Privacy information for Do Not Invade My Yard, Man!
Effective date: 6 November 2026
1. Controller and contact
Paul Zehm
Koberg 20
23552 Lübeck
Germany
Email: support@donottouchmylawnman.com
Phone: +49 151 20773290
This information covers the game, optional game account, in-app purchases, game information website, community links and support. Your operating-system, sign-in and store providers also process data under their own privacy information. This version is offered for iPhone and iPad. Passages about Google, Google Play and Android apply only to an Android version, which is not currently offered.
Changes to this information: We update this information when the game, our information website or the processing described here changes. The current version is shown on our information website together with its text version and effective date; the app opens it from Help & info. Before material changes take effect, we announce them on our information website and, where they come with an app update, in its App Store release notes. Where consent is required, we obtain it before the changed processing begins.
2. Playing without sign-in and local storage
You can play locally without signing in. Your device stores your collection, decks, gold, separate shard balances, card-specific upgrades, crafting receipts and progress, discovery history, quests, guarantee counters and incomplete pack openings. Device preferences are stored separately. Local play alone does not transmit these saves to our game server.
Storage and access needed for the explicitly requested game functions fall under section 25(2)(2) of the German TDDDG. Where we process personal data for these functions, the legal basis is Article 6(1)(b) GDPR. This does not cover unnecessary analytics or marketing access.
Operating-system backups and device transfers depend on your platform settings and terms. We do not back up a purely local save on our server and cannot access it unless you deliberately send it to us. Device loss or removal of app data can lose it. Manage platform backups separately.
3. Optional account and sign-in
We use Apple or Google sign-in for the optional secured account. The account service processes the verified provider identifier, internal game-account identifier, randomly generated device identifier and necessary sign-in, session and revocation evidence. The device identifier secures and assigns sessions; it is not an advertising identifier. Sign-in takes place with the provider; we do not request your name or email address from it. Never disclose Apple or Google passwords to our support.
For a connected account, our server processes the confirmed collection, decks, progress, gold, shard balances, card-specific upgrades, crafting and acquisition records and result data needed for quests and rewards, including league and rating values used to select suitable computer-controlled opponents. This may include chosen deck names and stored profile text. When a game account is first connected, this device’s local save is transferred to it once. After that, matches, deck changes, quests, confirmed pack openings, upgrades and crafting are first recorded in encrypted form on your device and transmitted to our game server in the background; the state confirmed there is authoritative. We do not continuously transmit every screen frame or individual combat action.
These requested account, recovery and game functions use Article 6(1)(b) GDPR. They require the relevant identity and account data. Local play remains available without an account. Matching email addresses alone do not link accounts.
If you start a cash purchase or use the free personal daily exchange in the shop without signing in, we automatically create a game account bound to this device, without sign-in. This lets purchases and your daily exchange be assigned securely to a game account. This happens before any payment is completed or before the exchange; this device’s local save is transferred to the account once. From then on, your game progress is stored on our game server as for a connected account. If you then cancel the purchase or exchange, the game account remains. It is bound to a randomly generated secret that is stored only on your device; our server stores only a check value derived from it. No name, email address or provider identifier is processed for it. If you later sign in with Apple or Google, that sign-in is linked to the same game account. The legal basis is Article 6(1)(b) GDPR.
4. In-app purchases and purchase management
Cash purchases use the native Apple or Google purchase dialog. When you open the shop while this device has no game account yet, the app retrieves the current daily selection from our game server without account or device identifiers and reads localized prices directly through Apple’s or Google’s store interface without involving RevenueCat. Once a game account exists, including the game account created automatically for this device, the app retrieves the selection with that game account’s session and uses RevenueCat for offers, prices and purchases. We use RevenueCat, Inc., USA, to display and manage requested purchase offers and to verify and assign purchases. Processing begins when you permissibly open the cash shop connected to your game account, before payment. Further processing may be required to check purchase and delivery status. Paid content is assigned to a game account; without sign-in this is the game account created automatically for this device (section 3). Connections to the participating services also technically process your IP address.
We integrate RevenueCat for the connected purchase service after the account association has been confirmed. In its requests, the integrated SDK also sends technical information, including the operating system and version, device model, app and build version, app identifier, preferred language settings, installation and runtime status, and the store country where available. Where iOS provides it, the SDK also sends the device’s Apple identifier for the app’s vendor (IDFV). This system identifier applies to apps from the same vendor on the same device; it is distinct from our own random device identifier and from the advertising identifier, IDFA. The SDK also sends the app-tracking authorisation status it reads on the device; the app itself does not request tracking permission. We have switched off the SDK’s optional diagnostics collection. RevenueCat can, however, switch it on through its remote SDK settings; the SDK then also sends technical diagnostic events about its operations, such as the operation type, duration, result and error codes and the affected product, transaction and store details.
