Privacy Policy

Last updated: 29 October 2026

Controller

Dario Aberle (AXATH), Gustav-Heinemann-Str. 37, 28215 Bremen, Germany. Email: [email protected]. This policy covers the game Gem Rush ("we").

What we process

• Game account and saved game. A random player ID, a hash of a secret stored on your device, and your saved progress. Purpose: to let you play and keep your progress. Basis: contract (Art. 6(1)(b) GDPR). Storage: until you delete your account.
• Sign in with Apple (optional). The stable ID Apple gives us and a token to revoke the link. We receive no password or email address. Purpose: moving your game to another device. Basis: Art. 6(1)(b). Storage: until you unlink or delete your account.
• Username, friends, gifts, leaderboards (optional). Your username, friend code, in-game profile, country, friends, blocks, gifts and weekly scores, visible to other players as shown in the game. Purpose: rankings and friends. Basis: Art. 6(1)(b). Storage: until you delete your account.
• Country. Derived from your IP address; only the country code is stored. Purpose: country rankings and applying the right privacy rules. Basis: legitimate interest (Art. 6(1)(f)).
• Purchases. Apple processes the payment; we receive only the transaction and product, to deliver what you bought. Basis: Art. 6(1)(b). We keep purchase records without any link to you for as long as tax law requires (up to 10 years, § 147 AO, § 257 HGB; Art. 6(1)(c)), also after account deletion.
• Player profile. Sessions, ads watched and purchases are used to give gifts and, for adults, personalised offers; under 18 only gifts. It never changes odds or the price of the same item. Basis: legitimate interest (Art. 6(1)(f)). You can object at any time: Settings > Privacy.
• Feedback and reports. Feedback messages (with game version, device type, language) and reports of players or ads, to fix problems, keep the community safe and pass ad reports to the ad network. Basis: Art. 6(1)(f). Storage: feedback and player reports until you delete your account; ad reports are not linked to you.
• Push notifications (optional). If you allow them, we store your Apple push token, language and time zone to send game reminders, never marketing. Basis: consent (Art. 6(1)(a); § 25(1) TDDDG). Revoke in your device settings; the token is deleted with your account.
• Age. The game asks for your birth year; only the age band is stored, to apply the rules for minors. Basis: Art. 6(1)(c), (f) and Art. 8 GDPR.
• Error logs. Technical error messages (no IP addresses) to run and secure the service; they are overwritten automatically after a short time. Basis: Art. 6(1)(f).
• Device storage. The game stores its settings and account key on your device. This is strictly necessary to provide the game (§ 25(2) No. 2 TDDDG).

Advertising

The game shows a banner ad, now and then a full-screen ad when you head home, and optional reward videos you choose to watch (the one-time "Remove Ads" purchase ends the banner and full-screen ads). They are shown by Unity LevelPlay (Unity Technologies) with the ad networks ironSource Ads and Unity Ads, which process device data and, only with your permission, an advertising ID. Details: unity.com/legal/game-player-and-app-user-privacy-policy.

• In the EU/EEA, UK and Switzerland we ask for your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG) via Google's User Messaging Platform (IAB TCF) before ads start. On iPhone, Apple's tracking prompt appears only if personalised ads are possible. Refusing never limits the game.
• Players under 13 get only non-personalised, child-directed ads; under 16 in the EU only non-personalised ads.
• You can change your choice at any time: Settings > Privacy.

Recipients

Processors acting on our behalf: our hosting provider STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany) and Cloudflare, Inc. (USA; network and security services, certified under the EU-U.S. Data Privacy Framework). Apple (payments, sign-in, push), Unity/ironSource and Google (consent tool) process data under their own responsibility. We do not sell personal data. Where recipients are outside the EU/EEA (for example the USA or Israel), transfers rely on an adequacy decision or EU standard contractual clauses.

Your rights

You have the rights to access, rectification, erasure, restriction, data portability (Art. 15-20 GDPR), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time with effect for the future. You can delete your account in the game (Settings > Delete account) or by email (see games.axath.com/gemrush/delete-account). For anything else write to [email protected]. You may complain to a supervisory authority; ours is Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen, Arndtstraße 1, 27570 Bremerhaven, www.datenschutz.bremen.de. Providing data is not required by law or contract, but the game cannot work without the game account data.

Children

Gem Rush is not aimed at children, but may be played by them. Under 13 there are no usernames, rankings or friends, ads are non-personalised and child-directed, and no tracking is requested. Under 16 in the EU, ads are non-personalised. Parents who believe their child gave us data can write to [email protected].

Changes

We update this policy when needed and show the date above.