Privacy Policy

This privacy policy explains how personal data is handled when you use the Nuddle website (the "Website") and the Nuddle mobile apps for iOS and Android (the "App"). It also serves as the privacy policy referenced from our Apple App Store and Google Play listings.

We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

The controller responsible for data processing is:

SCHMUT/WEISS GmbH Sieveringer Straße 9/13 1190 Vienna, Austria

Email: office@schmutweiss.com

2. Summary

Nuddle has no user accounts and no login. We do not ask for your name, email, or other directly identifying information. You can play offline, and the App contains no advertising or advertising SDK. The data we process falls into three areas: technical delivery of the Website, store purchases and entitlements, and pseudonymous usage statistics. Each is explained below.

A. The Website

A.1 Server log files

When you visit the Website, our hosting provider automatically processes technical information your browser transmits: anonymized/shortened IP address, date and time, the page requested, the referring URL, and your browser type and operating system. This is technically necessary to deliver the Website securely and is not used to identify you.

Legal basis: legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR).

A.2 Cookie-free website analytics

We use a first-party analytics endpoint to understand which pages and languages are useful, which identifiable referring hostnames or campaign links lead to the Website, and how often visitors select an Apple App Store or Google Play link. Each event immediately increments a daily aggregate counter in Supabase. The counter contains the event type, page path, language, referring hostname without the full referring URL, sanitized campaign values, broad device class, date, and total event count.

This analytics system does not use analytics cookies, local storage, advertising identifiers, persistent visitor or session IDs, fingerprinting, or cross-site tracking. We do not store IP addresses or full user-agent strings in the analytics database. The aggregate data cannot identify unique visitors or reconstruct an individual's journey. Store-link selections are outbound clicks and do not confirm a download or installation.

Legal basis: legitimate interest in measuring and improving the Website and our own communications while minimizing the data collected (Art. 6(1)(f) GDPR).

A.3 Functional cookie (language)

The Website uses one strictly necessary cookie (NEXT_LOCALE) to remember your chosen language. It stores only your language choice, contains no identifiers, and is not used for tracking.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR); strictly necessary, exempt from consent under § 165(3) TKG 2021.

A.4 Local storage (app banner)

On mobile, a small flag may be stored in your browser's local storage to remember that you dismissed the "Get the app" banner. It never leaves your device.

A.5 Hosting

The Website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, acting as our processor (Art. 28 GDPR). Where data is transferred to the USA, it is safeguarded by the EU Standard Contractual Clauses. Vercel privacy policy: https://vercel.com/legal/privacy-policy

B. The Nuddle App

Daily Nuddle, Sequence Challenge, Quick Math, Target Recall, and Nonogram are available without payment. Each premium game mode can be tried once for one complete run without starting a payment or subscription. This is not a timed subscription trial, and preview availability is stored locally for the installation. Nuddle Plus is an optional auto-renewable monthly or yearly subscription that includes all premium game modes and Shuffle while active. Owners of the former non-consumable Remove ads product retain permanent access.

B.1 Purchases and entitlements (Apple, Google, and RevenueCat)

• Subscriptions and legacy purchases are processed by Apple (App Store) or Google (Google Play). We never receive or store raw card, bank-account, or other payment credentials.
• We use RevenueCat, Inc. to validate purchases and determine whether Nuddle Plus is active. RevenueCat receives end-user technical and transaction information such as a pseudonymous app-user ID, device or operating-system details, product and store, Apple receipt data or a Google purchase token, transaction status, country, and entitlement or expiry information.
• We do not send your name, email address, contacts, or game content to RevenueCat. RevenueCat processes end-user information on our behalf as a processor. RevenueCat privacy information: https://www.revenuecat.com/privacy

Legal basis: performance of the purchase or subscription contract (Art. 6(1)(b) GDPR) and compliance with legal obligations where applicable (Art. 6(1)(c) GDPR).

B.2 Pseudonymous usage statistics (Supabase)

To understand which games and features are used and to improve the App, we record pseudonymous product-interaction events. These may measure premium-mode preview views, preview Try selections, trial starts and completions, Nuddle Plus purchase-view interactions, and app-side purchase-funnel outcomes such as started, completed, cancelled, or failed. Events include a randomly generated device UUID, a session ID, timestamps, app or platform context, and properties such as game mode, product, entry path, score, duration, or failure reason when relevant.

RevenueCat separately processes subscription lifecycle information used to validate access, including purchases, renewals, cancellations, expirations, billing issues, and refunds. App-side interaction events are not treated as authoritative financial records.

There is no Nuddle account, name, email address, contact list, or advertising identifier attached to these records. The device UUID nevertheless distinguishes one installation from another and is therefore treated as pseudonymous data rather than as fully anonymous data. Analytics is best-effort and never required to play.

This data is stored on our behalf by Supabase, Inc. as our processor. Supabase processes customer data under its data-processing terms. Supabase privacy information: https://supabase.com/privacy

Legal basis: legitimate interest in measuring and improving the App while minimizing the data collected (Art. 6(1)(f) GDPR).

B.3 App distribution stores

The App is distributed through the Apple App Store and Google Play. When you download or use the App, Apple and Google process data (such as account and download information) as independent controllers under their own policies:

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

The "App Privacy" details on the App Store and the "Data safety" section on Google Play summarize the above categories; this policy is the authoritative description.

B.4 Children

Nuddle is a general-audience puzzle game and is not directed at children under the age required for consent in your country. We do not knowingly collect personal data from children.

C. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise these rights, contact us at office@schmutweiss.com. Because the App does not use an account and its pseudonymous identifiers are not linked to your identity, we may be unable to locate a specific record without the relevant device or purchase identifier (Art. 11 GDPR).

D. Right to lodge a complaint

You may lodge a complaint with the Austrian supervisory authority:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria Web: https://www.dsb.gv.at

E. Retention

Server log files are kept only as long as necessary for security and operation, then deleted or anonymized. Purchase and entitlement records are kept for as long as necessary to provide subscription or lifetime access and meet legal obligations. Pseudonymous usage events are retained only as long as reasonably necessary for product analytics and may then be deleted or aggregated.

F. Changes to this policy

We may update this policy to reflect changes to the Website, the App, or legal requirements. The current version always applies.

Last updated: 3 September 2026