Privacy policy

Last updated: 12 October 2026. This policy applies to the Ovalings app and the website with the legal texts. It tells you which data we process, why, and what rights you have. If the German and English versions differ, the German version applies.

1. Controller

• Luis Dominic Bodenbach, Vogelsbergstraße 27, 60316 Frankfurt am Main, Germany
• Email: ovalings.support@proton.me
• Contact form: in the app under Settings, Legal, Contact, and on the website

We are not required to appoint a data protection officer. You can reach us about any privacy question through the channels above.

2. Which data we process

• Account: email address, password (only stored as an encrypted check value, never in plain text) and year of birth.
• Profile: display name and friend code.
• Game progress: diamonds, gold, energy and their bookings, eggs, Ovalings with their history, items, backdrops.
• Playing together: friendships, marketplace offers, inbox messages.
• Ovaling profiles: the three sentences in the profile and, for each AI call, your account ID, time, type of call, model, amount of text processed and cost (see section 7).
• Reward videos: for each reward you collect, your account ID, the day, the place in the game, whether it came from a video or a monthly pass, Google's transaction ID and the reward (see section 8).
• Purchases with real money: store (Apple or Google), receipt and order IDs, product, quantity, reference price, time, what was credited, for monthly passes the term and status of the subscription, for refunds the time, reason and what was taken back (see section 9). We do not receive payment data such as card numbers.
• Parental approval (only under 18): the email address you enter for your parents, until they decide, then only the status, the monthly limit and the time of the decision (see section 9).
• Contact form: your message, the topic, your email address and an encrypted check value of your IP address against spam.
• Technical data: every connection to our server involves your IP address, the time and the request.
• On your device: your sign-in (encrypted), your settings and cached images of your Ovalings.

We ourselves do not use analytics or tracking tools. Google's advertising SDK is built in for the reward videos, section 8 explains what it processes. The app does not access your location, contacts, photos, camera or microphone.

3. Purposes and legal bases

• Account, game progress, friends, marketplace and inbox: so you can play Ovalings. The legal basis is the contract of use (Art. 6(1)(b) GDPR).
• Year of birth: to enforce the minimum age of 16 and to lock purchases for players under 18 (Art. 6(1)(b) and (c) GDPR).
• Confirmation emails and password reset emails: for your account (Art. 6(1)(b) GDPR).
• Profiles: so every Ovaling gets its own description (Art. 6(1)(b) GDPR) and to limit the number of calls per account and day and the cost (Art. 6(1)(f) GDPR).
• Reward videos: to credit the reward you choose exactly once and to keep the daily limits (Art. 6(1)(b) GDPR). For personalised ads and for Google storing information on your device we ask for your consent first (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Purchases with real money: to verify purchases, credit them, run monthly passes and record refunds (Art. 6(1)(b) GDPR), and to keep receipts as long as tax and commercial law require (Art. 6(1)(c) GDPR).
• Parental approval: to allow purchases by players under 18 only with their parents' consent and within their limit (Art. 6(1)(b) and (f) GDPR).
• Currency bookings and server logs: to detect fraud, abuse and errors and to run the game securely. The legal basis is our legitimate interest in a fair and secure game (Art. 6(1)(f) GDPR).
• Contact form: to answer your request (Art. 6(1)(b) or (f) GDPR).
• Deleting your account: to carry out your request (Art. 6(1)(c) GDPR together with Art. 17 GDPR).

4. Storage on your device

The app stores your sign-in, your settings (language, sound, appearance) and images of your Ovalings on your device. This is necessary for the app to work the way you want to use it (Section 25(2) no. 2 TDDDG). No consent is needed for this. If you delete the app, this data is gone. Section 8 explains what Google's advertising SDK stores on your device.

5. Recipients

• Supabase: our server runs at Supabase (Supabase Pte. Ltd.), data centre in Frankfurt am Main, Germany. Supabase processes the data only on our behalf and according to our instructions (processing under Art. 28 GDPR). Confirmation emails are also sent through it.
• Anthropic: writes the profiles (Anthropic, PBC, model Claude Haiku). Section 7 explains what we send there.
• Google AdMob: shows the reward videos (Google Ireland Limited). Details in section 8.
• Resend: sends the email to your parents when you are under 18 and ask for approval of purchases (section 9).
• Other players: others can see your display name, your showcase, your backdrop and your marketplace offers. Only your friends can see your profile with your collection. Everyone who looks at an Ovaling can see its profile. Nobody can see your email address.
• Apple and Google: they distribute the app and handle in-app purchases. They are responsible for this themselves and their privacy policies apply. Our server checks every receipt with them to verify a purchase, and they notify us of renewals, cancellations and refunds. We only receive the information we need for this, no payment data.
• GitHub: the website with the legal texts and the page where parents approve purchases are hosted on GitHub Pages (GitHub, Inc.). GitHub stores the IP address of every visit for security purposes.

We do not sell data. For advertising we only pass on what section 8 describes.

