Privacy Policy

This privacy policy explains how personal data is handled when you use the Nuddle website (the "Website") and the Nuddle mobile apps for iOS and Android (the "App"). It also serves as the privacy policy referenced from our Apple App Store and Google Play listings.

We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

The controller responsible for data processing is:

SCHMUT/WEISS GmbH Sieveringer Straße 9/13 1190 Vienna, Austria

Email: office@schmutweiss.com

2. Summary

Nuddle has no user accounts and no login. We do not ask for your name, email, or any directly identifying information. You can play offline. The data we process falls into three areas: technical delivery of the Website, advertising and purchases inside the free App, and anonymous usage statistics. Each is explained below.

A. The Website

A.1 Server log files

When you visit the Website, our hosting provider automatically processes technical information your browser transmits: anonymized/shortened IP address, date and time, the page requested, the referring URL, and your browser type and operating system. This is technically necessary to deliver the Website securely and is not used to identify you.

Legal basis: legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR).

A.2 Functional cookie (language)

The Website uses one strictly necessary cookie (NEXT_LOCALE) to remember your chosen language. It stores only your language choice, contains no identifiers, and is not used for tracking.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR); strictly necessary, exempt from consent under § 165(3) TKG 2021.

A.3 Local storage (app banner)

On mobile, a small flag may be stored in your browser's local storage to remember that you dismissed the "Get the app" banner. It never leaves your device.

A.4 Hosting

The Website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, acting as our processor (Art. 28 GDPR). Where data is transferred to the USA, it is safeguarded by the EU Standard Contractual Clauses. Vercel privacy policy: https://vercel.com/legal/privacy-policy

B. The Nuddle App

The Nuddle App is free and financed through advertising, which you can permanently remove with an optional one-time purchase.

B.1 Advertising (Google AdMob)

The free version of the App displays banner, interstitial, and rewarded ads through Google AdMob (provided by Google Ireland Limited / Google LLC). To deliver, frequency-cap, and measure ads, AdMob and its partners may process:

  • your device's advertising identifier (IDFA on iOS, Advertising ID on Android),
  • IP address and coarse, IP-derived location,
  • device and ad-interaction data (e.g. ads shown, taps).

Personalized vs. non-personalized ads. Whether you see personalized ads depends on your consent (see B.2). If you do not consent, AdMob serves non-personalized (contextual) ads instead.

Legal basis: your consent for personalized ads and any tracking (Art. 6(1)(a) GDPR); legitimate interest in financing a free app through non-personalized advertising where consent is not given (Art. 6(1)(f) GDPR).

More on how Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites · Google privacy policy: https://policies.google.com/privacy

B.2 Consent and tracking transparency (ATT & Google UMP)

  • In the EU/EEA and UK, on first launch the App shows a Google User Messaging Platform (UMP) consent screen where you choose whether to allow personalized ads. You can change this choice later in the App's settings.
  • On iOS, the App also asks for permission via Apple's App Tracking Transparency (ATT) framework before any cross-app/website tracking. If you decline, your advertising identifier is not used for tracking and ads are non-personalized.

B.3 In-app purchase "Remove ads forever" (RevenueCat)

The App offers a single, one-time, non-consumable purchase, "Remove ads forever," which permanently disables advertising. You can restore it on a new device via "Restore purchases."

  • The purchase itself is processed by Apple (App Store) or Google (Google Play). We never receive or store your payment card details.
  • We use RevenueCat, Inc. (8 The Green, Dover, DE 19901, USA) to validate purchases and manage your entitlement. RevenueCat processes an anonymous app-user ID and the purchase/receipt data (product, transaction, store, country). It is not linked to your name. RevenueCat privacy policy: https://www.revenuecat.com/privacy

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

B.4 Anonymous usage statistics (Supabase)

To understand which games and features are used and to improve the App, we record anonymous usage events (e.g. a game started/finished, a daily puzzle solved, the remove-ads offer viewed) together with a randomly generated anonymous device ID (UUID), a session ID, and timestamps. There is no account, no name, and no contact data — the device ID cannot be traced back to you by us. Analytics is best-effort and never required to play.

This data is stored on our behalf by Supabase, Inc. (970 Toa Payoh North, Singapore) as our processor. Supabase privacy policy: https://supabase.com/privacy

Legal basis: legitimate interest in measuring and improving the App using anonymous data (Art. 6(1)(f) GDPR).

B.5 App distribution stores

The App is distributed through the Apple App Store and Google Play. When you download or use the App, Apple and Google process data (such as account and download information) as independent controllers under their own policies:

The "App Privacy" details on the App Store and the "Data safety" section on Google Play summarize the above categories; this policy is the authoritative description.

B.6 Children

Nuddle is a general-audience puzzle game and is not directed at children under the age required for consent in your country. We do not knowingly collect personal data from children.

C. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time (e.g. via the in-app consent settings or your device's advertising settings), without affecting prior processing.

To exercise these rights, contact us at office@schmutweiss.com. Please note that because our analytics and advertising identifiers are not linked to your identity, we may be unable to locate "your" records without additional information from you (Art. 11 GDPR).

D. Right to lodge a complaint

You may lodge a complaint with the Austrian supervisory authority:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria Web: https://www.dsb.gv.at

E. Retention

Server log files are kept only as long as necessary for security and operation, then deleted or anonymized. Advertising identifiers are governed by Google's retention policies and your device settings. Purchase/entitlement records are kept for as long as needed to honor your purchase and to meet legal (e.g. tax) obligations. Anonymous usage events are retained in aggregate for product-analytics purposes.

F. Changes to this policy

We may update this policy to reflect changes to the Website, the App, or legal requirements. The current version always applies.

Last updated: 15 June 2026