1. Controller and contact
The controller is:
Yakuma — Yassin Kuczma
c/o Online-Impressum 10897
Europaring 90
53757 Sankt Augustin
Email: mail@yakuma.de
Support: support@yakuma.de
2. Playing and age settings
Game saves, progress, settings, privacy settings, and your age settings are stored locally on your device so that the app can function and we can apply protection and consent rules. Until you make a selection, personalised advertising and Firebase Analytics remain disabled. If you are under 18, they remain disabled. Your age settings are not sent to Firebase Analytics and are not attached to analytics events. We send optional crash reports through Sentry only if you are at least 18 and have expressly opted in. Local data remains stored until you delete or reset the app or its data.
3. Local player identification
The app creates and stores a local player identifier on your device. RevenueCat uses this identifier to associate Store purchases and access entitlements. Game saves, progress, settings, and virtual inventory are stored locally on your device.
4. Purchases, advertising, analytics, security, and support
Purchases and subscriptions. Apple or Google process payment, the store receipt, and the transaction identifier. RevenueCat processes the local player identifier, product, purchase, and entitlement data, including the purchase time and information about the term of access, as required to provide and restore Hoshi Pro and process consumable purchases. Purchase and entitlement data may remain for as long as a store subscription is active or purchased access must be restored. Deleting local app data does not cancel a store subscription. We do not receive payment data.
Advertising. We may display personalised, non-personalised, or limited ads. If you are under 18, we do not use personalised advertising. If you are at least 18, we use personalised advertising only with your consent and where further platform requirements are met.
Non-personalised ads may use information on your device, including mobile identifiers, for frequency capping and aggregated reporting. Where the required consent is absent, Google may instead serve limited ads. Functions that require a local identifier are not used for limited ads. Limited ads are not served programmatically.
Google AdMob and Google’s consent tools may process, in particular, your IP address, app and device information, advertising or device identifiers, technical timestamps, and your consent status. For age-appropriate consent and ad delivery, we tell Google only whether age-restricted treatment is required. We do not transmit your specific age setting. The consent tools store your choice on your device so that it can be respected and changed later. For more information about how Google uses data in its partners’ apps, see Google’s privacy information.
Analytics. Firebase Analytics is initially disabled. If you are at least 18, a Google consent form may be shown in the game. Firebase Analytics starts only after you expressly consent there. Earlier actions, including the first tutorial, are not collected later.
Only after your consent do we use Firebase Analytics to better understand how Hoshi is used, develop the app further and identify technical issues. We record information about the use of our game features and offers, purchases, the functioning of advertising, interactions with notifications and selected app settings. After your consent, Firebase may additionally collect automatic technical events about app and session use. For purchases and subscriptions, this may include information about the product, price or value, currency, quantity, and subscription status. For more information about automatically collected events, see Google Analytics Help. If the app is temporarily offline, only events created afterwards may be cached locally. These events may show, for example, how you use the app, how long you play, the game results you achieve and which app settings you choose. Firebase may process an app identifier and technical, usage, and timing information for this purpose. We do not send your age settings, email address, or free-text content with these events.
In the Help Center under “Privacy”, you can reopen your privacy choices and stop Analytics for the future. Further collection stops immediately. Under “Delete my data”, the app prepares an email request to support@yakuma.de containing your local player identifier and any available current or retained Analytics App Instance IDs. You can open the prepared email or copy the request text and send it yourself. We process requests manually and respond by email. Local app data is deleted only after a separate confirmation. Send your request before deleting local data so that the identifiers remain available for processing.
Security and stability. We use Firebase App Check to protect our Firebase services against abusive access. On Android, attestation uses Google Play Integrity. On iOS, we use Apple App Attest with Apple DeviceCheck as a fallback. Google and, on iOS, Apple process app and device integrity attestation material for this purpose. Firebase also processes time-limited App Check tokens and necessary network and timing information. This processing is independent of analytics and advertising.
If you are at least 18 and separately give voluntary consent to optional crash reports, we process technical data such as app and version information, operating system, device type, time, error message, and the technical sequence leading to the error. We use Sentry, with data stored in the European Union. Crash reports contain technical diagnostic information.
Support. When you contact us, we process your email address, message, and information you provide in order to respond to your request. We use an IONOS mailbox to receive and store these emails.
5. Legal bases
Article 6(1)(b) GDPR applies to the app and purchases. Firebase App Check and general error diagnosis are based on our legitimate interests under Article 6(1)(f) GDPR in protecting our services against abusive access and fixing errors. Depending on the case, support requests are based on performance of a contract or our legitimate interests. Optional crash reports, personalised advertising, and Firebase Analytics are each processed only under the applicable consent pursuant to Article 6(1)(a) GDPR. We base the processing of technical data for non-personalised and limited advertising on our legitimate interests under Article 6(1)(f) GDPR in financing the app through advertising and providing ads securely and reliably. By contrast, we process local identifiers for non-personalised advertising only with your consent pursuant to Article 6(1)(a) GDPR. We process the local age setting based on our legitimate interest in protecting minors and applying consent rules.
