Privacy Policy

Last updated: October 13, 2026

1. Controller

The controller responsible for processing personal data in the GridMaster app and on this website is:

Karan Soni
Esplanade 29-30
20354 Hamburg
Germany
mail@karancode.de

We have not appointed a data protection officer because we are not required to. For privacy questions, contact us at the address above.

2. Overview

GridMaster works without an account. We do not run our own server for the app and the app does not send us any data about you. Your progress stays on your device.

Data only leaves your device where services are involved that are needed for ads, purchases and leaderboards. We describe these services and the data they receive below. If you write to us, we also process your message.

3. Data on your device

The app stores on your device: levels and scores, block points and coins, unlocked items, statistics, settings and the state of the daily challenge. This data is not sent to us and is deleted when you delete the app. Whether it is included in a device backup (such as iCloud or Google) depends on your device settings.

4. Daily reminder

The daily challenge reminder is a local notification: the app schedules it on your device, no server or push service is involved. For this the app reads your device's time zone. The reminder only appears if you allow notifications. You can turn it off at any time in the app or in your device settings.

5. Advertising (Google AdMob)

The free version of GridMaster is funded by ads. For this we use Google AdMob by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Through AdMob mediation, ads may also be served by Unity Ads of Unity Technologies (Unity Software Inc., USA).

The data processed may include: IP address, device and operating system information, language setting, approximate location derived from the IP address, device identifiers (the advertising ID on Android; on iOS the identifier for vendors, and the IDFA only if you allowed tracking – GridMaster does not ask for it) and information about ads shown and tapped.

The purposes are serving ads, limiting how often they appear, preventing fraud and billing. Personalized ads are only shown based on your consent (Art. 6(1)(a) GDPR) where consent is required; otherwise the processing is based on our legitimate interest in offering the app for free (Art. 6(1)(f) GDPR). If you buy the ad-free version, the app no longer shows ads.

Google and Unity may transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework; otherwise the European Commission's standard contractual clauses apply. More information: Google privacy policy, Unity privacy policy. You can reset or delete the advertising ID in your device settings.

6. In-app purchases (RevenueCat)

You pay for purchases such as the ad-free version through Apple or Google, under their privacy terms. We do not receive any payment details.

To verify and restore purchases we use RevenueCat by RevenueCat, Inc., USA. RevenueCat receives a randomly generated app user ID (no name or email), purchase receipts and transaction data from Apple or Google, information about device, operating system, app version and country, and the IP address. The legal basis is performing the purchase contract (Art. 6(1)(b) GDPR). Transfers to the USA are based on standard contractual clauses or the EU-US Data Privacy Framework. More: RevenueCat privacy policy.

7. Leaderboards (Game Center and Google Play Games)

If you are signed in to Game Center (Apple) or Google Play Games (Google) on your device, the app sends your scores to that service so they appear on the leaderboards. Apple or Google process your player ID, player name and scores. The legal basis is providing the feature you use (Art. 6(1)(b) GDPR). If you are not signed in, nothing is sent. The privacy terms of Apple or Google apply.

8. App Store, Google Play and ratings

When you download or rate GridMaster, Apple or Google process data such as your account and device data under their own responsibility. The app asks for a rating through the Apple or Google system feature; we do not learn who rates. From Apple and Google we only receive aggregated, anonymous statistics (such as downloads and crashes without personal reference).

9. Support requests

When you contact us through the support form or by email, we process your email address, optionally your name, the device and app version details and your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where it concerns the app or a purchase, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).

The form is sent via Formspree by Formspree, Inc., USA, which stores the message and forwards it to us. Formspree also processes your IP address to prevent spam. Transfers to the USA are based on standard contractual clauses. More: Formspree privacy policy.

We delete requests once they are resolved, at the latest after twelve months, unless statutory retention obligations apply.

10. This website

Hosting

The website is hosted by Vercel Inc., USA. When you visit it, Vercel processes technically necessary data in server logs: IP address, date and time, page requested, referrer, browser and operating system. This is necessary to deliver and secure the website (Art. 6(1)(f) GDPR). Vercel is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. More: Vercel privacy policy.

Analytics (Fabulous Analytics)

To understand how the website is used, we use the analytics service Fabulous Analytics. On a page view it receives in particular the page requested, referrer, browser, operating system, screen size, language setting and approximate country; the IP address is processed for the transfer. We only use aggregated reports and not to identify individuals. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).

Fonts

The “Outfit” font is served from our own server. No connection to Google Fonts is made.

Local storage

If you choose a language, the website stores that choice in your browser's local storage so it applies on your next visit. It is not sent to us (Section 25(2) no. 2 TDDDG).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to us at mail@karancode.de.

Because the app does not send data to us, data held by Google, Unity, RevenueCat, Apple or Formspree can often only be found through those providers. We will help you with that.

You can lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

If you live outside the EU, you also have the rights granted by the law of your country, such as Brazil's LGPD or Mexico's data protection law (LFPDPPP). Contact us at the address above for these as well.

12. Children

GridMaster does not knowingly collect personal data from children. If you believe a child has sent us data, for example through the support form, please let us know and we will delete it.

13. Changes

We update this privacy policy when the app, the website or the law changes. The version published here applies.