Data include the pseudonymous game-customer identifier, product and transaction identifiers, receipts or store purchase tokens, purchase and refund status and necessary technical app and connection information. Our server also stores the specific card benefit confirmed before payment, offer and order identifiers, pending and approval states, the immutable delivery promise and acquisition and consumption records for card copies and shards. These support correct assignment, delivery, refunds and prevention of duplicate or unauthorised grants. A delayed payment confirmation belongs to the original order; the current daily selection does not replace its confirmed benefit. For purchases through Apple, the integrated SDK also passes the pseudonymous game-customer identifier to Apple as the transaction’s account token (appAccountToken) so that receipts can be assigned unambiguously to the game account. Purchase and status notifications delivered and authenticated by RevenueCat are stored in encrypted form in our database and as immutable encrypted recovery records; they contain the customer, product, transaction, time and store details sent by RevenueCat. We remove their content from our database 30 days after receipt, but not before the purchase has been processed and confirmed; only the event identifier and a check value remain to detect repeated deliveries. Recovery records are deleted as described in section 10. We do not receive complete payment-card numbers or bank-login credentials through this flow.
Purchase verification, assignment, delivery and related performance or refund issues use Article 6(1)(b) GDPR. Legally required accounting and settlement evidence uses Article 6(1)(c) GDPR together with the applicable tax and commercial obligations.
Necessary evidence for detecting purchase abuse and unauthorised duplicate grants uses Article 6(1)(f) GDPR. Our legitimate interest is protecting the service, its users and correct fulfilment. Revenue summaries needed to manage the business also use Article 6(1)(f) where personal data remain necessary. These summaries are limited to what is needed and are not advertising profiles.
5. Hosting, backups and recipients
We use OVHcloud for the game server, encrypted database backups and recovery evidence. Contracting provider and storage locations: OVH GmbH, Germany; game server in Frankfurt am Main and encrypted recovery and database-backup storage in Paris, France. Backups contain personal account data. Additional active automatic VPS backups may contain data from the server disk; these copies are also included in the retention and erasure process. Encryption and separate permissions do not replace retention and erasure rules. Backups protect against data loss and support reliable recovery. Where not already necessary for contractual performance, this uses Article 6(1)(f) GDPR and our interest in a secure, recoverable service.
Email support uses mittwald CM Service GmbH & Co. KG in Germany. Domain registration, DNS management, website hosting and email hosting are separate services. The game information website is hosted by Mittwald CM Service GmbH & Co. KG, Germany, in our existing agency-server project; the existing data-processing agreement provides for processing in the EU or EEA. Processors act under Article 28 GDPR agreements. Within our organisation, access is limited to authorised people for the relevant task. Recipients may also include competent authorities and, where necessary, confidential tax or legal advisers. Apple and Google also process data independently for their accounts and stores.
6. Transfers outside the European Economic Area
RevenueCat may process data in the USA and countries listed in the applicable subprocessor list. The RevenueCat Data Processing Addendum incorporated into our contract governs these transfers. For transfers not covered by an applicable adequacy decision, the European Commission’s Standard Contractual Clauses are agreed; Module 2 applies to us as controller and RevenueCat as processor. Where UK data protection law applies to such a transfer, the UK Addendum also applies. Contractual safeguards include processing on our instructions, access rights limited to the relevant tasks, encryption and corresponding protective obligations for subprocessors. The current list of these service providers, with the processing locations and purposes stated by RevenueCat, is in Annex 3 of the addendum (https://www.revenuecat.com/dpa). Paragraphs 1–11 of the published addendum concern data about people in the EEA or United Kingdom. Request information about these safeguards or copies of relevant contractual provisions at support@donottouchmylawnman.com; necessary redactions protect third-party rights. Apple and Google explain transfers for their own processing. We do not promise exclusively European processing of all data associated with the game.
7. Visiting the game information website and community links
Mittwald processes connection data, including the IP address, to deliver the site. According to the provider, access logs also record time, requested page, protocol, response status, data volume, referrer, browser identifier, hostname and, where applicable, a directory-protection username. Mittwald documents shortened IP addresses and 60-day retention for these logs; directory-protection usernames are anonymised after one day. Error logs may contain an IP address, error message and affected page and are deleted after seven days. These are the documented routine hosting-log periods, not a guaranteed maximum for every backup copy. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in secure delivery, fault investigation and abuse prevention. Data separately required for a specific incident is retained only for that purpose and for a limited period.
