Privacy Policy

Last updated: 12 November 2026

This Privacy Policy explains how personal data is processed when you play the Riddle Mind mobile game (the “App”) and when you visit our website (the “Website”). We keep data collection to a minimum: you don’t need an account, we don’t use analytics or tracking tools, and we don’t sell your data.

1. Who is responsible

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not legally required to. For any privacy question or request, please email us at the address above.

2. Summary

• No account or login. The App recognizes your installation with a random, anonymous player ID.
• Your questions and theories are sent to OpenAI to generate the game’s answers, without your player ID or device data. Please don’t type personal information into the game.
• Free players watch a short video ad, started with a tap, to unlock a story, a hint or a new set of 25 questions. There are no banner or pop-up ads, and Premium players don’t see these ads while they have Premium requests left. Ads are provided by Google AdMob, with a consent message where required by law.
• Riddle Mind is meant for players aged 16 and over.
• No analytics, no crash reporting, no push notifications.
• Our servers are located in Germany.
• You can request deletion of your server data at any time.

3. Data we process in the App

3.1 Anonymous player ID and game progress

When you first open the App, it creates a random player ID (a UUID). It is not linked to your name, email address or phone number, and it is not based on any device identifier. Together with a hashed authentication token, we use it to save your game progress on our server, such as the stories you started or solved, hints used, your question counter and your remaining Premium requests, and to recognize your installation in later sessions.

Legal basis: Art. 6(1)(b) GDPR (providing the game you requested).

3.2 Questions, theories and AI answers

The questions you ask and the solutions you submit are sent to our server and processed to generate the game’s answers (see section 4). We store them together with the answers so the conversation in a story is available to you.

Legal basis: Art. 6(1)(b) GDPR. Please don’t include personal information (such as names, addresses or health details) in your questions.

3.3 IP address and technical data

When the App connects to our server, your IP address, the time of the request, the requested address and basic connection data are processed. We use the IP address to limit the number of requests per address, which protects the game against abuse and automated attacks. Our web server may also record this data in log files.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running a secure and stable service).

3.4 Usage, reward and security records

To run the game reliably and prevent misuse, our server also keeps a few technical records linked to your player ID:

• AI usage records: the amount of text processed (tokens), the cost, the status of each request and technical request identifiers,
• ad reward records: confirmations that a rewarded ad was completed (see section 5),
• rate-limiting data: request activity and IP-based counters that protect the service against abuse.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (our legitimate interest in a secure, stable and affordable service).

4. AI answers (OpenAI)

The game’s answers are generated with the OpenAI API, provided by OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA (for users in the EU: OpenAI Ireland Ltd.). For each request, our server sends OpenAI only:

• your current question or submitted solution,
• information about the story (its text, the hidden solution and the story’s rules), and
• our instructions for evaluating the question.

We do not send your player ID, session data, device information, IP address or previous conversations. We use OpenAI with storage of responses disabled. According to OpenAI, data sent through its API is not used to train its models and may be kept for up to 30 days to detect abuse, after which it is deleted unless the law requires otherwise.

OpenAI processes this data on our behalf under a data processing agreement (Art. 28 GDPR). For transfers to the USA, see section 11.

The AI only evaluates your answers within the game. It does not make decisions that have legal or similarly significant effects on you (Art. 22 GDPR). The AI can only answer with fixed responses (Yes, No or Not relevant, and whether your solution is correct). These can occasionally be wrong; if you think an answer is wrong, please email us.

5. Advertising (Google AdMob)

The App only shows rewarded video ads that you start with a tap. Free players watch one to unlock a story, to open a hint, and to get a new set of 25 questions. We don’t show banner ads or ads that pop up on their own. Premium players don’t see these ads while they have Premium requests left; after that, they can choose to watch ads for more requests, and hints stay ad-free. Ads are provided by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To show and measure ads, Google processes data such as your device’s advertising ID, device type and settings, IP address, app information, approximate location derived from the IP address, and how you interact with the ad. Depending on your choices, ads can be personalized (based on your interests) or non-personalized (based only on context, such as the App itself).

