English
← Back to Screw It Up!

Privacy Policy

This page is a translation for your information. Only the German version is legally binding. Read the German original

Information pursuant to Art. 13 of the General Data Protection Regulation (GDPR) — for this website and the mobile app “Screw It Up!”

1. Controller

The controller responsible for data processing on this website and in the app is:

Christian Zippel
Ruibrunnenstr. 2
75242 Neuhausen
Deutschland
Email: support@fatfred.net
VAT ID: DE455036337
Legal form: sole proprietor

2. General information

We take the protection of your personal data seriously and treat it confidentially and in accordance with the statutory data protection regulations (GDPR, BDSG, TDDDG) and this Privacy Policy.

This website is a purely static information page about the game “Screw It Up!”. No cookies are set, no analytics or tracking services are used, no account is required and there is no data collection via forms. No game runs in the browser either — the actual game is distributed exclusively via the Apple App Store and Google Play.

Important note on scope: The statement “no trackers” refers to this website. In the mobile app versions, advertising is delivered via Unity Ads; in the process, Unity processes device and advertising identifiers – on Android also the device’s advertising ID (unless you have deleted or restricted it), on iOS the advertising ID only after you have consented to app tracking (ATT). In addition, the app transmits crash reports, technical statistics of the Unity engine and, in the case of purchases, purchase events to Unity, and retrieves its game configuration from our server. You can find details in Section 5.

3. Server logs

This website is hosted on a virtual server (vServer) in Germany (Plesk web space, data centre within the EU). When the site is accessed, the web server stores technically necessary access data in server log files:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability, security and the detection of misuse).
Retention period: up to 14 days, followed by automatic rotation and deletion.
Recipients: none — the logs are stored exclusively on our server and are not passed on to third parties.

Corresponding access data is generated when the app retrieves its game configuration from this server (see Section 5, “Game configuration”). If you open our legal texts in the app, the app displays them in a browser window of the operating system (iOS: Safari view, Android: Chrome Custom Tabs or your default browser); the same access data is generated as when you visit this website.

4. No cookies, no tracking on this website

This site sets no cookies, uses no Local Storage or IndexedDB, loads no tracking pixels and embeds no advertising or analytics scripts. There is also no WebGL/browser game embedded.

The game itself is distributed via the official app stores (Apple App Store, Google Play). Data processing in the app versions (advertising, in-app purchases, crash reports and Unity engine statistics, retrieval of the game configuration from our server) is described in Section 5 below; the policies of the respective store operators apply in addition.

5. Advertising and data processing in the app

The mobile app versions of “Screw It Up!” show advertisements (rewarded video ads, full-screen ads from level 10, banners in the main menu from level 5) via the Unity Ads service of Unity Technologies S.F., 116 New Montgomery Street, Suite 200, San Francisco, CA 94105, USA (privacy policy: https://unity.com/legal/privacy-policy).

Data processed

In connection with ad delivery, the following data in particular is processed: the device’s advertising ID (Apple IDFA or Google Advertising ID, insofar as provided by the operating system and not restricted by the user) and your app tracking choice, an app installation identifier, possibly further identifiers (e.g. on Android the app set ID of Google Play services, on iOS the identifier for vendors IDFV; Unity determines on the server side which of these are transmitted), the IP address, technical device information (device model, processor and graphics chip, storage and RAM size, battery level and power saving mode, volume, screen brightness, system boot time and uptime), operating system version, language, time zone, locale and keyboard languages, the type of network and mobile connection, and the geographic region at country level.

The Unity Ads SDK includes the ironSource Ad Quality component (Unity Technologies or its group company ironSource Ltd., Israel; an adequacy decision of the European Commission exists for Israel). It serves to ensure the quality of the ads delivered (e.g. detecting faulty or impermissible ad creatives) and, for this purpose, processes a device identifier as well as technical diagnostic and performance data of ad delivery. This component does not track users across apps and websites.

The Unity Ads SDK also includes a component for fraud and quality checks (“UnityCoherenceLib”). It evaluates technical device signals on the device (e.g. device model, battery level and charging status) and attaches the result to the ad requests sent to Unity. Unity can update the check modules used for this, which are signed by Unity; the component communicates exclusively with Unity servers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing advertising fraud and in secure ad delivery).

To measure advertising success, the Unity Ads SDK uses the Attribution Reporting interface of the Android Privacy Sandbox on Android version 13 and later: the SDK notifies the operating system when an ad has been viewed or clicked; the operating system matches this on the device with later actions in the advertised app and, based on this, sends limited, delayed reports to Unity. This only happens if your device supports this function and ad measurement is switched on in the Android settings for ad privacy (the name varies depending on the device); you can switch it off there at any time. The permission for the Topics interface (“Topics”), which the SDK also declares, is not used. On iOS, Unity Ads measures advertising success via Apple’s SKAdNetwork and AdAttributionKit methods, in which Apple reports the results without an advertising ID and with a delay. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring advertising success in order to fund the free app).

