Privacy Policy for Village Legacy

In short

• You need no account, no name and no e-mail address to play Village Legacy. The game only knows you by a random ID your device creates on first launch.
• Your game progress is backed up on our server so it is not lost and you can take it to another device.
• We send statistics only if you say "Yes" when the game first asks. You can change that in the menu at any time.
• Ads exist only as optional reward videos, served by Google (AdMob). Before the first video we ask whether Google may show personalised ads.
• In the community, other players see your player name and your single adult villagers. Never enter your real name or other personal details there.
• Payments are handled only by Apple or Google. We never see your payment details.
• You can ask for access to or deletion of your data at any time: .

1. Who is responsible?

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

‹Name or company of the controller›
‹Street and number›
‹Postcode, town›
Austria

E-mail:
Support: https://villagelegacy.de/en/support/

‹If appointed: contact details of the data protection officer. Otherwise delete this paragraph.›

2. No account: how the game recognises you

On first launch the app creates three things on your device. None of them contains anything about you or your device — no name, no e-mail address, no device or advertising ID.

Because we know nothing else about you, this data is pseudonymous: we cannot tie it to a specific person unless you tell us who you are (for example in a support e-mail).

Whoever has the recovery code has the game progress. Do not share it.

3. What we process, why, and on what legal basis

3.1 Basic operation: game content, mail and offers

To show current settings, events, offers and in-game messages ("mail"), the game fetches them regularly from our server.

• Processed: your player ID (when fetching mail and offers), your device token (for mail), when you first and last fetched, which messages you have claimed and which special offers you have already used.
• Why: to show you the right messages and offers — e.g. a message only for players active in the last few days — and to stop a reward being paid twice.
• Legal basis: performance of the contract for using the game (Art. 6(1)(b) GDPR).

3.2 Cloud save and moving to another device

The game backs up your progress to our server on launch, every five minutes, and when it is paused or closed.

• Processed:
  • your game progress (village, villagers including the names you give them, stock, progress, in-game currencies), exactly as the game also stores it on your device;
  • player ID, hash of the device token, hash of the recovery code (our server knows the code itself only at the moment it sends it to you);
  • save times and a running number so two devices can tell which copy is newer.
  • We keep the current and the immediately previous save, no further history.
• When restoring with a code, additionally: a salted hash of your IP address (not the address itself; for IPv6 only of the network prefix) to slow down guessing other people's codes. Failed attempts are deleted after one day. Successful restores are logged with the time, both device IDs and this hash so we can help if a save goes "missing".
• Why: to back up your progress, keep it in step across your devices and let you move to a new device.
• Legal basis: performance of contract (Art. 6(1)(b) GDPR); for the IP hash and the log, our legitimate interest in protecting the service and your progress from abuse (Art. 6(1)(f) GDPR).

Our operators can view an individual save only by searching for exactly one recovery code — for example because you asked us for help.

3.3 In-game purchases

Purchases (e.g. gems, "Ad-free") are handled only by Apple (App Store) or Google (Google Play). We never receive your payment details, name or address.

• Processed: the receipt issued by the store (including transaction number, product and purchase time), the platform, your player ID, the result of the check and what was credited to you.
• Refunds: when Apple refunds a purchase, Apple sends us a signed notification about it (transaction number, product, time, reason for the refund, test or live environment). We match it to the receipt and thus to your player ID, take back in the game what the purchase gave you (e.g. the gems — even if your balance becomes negative — or "Ad-free") and show you a notice about it. We store whether the reversal has reached your game, which also lets us recognise repeated refunds. ‹Not yet implemented for Google Play.›
• Why: to verify the purchase is genuine, credit what you bought, deliver a purchase later if the connection dropped during it, take back a refunded purchase, and prevent fraud (e.g. forged or reused receipts, repeated refunds). For Apple purchases we send the receipt to Apple's verification server; for Google we check the signature ourselves.
• Legal basis: performance of contract (Art. 6(1)(b) GDPR); fraud prevention: legitimate interest (Art. 6(1)(f) GDPR); ‹retention for tax/commercial law duties, if applicable: Art. 6(1)(c) GDPR — legal review›.
• After a deletion request: purchase receipts and refund notifications stay stored, even if you have the rest of your data deleted (see sections 6 and 7).

The payment itself is governed by Apple's or Google's privacy policy.

3.4 Redeem codes

When you redeem a promo code we store the code, your player ID and the time, so each code works only once per player. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

3.5 Advertising (Google AdMob) and your consent

Village Legacy shows only optional reward videos: you choose to watch one and get something in the game. There are no banners or interstitials. With the "Ad-free" purchase you get the reward without a video.

Videos are served by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). Consent is collected through Google's User Messaging Platform (UMP).

