Privacy Policy

The essentials

No ads, no tracking, no analytics. Your save game stays on your device.

The game only goes online when you want it to: when you buy something in the shop (we then keep a purchase account so that nothing you bought gets lost), when you turn on the online backup, when you connect your purchase account with Google Play Games, and when you use the Star Arena with friends, duels and home visits. We never store names, e-mail addresses or payment details.

You can delete your purchase account and your arena account yourself in the game – see Delete account & data.

1. Controller

Kevin Heymann
mtcteam.de
Armstrongstraße 17A
63654 Büdingen
Germany
E-mail: info@mtcteam.de
Phone: 0179/2637259

2. The game on your device

Your save game, settings, photos from photo mode and all Lumins are stored in the app's storage on your device. Without the online backup (section 6) they do not leave your device. Photos from photo mode never leave your device – you save them yourself if you want to share them.

Gift codes are checked on the device (digital signature); redeeming them does not contact any server.

3. "Together" on the same Wi-Fi

For trading, friendly battles and playing together, two devices connect directly over the local network (Wi-Fi). Player name, team and moves are exchanged between the two devices – without a server and without anything being stored by us. This is why the app needs the "Internet", "network state" and "Wi-Fi state" permissions.

4. Shop: buying Fluffy Pearls

The game is free; in the shop you can buy the in-game currency "Fluffy Pearls" and use it for bundles, chests with fixed contents shown in advance, cosmetics and convenience items. Google Play handles the purchase and payment (section 9) – we never see payment details. So that nobody receives pearls without paying, the game sends Google's proof of purchase to our server after you buy. We ask Google whether the purchase was paid and store as a receipt:

• a hash of the proof of purchase – not the proof itself,
• Google's order number (GPA.…), the package bought, the number of pearls, the time, whether it was a test purchase and whether Google later refunded it,
• the random purchase ID of your purchase account. It is also passed to Google with the purchase (as an "obfuscated account ID") so that a proof of purchase only fits your account. It is not a device ID and contains nothing about you.

If Google refunds a purchase, we check this with Google several times a day and remove the pearls again; if the balance is not enough, the most recently bought cosmetics and convenience items are cancelled.

Retention: because of German tax law we keep receipts and pearl transactions for ten years from the end of the calendar year (§ 147 AO); our server deletes them automatically afterwards. Legal basis: Art. 6(1)(b) GDPR (contract), (c) (retention duty) and (f) (fraud prevention).

5. Purchase account and recovery code

So that bought Fluffy Pearls and everything you buy with them are never lost (new phone, reinstall), we keep a purchase account on our server. It is created only with your first purchase, when you redeem a recovery code, or when you explicitly tap "Connect with Google Play Games". It contains:

• the random purchase ID, when the account was created and last used,
• per device a hash of a random device key – not the key itself, no device ID – with the time it was added and last used (at most 10 devices),
• your pearl transactions (purchase, spending, refund, cancellation) with item and time – they make up your balance and what you own,
• if you create one: a hash of your recovery code. The code moves the account to another device; anyone who knows it can use the account – keep it safe. Only your main device (the one used first; after 30 days of inactivity the next one takes over) can create a new code; this invalidates the old code and signs out all other devices,
• if you connect your account with Google Play Games: a hash of your Play Games player ID (section 7).

No name, no e-mail address, no password. Legal basis: Art. 6(1)(b) GDPR – you paid for permanent content and should keep it.

Deletion: in the game under Shop → Account → "Delete account" (on the main device; other devices can remove themselves with "Sign out this device"). Device keys, code, Google connection and online backups are deleted immediately. Transactions and receipts remain until the end of the retention period (section 4) – without any link to a device, code or Google account. Purchase accounts without any transaction are deleted automatically 180 days after their last use.

6. Online backup of your save game (only if you turn it on)

With a purchase account you can turn on the online backup in the shop under "Account". Then a copy of your save game is sent to our server when you save (automatic saves at most every 5 minutes), so that items you bought that are in your save game come along to a new device. The save game contains the player name you chose and your progress (Lumins, bag, home, story flags). Only the newest save per device is kept (at most 1 MB, at most 4 MB per account in total).

Legal basis: your consent by turning it on (Art. 6(1)(a) GDPR). You can withdraw it at any time by turning it off; existing backups are deleted with "Sign out this device" or "Delete account". Backups of signed-out devices are deleted after 90 days.

7. Google Play Games

The game uses Google Play Games Services for achievements: when you complete a constellation, the app reports it to Google. Whether and how you are signed in to Google Play Games is managed by Google; Google's privacy policy applies.

Connecting your purchase account: with your first purchase, or when you tap "Connect with Google Play Games", the app asks Google for a one-time sign-in code for our server. Our server exchanges it with Google for your Play Games player ID and stores only a hash of it – never the ID itself, no name, no e-mail. This lets your purchase account find its way back on a new phone without a code. A connected purchase account is never silently moved to a different Google account. Legal basis: Art. 6(1)(b) GDPR.