• Consent: Where required by law (for example in the EU, the EEA, the UK and Switzerland), the App shows Google’s consent message before any ads are loaded. You can change your choice at any time in the App’s Options menu (Ad privacy preferences), which opens Google’s consent form again.
• Players in the United States: if you live in a US state with a consumer privacy law (such as California), you can opt out of the “sale” or “sharing” of your personal information for targeted advertising at any time in the App’s Options menu (Ad privacy preferences). We do not sell personal information for money.
• Reward check: When you finish an ad, Google confirms the reward to our server so we can unlock the story, hint or requests. This confirmation is linked to your player ID.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) for accessing information on your device and for personalized ads; otherwise Art. 6(1)(f) GDPR (our legitimate interest in funding the free version of the game through ads). You can withdraw your consent at any time with effect for the future. Google’s use of data is described in Google’s privacy policy: policies.google.com/privacy at policies.google.com/technologies/ads and, for how Google uses information from apps that use its services, at policies.google.com/technologies/partner-sites. The list of Google’s ad partners is available in the consent form under Manage options.

6. Minimum age

Riddle Mind is meant for players aged 16 and over. We don’t ask for your age and don’t collect any data about it. By using the App, you confirm that you are at least 16 years old. See also section 13.

7. Premium purchases

Riddle Mind Premium is a one-time in-app purchase. Payment is handled entirely by Google Play (Google Payment Ireland Ltd.) as an independent controller. We never receive your payment details. From Google we receive only the information needed to confirm and restore your purchase, such as the product, the purchase token or order ID, the purchase date and its status. We store this together with your player ID and your remaining request balance to activate Premium, restore it on a new device, prevent duplicate purchases, handle refunds and revoked purchases, and protect against fraud.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR where we must keep records for tax purposes.

8. Data stored on your device

The App stores your player ID and login token securely on your device (in the device’s secure storage) so that you stay recognized without an account. It also stores your settings, such as sound and music. This storage is strictly necessary to provide the App (§ 25(2) no. 2 TDDDG). Uninstalling the App removes this data from your device.

Google’s Mobile Ads SDK may also store or read information on your device as described in section 5, based on your consent where required.

9. Our Website

When you visit our Website, our hosting provider IONOS automatically processes your IP address, the date and time of access, the page requested, your browser and operating system, and the referring page. This is technically necessary to deliver the Website and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after 30 days.

From these log files, our server creates aggregated access statistics (such as the number of visits per page) with the open-source tool AWStats, which runs on our own server. The Website does not use cookies, third-party analytics, tracking or advertising tools. Fonts are loaded from our own server, not from third parties.

If you use our data deletion request page, we process the details you enter (such as your player ID, verification code and message) only to handle and document your request (Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR).

If you email us, we use your email address and message only to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the matter is closed, unless we must keep them by law.

10. Service providers

We do not sell your data and do not share it with anyone else, unless we are legally required to (for example by a court order).

11. Transfers outside the EU

OpenAI and Google may process data in the USA. These transfers are based on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards by email.

12. How long we keep data

13. Children

Riddle Mind is meant for players aged 16 and over and is not directed at children. If you believe a child under 16 has used the App, please contact us and we will delete the related data.

14. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw consent at any time, with effect for the future (Art. 7(3)).

To use these rights, email us at [email protected]. Because we don’t know your name, please include your Account ID from the App’s Options menu so we can find your data.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

15. How to delete your data

• Online: use our data deletion request page, also linked in the App under Options → Request data deletion. The page explains how to send a request with or without the App installed.
• By email: send your Account ID (from the App’s Options menu) to [email protected].

We may ask for verification to link the request to your data. We delete your player ID, progress, questions and related records from our server without undue delay, and at the latest within one month. Chats stored on your phone are removed when you uninstall the App or clear its storage in Android’s settings. Data on our server is also deleted automatically after 12 months without any activity (see section 12).

Deleting your data resets your progress. If you bought Premium, we keep only a minimal purchase record (the purchase token, your Premium status and your remaining requests), without your player ID, questions or progress. This lets you restore Premium with Restore purchase and prevents misuse of the request allowance (Art. 6(1)(b) and (f) GDPR). If you want this record deleted as well, select that option on the request page or tell us by email; Premium can then no longer be restored.

16. Security

We protect your data with technical and organizational measures. These include encrypted connections (HTTPS/TLS), secure storage of credentials on your device, access restrictions on our servers, and rate limiting against abuse.

17. Changes to this policy

We may update this policy when the App, the Website or the law changes. The current version is always available on this page and in the App. If a change affects how we use your data in an important way, we will let you know in the App.