating or age-group selection in Google Play. That classification is determined separately according to the actual game content. Parents or guardians with questions about data processing can use the privacy contact.

13. This website

This privacy notice website is hosted on GitHub Pages. Your browser retrieves its HTML and CSS files. The site itself sets no cookies and uses no analytics, JavaScript tracking or externally loaded fonts. Language switching uses ordinary links and is not stored in a cookie.

GitHub states that it logs and stores IP addresses of GitHub Pages visitors for security purposes, including visitors who are not signed in to GitHub. This hosting processing is separate from the optional services within the app. Details: GitHub Pages — data collection and GitHub Privacy Statement.

External information links are opened only when you click them. The destination website is then subject to its own privacy notice.

14. Changes and language versions

This version is based on the technical state examined from version 1.0.16 (23) and information confirmed by the operator. The explicitly labelled age selection applies from that version; older test versions do not yet include it. Changes to services or processing may require an update. The date at the top identifies this version. The German, English, French, Spanish, Italian and Portuguese versions describe the same practices. You can choose a language at the top of every page. Already published app versions may still open English for some languages; the translations are accessible from that page.