Privacy Policy for the Games

This privacy policy applies to all mobile games we publish on Google Play under the brand "stillmeasure. games". It explains which data is processed when you play, why, on what legal basis, and what rights you have.

In short:

You don't need an account. We don't run our own servers. Your progress is stored only on your device.
Our games are free and funded by ads from Google AdMob. In the EU, the EEA, the UK and Switzerland we ask you first whether Google may show personalised ads and access your device for that. You can decline and still play normally.
Purchases (e.g. "Ad-free") are handled by Google Play. We never receive your payment details.

1. Games covered

Game	Google Play package name
Snake Escape: Brain Puzzle	com.stillmeasure.snaku
Plokko	com.tbygroup.plokko
Candy Blast	com.tbygroup.blocks

2. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Tobias Marks
MarksFinanceGroup (sole proprietorship), brand "stillmeasure." / "stillmeasure. games"
Sponheimer Str. 14
55595 Mandel
Germany

Email: contact@stillmeasure.com
Contact form: www.stillmeasure.com/contact/

We have not appointed a data protection officer because we are not legally required to (Section 38 German Federal Data Protection Act (BDSG), Art. 37 GDPR).

3. What stays on your device (local storage)

The games store on your device:

your progress, solved levels, stars, best scores, streaks and collections
your supply of in-game helpers (e.g. hints) and, where a game has them, in-game coins
settings (language, sound, vibration, reminders)
your privacy choice (see section 4.3) and the status of your purchases

This data does not leave your device and we cannot access it. Storing it is technically necessary for the game to work the way you use it (Section 25(2) no. 2 German Telecommunications Digital Services Data Protection Act (TDDDG); where personal data is involved: Art. 6(1)(b) GDPR).

Android backup: If you have turned on backup to your Google Account in your Android settings, Android also backs up your progress there. This is a feature of Google and your device. We have no access to this backup. You can turn it off in your Android settings.

Deleting: You can delete your progress in the game under "Settings → Reset progress", or uninstall the game or clear the app data in your Android settings. Google Play restores permanent purchases (e.g. "Ad-free") afterwards. Spent or locally stored in-game currency may be lost if there is no backup.

4. Ads with Google AdMob

4.1 Provider

Ads in our games are served by Google AdMob. For users in the EEA and Switzerland the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA is also involved. Google processes the data for advertising as an independent controller (Google Ads Controller-Controller Data Protection Terms).

At the moment Google is our only ad partner. The consent form shows you the full, current list. If we add other ad networks later, we will name them here and in the form before they receive any data.

4.2 Data processed by the Google ads SDK

According to Google's own disclosure, the Google Mobile Ads SDK collects:

IP address (Google may use it to estimate your approximate location, e.g. country or region)
device and app identifiers: Android advertising ID (if you consent), app set ID
interactions with ads: e.g. app launches, taps, video views
diagnostic data about app and SDK performance (e.g. loading time)
technical details such as device type, operating system version, language and app version

The data is encrypted in transit (TLS).

4.3 Your choice: the consent form (EU, EEA, UK, Switzerland)

On first launch we show you Google's consent form (User Messaging Platform, UMP). It follows the IAB Europe Transparency & Consent Framework (TCF) and is a Google-certified consent management solution. Ads are only requested after you have made your choice.

Consent: Google may store and read information on your device (e.g. the advertising ID) and choose and measure ads based on your interests.
Do not consent: You keep playing normally, with no disadvantage in the game. Without your consent there are no personalised ads. Google then only shows limited ads ("Limited Ads"). In this case Google
- does not read your advertising ID or any other device identifier for advertising purposes,
- builds no ad profile and does not choose ads based on your interests,
- uses only what is needed to deliver the ad: your IP address to transmit it, plus app and device details so the ad is displayed correctly,
- uses data, and where applicable storage on your device, solely to detect invalid traffic and ad fraud.
Partial consent: If you agree to storage on your device but not to personalisation, Google shows non-personalised ads. They are chosen only by context (e.g. the game they appear in and the approximate location derived from the IP address), not by your past behaviour.
Change or withdraw: at any time in the game under "Settings → Privacy settings". Withdrawal takes effect from that moment.