The generated page contains no analytics tags, externally loaded fonts or advertising trackers and requires no sign-in. Necessary device-storage access falls under section 25(2) TDDDG. Additional functions requiring consent are not enabled without the appropriate prior consent.
In Help & info and on our information website, we link to our Discord server and Reddit community. The app only opens the relevant address in the Discord or Reddit app or in your browser; no game save, account or device identifiers are passed on. When you open and use these services, Discord and Reddit process data under their own privacy information, including outside the European Economic Area. We can see posts and messages you address to us or publish in our community within these services’ features and use them to respond and moderate. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in communicating with the game community.
8. Technical operation and security
Our game server processes technical operational events for security and troubleshooting, particularly times, service and process identifiers, event and error classes, and necessary connection and request metadata. Depending on the event, this can include a network address, requested path and response status. General operational logs are rotated automatically and kept for at most 15 days (14 days plus the current daily file). Specific security cases are handled separately, restricted to necessary information and subject to the case criteria below. The basis is Article 6(1)(f) GDPR and our interest in a secure, available service.
General operating logs do not contain complete profiles, passwords, usable session tokens or complete purchase receipts. Independent availability and job monitors receive technical operating information and operator contacts, rather than player profiles or purchase receipts.
For protected purchase requests, we use Apple App Attest and signed app-download records, or Google Play Integrity. We process technical evidence about the app, its installation and device environment, together with its association with your current session and request. The app communicates with Apple or Google for this purpose. On Android, our server verifies the integrity token issued by Google through Google’s service. This origin check alone does not confirm your age, parental approval or a payment.
For Apple App Attest, we store the public key’s association with your game account and device, a counter that prevents replay, registration and use times, and an encrypted security receipt. The private App Attest key stays in your device’s protected storage. Original request signatures and app-download records are processed temporarily for the relevant check; complete raw copies are not stored in this security table.
9. Support contact
We process your contact details, message and attachments to handle your request. Contract-related requests use Article 6(1)(b) GDPR; other requests use Article 6(1)(f) and our interest in responding appropriately. Data-protection requests use Article 6(1)(c) with the applicable GDPR duties.
“Contact support” opens an email draft addressed to our support address; the app adds only its version to the message body. “Give feedback” opens a draft to the same address with only the subject prefilled. The app does not generate a diagnostic report, attach logs or send any draft automatically. Information you voluntarily add to a message or attachment is processed with your support request.
Ordinary support correspondence, including replies and attachments, has a maximum retention period of 12 months after the case is closed. Unnecessary content is deleted earlier. Cleanup covers the inbox, sent messages, trash and working copies we create. Only records needed for a specific open legal case or an applicable statutory evidence duty are retained separately for that purpose. Backup copies held by providers follow their backup cycles and are distinct from the active mailbox. Messages from children under 13 are answered once and then deleted.
10. Retention and account deletion
Data needed for a connected account are retained for its use and associated services. You can request account deletion in the app or, without it installed, through the public deletion information or email to support@donottouchmylawnman.com. Signing out alone does not delete the account. Sessions are deleted one day after they expire, no later than 31 days after sign-in, and sign-in processes after 30 days.
Scope and processing status of erasure in the live account service, sign-in providers and RevenueCat: After acceptance is confirmed, new sessions and inventory changes are blocked. Unneeded profile, card, deck, progress, import and operation data is removed from the live system. Sign-in authorisations are revoked and RevenueCat customer deletion is verified separately. The request remains pending while a required step is unconfirmed. If we need additional information to verify your identity, we ask only for what is necessary for that purpose. Signing out, accepting a deletion request and completing erasure are different events.
Erasure also covers the account-linked App Attest key associations and Google installation-identifier values. Necessary revocation records kept independently are limited to their protection purpose and handled under the separate retention criteria described in section 12. Backups may also contain these security associations. Using digest values or encryption does not replace a maximum residual retention period.
Outstanding payments, refunds and legal claims are handled separately and do not justify indefinite retention of the entire profile. Only data actually needed for a specific purpose may remain. Statutory retention periods, such as eight years for accounting vouchers, six years for certain business correspondence and ten years for certain books and annual accounts, apply to our business records, for example Apple’s settlement reports; these contain no player data. Purchase records of a deleted account are kept only until open claims such as refunds are settled, and at most three years from the end of the calendar year (sections 195 and 199 of the German Civil Code).
