Clear choices. Minimal data.

1. Controller and contact

The controller responsible for the processing described in this policy is:

No data protection officer has been appointed because no statutory appointment requirement currently applies.

2. Scope and privacy summary

3. Processing overview and legal bases

Where processing is based on legitimate interests, those interests are operating, securing and financing the service, preventing fraud, responding to users and establishing or defending legal claims. You may object as described below.

4. Local app data

Local gameplay data is stored using Apple platform storage in the app’s protected container. It normally remains there until you use an available reset function or delete the app. Deleting local data may permanently remove progress, consumable virtual items and settings. Non-consumable App Store entitlements can generally be restored from Apple; consumable purchases and purely local progress generally cannot.

5. Apple Game Center

When Game Center is available on your device, Shadow Step asks Apple to authenticate the local player. The app may read your Game Center display name and player identifier, submit best scores and achievement progress, and retrieve leaderboard and achievement data. Other players may see information Apple makes public through Game Center. You can manage Game Center through your Apple device settings.

Apple operates Game Center and determines its own processing. See Apple’s Privacy Policy.

6. App Store purchases

Purchases are processed by Apple through StoreKit and the App Store. eleDSIGN does not receive your payment-card number or Apple Account password. Shadow Step verifies transactions and locally records the entitlement or delivered virtual item. Apple may provide aggregated or transaction-related reporting through App Store Connect for accounting, fraud prevention and support.

7. Advertising, Google AdMob and consent

Shadow Step uses Google AdMob for optional rewarded advertising and occasional interstitial advertising. Depending on your region, device settings, consent decision and the advertisement served, the Google Mobile Ads SDK and participating advertising partners may process:

• IP address and approximate location inferred from it;
• device, app and advertising-related identifiers, such as an app-scoped/publisher identifier and, only when available and permitted, Apple’s advertising identifier;
• device model, operating-system version, language, network and app information;
• ad requests, impressions, views, clicks, reward completion and frequency information;
• diagnostics, performance, security and invalid-traffic signals.

Google’s User Messaging Platform (UMP) requests and stores applicable privacy choices before ads are requested. In the EEA, United Kingdom and Switzerland, the consent form identifies the currently selected advertising technology providers and their purposes. The current provider list can change and is available through Shadow Step → Settings → Privacy Choices whenever Google requires that entry point.

Apple App Tracking Transparency (ATT): When ads may be requested under the applicable consent settings, Shadow Step also requests Apple's tracking permission during startup if no decision has been recorded and iOS permits the request. This happens after any required regional consent form and before the advertising SDK starts. Your permission allows Apple's advertising identifier to be used for personalized advertising and advertising measurement across other companies' apps and websites. Apple's permission does not replace any required regional consent. If tracking permission is denied or restricted, the app requests non-personalized ads and Google does not receive a usable Apple advertising identifier. Playing and making in-app purchases do not require tracking permission.

Manage your Apple tracking decision in device Settings → Privacy & Security → Tracking → Shadow Step, where iOS makes that control available. An existing decision or system restrictions may prevent the prompt from appearing again. Manage regional advertising consent separately through Shadow Step → Settings → Privacy Choices, when available.

Rejecting personalized advertising does not necessarily remove all advertising. Contextual or otherwise restricted advertisements may still use limited information such as IP address, app context and fraud-prevention signals. Purchasing “Remove Ads Forever” removes forced interstitial advertising, but voluntary rewarded ads remain available.

Further information: Google Privacy Policy, How Google uses information for advertising, and the in-app privacy form.

8. Website hosting and server logs

This website and the app's first-party mission-time endpoint are hosted in Germany by Linevast Hosting, a service of Droptop GmbH, Am Grashorn 8, 14548 Schwielowsee, Germany. The hosting provider receives information technically required to return the requested resource, particularly IP address, date and time, requested URL, referrer where transmitted, browser/user-agent data, transferred data volume and technical error/security information.

Routine server logs under our control are retained for no longer than 14 days and then deleted or anonymized, unless a security incident, abuse investigation or legal obligation requires longer retention. See also Linevast’s privacy information.

9. Cookies and similar technologies on this website

This website currently sets no cookies and uses no analytics, advertising pixels, local storage, session storage, remote web fonts, embedded videos or social-media plugins. Its images, styles and scripts are served locally. The publicly accessible app-ads.txt file only declares authorized advertising sellers for the app and does not track visitors.

For that reason, no cookie-consent banner is displayed. If optional analytics, advertising, embedded third-party media or other non-essential device access is introduced later, we will update this policy and obtain consent before activation where required.

10. Support communications

If you contact us, we process your email address, message content, attachments and related metadata. Please do not send payment credentials or your Apple Account password. Ordinary support correspondence is deleted no later than 12 months after the matter is closed. Records relevant to contracts, accounting, legal claims or statutory obligations are retained for the applicable legal period.