6. Transfers outside the EU

Supabase is based in Singapore and uses service providers, including Amazon Web Services in the USA. Your game data is stored in Frankfurt, but access from these countries is possible, for example for maintenance and support. The safeguard is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can get a copy on request. GitHub transfers data to the USA on the basis of the adequacy decision for certified companies (EU-US Data Privacy Framework) and standard contractual clauses. Anthropic processes the information for the profiles in the USA. Google and Resend may also transfer data to the USA.

7. AI-written profiles

The three sentences in an Ovaling's profile are written by an AI: Claude Haiku by Anthropic. The call only goes through our server, never directly from the app. We only send information calculated from the Ovaling's ID: family, egg, rarity, epithet, appearance (body, eyes, skin, marking, brows, rare parts), the stats as a rough level, rank within its rarity, usefulness in fights, number of attack slots and the passive. For a translation, the finished English profile is added. Your name, your email address, the Ovaling's nickname or other information about you are not sent.

The AI decides nothing in the game. Stats, odds and loot are calculated by our code alone, the AI only writes the text. The profile is created when the owner looks at the Ovaling for the first time and is stored with the Ovaling. It stays as long as the Ovaling exists. To limit costs, we store which account triggered each call (see section 2).

8. Advertising

Ovalings only shows ad videos that you start voluntarily to get a reward, such as double loot after a fight, energy, diamonds or a spin of the lucky wheel. There are no ads between actions and no banners. Players with a monthly pass get the same rewards without a video.

The videos come from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Where required, for example in the EU, the app uses Google's consent form at start-up to ask whether Google may use data for personalised ads and store information on your device. You can change your choice at any time in the settings under "Ad privacy options". Without consent, Google only shows non-personalised ads or none. We only allow ads that are suitable for teenagers.

What Google processes when loading and showing a video (such as device identifiers, IP address, information about the device and the ad) is decided by Google itself, and Google's privacy policy applies. When a video is loaded, we only pass Google your account ID and the place in the game, for double loot also the ID of the fight. After the video, Google tells our server that you have earned the reward. Our server checks the signature of this message and credits the reward exactly once per transaction. Section 2 lists what we store. These records stay until you delete your account.

9. Purchases with real money

Purchases go through Apple's App Store or Google Play. After a purchase, the app sends the receipt to our server. The server checks with Apple or Google whether the purchase is genuine and paid, and only then credits the content, exactly once per receipt. Apple and Google also notify us of renewals, cancellations and refunds.

If you get a refund, we take back the content of the purchase, at most until your balance reaches 0. If diamonds are missing because they were already spent, we note the shortfall. From the second such refund on, further purchases are locked until you settle the shortfall with diamonds.

If you are under 18, purchases are locked until your parents unlock them. To do this, you enter your parents' email address in the app. We send them an email through Resend with your display name and two links, one to approve with a monthly limit and one to decline or withdraw the approval later. We only store a check value of the links. We delete the address as soon as your parents have decided, at the latest after 7 days. After that we only store whether purchases are approved, the limit and the time.

Guest accounts cannot make purchases with real money.

10. How long we keep data

• Account and game progress: until you delete your account. We then mark it for deletion for 30 days. During this time others no longer see you, and you can cancel the deletion by signing in. After that we delete everything that belongs to your account, including your messages sent through the contact form, and your account ID and nicknames are removed from the history of Ovalings you sold. Guest accounts are deleted right away. Ovalings, eggs and items you sold to others belong to them and stay with them, as do the profiles of those Ovalings.
• Reward videos: until you delete your account.
• Parents' email address: until they decide, at most 7 days.
• Contact form: until your request is resolved, then for at most one year.
• Server logs: only briefly, according to Supabase's retention periods.
• Records of purchases: as long as tax and commercial law require (up to ten years). If you delete your account, they are kept without any link to your account.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw any consent at any time with effect for the future, your consent for ads directly in the settings. Otherwise just write to us through the contact form or by email.

You can also lodge a complaint with a data protection supervisory authority, for example in the country where you live (Art. 77 GDPR).

12. Children and young people

Ovalings is for players aged 16 and over. For players under 18, purchases with real money are locked until their parents unlock them (section 9). In-app purchases go through Apple and Google, where their family settings also apply.

13. Do you have to provide data?

For an account we need your email address, a password and your year of birth. Without them you cannot play Ovalings. Everything else is created while you play. Reward videos and purchases are voluntary.

14. Automated decisions

What an egg contains is decided by chance on our server, using the odds shown in the shop. This is not a decision about you as a person. The AI-written profile also only describes the Ovaling, not you. We do not create profiles about you.

15. Security

All connections are encrypted. Your sign-in is stored encrypted on your device. Values such as diamonds and Ovalings are only written by the server, and each account can only see its own data in the database. Rewards and purchases are only credited by the server, after the verified message from Google AdMob or after checking with Apple or Google.

16. Deleting your account

In the app: Settings, Account, Delete account. Without the app: use the contact form on the website with the topic Delete account. We will then delete your account with all its data, after a 30-day period in which you can change your mind (see section 10). A running monthly pass does not end at the store because of this. Cancel it beforehand in the App Store or on Google Play.

17. Changes

If the app or the law changes, we will update this policy. The current version is always available in the app and on the website.