Privacy Policy

For the website plushlight.app and the game “Plushlight: Teddy Survival” for iPhone and iPad. Last updated: October 21, 2026.

In short: The website sets no cookies, runs no JavaScript and loads nothing from other servers; visits are only counted from shortened server logs. The game needs no account. Your score and settings stay on your device. The game is paid for by ads from Google AdMob. You only see personalized ads if you consent, and never if you are under 16.

Contents

1. Controller
2. The website
3. The game
4. Data on your device
5. Age question
6. Ads with Google AdMob
7. Consent and tracking
8. Apple and the App Store
9. Transfers outside the EU
10. Your rights
11. Complaints to a supervisory authority
12. Changes

1. Controller

Represented by its managing directors Alexander Hansen and Jan Philipp Biehl.
Privacy requests: privacy@plushlight.app

We have not appointed a data protection officer.

2. The website

Hosting and server logs

The website runs on a server in Germany that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Our websites pulsehq.de and docs.pulsehq.de run on the same server. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

When you open a page, the server logs the address requested, the date and time, the status code, the amount of data sent, your browser and operating system (user agent), and your IP address. We process these logs in three stages:

• Full log: it is kept in a buffer of fixed size that the server keeps overwriting, so your full IP address is stored there only for a short time.
• Shortened log: from it, the server immediately writes a second log in which the IP address is shortened: IPv4 addresses lose their last octet, IPv6 addresses are cut to their first three blocks. It is deleted after seven days.
• Statistics: from the shortened log we compile statistics, such as how often each page was opened and with which browsers. They contain no IP addresses, are kept longer, and cover all websites on this server together.

The purpose is to run the website securely and reliably, for example to detect attacks and errors, and to understand how the website is used. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. You can object to this processing under Art. 21 GDPR by emailing privacy@plushlight.app.

No cookies, no analytics tools

The website sets no cookies, stores nothing in your browser and runs no JavaScript. Apart from evaluating the server logs above, we use no audience measurement tools. The font, images and video are served from our own server; nothing is loaded from third parties. That is why there is no cookie banner.

Contact by email

If you write to us, we process your email address and your message to reply. The legal basis is Art. 6(1)(b) GDPR where it concerns the game you use, and Art. 6(1)(f) GDPR otherwise. We delete the message once your request is resolved and no legal retention period applies.

Links to the App Store

The “Download on the App Store” button is a plain link. Only when you tap it does Apple's App Store open; from then on Apple's privacy policy applies.

3. The game

You can play Plushlight without an account and without signing in. We run no servers for the game and receive no personal data from the app itself. The game contains no analytics or tracking tools. The only place where the game sends data to anyone else is Google's advertising (section 6).

4. Data on your device

The game stores on your device:

• your best score,
• your settings, such as whether sound is on,
• your birth year (the year only, see section 5),
• your choice in Google's consent form, which Google's software keeps on the device itself.

We do not take this data off your device. If you use iCloud Backup, it may be part of your backup with Apple. When you delete the app, all of it is gone.

Storing it is necessary for the features you use in the game (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

5. Age question

On first launch, before asking for any consent, the game asks once for your birth year. In Germany, people under 16 cannot consent themselves to processing for personalized ads (Art. 8 GDPR). Since only the year is known, a player who turns 16 this year counts as under 16 until next year.

Your birth year stays on your device. Google only receives whether you are under the age of consent (yes or no). If you are:

• the game shows no consent form and no tracking prompt from Apple,
• every ad request is tagged as “under the age of consent”,
• Google shows no personalized ads and no remarketing, and shares no data with third-party ad partners.

The legal basis is Art. 6(1)(c) GDPR together with Art. 8 GDPR, and our legitimate interest in protecting minors (Art. 6(1)(f) GDPR). To change your birth year, delete and reinstall the app.

