Stadtbild ← Back to home Legal

Privacy Policy

for the app “Stadtbild” and the website stadtbild-quiz.com · Last updated: September 2026

This is an English translation of our German privacy policy (Datenschutzerklärung). In case of any discrepancy, the German version prevails.

Contents

  1. Controller
  2. Overview and scope
  3. What data we process
  4. Recipients and processors
  5. Transfers to third countries
  6. Retention period
  7. Deleting your account
  8. Your rights
  9. Children and young people
  10. No automated decision-making
  11. Data security
  12. Website and waiting list
  13. Changes to this policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hassouna Habibi
Würzburger Str. 7b, 51103 Köln (Cologne), Germany
Email: hassounahabibi92@googlemail.com
Phone: +49 1567 9769785

We are not legally required to appoint a data protection officer, as the statutory requirements for doing so are not met. If you have any questions about data protection, you can contact us directly at any time at the address above.

2. Overview and scope

This privacy policy informs you about which personal data we process when you use the mobile application “Stadtbild” (hereinafter the “App”) for iOS and Android and our website stadtbild-quiz.com, for what purpose and on what legal basis this is done, and what rights you have.

“Personal data” means any information relating to an identified or identifiable natural person.

3. What data we process, for what purpose and on what legal basis

3.1 Anonymous use (play right away)

When you first start the App, you can play right away without creating an account. For this purpose, an anonymous user account with a randomly generated identifier is created for you. At this stage, we do not process any data that identifies you, such as your name or email address, but only this technical identifier and your game progress.

3.2 Registration and sign-in

If you want to save your progress permanently, you can link your account via “Sign in with Apple” or “Sign in with Google”. Depending on what you allow with the respective provider, we receive the identifier stored with Apple or Google and, where applicable, your name and email address. With “Sign in with Apple” you can choose to hide your email address; in this case, we only receive an anonymized relay address.

In addition, you can choose a display name of your choice, which is shown to other users (e.g. in leaderboards and duels).

3.3 Game and usage data

To provide the game features, we process data generated during use, in particular: your game progress, the results of individual game rounds (e.g. how many items you assigned correctly and how quickly), your personal bests and leaderboard entries (such as your fastest round per game), your rating or rank, the results of your 1v1 duels and your record against individual friends, as well as your friend connections.

In a live 1v1 duel, two players compete against each other in real time in the same game. So that both see the same game state, your display name, your online status during the duel and your moves (in particular which field, country or element you claim) are transmitted to your duel partner in real time.

3.4 Push notifications

If you agree, we send you push notifications (e.g. invitations to duels). For this purpose, a device- or installation-related push token is processed. You can turn off these notifications at any time in the App or device settings.

3.5 In-app purchase (ad-free version)

The App is financed by advertising (see section 3.10). You can remove the ads permanently by unlocking the ad-free version with a one-time purchase. Payment is processed exclusively via the respective app store (Apple App Store or Google Play). We ourselves do not receive any payment data such as credit card numbers. To manage the purchase and assign it to your account – among other things, so that the ad-free version can be restored on your devices – we use the service provider RevenueCat, which processes an app-related user identifier as well as purchase and product information (e.g. transaction ID, purchased product).

3.6 Technical data and security

When you connect to our servers, technically necessary data such as your IP address are processed. To protect the integrity of the game (e.g. against manipulation and fraud), we also process security-relevant usage data.

3.7 Name moderation (OpenAI)

To check display names for impermissible content, we transmit only the chosen name text to OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA) for automated moderation – without a user ID or anything else that links it to you.

We have concluded a data processing agreement with OpenAI; the transfer to the USA is based on the EU Standard Contractual Clauses (see section 5).

3.8 Finding friends via your contacts (optional, only with your consent)

You can use your address book to see which of your contacts already play Stadtbild. This feature is voluntary and only starts after you have expressly activated it and allowed system access to your contacts.

We do not upload or store your contacts. Matching takes place exclusively via irreversible checksums:

So that your friends can find you in the same way, we additionally store a hash value of your own email address or phone number as verified by us. Here, too, the plain text is not additionally stored for this purpose.

A note on transparency: Matching via checksums protects the plain-text data, but is technically not absolute protection – someone who tries out a very large list of possible addresses could deduce whether a particular address is registered. We therefore limit the number of queries per account and the size of each individual query.

