Privacy Policy

Last updated: 12 August 2026

1. What this policy covers

This policy explains how we process personal data when you visit playmudlings.com and when you use the Mudlings: 2 Player War mobile app. It applies alongside the privacy information shown on the App Store and Google Play listings.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Bytes & Pixels GmbH
Gröbenzeller Str. 40, 80997 München, Deutschland
Represented by: Benjamin Robert Bachhuber
E-mail: kontakt@bytes-and-pixels.de
Phone: 089-15002979

For questions about data protection, including requests to exercise your rights, write to kontakt@bytes-and-pixels.de.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, the hosting provider automatically processes technical information (IP address, browser type, operating system, referrer URL, time of access) in server log files to deliver the website and ensure its stability and security (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel. Log data is deleted or anonymised after a short period.

4. Analytics and marketing on this website

This website currently uses no analytics or marketing tracking tools and sets no cookies beyond those technically required to deliver the pages.

5. Data we process in the Mudlings app

Mudlings is a two-player game: two people share one device and battle each other on a single screen. To do that, the App processes the following data, each for the stated purpose and on the stated legal basis:

  • Game progress and settings — stored on your device so you can carry on where you left off — we do not receive it. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
  • Purchase receipts and the identifier your store sends us — to unlock what you bought and to restore it on a new device. Legal basis: Art. 6 (1) (b) GDPR.
  • Device and diagnostic data (device model, operating system and app version, crash reports) — to find and fix errors and keep the game stable. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a working game).
  • Usage data (which screens and features you use, pseudonymous) — to understand how the game is played and improve it. Legal basis: Art. 6 (1) (a) GDPR (consent — you can decline without losing any feature).
  • Support correspondence (your message and contact details) — to answer your request. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Where processing is based on your consent, you may withdraw it at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out beforehand. Where data is needed to provide a feature, not providing it means that feature cannot work.

6. Advertising

The game shows no third-party advertising, uses no advertising identifier and builds no advertising profile of you. We do not sell personal data.

7. Service providers

We use the following providers to operate the App. They process data on our behalf as processors under Art. 28 GDPR, on the basis of a data processing agreement, and only on our instructions:

  • Apple App Store and Google Play (Apple Distribution International Ltd., Ireland and Google Ireland Ltd., Ireland) — distribution of the game and processing of in-app purchases.
  • RevenueCat (RevenueCat, Inc., USA) — management and validation of in-app purchases.
  • Sentry (Functional Software, Inc., USA) — crash reports and error diagnostics.
  • PostHog (PostHog, Inc., EU Cloud) — pseudonymous product analytics, only if you consent.

Apple and Google additionally act as independent controllers for the store and payment data they collect when you download the App or make a purchase; their own privacy policies apply to that processing.

8. Transfers outside the EU

Some of the providers named above are based outside the European Economic Area, or process data there. In those cases the transfer is safeguarded by the European Commission’s standard contractual clauses, by the provider’s certification under the EU-US Data Privacy Framework, or by your explicit consent (Art. 44 ff. GDPR). Despite these safeguards, we cannot rule out that authorities in those countries access data.

9. How long we keep data

Your game progress stays on your device until you delete the game. Purchase records are kept for as long as warranty and tax retention periods require. Crash reports are kept for 90 days and pseudonymous usage data for 12 months.

Website server log data is kept only briefly for security purposes. Beyond that we keep personal data only as long as it is needed for the purpose it was collected for, or as long as statutory retention periods require — invoices and accounting records, for instance, must be kept for up to ten years under German tax and commercial law.

10. Deleting your data

You can delete your data at any time: delete the game from your device, which removes your local progress — there is no account to delete. You can also ask us to do it by writing to ben@bytes-and-pixels.de — we confirm deletion within 30 days.

Deletion removes your data from our live systems. Encrypted backups are overwritten on their normal rotation, and data we must keep for legal reasons — invoices, for instance — is blocked from further use instead of deleted until the retention period ends.

11. Children

The App is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it. Where we rely on consent, users under 16 in the EU need the consent of a parent or guardian (Art. 8 GDPR).

12. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future. To exercise your rights, contact kontakt@bytes-and-pixels.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany. You may also contact the authority where you live.

13. Changes to this policy

We may update this privacy policy to reflect legal or technical changes. The current version is always available at https://playmudlings.com/privacy.