Privacy Policy

Last updated: 28 October 2026 · applies to the app “DROP!” (Android, package name com.vsterstudio.drop), the web version of the game and the website dropthegame.app.

1. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Benjamin Fauster (vster Studio)
St. Margarethen an der Raab 395
8321 St. Margarethen an der Raab, Austria
Email: support@dropthegame.app

We have not appointed a data protection officer as we are not legally required to do so. For any privacy question, contact us at the email address above.

2. Data stored only on your device

The game stores the following data exclusively on your device (in the web version, in your browser’s storage):

• career save, statistics, high scores, achievements, Daily Drop and training progress
• crowns, unlocked and purchased cosmetics, your character’s look
• the optional player name you choose
• settings (sound, music, vibration) and tutorial status
• a counter for how often ads were shown and your “ad-free” status
• the game settings last downloaded from the server (see section 3)

We do not receive this data – except for the data needed for the online leaderboard described in section 3. Uninstalling the app or clearing your browser’s site data removes it. This storage is strictly necessary to provide the game (Art. 6(1)(b) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021, which does not require consent for strictly necessary storage).

3. Online features: guest account and Daily leaderboard

What happens?

So that you can compare yourself with others on the Daily Drop leaderboard, the game automatically signs in to our server with an anonymous guest account when it starts. You do not need to provide an email address or any other contact details. Without an internet connection the game remains fully playable; results are sent later.

In addition, the game downloads general game settings from the server once at start-up (e.g. ad intervals and the latest available version, to notify you about updates). No account is needed for this; only technical connection data is processed.

Which data?

• Account data: a randomly generated account ID, access and refresh tokens (also stored on your device), time of creation and last sign-in.
• Public name: the player name you chose in the game. If you have not chosen one, the game assigns a random name (e.g. “Swift Owl”).
• Daily results: date and version of the daily challenge, score and details of the attempt (points per jump, placement, number of perfect landings, best reaction time, false starts, crashes, daily twist, an attempt identifier), number of submissions and time.
• Technical connection data: with every request the server processes your IP address, date and time and technical information about your device or browser (e.g. user agent). We use this only to establish the connection and to prevent abuse (e.g. mass account creation); it is not combined with your game profile.

Who sees what?

On the leaderboard, your public name, score and rank are visible to all players. Your account ID, game details and technical data are not public. Please do not choose a player name that contains your full real name or other personal information.

Purpose and legal basis

Providing the online leaderboard and game settings as part of the game (Art. 6(1)(b) GDPR); security, fraud and abuse prevention (e.g. checking unrealistic scores, rate limiting) based on our legitimate interest in fair and stable gameplay (Art. 6(1)(f) GDPR).

Service provider

We use the database and authentication service Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992) as a processor. Data is stored in a data centre in the EU (Ireland, Amazon Web Services). Access from third countries (e.g. by Supabase support) cannot be ruled out; a data processing agreement and EU Standard Contractual Clauses are in place (Art. 46(2)(c) GDPR). More information: supabase.com/privacy.

Retention and deletion

We keep the account and leaderboard entries for as long as the guest account exists. Technical log data is kept by the provider only briefly for operation and security and then deleted automatically. You can request deletion of your guest account including all leaderboard entries at any time – see Delete account for how. We confirm deletion within one month.

4. Advertising with Google AdMob (Android app only)

The Android app is financed by ads (interstitial ads between game sections). For this we use Google AdMob by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The web version shows no ads.

Consent

On first launch in the EU, EEA, United Kingdom and Switzerland, the app shows a consent dialog (Google User Messaging Platform). There you decide whether Google and its ad partners may store or access information on your device and show personalised ads. You can change or withdraw your choice at any time in the app under Settings → PRIVACY SETTINGS.

Data processed

Google processes in particular your device’s advertising ID (unless you have reset or deleted it), your IP address (and an approximate location derived from it), device type, operating system, app information and information about ads shown and clicked.

Purpose and legal basis

• Personalised ads and storing or accessing information on your device for advertising only with your consent (Art. 6(1)(a) GDPR, Section 165(3) Austrian Telecommunications Act 2021).
• Without consent, Google shows non-personalised or limited ads, processing data only to the extent Google needs for ad delivery, frequency capping and fraud and abuse detection. The legal basis is our legitimate interest in financing the free game (Art. 6(1)(f) GDPR).

Recipients and international transfers

Google may transfer data to Google LLC (USA). Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); EU Standard Contractual Clauses also apply. Our cooperation with Google is governed by Google’s Controller-Controller Data Protection Terms. More information:

• Google Privacy Policy
• How Google uses information from apps that use its services
• Ad partners and data use in AdMob

Independently of this, you can reset or delete your advertising ID in the Android settings (Google → Ads).

Ad-free

After purchasing “Remove Ads”, the app no longer starts AdMob, and no data is sent to Google AdMob any more.

5. In-app purchase via Google Play

The “Remove Ads” purchase is processed by Google Play (Google Ireland Limited) using the Google Play Billing system. We do not receive any payment data. The app only receives information from Google on whether and which product was purchased, a purchase token and the purchase status; it uses this to unlock ad-free play, acknowledge the purchase and restore it after reinstalling (Art. 6(1)(b) GDPR). Payment processing is governed by the Google Privacy Policy.

6. Download, hosting and email

• Google Play: When you download and update the app, Google processes data about your Google account and device as an independent controller. We have no influence on this.
• Web version: The web version is provided via the itch.io platform (Itch Corp, USA). When you open the page, itch.io processes data such as your IP address as an independent controller; the itch.io Privacy Policy applies. The game stores save data in your browser’s local storage.
• This website: dropthegame.app is served via GitHub Pages (GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit, GitHub processes your IP address and technical access data (e.g. time, page requested, browser) in server logs to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR). GitHub is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). More information: GitHub Privacy Statement. The website uses no cookies, no analytics tools and loads no third-party content.
• Email: If you email us, we process your address and the content to answer your request (Art. 6(1)(b) or (f) GDPR). Emails to @dropthegame.app are forwarded via the forwarding service ImprovMX to our mailbox at Google (Gmail). We delete the correspondence when it is no longer needed, at the latest after statutory retention periods expire. More information: ImprovMX Privacy Policy.

7. Android app permissions

• Internet: for the online leaderboard, game settings, ads and in-app purchase.
• Vibration: for haptic feedback in the game (can be turned off in the settings).
• Advertising ID (via the Google Mobile Ads SDK): for ads only, see section 4.

The app does not access your camera, microphone, location (GPS), contacts or files outside its own storage area.

8. No analytics, no profiling by us

We do not use any analytics, statistics or tracking tools and do not create user profiles. There is no automated decision-making within the meaning of Art. 22 GDPR. Plausibility checks of submitted scores only serve to protect the leaderboard against manipulation.

9. Children

The game is not specifically directed at children under 13. If you are a parent or guardian and become aware that your child has provided us with personal data without your consent, please contact us and we will delete the data promptly.

10. Data security

All connections between the game and the server and to this website are encrypted using TLS (HTTPS). Database access is technically restricted so that each guest account can only submit its own results and read the public leaderboard through verified server functions.

11. Your rights

Under the GDPR you have the right to

• access the data we store about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)), e.g. via Settings → PRIVACY SETTINGS,
• lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the member state of your habitual residence. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

An email to the address in section 1 is sufficient for your request. As the guest account is anonymous, we need details that allow us to identify it (see Delete account).

12. Changes

If we add new features to the game (e.g. an account with an email address or cloud saves), we will update this privacy policy. The version published here applies.