Your choice is stored on your device as a so-called TC string so that we don't have to ask you again on every launch.

4.4 Legal bases for advertising

Processing	Legal basis
Storing and accessing information on your device for advertising (e.g. advertising ID)	consent, Section 25(1) TDDDG
Personalised ads, measurement and analysis by Google	consent, Art. 6(1)(a) GDPR
Storing your consent choice on the device	Section 25(2) no. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent)
Limited ads after refusal: delivering the ad, fraud prevention	legitimate interests, Art. 6(1)(f) GDPR. Our interest: offering the games for free and preventing ad fraud
Storage on the device with limited ads, solely to detect invalid traffic	Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR
Non-personalised ads with partial consent	consent (Section 25(1) TDDDG) for storage; Art. 6(1)(f) GDPR for contextual selection
Rewarded videos you start yourself (e.g. "Watch a video for a hint")	as above, depending on your consent; we credit the reward only on your device

4.5 Users outside the EU, EEA, UK and Switzerland

Outside these regions Google may show personalised ads without asking first, where local law allows. In some US states we show a separate notice from Google with an opt-out. You can also reset or delete your advertising ID at any time in your Android settings under "Privacy → Ads".

4.6 More from Google

5. Purchases via Google Play

Some games let you buy content, e.g. "Ad-free" or packs of hints or coins. Purchases are handled entirely by Google Play (Google Play Billing). Google's terms and privacy policy apply to the payment. In the EU, Google acts as merchant of record on our behalf.

We never receive payment details (no card number, no bank account, no billing address).
The app asks Google Play which purchases belong to your Google Account and unlocks them on your device. To do so the app processes a purchase token and the product ID on the device only.
In our developer console we see order information from Google for each purchase, e.g. order number, product, date, price, currency, country and status (e.g. refunded). We use it to handle requests and to meet tax obligations.

Legal bases: performance of a contract, Art. 6(1)(b) GDPR; statutory retention under tax and commercial law, Art. 6(1)(c) GDPR.

6. Contacting us (support)

If you write to us (email or contact form), we process your message, your email address and anything else you tell us (e.g. an order number for purchase problems, your device model for bugs). Please do not send us payment details.

Legal bases: Art. 6(1)(b) GDPR (where it concerns a purchase or the game), otherwise Art. 6(1)(f) GDPR (our interest in answering your request).

Online withdrawal: If you use our "Withdraw from contract" function, we process the details you enter there (name, email address, game, purchased content, purchase date and, if given, your Google Play order number) to handle your withdrawal and confirm its receipt. The details are sent encrypted to a server function run by our website host Cloudflare, which immediately emails them via Hostinger's mail server to our mailbox and, as an acknowledgement of receipt, to your email address. The function itself stores nothing. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code (BGB). Retention follows section 11 (support messages).

7. Other Google Play features without our own data collection

Statistics and crash reports in the Play Console: Google provides us with aggregated statistics (e.g. installs by country, ratings) and crash and "app not responding" reports from users who allow Android to share diagnostic data with Google. These reports contain technical details (device model, Android version, where the error occurred) but no name and no email address. We use them to fix bugs (Art. 6(1)(f) GDPR).
Rating dialog: Some games show Google Play's rating dialog. We do not learn whether or how you rate; public reviews are subject to Google's terms.
Sharing: If you share a result, Android's share menu opens. You decide what you share and with whom; we receive nothing.
Reminders (only if you turn them on): reminders are scheduled locally on your device. No data is transferred. You can turn them off in the game or in your Android settings.
"More games": Tapping it opens the Google Play store listing. Google's privacy policy applies to that page.

8. Crash reports with Firebase Crashlytics

To find and fix crashes, our games use Firebase Crashlytics from Google Ireland Limited / Google LLC. Google processes the data as our processor (Firebase Data Processing and Security Terms). We do not use Google Analytics for Firebase.