Section 25 TDDDG additionally applies to storing or accessing information on your device. Where these operations are not strictly necessary, they take place only with your consent pursuant to Section 25(1) TDDDG. Local game saves, your settings, storage of your privacy choice, and necessary security and session tokens may be stored or accessed pursuant to Section 25(2) no. 2 TDDDG where this is strictly necessary for the app or online function you request. Any subsequent processing of personal data is additionally governed by the legal bases under Article 6 GDPR stated above.
6. Requirement to provide data
Without local game saves and settings, progress and selected settings cannot be retained permanently.
Firebase Analytics and optional Sentry crash reports are voluntary. If you do not consent, this does not disadvantage your basic use of the game. Purchase, store, and RevenueCat data is required to purchase, provide, or restore Hoshi Pro. App Check tokens and the required attestation material may be necessary for protected online functions. If they cannot be provided, those online functions may be unavailable; local gameplay remains unaffected.
During free use, Google may serve an eligible ad depending on your privacy choices. If an ad cannot be requested or provided, directly ad-dependent functions may be temporarily unavailable.
7. Recipients and third countries
| Recipient | Purpose and storage location | Possible third-country transfer |
|---|---|---|
| Google Ireland Limited and Google LLC | Firebase App Check, Firebase Analytics, management of privacy choices, requested deletion of Analytics data, and AdMob; depending on the service, EU and United States | United States; in particular on the basis of EU Standard Contractual Clauses |
| Apple Distribution International Ltd. and Apple Inc. | Store purchases and App Check attestation through App Attest or DeviceCheck; depending on the service, EU and United States | United States; subject to the safeguards applicable to the respective Apple service |
| RevenueCat, Inc. | Purchase entitlements; United States | United States; in particular on the basis of EU Standard Contractual Clauses |
| Functional Software, Inc. / Sentry | Error reports; stored in the EU | Access from the United States is possible; in particular safeguarded by EU Standard Contractual Clauses |
| IONOS SE | Provision of the email mailbox and processing of support requests; Germany | Subject to the agreed data processing agreement and the subprocessors named in it |
For AdMob, we and Google generally act as independent controllers for the respective processing activities. For individual AdMob functions, Google may act as a processor. Apple and Google process store purchases under their own responsibility to the applicable extent. You may obtain a copy of the relevant safeguards by contacting support@yakuma.de.
8. Retention periods
Local game, age, and consent data remain stored until the app data is deleted or reset. We delete locally cached analytics events no later than after seven days. App Check tokens are valid for no more than seven days. Where Firebase App Check retains tokens to protect against replay, it does so for no more than 30 days. After withdrawal, available previous Analytics App Instance IDs remain encrypted on your device for a manual deletion request until you delete the local app data. Purchase and entitlement data associated with the local player identifier or active store subscriptions remain for as long as needed to provide or restore access. We delete support data after the request is completed unless statutory obligations require otherwise. We retain Sentry error reports for no more than 30 days. Firebase Analytics generally retains event data for 14 months. Certain associated user-level data may remain available for longer during continued use. According to Google, advertising data in server logs is progressively anonymised by removing parts of the IP address after nine months and cookie information after 18 months; individual data may be retained longer for security or legal obligations.
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where our processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal. We generally respond to privacy requests within one month. For privacy requests, contact us at support@yakuma.de. You may in particular lodge a complaint with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. We do not make automated decisions that produce legal or similarly significant effects concerning you.
10. Additional information for California residents, where applicable
Where California privacy law applies to us, these notices supplement the information above. During the preceding twelve months, or since the app became available if that period is shorter, we have processed the following categories of personal information: identifiers (local player identifier and advertising or device identifier), commercial information (purchases and entitlements), internet or other electronic network activity and device data (interactions, app version, operating system, device type, and error reports), and information in support requests. The data comes from you, your device, the store providers you use, and our service providers.
We use this data to provide the app and purchases; operate the app securely and reliably; provide support; and enable advertising and analytics in accordance with your settings. For these purposes, we may disclose the listed categories to the service providers named in Section 7 and, for store purchases, to Apple or Google. We do not sell personal information for monetary consideration. When personalised advertising is enabled, disclosure of advertising and device identifiers and usage data to Google AdMob may constitute “sharing” for cross-context behavioural advertising under California law. You may change your privacy choices under “Privacy” in the Help Center; non-personalised or limited advertising may still be displayed.
You may request access to your data, correction of inaccurate data, deletion, and opt out of the sharing described above. Exercising these rights will not result in discriminatory treatment. For requests, email support@yakuma.de. To verify a request, we may require reasonable information to confirm your identity and generally respond within 45 days, unless the law permits otherwise.
11. Changes
Where legally required, we will inform you of material changes. The current version is available at https://yakuma.de/en/games/hoshi/legal/privacy-policy.