Legal basis

For iOS users who have given App Tracking Transparency (ATT) consent, personalised advertising is delivered on the basis of your consent (Art. 6(1)(a) GDPR); before any tracking takes place, Apple’s system ATT dialog is shown for this purpose. Without ATT consent, the app requests non-personalised (non-behavioural) advertising on iOS; the legal basis is then our legitimate interest in funding the free app (Art. 6(1)(f) GDPR).

On Android, the app always requests non-personalised advertising from Unity Ads: at every launch, before initialisation, it informs Unity that there is no consent to personalised advertising and that only non-behavioural advertising is to be delivered; no consent dialog is displayed. How Unity implements this information is decided by Unity as an independent controller; we do not create any profiles. The legal basis for this delivery is our legitimate interest in funding the free app (Art. 6(1)(f) GDPR). You can restrict or delete your device’s advertising ID yourself at any time in the system settings (see below).

Recipients and transfers to third countries

The recipient of the data is Unity Technologies S.F., 116 New Montgomery Street, Suite 200, San Francisco, CA 94105, USA (contact in the EU: Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark; data protection contact: DPO@unity3d.com). Under the Unity Data Processing Addendum (clause 3), Unity generally processes the data as an independent controller – in particular when delivering advertising (Unity Ads), for transaction and billing data from Unity IAP that Unity uses for its own purposes (e.g. payment reconciliation and fraud prevention) and, as we understand it, also for the crash reports (Unity Cloud Diagnostics) and the Unity basic statistics (“Core Stats”), which the Addendum does not list as processing by a processor. To that extent, according to its own statements, Unity also uses the data for its own purposes, for example to maintain and improve its services; Unity’s privacy policy applies in addition. Unity processes the data of Unity Engine Diagnostics on our behalf (Art. 28 GDPR). In the process, your data is transferred to the USA and processed there; for this, Unity uses, among other things, the infrastructure of Google Cloud Platform. In addition, Unity may transfer data to affiliated companies in countries for which an adequacy decision of the European Commission exists (e.g. Israel, Canada, Japan, Switzerland, United Kingdom).

The transfer to the USA is based on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). These form part of the Unity Data Processing Addendum (https://unity.com/legal/unity-data-processing-addendum-dpa); you can view them there or request a copy from us (see contact below). Please note that courts and authorities in the USA may, under certain circumstances, be able to access the transferred data.

When ads are retrieved, for crash reports and the Unity engine statistics, and for purchase events (see below), the following domains, among others, are contacted: gateway.unityads.unity3d.com, auction.unityads.unity3d.com, config.unityads.unity3d.com, publisher-config.unityads.unity3d.com, cdn.unityads.unity3d.com, thind.unityads.unity3d.com, httpkafka.unityads.unity3d.com, ads-events.unityads.unity3d.com, ads-stats.unityads.unity3d.com, perf.unityads.unity3d.com, a-adq.mediation.unity3d.com, i-adq.mediation.unity3d.com, o-adq.mediation.unity3d.com, cdp.cloud.unity3d.com, config.uca.cloud.unity3d.com, prd.insights.analytics.unity3d.com, perf-events.cloud.unity3d.com, engine-data.unity3d.com, engine-data.services.api.unity.com, webview.unityads.unity3d.com, cdn-store-icons-akamai-prd.unityads.unity3d.com, cdn-creatives-cf-prd.acquire.unity3dusercontent.com.

Retention period

Insofar as Unity processes the data as an independent controller (see above), Unity Technologies S.F. determines the retention period; according to Unity’s privacy policy (section “Retention”), personal data is stored for as long as is necessary for the respective purpose or permitted by law. Unity processes the data of Unity Engine Diagnostics on our behalf for the duration of our use of this service and deletes it at our request once that use has ended (clause 6.5 of the Unity Data Processing Addendum). Data stored on your device (see “Local data”) remains there until the app is deleted.

Crash reports and Unity engine statistics

We ourselves do not analyse your use of the app statistically: the app does not start Unity Gaming Services, does not sign in to Unity automatically and does not transmit any game events it generates (such as game progress or in-game currency movements) – neither to us nor to Unity. The Unity engine itself, however, transmits its own statistics on the start, duration and performance of app sessions (see below). In addition, at every launch the app informs the Unity services (with the exception of Unity Ads, see above) that there is no consent for analytics and advertising purposes; as a result, Unity IAP, for example, does not read out an advertising ID. However, this information does not prevent the engine statistics described below or the purchase events of Unity IAP (see “In-app purchases”).

