Privacy.

This privacy policy applies to the website viewmedia.de and to all mobile applications developed by viewmedia and published via app stores (Google Play Store and Apple App Store) — hereinafter referred to collectively as "our services".

Not every service described here is used in every individual app. Which services a specific app uses depends on its feature set (e.g. online multiplayer, advertising, in-app purchases).

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

If you have questions about data protection or wish to exercise your rights, please contact us at the email address above.

2. General information

The protection of your personal data is important to us. We process your data exclusively on the basis of the legal provisions (GDPR, BDSG, TTDSG) and to the extent necessary.

"Personal data" means any information relating to an identified or identifiable natural person — e.g. name, email address, IP address, device identifier.

3. Data in our apps

The following sections describe data processing that may occur in our apps. Which of these apply depends on the specific app.

3.1 Game progress and account data (PlayFab)

If one of our apps offers cloud-based sync or online leaderboards, we automatically create an anonymous account with the service provider PlayFab (Microsoft Corporation, USA). The following data is processed:

Required service (Wengla): In Wengla, the PlayFab account and the features built on it (leaderboards, tournaments, teams, account recovery) are an integral part of the game. Processing takes place to provide the game (Art. 6(1)(b) GDPR) and is not based on consent; it therefore cannot be switched off individually in the app. If you only play offline, no data is sent to PlayFab. You can delete the account at any time in the app (see Section 7).

PlayFab stores data on servers in the USA. Microsoft is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023). PlayFab privacy policy: privacy.microsoft.com

Sign-in via Game Center / Google Play Games and cloud backup (from version 2.0.0009): So that your progress is available again after a reinstall or on a new device, the app can link your anonymous PlayFab account with your player identifier from Apple Game Center (iOS) or Google Play Games (Android). Only a pseudonymous player ID of the respective platform service is transmitted – no email address and no real name. Sign-in uses your device's system function; if you decline, you keep playing as usual, but without account recovery. In addition, your progress (levels, gold, unlocked content, settings) is transmitted in encrypted form and backed up at PlayFab at regular intervals; the time of the last backup and a manual backup are available in the app under Profile → "Account". Legal basis: Art. 6(1)(b) GDPR (provision of your game progress). Platform privacy notices: Apple, Google.

Account deletion directly in the app: You can delete your game account yourself at any time — in the app under Settings → Delete account. After a two-step confirmation, your PlayFab account including game progress, statistics, leaderboard entries and display name is permanently removed from the server, and all game data stored locally on the device is erased. This action is irreversible. Purchases made through the app store (e.g. ad-free packs) remain with your store account and can be re-activated in the app via "Restore purchases". Alternatively, you can request deletion informally by email (see Section 8).

3.2 Advertising

Some of our apps are offered as free versions financed through advertising. In these cases, ads are served exclusively via Google AdMob (Google Ireland Ltd., Ireland, or Google LLC, USA). We do not use ad mediation or any other ad networks. Ads only appear when you trigger them yourself (e.g. "Watch reward" for bonus gold) or occasionally between two levels; with an ad-free pack (see 3.3) they are removed entirely.

Consent (Google User Messaging Platform): On the first launch of an ad-financed app we show you — where required in your region, in particular in the EU, EEA, UK and Switzerland — the consent dialog of the Google User Messaging Platform (UMP). It follows the IAB Europe Transparency & Consent Framework (TCF 2.2). There you decide whether Google and the ad partners listed may serve personalized advertising; you can equally choose "Do not consent" or reject individual purposes. No ads are loaded before you have made your choice. On iOS, Apple's mandatory App Tracking Transparency dialog (ATT) also appears; if you decline there, Google does not receive access to the advertising ID (IDFA).

Withdrawal: You can change your choice at any time — in the app under Settings → Privacy settings the consent dialog opens again. In addition, you can reset the advertising ID in your device's system settings or disable personalized advertising system-wide (Android: Settings → Google → Ads; iOS: Settings → Privacy → Tracking).

Legal basis: with consent — Art. 6(1)(a) GDPR. Without consent (non-personalized) — Art. 6(1)(f) GDPR.

Further information: Google Privacy Policy, How Google uses data from apps that use Google services. The list of ad partners you can authorize is shown directly in the consent dialog.