3.9 Invitations and referrals

If you invite someone via an invitation link or an invitation code, we store who invited whom (the two account identifiers, the code used, the invitation channel and the time). This automatically links both accounts as friends, and the invitation can be rewarded in the future.

3.10 Advertising

The free version of the App shows advertising (e.g. between game rounds). For this purpose, we use the advertising network Google AdMob (Google Ireland Limited, Ireland / Google LLC, USA). To deliver ads, AdMob processes technical data of your device, in particular an advertising identifier (the “IDFA” on iOS, the “Advertising ID” on Android), your IP address and general device and usage information.

Personalized or non-personalized advertising – your choice:

Without your consent, you will only receive non-personalized advertising; in that case, there is no cross-device tracking and no interest-based profiling.

You can withdraw any consent you have given at any time with effect for the future (in the App or in your device settings) and reset the advertising identifier in your device settings. If you purchase the ad-free version (section 3.5), you will no longer be shown any advertising, and the associated processing of advertising data no longer takes place.

4. Recipients and processors

To provide the App, we use carefully selected service providers that process personal data on our behalf (processing on behalf of a controller under Art. 28 GDPR), unless they act as independent controllers:

Your data is only passed on to other third parties if this is legally permitted or you have consented.

5. Transfers to third countries

The account and game data we store about you are currently processed by our service provider Supabase in a data center in the Republic of Korea (South Korea). In an adequacy decision under Art. 45 GDPR, the European Commission has determined that the Republic of Korea ensures a level of data protection that is adequate compared to the EU; transfers there are therefore permitted without additional safeguards. We plan to move the database to a data center within the European Union; this policy will be updated accordingly if this changes.

Some of the providers named in section 4 (in particular Apple, Google including AdMob, RevenueCat, OpenAI, Expo and Cloudflare) are companies based in the USA or process data there. Where personal data is transferred to a third country outside the EU/EEA in this context, this is done on the basis of appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the EU-U.S. Data Privacy Framework (where the respective provider is certified) and/or the Standard Contractual Clauses adopted by the European Commission.

6. Retention period

We store your personal data only for as long as is necessary for the purposes stated or for as long as your user account exists. If you delete your account (see section 7), the associated personal data will be deleted unless statutory retention obligations (e.g. obligations under commercial or tax law for purchases) prevent this. Security and log data are deleted or anonymized once the purpose no longer applies.

7. Deleting your account

You can delete your user account yourself at any time directly in the App (Settings → Account → “Delete account”). Deletion removes your personal data unless statutory retention obligations apply.

8. Your rights as a data subject

Under the GDPR, you have the following rights:

To exercise your rights, an informal message to the contact address given in section 1 is sufficient.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

You can also contact the supervisory authority at your habitual place of residence.

9. Children and young people

The App is aimed at a general audience and is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without the consent of their parents or legal guardians. If we become aware that such data has been transmitted to us without the required consent, we will delete it without delay. As the App is financed by advertising, we also instruct the advertising network not to treat ad requests as directed at children.

10. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Leaderboards and rankings serve exclusively to display your performance as part of the game.

11. Data security

We take appropriate technical and organizational measures to protect your data. Data transmitted between the App and our servers is encrypted (TLS). Access to stored data is restricted and secured by access rules.

12. Use of our website and waiting list

Our website stadtbild-quiz.com is hosted by Cloudflare (Cloudflare, Inc.). When you visit the website, technically necessary data (in particular your IP address as well as information about your browser and the time of access) are processed in order to deliver the page and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website). The website does not set any advertising or tracking cookies and does not use any analytics services.

On the website, you can voluntarily add your email address to a waiting list (“Tester werden” – “Become a tester”) to be informed about the launch of the App or about the opportunity to take part in testing. We process the email address you provide exclusively for this purpose. It is stored in our database at Supabase (see sections 4 and 5).

You can withdraw your consent at any time with effect for the future and request the deletion of your email address – an informal message to hassounahabibi92@googlemail.com is sufficient. We will delete the email address stored for the waiting list at the latest after the launch of the App or once the purpose of the waiting list no longer applies.

13. Changes to this privacy policy

We will update this privacy policy if our data processing changes or if legal requirements make this necessary. The current version is available in the App and at the address we provide. The version current at the time of your use applies.