for the UnArrow app (iPhone and iPad) and its server · Last updated: 29 October 2026
This is a translation. The German version is the binding one.
In short
Write to this address with questions about privacy or to exercise your rights. Please include your support code (in the app under Settings and in your profile) so we can find your account. We never ask for passwords or access keys.
Legal basis: providing the game (Art. 6(1)(b) GDPR); App Attest to protect against fraud and tampering (Art. 6(1)(f) GDPR).
We store which levels you solved: for each solution the duration, mistakes, stars and points, along with the time, time zone and app version. We also store your items (such as hints and scissors) and how you used them, your designs, daily puzzles, festival puzzles and days played. This keeps your progress safe and brings it to all your devices, lets us check solutions for fairness and lets us give rewards.
With each solution the app sends the sequence of moves and the time between them. The server replays it on arrival to check the solution and keeps it until the end of the league week in which you solved the level; then we delete it. It is kept longer only for unusually fast solutions (as long as the solution's details) and while we check a suspected manipulation (below). Of a rejected solution we keep only the start of the sequence.
We keep the details of each solution for 41 days. After that only your best results per level and totals for your statistics remain (number of solutions and of rejected solutions, play time, arrows removed, hits and mistakes).
We do not process a solution or game event dated more than 38 days back: we could no longer tell it from one already counted. Such a solution earns nothing and does not count; we keep it only as a rejected solution.
If we suspect manipulation, we keep the details of your solutions and game events and the sequences of moves of your solutions from the running league week on for 30 days from the latest cause. If another player reports you for cheating, we keep them until we have looked into the report and for 30 days after. If we check the case for longer or exclude you from the league, we keep them for as long as that lasts and for 30 days after. A suspicion arises when the check rejects a solution in a way that points to manipulation (including a date more than 38 days back), when another player reports you for cheating, when a solution is among the fastest of the day, when we exclude you from the league, or when we look into a case ourselves. What was deleted before stays deleted.
Legal basis: Art. 6(1)(b) GDPR; the fraud checks and the longer retention when we suspect manipulation rest on our legitimate interest in fair leagues and in preventing fraud (Art. 6(1)(f) GDPR).
The app sends pseudonymous, purely numeric game events, such as how often a level is started or abandoned. From them we compute statistics to balance the levels' difficulty. Figures summed up per day are anonymous. We delete the individual events after 7 days, and the record that you started a daily puzzle 7 days after its catch-up period ends. For the statistics in your profile we keep the largest values of each attempt without a solution (play time, arrows removed, hits, mistakes) until 40 days after its last event, and only their totals after that.
In the app under Settings › Privacy you can switch off "Share balancing data" (it starts on). The app then sends no more game events and discards those still waiting on your device; nothing else changes. Events that reached us before you switched it off stay as described above until their deletion and count in the analysis and your statistics until then. So that your statistics stay complete, the app then counts the play time, arrows removed, hits and mistakes of your attempts without a solution on your device only, separately for each account, and adds them to our figures in your profile. These numbers do not leave your device; another device shows our figures only.
Legal basis: our legitimate interest in a well-balanced game (Art. 6(1)(f) GDPR). You can object with the switch, or as described in section 7.
Legal basis: the league is part of the game (Art. 6(1)(b) GDPR); moderation, reports and the name history to protect players (Art. 6(1)(f) GDPR).
If you link your account with "Sign in with Apple", Apple gives us an identifier. The app does not ask for your name or e-mail address. We store a token from Apple, encrypted, so we can revoke the link when you delete your account. If the Apple ID already belongs to another UnArrow account, we merge your guest account into it.
Legal basis: Art. 6(1)(b) GDPR.
Purchases go through Apple's App Store; we never see your payment details. We store the transaction data (transaction identifiers, product, time, status and the receipt signed by Apple) and receive notifications from Apple, for example about refunds or about a purchase the app did not report to us, which we then credit to your account.
Information on refunds (only with your consent): When you ask Apple to refund a purchase, Apple asks us whether the purchase arrived and how much of it was used. Only if you have turned on "Share purchase use for refunds" under Purchases in the app's settings do we answer Apple: that the purchase arrived, that the shop showed its content before the purchase, and for a pack, what share of its items is used up. Apple weighs this in its decision on the refund and processes the information under its privacy policy. The consent is voluntary and off at first; you can withdraw it there at any time, and we send no more information after that. We store since when you have consented, and for 90 days each request from Apple with our answer.
Legal basis: Art. 6(1)(b) GDPR; keeping the receipts Art. 6(1)(c) GDPR together with the retention duties of German commercial and tax law (§ 147 AO, § 257 HGB); the information on refunds your consent (Art. 6(1)(a) GDPR).
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) for personalised ads and access to your device; for limited ads our legitimate interest in financing the free game (Art. 6(1)(f) GDPR); rewards Art. 6(1)(b) GDPR.
Both notifications are off until you turn them on. The app schedules the daily reminder on your device and sends nothing to us for it. For the league note ("The league ends soon") we store your device's push token with its time zone, language and app version, and send the note through Apple's push service.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app under Settings › Notifications.
Achievements go through Apple's Game Center. Your Game Center data stays with Apple; our server receives nothing of it.