3.3 In-app purchases

Some of our apps offer paid content (e.g. ad-free packages, virtual currency, additional features). All purchases go through the app stores (Google Play Store or Apple App Store). We do not receive any payment data (credit cards, bank details).

3.4 Crash reports and stability

Our apps contain no crash SDK of their own; Unity Analytics and Unity Cloud Diagnostics are disabled. NEO Blocks optionally includes Google Firebase Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Game analytics is off by default. In the EEA, the United Kingdom and Switzerland it only becomes active if, in the consent dialog shown at app start (Google User Messaging Platform, IAB TCF v2.2), you have consented to the purpose "Store and/or access information on a device" and to Google as a vendor (Legal basis: Art. 6(1)(a) GDPR). You can change or withdraw this consent at any time in the app under Settings > Privacy Settings with effect for the future; on withdrawal the device's analytics data is reset. Outside these regions game analytics is active where local law does not require consent. When enabled, level start and level end events (game mode, level number, move count) and technical device information (device model, operating system, app version, language) are recorded, linked to a pseudonymous identifier (hash of your PlayFab player ID). Advertising IDs and the IDFV device identifier are not collected; ad personalization through Firebase is disabled. On account deletion, the device's analytics data is reset. Further information: firebase.google.com/support/privacy. We receive crash and stability reports exclusively in aggregated, anonymized form via the app stores (Google Play Console or App Store Connect) — and only if you have allowed sharing such reports in your device's system settings. These reports contain technical information (stack trace, device model, OS version) but no personal data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability of our apps).

3.5 Online multiplayer (Photon)

If one of our apps offers an online multiplayer mode or private rooms, we use the service Photon (Exit Games GmbH, Hamburg, Germany) for the real-time connection between players. The following data is processed:

Photon connection data is only processed during the active session and discarded when the session ends. Game move data contains only game-mechanical information (e.g. which card was played) and no personal content.

Team and world chat (Wengla): In addition, you can send text messages (max. 200 characters) to other players in team and world chat. These messages are transmitted via Photon Chat, temporarily cached server-side (history: the last 30 messages per channel) and shown together with your display name and a pseudonymous chat ID. So that team members can still read messages later, we additionally store the last 50 messages of the team chat (text, display name, pseudonymous chat ID, time) for a maximum of 7 days on our game backend (PlayFab, see 3.3); after that they are deleted automatically, as they are when the team is disbanded. World chat is not stored. You can mute other players locally or report messages. Legal basis: Art. 6(1)(b) GDPR.

Required service (Wengla): The Photon connection is technically necessary for online games, tournaments, team tables and chat and is part of the game (Art. 6(1)(b) GDPR). It cannot be switched off individually in the app; no connection is made during offline play.

Exit Games is based in Germany and subject to the GDPR. However, Photon operates servers in several regions worldwide (Europe, USA, Asia, South America). The server region is automatically selected based on connection speed or set by the player in settings. When connecting to non-EU servers, data is transferred to third countries (see Section 6).

Photon's privacy policy: photonengine.com/legal/privacy

3.6 Teams (Wengla)

If you found or join a team in Wengla, the team name, tag, description and emblem as well as your display name with role (captain, deputy, regular, member), your weekly contribution to the team score and the time of your last activity become visible to other team members and in the team leaderboards. Members of the same team can also open your player profile: game statistics (e.g. Wengs, Wengcoins won, games, combinations), your country (country code of your last login only), the date your account was created and your last activity. The captain and deputies can remove members from the team. This data is stored at PlayFab (see 3.3) and removed when you leave the team or delete your account. Legal basis: Art. 6(1)(b) GDPR.

4. Data on the viewmedia.de website

4.1 Server logs

Each time the website is accessed, technical information is automatically recorded in server logs:

• Anonymized IP address (last octet truncated)
• Date and time of access
• Requested URL
• Referrer URL
• Browser type and version
• Operating system

This data is processed solely to ensure website operation, error diagnosis, and defense against attacks. Retention period: maximum 14 days. Legal basis: Art. 6(1)(f) GDPR.

4.2 Cookies

Without your consent, this website uses no tracking cookies, no analytics cookies (e.g. Google Analytics), and no advertising cookies. Technically necessary cookies and storage entries may be used (e.g. session cookies, language preference, your ad measurement choice). Legal basis: § 25(2) TDDDG. The only exception is the voluntary ad measurement described in section 4.4, which starts only with your explicit consent.