11. Recipients and service providers

Depending on the feature used, personal data may be disclosed to:

• Droptop GmbH / Linevast Hosting for website hosting, delivery and security, and mission time verification;
• Apple group companies applicable to your region for Game Center, StoreKit, App Store distribution, purchase administration and platform security;
• Google Ireland Limited, Google LLC and the advertising technology providers shown in the consent form for consent management, advertising, measurement, security and fraud prevention;
• professional advisers, authorities or courts where required by law or necessary to establish, exercise or defend legal claims.

We do not operate a proprietary user-data marketplace and do not sell personal information for money.

12. International data transfers

Website hosting is intended to take place in Germany. Apple, Google and advertising partners may process information outside your country, including in the United States. Where the GDPR or UK GDPR applies, transfers to countries without an adequacy decision must use a recognized safeguard, such as the EU–US Data Privacy Framework where applicable, the UK extension where applicable, or contractual safeguards including the European Commission’s Standard Contractual Clauses. Details and applicable safeguards are available from the relevant service provider or from us on request.

13. Retention and deletion

14. Your privacy rights

Subject to applicable law, you may request access, correction, deletion, restriction of processing, data portability and information about recipients. You may object to processing based on legitimate interests. You may withdraw consent at any time for future processing without affecting processing that was lawful before withdrawal. You also have the right not to be subject to unlawful discrimination for exercising applicable privacy rights.

Send requests to Privacy request by email. We may request proportionate information to verify your identity and protect other users. If another provider controls the relevant data—for example Apple for Game Center or App Store billing—we may direct you to that provider.

EEA residents may lodge a complaint with any competent supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

15. Privacy choices and consent withdrawal

Our Privacy Choices guide explains where to manage your choices. The website does not provide controls to change app settings or delete app data. In the app, use Settings → Privacy Choices to reopen Google’s form when the option is required. You can manage Game Center and relevant Apple privacy settings in your device settings. Deleting the app removes locally stored gameplay data, subject to device backups and Apple-managed purchase or Game Center records.

16. United States privacy disclosures

Residents of states with applicable consumer privacy laws may have rights to know/access, correct, delete, obtain a portable copy, opt out of targeted advertising or the sale/sharing of personal information, limit certain sensitive-data uses, appeal a denied request and receive equal service.

During the preceding 12 months, the categories potentially processed through the app or website are identifiers and network data, internet or app activity, approximate location inferred from IP, commercial/purchase entitlement information, gameplay/achievement information and diagnostics. These categories are used and disclosed for the purposes and to the recipients described above. We do not knowingly collect sensitive personal information for purposes requiring a right to limit.

eleDSIGN does not sell personal information for money. Personalized advertising may nevertheless qualify as “sharing,” “targeted advertising” or a “sale” under certain US state definitions. Where applicable, use Shadow Step → Settings → Privacy Choices and select Do Not Sell or Share My Personal Information, or contact us. We honor legally required opt-out signals where supported by the relevant service. Authorized agents may submit requests subject to legally permitted verification.

17. United Kingdom, Switzerland, Brazil and other jurisdictions

Where the UK GDPR or the Swiss Federal Act on Data Protection applies, you may exercise the access, correction, deletion, objection, consent-withdrawal and complaint rights available under that law. Where Brazil’s LGPD applies, you may request confirmation of processing, access, correction, anonymization, blocking or deletion where appropriate, portability, information about sharing and consent choices, and review of relevant automated decisions. Users in Canada, Australia and other jurisdictions may exercise equivalent rights available under their local law by contacting us.

18. Children

Shadow Step is a general-audience game and is not directed to children under 13. We do not knowingly request a child’s name, email address or other direct contact information through the app. Advertising and platform SDKs may process persistent identifiers or network information, which can be personal information under children’s privacy laws. If you believe a child has provided personal information contrary to applicable law, contact us so that we can investigate and request deletion where appropriate.

Parents and guardians should use Apple’s family and device controls. Users below the minimum digital-consent age applicable in their country should use relevant online features only with permission from a parent or guardian.

19. Automated decision-making and security

eleDSIGN does not use personal data to make solely automated decisions producing legal or similarly significant effects. We apply reasonable technical and organizational safeguards appropriate to the service, including HTTPS for the website, Apple’s application sandbox, verified StoreKit transactions and access controls. No method of transmission or storage can be guaranteed completely secure.

20. Changes to this policy

We update this policy when the app, website, service providers or legal requirements change. Material changes affecting consent or user choices will be communicated in an appropriate manner before the new processing begins where required. The current version and update date will remain available at this URL.