Privacy notice for Banana Clicker

The controller is Digital-e UG (haftungsbeschränkt), represented by managing director Kurt Laabs, Norderstraße 47, 25436 Tornesch, Germany. Registered at Amtsgericht Pinneberg under HRB 18836 Pi.

Privacy and deletion requests: anfrage@digital-e.org. Telephone: +49 4122 8452786. Technical game support: kurt.laabs@digital-e.org. You may also exercise your privacy rights by writing to our postal address above.

Your banana balance, progress, achievements, unlocked and selected artwork, language, sound and motion preferences are stored on your device. A local backup helps recover a damaged save. We do not synchronise game progress to our own cloud.

Incomplete purchases may temporarily remain in a local queue with the product ID, purchase token or receipt, and transaction ID, so delivery can continue after a connection failure. Once completion succeeds, the entry is removed from the active queue. An earlier local backup may still contain it until overwritten.

This storage supports the game you request and reliable delivery of purchased content. Processing personal data is based on Article 6(1)(b) GDPR. Necessary storage on or access to your device is covered by section 25(2)(2) of Germany's TDDDG. Without this storage, progress and purchase delivery cannot be maintained reliably. Android backups and other backup services you configure are subject to your device settings and those services' privacy notices.

When Google Play is available and the shop connection is initialised, Firebase Authentication creates a technical user ID without asking for your name or email. This may happen before a purchase. The ID is pseudonymous: it links requests and purchase entitlements even though we do not know your name. There is no Banana Clicker password login and no separate app sign-in linking your Google account.

Firebase processes the ID, IP address and technical connection information. Firebase App Check and Google Play Integrity check app and device authenticity using technical app, signature, licensing and integrity information. The app sends authentication and attestation tokens to our purchase service. These checks prevent manipulated requests, duplicate delivery and unauthorised unlocks. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in operating securely and preventing abuse.

These technical data are required for the online functions. Failed verification can temporarily prevent purchases or restoration. The local basic game requires neither a purchase nor your name. The app does not request access to your location, contacts, camera or microphone and does not use an advertising ID.

Purchases are optional and use Google Play Billing. Google processes your Google account, order and payment under the information and terms applicable to Google Play. We do not receive card numbers, bank details or Google passwords.

For verification, the app sends the product ID, platform, purchase token or receipt, any transaction ID and technical verification tokens to our service at server.digital-e.org/banana-backend/ over HTTPS; games.digital-e.org remains available for existing installations and as a fallback. Google returns information about validity, product, delivery and revocations or refunds. The data therefore come from the app and Google's purchase verification, not from public sources.

Our purchase register stores the product, platform, delivery and revocation status, timestamps, and hashed purchase and user identifiers. Hashes are pseudonymous evidence, not a guarantee of complete anonymity. Raw purchase and authentication tokens are not persistently stored in the purchase register or recorded in application logs. Technical event logs contain a request ID, operation type, product ID, result and duration. Manually reviewed refunds include a hashed order reference. These logs support delivery, troubleshooting and security of the purchase service; they contain no gameplay actions or advertising profiles.

Providing, confirming and restoring purchased content is based on Article 6(1)(b) GDPR. Preventing duplicate delivery and purchase fraud is based on Article 6(1)(f) GDPR. You may ask game support to review a failed technical purchase check. You do not need to send full payment details.

When you contact us, we process your sender address, message and any information you voluntarily include. A technical user ID or order reference may help identify your request. Do not send passwords, full payment details or unsolicited identity documents. Purchase-related support is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR, our interest in answering your request. We handle privacy requests under Article 6(1)(c) GDPR to meet our obligations under Articles 12 to 22 GDPR.

When you visit the information pages at games.digital-e.org, the web server processes information including your IP address, access time, requested address, status code and transmitted browser and referrer details. This delivers and secures the pages under Article 6(1)(f) GDPR. These pages use no cookies, external fonts, analytics or advertising scripts.

The corporate website at www.digital-e.org is delivered through Firebase Hosting. Google processes IP addresses for delivery, abuse prevention and technical usage information and states a retention period of a few months. The legal basis is Article 6(1)(f) GDPR, our interest in an available and secure website. The corporate website's own privacy information also covers its additional functions.

Data are accessible to Digital-e staff responsible for operations and support and to technical providers for server hosting and email. Google/Firebase processes technical authentication and security data for the described functions. Google Play also processes order and payment data as an independent controller. Authorities or advisers involved in a specific legal matter may receive data where legally required. We do not sell personal data or disclose it for advertising.

Google services may process data in the United States and other countries outside the European Economic Area. Google describes safeguards including standard contractual clauses and, for covered transfers to certified US recipients, the EU-US Data Privacy Framework. Applicable safeguards are described in the Firebase data processing terms and Google's international transfer information. Contact our privacy address for information or a copy of the relevant safeguards. Further information is available in Firebase privacy information and Google's privacy policy.

Mandatory retention under section 257 HGB or section 147 AO is based on Article 6(1)(c) GDPR. These periods apply only to documents actually subject to retention requirements; they do not turn all game and security data into accounting records. Specific legal claims may require limited additional retention under Article 6(1)(f) GDPR. Use is then restricted to that purpose.

Firebase states that authentication IP logs are retained for a few weeks and residual authentication data are removed from live and backup systems within up to 180 days after user deletion is initiated. Google Play manages its own order, payment and security data under its privacy information. Our server retention periods do not apply to Google's records.

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and portability under Articles 15 to 20 GDPR. You can withdraw any consent you have given for future processing without affecting the lawfulness of earlier processing. The core functions described here rely on the specified legal bases, not on blanket privacy consent.

Write to anfrage@digital-e.org. We verify the connection to your data using as little additional information as possible and generally respond within one month. If a lawful extension is needed, we explain the reasons within that month. You do not have to reinstall the app or purchase anything to make a request.

The data deletion instructions explain deletion of local data, the technical identity and server-side links. Deletion by us does not delete a Google Play order or issue a refund. Continuing to use the app's shop can create a new technical identity.

You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. The authority responsible for our registered office is the Independent Centre for Data Protection Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR. Contact anfrage@digital-e.org.

We will stop the affected processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Direct marketing would be subject to an unconditional right to object; we do not use your data for direct marketing.

The purchase service automatically checks whether evidence is valid, matches the product and has already been delivered or revoked. Security checks may block online purchase processing. We do not evaluate personal characteristics or create advertising profiles. The app has no AI feature and does not send player input to AI services. You may ask game support to review an incorrect rejection.

Sharing opens your device's system share sheet. The selected content is passed to another app only after you choose it. That app's provider is responsible for its subsequent processing.

Banana Clicker is intended for people aged 16 and over. A store content rating is a separate classification. Minors should make paid purchases only with any required permission from their parent or guardian. The app does not collect a date of birth or perform age verification. Parents and guardians may contact our privacy address with questions or deletion requests.

We update this notice and its date when functions or processing change. We inform you before beginning processing for a new purpose. The current notice is available through app settings and the store's privacy link. This English version covers the same content as the German version; the German version prevails in case of linguistic differences, without limiting mandatory legal rights.