6. Ads with Google AdMob

The game is free and shows ads through Google AdMob. For users in the European Economic Area and Switzerland, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Which ads

• A video to keep dreaming: after waking up, you can choose to watch a video once per run to continue.
• Ads between runs: at most at every third restart, at least three minutes apart, and never after a run in which you already watched a video.

Ads are limited to content suitable for teens (rating “T”).

Which data

To load and show ads, Google says it processes, among other things:

• your IP address, from which Google estimates your approximate location,
• device identifiers: the identifier for vendors (IDFV) and the advertising identifier (IDFA), the latter only if you allow tracking in Apple's prompt,
• advertising data, such as which ads you saw or tapped,
• interactions with the app, such as app launches and videos watched,
• crash logs and performance data, such as loading times,
• technical details such as device model, operating system and language setting.

What for

• delivering and showing ads,
• limiting how often you see the same ad,
• measuring and billing ad reach and performance,
• detecting and preventing fraud and abuse,
• only with your consent: tailoring ads to your interests (personalized ads).

Legal basis

For storing and reading information on your device and for processing for advertising, we ask for your consent through Google's consent form: Section 25(1) TDDDG and Art. 6(1)(a) GDPR. This also applies to non-personalized ads, because they too store information on the device, for example to cap how often an ad is shown.

If you decline, Google may show “limited ads”, which use no device identifiers, store nothing on the device and are not personalized. For these we rely on our legitimate interest in funding the free game (Art. 6(1)(f) GDPR).

The game works fully without ads; only the video to keep dreaming is then not available.

Google as recipient

Google processes the data for advertising partly as a controller in its own right. How Google uses data from apps that use its services is explained at policies.google.com/technologies/partner-sites; Google's privacy policy is at policies.google.com/privacy. The consent form shows the full list of ad partners you can consent to.

Retention

Google decides how long it keeps the data. According to Google, ad serving logs are anonymized by removing part of the IP address after 9 months and cookie information after 18 months.

7. Consent and tracking

Google's consent form

From 16, the game shows Google's consent form (User Messaging Platform) before the first ad. There you can accept, decline, or choose individual purposes and partners. You can change or withdraw your choice at any time: on the title screen under Settings → Privacy settings. Withdrawal applies from then on; what happened before stays lawful (Art. 7(3) GDPR).

Apple's tracking prompt (App Tracking Transparency)

After the consent form, Google briefly explains what the advertising identifier is for, and iOS asks whether Plushlight may track you across other companies' apps and websites. Google only receives your device's advertising identifier if you choose “Allow”. You can change this at any time in the iOS Settings under Privacy & Security → Tracking.

You only see personalized ads if you consent in the consent form. Under 16, there is neither the form nor the tracking prompt.

8. Apple and the App Store

You download the game from Apple's App Store. Apple processes data such as your Apple Account and the download under its own responsibility; Apple's privacy policy applies.

If you have turned on “Share With App Developers” in the iOS Settings, Apple sends us crash reports and usage statistics without your name or Apple Account. We use them to fix bugs. The legal basis is the consent you gave Apple (Art. 6(1)(a) GDPR), which you can withdraw in the iOS Settings under Privacy & Security → Analytics & Improvements.

9. Transfers outside the EU

Google and Apple may also process data in the United States and other countries outside the EU. For the United States, the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of July 10, 2023 applies, under which Google LLC and Apple Inc. are certified; for Switzerland, the Swiss-U.S. Data Privacy Framework applies in the same way. For other countries, Google uses the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

10. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Write to us at privacy@plushlight.app. Please note: we do not have the data the game stores on your device; you delete it by deleting the app. Data Google processes for advertising is held by Google; we can forward requests about it, or you can contact Google directly.

11. Complaints to a supervisory authority

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live. The authority responsible for us is:

In Austria it is the Datenschutzbehörde, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

12. Changes

When the game or the website changes, for example with in-app purchases, we update this policy. The version published here applies. This English version is a translation; the German version is the binding one.