If a game crashes, Crashlytics sends a crash report containing:

where the error occurred in the code (stack trace) and the state of the app at the time of the crash,
device data at the time of the crash: device model, Android version, RAM and free storage, whether the device is rooted,
package name, app version and time,
random identifiers: a Crashlytics installation ID (stored on your device so we can see how many devices are affected by a bug), a Firebase installation ID and a session ID.

Your name, email address, advertising ID and game progress are not transmitted. We do not attach any user identifiers of our own to the reports.

Your choice: In the EU, the EEA, the UK and Switzerland, sending crash reports is off by default and is only turned on if you agree under "Settings → Send crash reports". Outside these regions it is on by default and can be turned off at any time.

Legal bases: consent, Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw at any time with the same switch.
Retention at Google: 90 days, then deletion. For transfers to the USA see section 10.

9. Recipients

Google (Google Ireland Limited; Google LLC) as independent controller for advertising (AdMob), purchase processing (Google Play) and Play Console statistics, and as processor for Firebase Crashlytics
our email provider for support messages: Hostinger International Ltd., Larnaca (Cyprus), as processor
for the "Withdraw from contract" function on our website also our website host Cloudflare, Inc. (San Francisco, USA) as processor
tax advisers and authorities, where required by law

We do not sell personal data.

10. Transfers to the USA

Google may transfer data to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Google also uses the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The EU General Court dismissed an action against the DPF on 3 September 2025 (T-553/23); an appeal before the Court of Justice is pending. If the DPF ceased to apply, Google would rely on the standard contractual clauses.
Google's information: policies.google.com/privacy/frameworks

11. How long data is kept

Data	Retention
Progress, settings and consent choice on your device	until you reset them, clear the app data or uninstall the game
Advertising data at Google	according to Google's periods; Google states that it anonymises ad logs by removing part of the IP address after 9 months and cookie information after 18 months
Order information from Google Play	until the end of the statutory retention period (6, 8 or 10 years depending on the record, Section 147 German Fiscal Code, Section 257 German Commercial Code)
Support messages	until your request is resolved, at the latest 3 years after the end of the year of the last message (limitation period); longer only if they must be kept for tax purposes
Crash reports (Firebase Crashlytics)	90 days

12. Children and young people

Our games are intended for people aged 16 and over. The age rating in the store (e.g. USK 0 / PEGI 3) only means the content is harmless; it does not mean the games are directed at children. We do not ask for your age. In Germany, people under 16 cannot consent to personalised ads themselves (Art. 8 GDPR); parents can withdraw consent at any time under "Privacy settings" and contact us. Ads in our games are limited to the content rating "G" (suitable for all ages).

13. Your rights

You have the right to

access (Art. 15 GDPR),
rectification (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing based on legitimate interests (Art. 21 GDPR),
withdraw consent with effect for the future (Art. 7(3) GDPR), in the game under "Privacy settings" or "Send crash reports".

Because we have no accounts and do not store game data on our own servers, we usually cannot identify you. Data held by Google (ads, purchases) is easiest to manage directly with Google (e.g. myactivity.google.com). We are happy to help: contact@stillmeasure.com. We reply within one month.

Right to lodge a complaint: You can complain to a data protection supervisory authority, for example where you live, or to the authority responsible for us:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de

14. No obligation, no automated decisions

You don't have to give us any data. Without consent you won't see personalised ads and (in the EU/EEA/UK/CH) no crash reports are sent; the game still works fully. We do not make automated decisions with legal effect within the meaning of Art. 22 GDPR. Google decides automatically which ad you see; this has no legal effect on you.

15. Notice for residents of US states

We do not sell personal data for money. Sharing identifiers with Google for personalised ads may count as a "sale", "sharing" or "targeted advertising" under some US laws (e.g. in California). You can opt out at any time in the game under "Privacy settings" or delete your advertising ID in your Android settings. Send requests about your rights (access, deletion, correction, opt-out) to contact@stillmeasure.com.

16. Changes

We update this policy when our games or the law change (e.g. a new ad partner). The current version is always available at www.stillmeasure.com/games/privacy/ and as a copy inside the game. If a material change requires new consent, we will ask you again in the game.

You'll find the German version at Datenschutzerklärung für die Spiele.