8. The Star Arena, friends and home (optional, online)

The Star Arena is an optional extra. If you never open it, it creates no data at all. The first time you open it, you create an arena account. The following is stored:

• Arena name – a suggestion from the name builder or a name you choose yourself, which is automatically checked for unfriendly words, links and e-mail addresses. Please don't use your real name.
• A random account secret (stored only as a hash) and a friend code. No e-mail address, no password, no phone number.
• Your defence team (species, levels, moves, gear, your Lumins' nicknames) – other players battle against it in shadow battles.
• Rank points, season and season reward, when the account was created and your last visit (to show "online" to friends).
• Battle results with the random seed and your moves, so that our checking service can replay the battle and rule out cheating; deleted after 30 days. Opponent suggestions for shadow battles expire after one day.
• Friendships, friend requests, reports and blocks between arena accounts. You only become friends once the other person accepts. After several reports a name is automatically replaced with a name-builder name.
• Live duels, playing together and trading over the internet: moves and positions are relayed through our server and deleted after one day at the latest (most after 30 minutes). When trading, the offered Lumin is held by the server until the handover (escrow): unfinished trades are deleted after one day, finished ones once both sides have collected their Lumin, at the latest after 30 days.
• Home and visits: when you leave your home, the game uploads its layout (walls, floors, furniture), the species, nickname and level of your home and farm Lumins and your best scores on the playground. Only confirmed friends can see this. The guestbook only accepts pre-written greetings (no free text) and up to three small items, once a day per friend; the last 60 entries are kept.

There is no chat and no free-text messaging between players. Your arena account stays until you delete it: Star Arena → Account → "Delete arena account" immediately removes name, team, results, friendships, requests, reports, blocks, duels, home and guestbook; an already finished trade only remains until your trading partner has collected their Lumin.

Legal basis: Art. 6(1)(b) GDPR (providing the arena you choose to use) and (f) (protection against abuse and cheating).

9. Google Play as payment processor

Google handles shop purchases (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google collects your payment details for this; we receive no payment details, only the proof of purchase (section 4). Google's privacy policy applies: policies.google.com/privacy.

10. IP addresses and server logs

The purchase server and the arena server only use your IP address to limit requests (protection against overload, code guessing and throwaway accounts). For this they only store a hash of the address:

• general request limit (purchase and arena): deleted after one hour,
• attempts to enter a recovery code: deleted after 24 hours,
• daily counter of newly created accounts (purchase and arena): deleted after two days at the latest.

The servers run on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, under a data processing agreement pursuant to Art. 28 GDPR. The web server automatically writes log files (IP address, time, requested address, amount of data transferred); they serve secure operation (Art. 6(1)(f) GDPR) and are not combined with purchase or arena data. All connections are encrypted (HTTPS).

11. What explicitly does not happen

• No ads, no advertising ID, no analytics or tracking services.
• No location, contacts, microphone or camera permission.
• No paid random loot boxes – chests have fixed contents shown in advance.
• No selling or sharing of your data with third parties (except Google as described above).

12. Older versions (1.0.3 and 1.0.4)

Up to version 1.0.4 the game created a purchase account at start-up and connected it to your Play Games player ID (as a hash) if you were signed in to Google Play Games – even without a purchase. With a purchase account, the online backup of the save game was on by default. As long as you use one of these versions, this still happens. From version 1.0.5 a purchase account is only created as described in section 5, and the online backup stays off until you turn it on yourself (players who have bought something are asked once). Accounts created this way without a purchase are deleted automatically, including their backup, 180 days after their last use; you can delete one immediately in the game under Shop → Account → "Delete account".

13. Children

The game is meant for all ages. Before a purchase the game reminds minors to ask their parents first. The arena is deliberately designed so that players can't contact each other: no chat, names are checked, players can be reported and blocked, friendships need to be accepted and live duels only work with friends.

14. Fonts on this website

This website loads fonts from Google Fonts, which transmits your IP address to Google (Art. 6(1)(f) GDPR). The game itself does not – all fonts are bundled.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent with effect for the future (Art. 7(3)). You can delete your purchase account and arena account yourself in the game at any time (how-to). For anything else, write to info@mtcteam.de. Because we store no names or e-mail addresses, we need one of these to find your data: for the purchase account the order number (GPA.…) from Google's purchase confirmation, the account ID (Shop → Account) or your recovery code; for the arena your friend code (Star Arena → Friends).

16. Right to lodge a complaint

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Data Protection Commissioner)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany

17. Changes

The version published on this page applies. In case of doubt, the German version prevails.

Last updated: 10 October 2026 (applies to version 1.0.5; section 12 describes older versions)

Legal notice (Impressum) · Delete account & data · Deutsche Fassung