For photo puzzles you choose a photo from your library or take one with the camera. The photo and the puzzle made from it are processed only on your device. Your puzzles of your own (photo, shape and plain puzzles, and the shared puzzles of others that you save) are stored on your device, in your own device backup and, while "My puzzles in iCloud" is on in the settings (it starts on), in the private iCloud database of your Apple Account: each puzzle with its best result and, for a photo puzzle, the photo, reduced to at most 1,024 pixels. That way they come back on your other devices and after a reinstall with the same Apple Account. Apple stores them for you under its iCloud terms; we cannot see them. A puzzle of your own reaches our server only if you share it, and then only its board (section 2.11); a photo never does. Switched off, the app sends nothing more to iCloud; what is already there stays until you delete your account (section 6) or delete UnArrow's data in your iCloud settings. Our server only learns how many puzzles of your own you solved, for rewards.
Legal basis: sharing at your request is part of the game (Art. 6(1)(b) GDPR); reports, blocks and the record of our decisions protect players and meet our duties as a host of content under the Digital Services Act (Art. 16 and 17 DSA; Art. 6(1)(c) and (f) GDPR).
For each request the server logs the method, path, status and duration and your network with a shortened IP address (IPv4 cut to its first three parts, IPv6 to its first three blocks); the code of a shared puzzle in a path is not logged. We delete these logs after 7 days. To limit requests and fend off overload and abuse, the server evaluates your full IP address, but only in memory and for at most one hour; it is not stored.
Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
We keep no access logs when you visit this page. It sets no cookies and loads nothing from third parties.
Legal basis: our legitimate interest in meeting the laws on young players that apply to our players and their app stores, and in protecting young players (Art. 6(1)(f) GDPR).
We pass on no other data unless the law requires us to.
Our server is in Germany. Google and Apple may also process data in the USA. They rely on the EU-US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) and on the Commission's standard contractual clauses.
| Data | Kept |
|---|---|
| Account, progress (best results per level, campaign progress, items, daily puzzles, days played), the totals of your statistics, league, reports and blocks | until you delete your account (section 6) |
| Details of each solution (duration, mistakes, stars, points, time, app version) | 41 days |
| Sequence of moves of a solution | until the end of its league week; for unusually fast solutions 41 days, as for the start of a rejected solution's sequence |
| Details and sequences of moves when we suspect manipulation | 30 days from the latest cause; after a report of cheating, until we have looked into it and 30 days after; if we check the case for longer or you are excluded from the league, as long as that lasts and 30 days after |
| Previous own names | 90 days |
| Shared puzzles (board, code, which puzzle of your gallery, its kind, when shared and last opened, how often opened) | until you stop sharing it, delete it from your gallery or delete your account; at the latest 1 year after its code was last opened; a hidden puzzle until our decision |
| A shared puzzle we deleted after reports (without the board, its size and its opens: its code, which puzzle of your gallery, its kind, its hash, when shared, hidden and deleted, the reason and our note) | 180 days |
| Hashes of deleted boards, and of boards still hidden when their account was deleted (nothing else) | 180 days |
| Reports of shared puzzles (with our decision) | 180 days after the report or, once decided, after our decision; of a hidden puzzle until our decision |
| Game events for analysis | 7 days (a started daily puzzle until 7 days after its catch-up period); the values per attempt for your statistics until 40 days after its last event, only their totals after that |
| Daily activity for internal statistics | 35 days |
| Push registration | until you turn the league note off, at most 90 days after the device was last used |
| Age group (under 13, or 13 to 17) and the identifier of your app download, with a device's session | while the session is signed in, at most 90 days after the device was last used |
| A parent's withdrawn consent (for each app download: when) | until UnArrow is started again on the download after the withdrawal, we end it at a parent's request, or the account is deleted |
| Signed-out sessions | 30 days |
| Replaced recovery keys (as a hash) | 30 days |
| Server logs with shortened IP addresses | 7 days |
| Purchase receipts and Apple's notifications | 10 years (legal retention), after an account deletion no longer linked to the account |
| Apple's requests on refunds and our answers | 90 days |
| Backups | 30 days |
In the app under Profile › Delete account. At once we lock your account, end all sessions, delete push registrations, blocks, your shared puzzles and your current league memberships, and revoke the link with Apple. After 28 days we delete the account with all game data for good; from the backups the data disappears at most 30 days later. Purchase receipts are kept for the legal period without a link to your account, and reports you filed remain without any reference to you. On your device the app deletes all local data, your puzzles of your own included, and deletes their copy in your iCloud, at once or as soon as iCloud can be reached again.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)).
Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR; Art. 21 GDPR). To the game events (section 2.3) you object most simply in the app, with "Share balancing data" under Settings › Privacy.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: the data protection authority of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
We make no automated decisions with legal effects for you (Art. 22 GDPR).
Where iOS shares your age range (section 2.14), the game follows the rules for young players: under 18 you play with your random name; under 13 you also cannot share puzzles or open shared ones and see the other players in the league with their random names; the ads follow your age (section 2.7), and the app does not ask whether apps may track you. Where the law provides for it, a parent can withdraw their consent for UnArrow through Apple (section 2.14).
If you are under 16, you may consent to personalised ads and tracking only with your parents' permission. Please ask them to answer the consent question together with you. Parents can write to us at the address in section 1, for example to have their child's account deleted.
The app connects to our server only over encrypted connections (TLS). There are no passwords; we store access keys only as hashes. The server can only be reached for administration with an SSH key. Backups run daily, encrypted, to storage at Hetzner that can only be reached over SSH; the key to decrypt them is not kept on the server.
We update this policy when the app or the law changes. The version published here applies.