• Consent: Before you watch the first video in the European Economic Area, the UK or Switzerland, the game shows Google's consent form. On iPhone and iPad, iOS also asks whether the app may "track" you across other companies' apps and websites (App Tracking Transparency). You can decline both and still play.
• What Google processes: among other things IP address, device and app information, your device's advertising ID (only if you allow it), approximate location (derived from the IP address), interactions with ads, and crash and performance data of the ad SDK. Google describes the details in its own disclosures.
• Without consent Google may serve non-personalised or limited ads; even then, technically necessary data (e.g. the IP address) is processed for delivery, fraud prevention and frequency capping.
• Already at launch the game asks Google whether consent is needed or already given; this sends your IP address to Google.
• Withdrawal: at any time under Settings → Ad Consent, or in iOS settings under Privacy → Tracking.
• Legal basis: for personalised ads and access to your device, your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021); for non-personalised ads, our legitimate interest in offering the game for free (Art. 6(1)(f) GDPR) ‹legal review, in particular whether § 165 TKG 2021 requires consent here too›.
• Google's role: ‹legal review: for AdMob, Google acts as an independent controller under the "Google Ads Controller-Controller Data Protection Terms", and as a processor for certain functions›.

More: Google's privacy policy https://policies.google.com/privacy and "How Google uses information from sites or apps that use our services" https://policies.google.com/technologies/partner-sites.

3.6 Community, friends and dating between villages

Your single adult villagers can date, marry and move with villagers from other players' villages. For this, while online the game syncs with our server about every two minutes.

• Processed:
  • your player name (free choice, up to 24 characters; if you choose none, "Dorf" plus four characters of your player ID), your friend code and the time of your last sync;
  • the cards of your single adult villagers: name, appearance, age, sex, stars, skills and similar game values;
  • date requests, answers, proposals and moves, each with both villagers' cards;
  • your friends list and whom you have blocked.
• What other players see: your player name and the cards of your single adult villagers (in the community list only if you played in the last seven days). Your friends also see how many days ago you last played. When a villager moves, its card arrives in the other player's village.
• Why: to provide this game feature.
• Legal basis: performance of contract (Art. 6(1)(b) GDPR).

‹OPEN: Today every village that is online takes part in the community automatically; there is no switch to opt out. Decide whether there should be one — or keep this paragraph and say so openly.›

Never use your real name, address, phone number or other personal details as a player or villager name. These names are visible to others.

3.7 Reporting, blocking and moderation

You can block other players (you then no longer see each other) and report them if a name breaks the Terms of Use.

• Processed in a report: your player ID, the reported player's ID, the player and villager name you saw at that moment, and the time.
• What we do: our operators see who was reported how often and can remove a player from the community. Their name is then reset to the default and their villagers disappear from the lists. The reported player is not told who reported them.
• Legal basis: our legitimate interest in a safe, respectful community and the protection of other players (Art. 6(1)(f) GDPR) and enforcing the Terms of Use (Art. 6(1)(b) GDPR).

3.8 Statistics (only with your consent)

On first launch the game asks whether it may send statistics. Only after a "Yes" is anything sent; before that and after a "No", none of it leaves your device. You can change your choice at any time in the menu under Send anonymous statistics.

• Processed: your player ID and a snapshot of your game: village level, number of villagers and buildings, gems, coins, stock, game days, how much you have spent in total and on what, number of wheel spins, pairings, births, deaths and departures, the latest progress per in-game event, gems spent per calendar day, and your country (two letters, e.g. "AT"; from the country of your app store or your device's region setting — not from your location and not from your IP address). We keep one snapshot per player, which is overwritten — no history.
• Why: to understand where players get stuck or stop, and to improve the game (e.g. difficulty and prices); the country, to break these figures down by country.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

Through the player ID this data is pseudonymous, not anonymous. ‹The in-game question currently says "anonymous statistics" — change the wording or align it here.›

3.9 Error and crash reports

If an error occurs in the game or it crashes, it sends an error report to our own server (see 4 — no third party). A crash is reported on the next start. You can turn this off in the settings under Send error reports; if Sync with the server is off, nothing is sent either. Turned off, none of it leaves your device — not later either.

• Processed: your player ID; the error message (cut to 300 characters), the place in the program (file, line, function) and the call stack — function names and lines only, no content; how often the same error occurred in a session; app version, operating system and its version, device model, selected language, whether the 3D figures are on, and how long the session ran. For a crash, also the last roughly 100 lines of the technical log of the session that crashed. No game saves, no location, no contacts. ⚠ An error message or the log can contain a villager or player name if it was being processed when the error happened; we do not analyse names in it.
• Why: to find and fix errors and crashes so the game runs reliably.
• Legal basis: our legitimate interest in a stable app (Art. 6(1)(f) GDPR). You can object at any time by turning the switch off. ‹Legal review: whether legitimate interest holds or consent is required.›
• Retention: 90 days from receipt; the server then deletes the reports by itself. "Delete my data" deletes them immediately.

