Grid Gang – Privacy Policy

Last updated: 11 October 2026. This is a translation; the German version (Datenschutzerklärung) is authoritative.

1. Controller

The Lucas Agency GmbH, Am Kabellager 11, 51063 Köln, Germany
Email: lucas.agency@outlook.com

You'll find more details in our legal notice.

2. Summary

• Grid Gang works without an account. We don't ask for your name or email address.
• Your progress (stars, levels, coins, settings) is stored on your device. If you are signed in to iCloud, Apple also backs it up in your iCloud account – we have no access to it.
• To show how all players did on a puzzle, we send anonymous round results to our server.
• The app is ad-supported (Google AdMob). You only get personalized ads with your consent, which you can change at any time.
• Purchases are handled by Apple. We never receive payment details.
• To measure which of our ads (e.g. on TikTok) lead to installs, we use AppsFlyer – in the EU only with your consent.

3. What data we process and why

a) Data on your device and in your iCloud account

Progress, stars, coins, statistics, rounds in progress and settings (e.g. sound, haptics, colorblind mode, language) are stored locally on your device and are not sent to us. The app reads your device's language setting on the device to choose German or English.

If you are signed in to iCloud with your Apple ID on your iPhone, the app stores a copy of your progress (stars, level results, recent dailies, statistics, coins, unlocked games) in Apple's iCloud key-value storage. This brings it back after reinstalling or on a new device with the same Apple ID. The copy is kept in your iCloud account; the provider is Apple (Apple Distribution International Ltd., Ireland), and Apple's iCloud terms and privacy policy apply. We have no access to it. The legal basis is Art. 6(1)(b) GDPR (providing the game with saved progress). You can turn off the backup in your iPhone settings under your name → iCloud.

b) Anonymous round results (community statistics)

After each round the app sends to our server:

• the game,
• whether it was a daily or a level and which puzzle (including its language),
• the number of attempts,
• whether the round was solved.

This includes a randomly generated, anonymous ID so a result isn't counted twice. It is not linked to your name, your Apple ID or your advertising ID. From this data we calculate what percentage of all players solved a puzzle in how many attempts.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a comparative statistic as part of the game.

Service provider: Supabase Inc. (hosting in the EU) as processor.

c) Advertising (Google AdMob)

We show ads through Google AdMob:

• interstitial ads between rounds,
• optional videos in exchange for coins or hints.

On first launch we ask for your consent through a consent dialog (Google User Messaging Platform). On iOS, Apple additionally asks whether apps may track you (App Tracking Transparency).

• With consent: Google may use your device's advertising ID (IDFA) and usage data to show personalized ads and measure their performance.
• Without consent: only non-personalized ads are shown. Google then processes technically necessary data such as IP address, device type and operating system version to deliver the ad and prevent fraud.

Legal bases: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) for personalized ads; otherwise legitimate interest in financing the free app (Art. 6(1)(f) GDPR).

You can change or withdraw your consent at any time in the app under Settings → Privacy settings. After buying "Remove ads", no more interstitial ads are loaded; optional videos remain available.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. More information: policies.google.com/technologies/ads.

Through AdMob mediation, Unity Ads (Unity Technologies) may also bid for an ad. If Unity wins, its SDK also processes device data to deliver and measure the ad, and – with your consent – the advertising ID. The same consents apply as for Google. More information: unity.com/legal/game-player-and-app-user-privacy-policy.

d) Purchases

In-app purchases (All games, Remove ads, Complete bundle, coins) are handled by Apple through the App Store. We don't receive payment details, only the information which product was bought.

To manage purchases we use RevenueCat, Inc. (USA). RevenueCat receives:

• an anonymous app ID,
• the purchased products with Apple's receipt.

From this, RevenueCat determines which unlocks you own.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

e) Technical data

When content and services are accessed, the IP address, time, device type and app version are processed for technical reasons to establish the connection and ensure security (Art. 6(1)(f) GDPR). Apart from AppsFlyer for measuring our ad campaigns (see f), we don't use any analytics or tracking tools of our own choosing.

f) Measuring our ad campaigns (AppsFlyer)

We advertise Grid Gang, for example on TikTok. To find out which ads lead to installs and purchases, we use AppsFlyer Ltd. (Israel). AppsFlyer receives:

• device identifiers: the vendor identifier (IDFV) and – only if you allowed tracking – the advertising ID (IDFA),
• IP address, device type, OS and app version, time of install and app launches,
• in-app events: purchases (product, amount, currency) and solved levels.

AppsFlyer attributes the install to the ad you came from and passes this result to the ad platform where we ran the ad (e.g. TikTok, later possibly Meta or Google). Through Apple's SKAdNetwork, AppsFlyer also receives anonymous, aggregated install reports from Apple.

When: In the EU, EEA, UK and Switzerland only if you consented in the privacy form at first launch – otherwise AppsFlyer does not start at all. Without tracking permission on your iPhone, no advertising ID is sent.

Legal basis: consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); outside the EU our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR). You can withdraw your consent at any time in Settings under "Privacy settings".

4. What we don't do

• We don't sell data.
• We don't build a profile about you.
• We don't access contacts, location, photos or the microphone.

5. Recipients and processors

We use the following service providers:

• Supabase Inc. – storage of anonymous round results (servers in the EU)
• Google Ireland Limited – advertising (AdMob) and consent management (Ireland)
• Unity Technologies – advertising (Unity Ads, via AdMob mediation) (USA)
• RevenueCat, Inc. – management of in-app purchases (USA)
• AppsFlyer Ltd. – measuring our ad campaigns (Israel; processing incl. in the EU and the USA)
• Ad platforms we advertise on (e.g. TikTok) – receive from AppsFlyer whether an install came from their ad
• Apple Distribution International Ltd. – App Store and payments (Ireland)
• Cloudflare, Inc. – delivery of this website via Cloudflare Workers (USA)

6. Transfers to third countries

With Google, Unity, RevenueCat, AppsFlyer, Cloudflare and – for support and maintenance – Supabase, data may be transferred to the USA; AppsFlyer is based in Israel, for which an adequacy decision of the European Commission exists. Transfers to the USA rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses.

7. Retention

• Anonymous round results: as long as they are needed for the statistics, at most 24 months.
• Data on your device: until you delete the app.
• iCloud backup: until you delete it in your device's iCloud settings.
• Purchase receipts: as long as statutory retention obligations apply.
• Advertising data at Google: according to Google's policies.
• Measurement data at AppsFlyer: according to AppsFlyer's policies.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw any consent you have given with effect for the future.

Because we don't store names or accounts, we usually can't link anonymous results to a person. Feel free to contact us anyway – we'll help as far as we can.

You can also lodge a complaint with a data protection supervisory authority.

9. Children

Grid Gang is not specifically aimed at children under 16. For users whose age we don't know, no personalized ads are shown without consent.

10. Changes to this policy

If the app or the services we use change, we'll update this policy. The version published here applies.

11. Contact

Privacy questions: lucas.agency@outlook.com