To fix errors, the app uses the crash reports of the Unity engine (Unity Cloud Diagnostics or Unity Engine Diagnostics). If the app crashes or an unhandled error occurs, a report is transmitted to Unity. It contains the technical error trace (stack trace), information about the device and operating system, the last 30 log lines of the app, as well as the app version, platform and version of the Unity engine. The app does not add a player or user identifier of its own; however, Unity may associate the report with the identifiers of the Unity engine described below.

In the Unity version we use, the crash reports cannot technically be separated from Unity’s own engine statistics. Therefore, when the app is started and during use, the Unity engine additionally transmits:

This data contains neither your name nor your email address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free product). You can object to this processing at any time (Art. 21 GDPR, see contact below) or contact Unity directly. Please note: the app cannot technically switch off the transmission for individual users; on your device, it can only be avoided by not using the app.

App versions up to and including 1.0.5 additionally transmit, until they are updated, pseudonymous game events (in-game currency movements, ad and purchase events) via Unity Gaming Services, sign in to Unity automatically for this purpose without a user account (pseudonymous player identifier, which is also attached to crash reports), send a session event via Unity IAP at every launch and retrieve game values via Unity Remote Config. The purpose of this processing is to analyse usage and purchases in order to improve the app and keep it stable, and to adjust game values without an app update; the legal basis is Art. 6(1)(f) GDPR. Recipients, transfers to third countries and retention period are as stated above. You can object to this processing at any time (Art. 21 GDPR, see contact below). It ends with the update to version 1.1.0.

In-app purchases

In-app purchases are processed via the Apple App Store or Google Play. We do not receive any payment data (no account numbers, credit card details or billing addresses); the app processes the purchase receipt in order to unlock the purchased content. The privacy notices of Apple or Google apply in addition.

To process purchases, the app uses the Unity IAP module of Unity Technologies S.F. This module transmits purchase events to Unity (prd.insights.analytics.unity3d.com) only in connection with purchases: when a purchase has been started, paid, completed or has failed, and also when the store subsequently reports an earlier purchase that had not yet been completed – in each case regardless of your app tracking choice. A purchase event contains:

The installation and player identifiers of Unity Gaming Services and the advertising ID are not transmitted in the process (the session identifier of the Unity engine mentioned above, however, is). The recipient is Unity in the USA (for recipients and transfers to third countries, see above). The purpose is the processing, validation and protection of purchases (fraud prevention) as well as billing; Unity also uses transaction and billing data as an independent controller for its own purposes (e.g. payment reconciliation, financial reports, compliance with legal obligations, fraud prevention). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the free app securely and economically). You can object to this processing at any time (Art. 21 GDPR); the processing of your purchases via the respective store remains unaffected. The purchase events cannot be switched off separately in the app; they only occur when you make a purchase or the store subsequently reports a purchase.

Fraud protection identifier: To protect against purchase fraud, the app generates a random identifier once, which is stored on your device and has no connection to your name or email address. When you make a purchase, the app passes a hash value calculated from it (SHA-256) to the store – to Apple as “appAccountToken”, to Google Play as an obfuscated account identifier (“obfuscatedAccountId”). The store uses it to detect fraud and returns it in the signed proof of purchase; with this proof, it also reaches Unity. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing purchase fraud).

Purchase data to Unity Ads: On iOS, Unity IAP passes every store transaction (transaction and product identifier, product data, time, signed transaction) on to the Unity Ads SDK. In addition, the Unity Ads SDK on iOS and Android contains a function of its own that observes purchases in the app or queries them from the store and transmits them to Unity as transaction events; whether this function is active is controlled by Unity on the server side. To our knowledge, the purpose is to attribute purchases to the advertising delivered (advertising attribution). Unity processes this data within the scope of Unity Ads as an independent controller. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in funding the free app through advertising).

Game configuration

At every launch, the app retrieves a configuration file with game values (e.g. frequency of advertisements, lives, rewards and a notice of a required app update) from our own server (https://screwitup.fatfred.net/config/remote-config.json). The request contains no advertising ID, no device or user identifier, no cookies and no login, and is independent of your app tracking choice. In the process, the access data listed in Section 3 is generated on our server (IP address, date and time, file retrieved, status code, amount of data transferred and, instead of the browser identifier, the user agent string of the app’s network function; no referrer URL is transmitted); retention period and recipients as described there. The app stores the most recently successfully loaded configuration file on your device and uses it when there is no connection; it contains only game values and no personal data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in being able to adjust game values without an app update and in secure server operation).

