Privacy Policy

Armytower – Tower Defense (app com.armytower.app) · Last updated: 9 October 2026 · Deutsche Fassung (the German version is legally binding)

This policy covers the Armytower app and its services at armytower.mtcteam.de (game server for multiplayer, purchase verification, account).

Controller

The principle

Armytower shows no ads, uses no advertising ID and no third-party analytics (no Google Analytics, no Firebase). The app does not ask for your real name, e-mail address, phone number or postal address. It does not read your contacts and does not know your location.

Playing without an account

Campaign, medals, research, inventory, statistics and settings are stored only on your device. When first needed, the app creates a random value (32 bytes) as a device key. The server only ever sees a cryptographic hash (SHA-256) of it and stores only that hash – for example for the leaderboard and to assign purchases. No person can be identified from this value.

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

Multiplayer and leaderboard

In multiplayer the app transmits your display name, your chosen commander and your device or account key (the server hashes it immediately). Your opponent sees your name and your commander. After each battle the server stores the result (winner, reason, duration, battle figures such as units and kills) and keeps an Elo rating. The public leaderboard in the app shows the top 50 with name, rating and wins/losses.

The game server uses your IP address only in memory to limit multiple connections from the same connection and message floods. If it disconnects you because of a message flood, the IP address appears in the server's system log.

Legal basis: Art. 6(1)(b) GDPR (multiplayer is part of the game) and (f) (protection against abuse).

Account (optional)

With an account, your game progress and your name are additionally stored on our server so that you can switch devices or reinstall the app. You can sign in with Google Play Games or without Google (then you move devices with a transfer code). We store:

• your game progress (campaign, medals, research, inventory, in-app purchases, chosen commander and camouflage, statistics) with the time of the last backup,
• your player name and when it was last changed,
• an account key (random value) and one session per device – the session only as a hash – with creation and last-use time,
• when signing in with Google Play Games: your Play Games player ID. We suggest your Play Games name once as your player name; we do not store it,
• transfer codes only as a hash, for at most 24 hours.

Your player name is unique and visible to other players (multiplayer, leaderboard). After a name change your old name stays reserved for you for 30 days.

Legal basis: Art. 6(1)(b) GDPR.

Reporting names

After a multiplayer battle you can report your opponent's name. We store the reported name, which account reported it (if signed in) and when. We review reports manually and reset inappropriate names. Processed reports are deleted after one year.

Legal basis: Art. 6(1)(f) GDPR (protection of players).

Purchases

Purchases are handled by Google Play; we never see payment details. So that a purchase cannot be forged, the app sends the purchase receipt (purchase token) to our server, which verifies and acknowledges it with Google. We store: product, purchase token, Google order number, time, the hash of the account or device key and whether the purchase was refunded. Once a day we ask Google which purchases were cancelled or refunded and block them.

Legal basis: Art. 6(1)(b) GDPR.

Rate limiting and server logs

To prevent abuse, account and purchase verification count requests per connection (IP address, for IPv6 the /64 network) per minute, and wrong transfer codes per hour. These counters are deleted after a few minutes or hours. This does not affect the usual access logs of the web server (IP address, time, requested address).

Legal basis: Art. 6(1)(f) GDPR (secure operation).

Who else sees data – complete list

• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – operates the server running the game server and database. A data processing agreement under Art. 28 GDPR is in place.
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland – distribution via Google Play, processing of purchases (Google Play Billing) and, if you use it, sign-in with Google Play Games. We send Google only purchase tokens for verification and, at sign-in, the app's one-time sign-in code; we receive the purchase status or your Play Games player ID and Play Games name. Google's own privacy policy applies to processing by Google.

How long

• Game progress, name, sessions and player ID: as long as the account exists,
• transfer codes: at most 24 hours,
• request counters: minutes to a few hours,
• processed reports: one year,
• battle results and rating: permanently as part of the game history (without a name after account deletion),
• purchase receipts: permanently, so that a purchase remains provable (refund, restore) – without reference to you after account deletion.

Deleting your account

In the app under Account → Delete account. Deletion takes effect immediately: game progress, name, player ID, sessions, transfer codes and reports about your name are removed; the leaderboard shows a dash instead of your name. Purchase receipts remain without reference to you; one-time purchases can be restored via Google Play at any time. The game progress on your device remains until you uninstall the app. You can also request deletion by e-mail – see Delete account.

Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). A message to info@mtcteam.de is enough; please include your player name.

Right to lodge a complaint with a supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

Children

The app is not specifically directed at children under 13 and does not knowingly collect data from them.