Privacy Policy

Last updated: 7 November 2026

This Privacy Policy explains how personal data is processed when you play the Riddle Mind mobile game (the “App”) and when you visit our website (the “Website”). We keep data collection to a minimum: you don’t need an account, we don’t use analytics or tracking tools, and we don’t sell your data.

1. Who is responsible

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not legally required to. For any privacy question or request, please email us at the address above.

2. Summary

• No account or login. The App recognizes your installation with a random, anonymous player ID.
• Your questions and theories are sent to OpenAI to generate the game’s answers, without your player ID or device data. Please don’t type personal information into the game.
• Free players watch a short video ad, started with a tap, to unlock a story, a hint or a new set of 25 questions. There are no banner or pop-up ads, and Premium players don’t see these ads. Ads are provided by Google AdMob, with a consent message where required by law.
• We ask for your birth year once, but store only your age group.
• No analytics, no crash reporting, no push notifications.
• Our servers are located in Germany.
• You can request deletion of your server data.

3. Data we process in the App

3.1 Anonymous player ID and game progress

When you first open the App, it creates a random player ID (a UUID). It is not linked to your name, email address or phone number. We use it to save your game progress on our server, such as the stories you started or solved, hints used, your question counter and your remaining Premium requests, and to recognize your installation in later sessions.

Legal basis: Art. 6(1)(b) GDPR (providing the game you requested).

3.2 Questions, theories and AI answers

The questions you ask and the solutions you submit are sent to our server and processed to generate the game’s answers (see section 4). We store them together with the answers so the conversation in a story is available to you.

Legal basis: Art. 6(1)(b) GDPR. Please don’t include personal information (such as names, addresses or health details) in your questions.

3.3 IP address and technical data

When the App connects to our server, your IP address, the time of the request, the requested address and basic connection data are processed. We use the IP address to limit the number of requests per address, which protects the game against abuse and automated attacks. Our web server may also record this data in log files.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running a secure and stable service).

3.4 Content reports

If you report an AI answer as inappropriate, we receive the reported answer, the related question and your player ID so we can review it and improve the game.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in keeping the game safe).

4. AI answers (OpenAI)

The game’s answers are generated with the OpenAI API, provided by OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA (for users in the EU: OpenAI Ireland Ltd.). For each request, our server sends OpenAI only:

• your current question or submitted solution,
• information about the story (its text, the hidden solution and the story’s rules), and
• our instructions for evaluating the question.

We do not send your player ID, session data, device information, IP address or previous conversations. We use OpenAI with storage of responses disabled. According to OpenAI, data sent through its API is not used to train its models and may be kept for up to 30 days to detect abuse, after which it is deleted unless the law requires otherwise.

OpenAI processes this data on our behalf under a data processing agreement (Art. 28 GDPR). For transfers to the USA, see section 11.

The AI only evaluates your answers within the game. It does not make decisions that have legal or similarly significant effects on you (Art. 22 GDPR). AI answers can occasionally be wrong; you can report an answer in the App.

5. Advertising (Google AdMob)

The App only shows rewarded video ads that you start with a tap. Free players watch one to unlock a story, to open a hint, and to get a new set of 25 questions. We don’t show banner ads or ads that pop up on their own, and Premium players don’t see these ads. Ads are provided by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To show and measure ads, Google processes data such as your device’s advertising ID, device type and settings, IP address, app information, approximate location derived from the IP address, and how you interact with the ad. Depending on your choices, ads can be personalized (based on your interests) or non-personalized (based only on context, such as the App itself).

• Consent: Where required by law (for example in the EU, the EEA, the UK and Switzerland), the App shows Google’s consent message before any ads are loaded. You can change your choice at any time in the App under Settings → Privacy & Legal → Ad privacy preferences.
• Players aged 13 to 15 only receive non-personalized ads, and their ad requests are marked as coming from a user under the age of consent.
• Players in the United States: if you live in a US state with a consumer privacy law (such as California), you can opt out of the “sale” or “sharing” of your personal information for targeted advertising at any time under Settings → Privacy & Legal → Ad privacy preferences. We do not sell personal information for money.
• Reward check: When you finish an ad, Google confirms the reward to our server so we can unlock the story, hint or requests. This confirmation is linked to your player ID.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) for accessing information on your device and for personalized ads; otherwise Art. 6(1)(f) GDPR (our legitimate interest in funding the free version of the game through ads). You can withdraw your consent at any time with effect for the future. Google’s use of data is described in Google’s privacy policy: policies.google.com/privacy and at policies.google.com/technologies/ads.

6. Age check

When you first open the App, we ask for your birth year. We use it only to work out your age group (under 13, 13–15, or 16 and over). We store only the age group, not your birth year. Players under 13 cannot use the App. For players aged 13 to 15, we show only non-personalized ads.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR (protecting minors), and Art. 6(1)(f) GDPR.

7. Premium purchases

Riddle Mind Premium is a one-time in-app purchase. Payment is handled entirely by Google Play (Google Payment Ireland Ltd.) as an independent controller. We never receive your payment details. From Google we receive only the information needed to confirm and restore your purchase, such as the product, the purchase token or order ID, the purchase date and its status. We store this together with your player ID and your remaining request balance to activate Premium, restore it on a new device and protect against fraud.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR where we must keep records for tax purposes.

8. Data stored on your device

The App stores your player ID and login token securely on your device (in the device’s secure storage) so that you stay recognized without an account. It also stores your settings, such as sound and music. This storage is strictly necessary to provide the App (§ 25(2) no. 2 TDDDG). Uninstalling the App removes this data from your device.

Google’s Mobile Ads SDK may also store or read information on your device as described in section 5, based on your consent where required.

9. Our Website

When you visit our Website, our hosting provider IONOS automatically processes your IP address, the date and time of access, the page requested, your browser and operating system, and the referring page. This is technically necessary to deliver the Website and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after 30 days.

The Website does not use cookies, analytics, tracking or advertising tools. Fonts are loaded from our own server, not from third parties.

If you sign up to be notified about the launch, we use your email address only to send you that notice (Art. 6(1)(a) GDPR). You can unsubscribe at any time, and we delete the list after the launch.

If you email us, we use your email address and message only to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the matter is closed, unless we must keep them by law.

10. Service providers

We do not sell your data and do not share it with anyone else, unless we are legally required to (for example by a court order).

11. Transfers outside the EU

OpenAI and Google may process data in the USA. These transfers are based on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards by email.

12. How long we keep data

13. Children

Riddle Mind is meant for players aged 13 and over and is not directed at children. Players under 13 cannot use the App. If you believe a child under 13 has used the App, please contact us and we will delete the related data.

14. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw consent at any time, with effect for the future (Art. 7(3)).

To use these rights, email us at playriddlemind@gmail.com. Because we don’t know your name, please include your Account ID from Settings → Privacy & Legal so we can find your data.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

15. How to delete your data

Use our data deletion request page, also linked in Options → Request data deletion. The page explains how to email us with or without the app installed. We may ask for verification to link the request to your profile.

Deletion removes server-stored gameplay data and sign-in access. Some Premium records may be retained for purchase recovery, fraud prevention, or legal obligations. Tell us in your request if it also covers purchase records.

16. Security

We protect your data with technical and organizational measures. These include encrypted connections (HTTPS/TLS), secure storage of credentials on your device, access restrictions on our servers, and rate limiting against abuse.

17. Changes to this policy

We may update this policy when the App, the Website or the law changes. The current version is always available on this page and in the App. If a change affects how we use your data in an important way, we will let you know in the App.