Local data

Game progress, lives, prize wheel status and settings (including the selected game language) are stored on your device. No user account is required; the app does not carry out any cloud synchronisation of its own. On Android, this data – like most app data – may be part of the Google backup managed by the operating system, provided you have activated it in the device settings. In addition, the app stores the most recently loaded game configuration (see above) and the random identifier for fraud protection in purchases (see “In-app purchases”). The app schedules reminders (notifications) exclusively locally on the device; no data is transmitted to us or to third parties in the process.

The Unity engine and the Unity Ads SDK create their own pseudonymous identifiers on the device (including installation and session identifiers of the engine); since version 1.1.0, the app no longer generates identifiers of Unity Gaming Services (such as a player identifier). None of these identifiers contains your name or email address; they are stored with the app data and removed when the app is deleted (on Android, subject to an activated data backup).

Obligation to provide data, automated decision-making

You are under no statutory or contractual obligation to provide data to us or to Unity. However, the transmissions described in this section are technically linked to the use of the app; without them, the app cannot be used or can only be used to a limited extent (without purchase data, for example, no in-app purchases are possible). If you decline app tracking on iOS, you will receive non-personalised advertising. We do not carry out any automated decision-making within the meaning of Art. 22 GDPR; for personalised advertising on iOS, Unity, as an independent controller, selects the ads automatically (see Unity’s privacy policy).

Right to object under Art. 21 GDPR

Insofar as we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) or have the app transmit it to Unity – non-personalised advertising, fraud and quality checks of the ads, measurement of advertising success, crash reports and Unity engine statistics, purchase events and purchase data to Unity, fraud protection identifier, retrieval of the game configuration and server logs –, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. As the app cannot technically switch off these transmissions for individual users, in practice an objection can only be implemented for further use by no longer using the app; with regard to data already stored by Unity, please also contact Unity (DPO@unity3d.com). Contact: support@fatfred.net.

Your rights / resetting the advertising ID

You can reset the advertising ID or restrict tracking yourself at any time — on iOS in the system settings (“Privacy & Security → Tracking” or “… → Apple Advertising”), on Android in the settings under “Privacy → Ads → Delete advertising ID”. You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), objection (Art. 21) and withdrawal of consent (Art. 7(3) GDPR). Contact: support@fatfred.net; for processing by Unity, please also contact Unity directly (DPO@unity3d.com).

6. Fonts (hosted locally)

The “Fredoka” font is delivered locally from our server (Open Font License). There is no connection to Google Fonts or other third-party providers; accordingly, no personal data is transferred to third parties in the process.

7. Contacting us by email

If you contact us via the email address given in the Legal Notice (e.g. to take part in the closed Android beta or to be notified of the Android launch), the data you provide (name, email address, content of the message) will be used exclusively to answer your enquiry, for the beta invitation or for the one-time notification you requested. For the beta invitation, we enter the Google account address you have given us in the tester list of the Google Play Console; as a result, Google receives this address. You will not be added to any newsletter mailing list.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry).
Retention period: until your enquiry has been dealt with conclusively or until the requested notification has been sent; longer where statutory retention obligations apply.

8. Hosting

The website is hosted on a dedicated virtual server (vServer) in a German data centre within the EU. The hosting itself involves no transfer to third countries. Fonts are delivered locally from our server (see Section 6), so no data is transferred to Google as a result; for the transfer of data to Unity in the USA by the app, see Section 5.

9. Your rights as a data subject

You have the following rights vis-à-vis us with regard to the personal data concerning you:

An informal email to support@fatfred.net is sufficient to exercise your rights.

10. Right to lodge a complaint with the supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our place of business is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Postal address: Postfach 10 29 32, 70025 Stuttgart
Phone: 0711/615541-0
Email: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de

11. Status and changes to this Privacy Policy

This Privacy Policy is currently valid and dated October 2026 (adapted to app version 1.1.0: no usage statistics of our own and no sign-in to Unity Gaming Services any more, game configuration from our own server, disclosure of the Unity engine statistics, of the purchase data sent to Unity IAP and Unity Ads, of the fraud protection identifier and of ad measurement via the Android Privacy Sandbox, transfers to Unity in third countries based on standard contractual clauses). As the website and the app are developed further, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. The current version can always be accessed at this URL.

12. Controller / provider (§ 5 DDG)

Christian Zippel
Ruibrunnenstr. 2
75242 Neuhausen
Deutschland

Email: support@fatfred.net
VAT ID (§ 27 a UStG, German VAT Act): DE455036337
Legal form: sole proprietor
Responsible for content pursuant to § 18(2) MStV (German Interstate Media Treaty): Christian Zippel (address as above)

Full Legal Notice: screwitup.fatfred.net/impressum.html