Privacy policy

Who is responsible?

This privacy policy covers the Otodama website and the Otodama app for iOS and Android. The controller is SCHMUT/WEISS GmbH, Sieveringer Straße 9/13, 1190 Vienna, Austria. For privacy questions and requests, contact office@schmutweiss.com.

Visiting this website

Your browser sends technical information needed to deliver the website, including your IP address, requested URL, access time, browser information and response status. Infrastructure providers process this information to deliver the site, maintain security and investigate technical problems. The legal basis is our legitimate interest in a reliable and secure website under Article 6(1)(f) GDPR. Technical records are retained only for the operational or security purpose for which they are needed, subject to the hosting configuration and any legal preservation duties.

Cookies, fonts and website analytics

This website uses no tracking cookies, localStorage or stored visitor or session identifiers for analytics. The URL determines the language. Work Sans and illustrations are served locally. Apple or Google is contacted when you follow the respective store link; that provider’s privacy notice then applies.

Website analytics

Our first-party website analytics counts page views, entry views, download navigation clicks, App Store and Google Play link clicks and the first successful card reveal on German and English pages. These counts help us understand website use and referrals. Collection runs automatically when the service is configured; there is no visitor opt-in control. Counts do not identify unique visitors, and store clicks are not app installs.

Events contain an approved page path without query strings, language, coarse viewport size, first known entry path, a restricted referral category, registered campaign, link placement and notice version. Arbitrary referral domains are grouped as “other”; unregistered campaigns are discarded. A random identifier belongs to one event only and prevents double counting during short retries. It does not identify a person or session. Names, full URLs, IP addresses and raw browser identifiers are not stored as analytics data.

The referral context and pending events exist only in this browser document’s memory, including internal navigation. There is no persistent analytics storage or event queue on your device. Reloading or restoring the page starts collection again without reusing stale referral or campaign evidence.

Events pass through our own server to the Otodama backend at Supabase. The browser’s IP address, cookies and browser headers are not forwarded as analytics fields. Infrastructure providers still process connection information to deliver the service and may keep operational logs. The backend is configured to retain aggregate counters for 24 months and event receipts for eight days. These counts are not linked to app installations or app analytics. Recognized assistant referrals represent observed referrals, not total visibility in AI services.

Playing Otodama

You do not need to create an Otodama account. Player names, your language choice and onboarding preferences are stored locally on your device so the app can remember them. We do not send those player names to an Otodama server. You can remove players in the app; clearing the app’s data removes local preferences, subject to your device’s backup settings. The legal basis for the processing necessary to provide these features is Article 6(1)(b) GDPR.

Game rounds work offline. The app can still contact the subscription service when launched with an internet connection, even if you have not made a purchase. There is no advertising SDK in the app. The app’s own analytics are described in the next section.

App analytics

In the released app, our own first-party analytics run automatically to help us improve the game, its reliability and the purchase experience. There is no in-app opt-in or opt-out control. Events are sent to our Otodama backend at Supabase. We do not use them for advertising, and we do not track you across other companies’ apps or websites.

We collect app launches and session duration, onboarding steps, selected game modes, player-count ranges, whether Spicy content is enabled, identifiers of our own prompt cards, round progression and outcomes without assignment to individual players, decision timings, paywall views, purchase and restore attempts including product and transaction identifiers, paywall loading times and a restricted set of technical error codes. Each event carries the app version, build number, platform and app language. Player names, spoken answers, audio, contacts and location are not collected.

When the app first runs, it generates a random installation identifier and a secret access token and stores them on your device; our server stores only a hash of the token. The installation identifier connects your events and can be linked to the app user identifier generated by RevenueCat. It is not derived from hardware or advertising identifiers and is not reused after you reinstall the app. These data are pseudonymous, not anonymous: they are linked to your installation.

Unsent events are queued on your device for up to seven days and are excluded from device backups. Our backend is configured to delete app events after 90 days. Installation records and the link to the RevenueCat identifier may be retained longer so that we can process deletion requests and produce permitted reports. Purchase records are covered in the next section.

The legal basis is our legitimate interest in understanding and improving the game under Article 6(1)(f) GDPR. You may object at any time by contacting office@schmutweiss.com. We will then revoke the installation identifier and delete its events and links. Because we hold no name or account, we may need information from your device to locate the installation. Deleting the app also ends collection.

Purchases and RevenueCat

Apple processes App Store purchases and payment details on iOS; Google processes Google Play purchases and payment details on Android. We use RevenueCat, Inc. to check receipts, manage access to Unlimited, restore purchases and understand subscription activity. RevenueCat processes an automatically generated app user identifier, purchase and subscription records, entitlement status, technical device information and a country derived from the transaction or, failing that, from the IP address, which RevenueCat then discards. RevenueCat notifies our backend at Supabase of purchase, renewal, cancellation and refund events; we retain the app user identifier, product, store, price, currency and transaction identifiers from those notifications, together with entitlement status, and can link the app user identifier to the installation identifier described above. We do not supply player names or a custom account identifier to RevenueCat. We do not receive your full payment-card details.

Subscription verification and fulfilment are based on Article 6(1)(b) GDPR. Preventing abuse and understanding subscription performance are based on our legitimate interests under Article 6(1)(f) GDPR. Transaction records subject to legal retention duties are processed under Article 6(1)(c) GDPR. Subscription records are retained as necessary to provide and restore access and meet applicable record-keeping duties. RevenueCat may process data in the United States. Applicable processor arrangements and transfer safeguards must cover this processing. See RevenueCat’s privacy information for its processing practices.

When you contact us

If you email us, we process your email address, the contents of your message and any information you choose to share. We use this information to answer your request and provide support. Contract-related requests are processed under Article 6(1)(b) GDPR; other correspondence is processed under Article 6(1)(f) GDPR, based on our interest in answering inquiries. We retain correspondence while needed to resolve the request and, where applicable, to meet legal obligations or establish or defend legal claims.

Recipients and international processing

Recipients may include website infrastructure and email service providers, Supabase for website analytics, app analytics and subscription records, RevenueCat for subscription processing, Apple or Google in connection with purchases through their respective stores, and professional advisers or authorities where legally necessary. Processors may act on our instructions; Apple and Google also process data as independent controllers. Where data is transferred outside the EEA, the transfer must be covered by an applicable adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses. Contact us for information about the safeguards applicable to your data.

Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not use personal data to make automated decisions with legal or similarly significant effects.

Send requests to office@schmutweiss.com. To delete app analytics, we revoke the installation identifier and remove its events and links. To locate an app purchase, we may need relevant purchase information; we will not ask you for your Apple or Google password or full payment-card details. You can also complain to your local supervisory authority or the Austrian Data Protection Authority at dsb.gv.at.

Changes

We update this policy when the app, website or relevant processing changes. The date at the top identifies the version you are reading.