Copies can remain in backups after the active account has been cleared. They are excluded from ordinary use and used only for recovery. Their remaining duration depends on expiry of the relevant full backup, its dependent backup and journal generations, and necessary technical storage locks. Database backups expire after 30 days, and outdated object versions are removed no later than 14 days after that. Recovery copies are removed by a daily cleanup after a technical storage lock of 36 days. Our goal is that backup copies of a deleted account are gone no later than 60 days after deletion. Until this cleanup runs fully automatically, planned by 15 January 2027, individual encrypted recovery copies can remain longer; they are used only for recovery. Confirmed deletions and effective revocations must be reapplied before a restored account service is opened; an old backup must not reactivate a deleted account. Minimal deletion records remain only while an admissible restore point could bring the deleted data back, and at most three years. Specific open delivery, refund or legal cases retain only necessary evidence until resolution and expiry of the retention or claim periods actually applicable to that case. That evidence is then deleted too; the complete game profile is not kept for this purpose.
Deleting a connected account does not remove a separate local save or a platform backup. Manage those on your device or with the platform provider.
11. Advertising and additional analytics
This game version has no integrated advertising and uses no advertising identifier for advertising. Account and purchase processing, including revenue summaries, is separate. We have not built cross-app advertising tracking. The app does not read the advertising identifier (IDFA) and does not request tracking permission. If additional analytics, marketing or profiling functions are introduced later, this information is updated beforehand and any necessary consent is obtained before activation.
Do Not Track and cross-site tracking: Neither the app nor our information website tracks you over time across third-party websites or apps, and we do not allow any third party to do so through our services. A Do Not Track signal from your browser or a comparable signal therefore does not change our processing. RevenueCat processes the data sent through its SDK only as our processor or service provider. Apple, Google, Discord and Reddit process data under their own privacy information when you use their services.
12. Age information and parental processes
In the iOS version described here, we request age information through Apple’s designated API when the platform reports a legal duty for your actual context. The platform may adjust the requested age boundaries under the applicable regional rules. We use the age range actually shared for the protection decisions described below. In other cases, we do not carry out an additional age enquiry of our own.
For legally or platform-required protection decisions, we distinguish game access, account processing, new purchases and significant changes. A store age rating, age information and purchase approval are different things. Where available and required, we use the relevant platform information and native parental processes. Voluntarily unshared information, unsupported interfaces, technical errors and mandatory verification are handled separately. A technical error does not count as adulthood or consent.
Platform age information is used only for its permitted protection purpose. The original age bounds are evaluated on the device. For necessary server-side protection decisions, we transmit limited derived information and permission outcomes together with the current account and request association. On Android, this may include whether the evaluated signal meets the required adult-age threshold, its source tier, and whether a Google installation identifier is present. This information and the one-use verification requests are processed temporarily; an origin signature does not replace independent age or consent evidence.
Where this protection process is available and permitted, an installation identifier provided by Google is used only to match revoked app approvals. The original identifier is processed briefly for this purpose. On our server, we store a purpose-specific value generated with a secret key and its separate association with the game account, device and current authorisation generation, including the association time. A limited encrypted recovery association contains the internal game-account identifier and this value so that revocations can be matched after a restore and the associations can be removed on account deletion. This is neither an advertising identifier nor anonymous information. Age and revocation data is not used for advertising, marketing, revenue analytics or RevenueCat customer attributes.
An enabled protection process uses the necessary age or permission decision, its source, associated account/device binding, applicable protection version, and necessary consent and revocation times. Original platform age responses are evaluated temporarily and are not added to game profiles, general logs or RevenueCat attributes. Purpose-specific server bindings and digests support protection and observance of revocations; active account bindings are cleared on account deletion. Separate revocation evidence remains necessary only while an affected permission could still be used or restored from backup. The basis is Article 6(1)(f) GDPR and our interest in data-minimising, age-appropriate and secure access; Article 6(1)(c) applies where a specific statutory protection duty exists. Necessary consent is handled separately under Article 6(1)(a) and, where applicable, Article 8 GDPR. If a function is refused, you can request an explanation and human review through support@donottouchmylawnman.com; binding platform or legal restrictions are still respected.
Where this protection process is enabled, we also process signed Apple notices about revoked app approvals and the notification history provided by Apple so that relevant restrictions can be taken into account after interrupted delivery or a restore. For this purpose, we retain minimised encrypted association, time and digest records, together with technical processing records. Complete signed notifications are checked temporarily in this process. Necessary revocation records are kept separately from the game profile. Where a reliable and permitted Google revocation report is available, the corresponding records use only the purpose-specific installation-identifier value and evidence identifying the source report, not a complete age response. Their actual retention and limits form part of the storage and deletion information in this section.