4.3 Contact by email

If you contact us by email (info@viewmedia.de), we process your email address and the content of your message solely to respond to your inquiry. Retention: until your inquiry is handled, then maximum 6 months for evidentiary purposes.

4.4 Voluntary ad measurement for ChatGPT ads (OpenAI)

We run ads for NEO Blocks in ChatGPT. To see whether these ads work, the NEO Blocks pages of this website use OpenAI's measurement script ("Measurement Pixel"). It is loaded only if you explicitly consent. The prompt appears only when you reach our site through a ChatGPT ad. All other visitors see nothing, and no data is sent to OpenAI.

What happens after you consent: The script is loaded from an OpenAI server (bzrcdn.openai.com). It stores the ad click identifier (oppref) in a cookie (__oppref) and tells OpenAI that you viewed the page and whether you click the link to Google Play or the App Store. Technical data is processed in the course of this (e.g. IP address, browser information, page URL). App installs are not measured. We flag these events so that OpenAI does not use them for future user-level personalization (opt_out). We only receive aggregated reports and cannot identify you.

Recipient: OpenAI (for users in the European Economic Area OpenAI Ireland Ltd., Dublin, Ireland; otherwise OpenAI OpCo, LLC, San Francisco, USA). Data may be transferred to the USA (see section 6). OpenAI's privacy notice: openai.com/policies/privacy-policy.

Legal basis: your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. Stored by us: your choice (allowed or declined) is kept locally in your browser so that we do not ask again.

Withdrawal: You can change your choice at any time with effect for the future: via the "Ad measurement" link in the footer of the NEO Blocks pages or directly via this setting. You can also delete the cookie in your browser.

5. App permissions

Android:

• INTERNET — internet connection for leaderboards, ads, updates
• AD_ID — access to advertising ID (only with your consent)
• VIBRATE — haptic feedback (can be disabled)
• POST_NOTIFICATIONS (Android 13+) — local tournament reminders (only if you register for a tournament and accept the prompt)

iOS:

• App Tracking Transparency prompt — access to IDFA (only with consent)
• Local notifications (if enabled in the app)

Which permissions a specific app actually requests depends on its feature set.

6. Data transfer to third countries

7. Retention

• PlayFab account data: until you delete the account in the app or request deletion by email, at the latest after 24 months of inactivity. A deletion triggered in the app is initiated immediately; PlayFab removes residual data from backups within 30 days.
• Ad consent (UMP): stored locally on the device until you change it or uninstall the app; Google re-prompts after 13 months at the latest
• Game progress and leaderboards: same as PlayFab account
• In-app purchase receipts: up to 10 years (legal retention obligation)
• Server logs: maximum 14 days
• Email correspondence: maximum 6 months after resolution
• Photon connection data: only during the game session, then automatically deleted
• Chat messages: history of the last 30 messages per channel on the chat server; older messages are overwritten
• Chat reports (report function): up to 200 reports (channel, reporting and reported chat ID, text, time) for moderation; older reports are displaced by new ones, no fixed deletion period

8. Your rights as a data subject

To exercise these rights, an informal email to info@viewmedia.de is sufficient. You can additionally delete your game account and change your ad consent yourself at any time directly in the app (see Sections 3.1 and 3.2).

Competent supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, P.O. Box 3163, 65021 Wiesbaden, Germany. A list of all supervisory authorities can be found here.

9. Children and minors

Our apps are not specifically designed for children under 13. We do not knowingly collect personal data from children under 13 (COPPA) or under 16 without parental consent (GDPR Art. 8). If we become aware that we have collected data from a child without appropriate consent, we will delete it immediately.

10. Security

• HTTPS encryption of all transmissions
• Server-side plausibility checks for in-app purchases
• HMAC-signed local save data (protection against tampering)
• Regular security updates of software components

Which of these measures are applied in a specific app depends on its feature set.

11. Changes to this privacy policy

We reserve the right to update this privacy policy to adapt it to changed legal situations or changes to our services. The current version is always available at this URL.

12. Contact for data protection inquiries

For questions or to exercise your rights:

We typically respond within 14 days, legally within one month at the latest.