3.10 Support e-mails

When you write to us we process your e-mail address, the content of your message and anything else you tell us (e.g. your player ID or recovery code) in order to reply. If you write via Settings → Send feedback, the game opens your mail app with a prepared e-mail. Below a line it contains your player ID, the game's version and build number, operating system and version, device model and language setting — so we can find your data and reproduce problems. You see these details before sending and can delete them; the game itself sends nothing. The device token is never included. Legal basis: performance of contract or pre-contractual request (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Retention: ‹e.g. until the request is resolved, then at most 12 months›.

3.11 Server logs and backups

• Access logs: For every connection to our server, the web server technically logs shortened IP address (not the full one; ‹how shortened, e.g. last block zeroed›), time, requested address (for mail and offers including the player ID), status code, amount of data transferred and the app/operating-system identifier (user agent). Why: operation, troubleshooting and defence against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: ‹define, e.g. 14 days — not defined today›.
• Backups: We back up the database daily and keep each backup for 14 days. Deleted data therefore also disappears from the backups no later than 14 days after deletion.

3.12 What stays on your device only

Your settings (language, sound, your answer to the statistics question) and the local copy of your game progress live on your device and are deleted with the app. The game does not read contacts, photos, location, microphone or camera data.

4. Who receives your data

• Our hosting provider ‹name, address›, which runs our server in ‹country/city of the data centre› — as a processor under Art. 28 GDPR ‹sign/confirm a data processing agreement›.
• Google (AdMob, UMP) for ads and consent, see 3.5.
• Apple and Google as app store operators: for download, payment and — for Apple — receipt verification, see 3.3.
• Other players: your player name and the cards of your single villagers, see 3.6.
• Authorities only where we are legally obliged.

We do not sell data and do not pass your game data on for advertising.

5. Transfers outside the EU

Our own server is located in ‹country; EU/EEA›. Google LLC and Apple Inc. are based in the USA, and data may be transferred there. Both are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); in addition they use standard contractual clauses (Art. 46 GDPR). ‹Legal review; check the certification at https://www.dataprivacyframework.gov before publishing.›

6. How long we keep data

When you ask for deletion we delete your data unless a legal obligation requires us to keep it.

Purchases are kept after a deletion request — whether you delete in the game or write to us: we keep purchase receipts and refund notifications to meet legal record-keeping obligations and to be able to handle refunds; likewise which redeem codes and promotions were already claimed, so that they cannot be claimed again after the deletion. How long is stated in the table above.

7. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR) — for statistics in the menu, for ads under Settings → Ad Consent or in iOS settings.

In the game: Settings → Delete my data deletes, after a second confirmation, everything our server stores under your player ID — cloud save, community profile and dates, friendships, personal mail, statistics and error reports. Deliberately kept: purchase receipts and refund notifications (see section 6), which redeem codes and promotions were already claimed (otherwise they could be claimed again after deleting), and blocks and reports that other players made about you.

Without the app (for example if you have already deleted it): write to . So that nobody can access or delete someone else's data, we handle a request for access or deletion without the app only if

1. you give your recovery code (under Settings → Transfer your save), or
2. you write from the same e-mail address from which you already sent us a mail with Settings → Send feedback — most easily as a reply to that mail. It contains your player ID, and the shared sender address shows that the request comes from you.

The player ID alone is not enough. It is not secret — it is shown in the settings and included in every feedback mail — and knowing it does not show that the data belongs to you. Without the code or a matching mail we therefore cannot assign any data to you. With either of them we find your data, tell you what we hold or delete it — to the same extent as the button in the game. The code stays secret: we do not store it, we only compare its hash.

If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, , https://www.dsb.gv.at — or to the supervisory authority of your EU country of residence.

8. Children and young people

‹DEFINE THE AGE POLICY. To decide, among other things:

• The intended minimum age (store age rating).
• In Austria young people can consent to the processing of their data for online services from the age of 14 (§ 4(4) DSG, Art. 8 GDPR); in other EU countries the threshold is between 13 and 16. Below it, parental consent is needed.
• Whether personalised ads are switched off for players below that age (Google AdMob offers a "tag for users under the age of consent" flag — not set today).
• Whether the community (freely chosen names visible to others) is restricted for children.

Until then a placeholder sentence, e.g.: "If you are younger than ‹age›, please ask your parents before consenting to statistics or personalised ads."›

9. Security

• All connections between the game and the server are encrypted (HTTPS).
• The server stores your device token only as a hash; without the token nobody can read or overwrite your cloud save, not even with your player ID alone.
• IP addresses are stored in the database only as salted hashes.
• The admin area is password-protected and accessible only to our operators.
• ‹Add the hosting provider's measures.›

10. Automated decisions

We make no automated decisions that have legal effects on you or similarly significantly affect you (Art. 22 GDPR), and we do not profile you for advertising. (What Google does for personalised ads is governed by Google's privacy policy.)

11. Changes

We update this policy when the game or the law changes. The current version is at https://villagelegacy.de/en/privacy and linked in the game under Settings → Privacy Policy. We point out significant changes in the game.

Last updated: ‹date of publication›