If a platform response tells us that you are under 13, the initial release provides only the permitted local game. Our online-account and cash-purchase services are not initialised for this group, and community links are not shown. A binding restriction on app use also applies to local play. If a shared age range identifies you as 13 to 17, local play remains available, including packs bought with earned gold; the initial release does not offer this age group a game account or cash purchases. The same applies while required age information is missing. Parental purchase approval alone does not lift this account restriction of ours.
Children under 13: The game is intended for teenagers aged 13 and over and adults. If a platform response or support contact tells us that an affected account is used by a child under 13, we review the actual data held and stop any unlawful further processing. Contact details needed for a single support reply are used only for that purpose and deleted afterwards. Parents or guardians can ask at support@donottouchmylawnman.com which personal information about their child under 13 we hold, have it deleted and refuse its further collection. Account attribution is checked proportionately; deletion follows section 10.
Privacy review of existing accounts: If a platform response or other reliably attributed information shows that this review is needed, we restrict ordinary online-account use and new purchases. We open a restricted review request linked to the existing account, recording the account link, derived protection reason, original observation and receipt times, review status and necessary evidence references. We store no date of birth or original platform age range for this request; however, the reason can already indicate that a user is under 13. The review creates neither a new game account nor a new purchase-service customer. We assess the actual data purposes, including data held by our processors, stop unlawful further processing and delete data we no longer lawfully need. Necessary outstanding delivery, refund or legal claims are handled separately with limited data. Closing a data case or parental purchase approval does not reopen the account. A reasoned release of the review case also requires a new permitted access decision.
We limit the necessary review and completion record to a follow-up period of 90 days from actual completion. Unneeded case details are then minimised and original recovery copies are removed after verified backup and restore qualification. Technical storage locks and backups not yet finally cleared can delay physical removal; the copies remain excluded from ordinary use. A still-necessary minimal access and restore restriction is kept separately. Its follow-up is 90 days after a genuinely secured release or final removal of the associated account; removing it also requires verified finality of affected original copies and restore possibilities. Mere passage of time does not reopen a restricted account. The basis is the applicable protection or rights duty under Article 6(1)(c) GDPR, or the limited interest in data-minimising, age-appropriate and secure handling under Article 6(1)(f) GDPR; necessary consent is assessed separately.
Identifiers for internal operations: The persistent identifiers needed for the functions described in this information include: the random device-account identifier, the game-customer identifier with RevenueCat, the IDFV sent by the RevenueCat SDK, IP addresses of connections, the App Attest key association and, with Sign in with Apple, the Apple identifier. We use them only to provide and secure the game, process and assign purchases, maintain and repair functions, prevent fraud and answer support requests. We do not use these identifiers for advertising, advertising profiles, tracking across unrelated apps or services, or unsolicited contact, and our processors may use them only on our behalf for these purposes.
13. Your rights
Subject to the statutory conditions, you may request access, correction, erasure, restriction or portability and object to processing based on legitimate interests.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Contact support@donottouchmylawnman.com. You need not send complete profiles or secrets. We may request additional information where necessary to verify your identity and authority appropriately. Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We respond without undue delay and generally within one month. Where a lawful extension of up to two further months is necessary, we explain the reasons and the additional processing time within the first month. We cannot search or change purely local files that we do not possess.
If you live in a US state with a consumer privacy law, for example Texas, you may request access to, correction and deletion of your personal data and a portable copy. We do not sell personal data, do not process it for targeted advertising and do not use it for profiling with legal or similarly significant effects, so there is nothing to opt out of. We answer requests and appeals without undue delay, normally within 45 calendar days; any shorter applicable legal deadline takes priority. We explain any legally permitted extension in time. If we decline a request, you can reply to our decision with the subject “Appeal”. We tell you the appeal process and applicable deadlines and, if we deny the appeal, how to contact your state’s attorney general.
If you are in New Zealand: Some information about you comes from other sources: purchase and transaction confirmations and purchase-status information from Apple and RevenueCat, as well as App Attest results and, where required, age-check results from Apple. As the controller identified in section 1, we collect and hold it for the purposes in sections 3, 4, 8 and 12 and disclose it only to the recipients in sections 5 and 6. Our Privacy Officer is Paul Zehm, contactable at support@donottouchmylawnman.com. You can request access and correction there, and complain to the Office of the Privacy Commissioner (privacy.org.nz).
You may complain to a data-protection authority, including one at your habitual residence, workplace or the place of the alleged infringement. For our stated establishment in Schleswig-Holstein, this includes the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein. You do not first need to complain to us.