Privacy

This is a translation. The German version is legally binding.

1. Who is responsible

This policy covers the website knirtgames.de and the app “Knirt” by KnirtGames (Android, Google Play).

2. In short

• The website sets no cookies, counts no visitors and loads nothing from third-party servers.
• The app has no user account and no ads. Player names and profile pictures stay on your phone.
• Usage statistics and crash reports only happen if you agree – and you can switch them off at any time.

3. Website

Hosting and delivery

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data: IP address, time, page requested, browser and operating system. This keeps delivery secure and fast and fends off attacks (Art. 6(1)(f) GDPR). The connection is encrypted with TLS (https). Cloudflare keeps this data only as long as needed for delivery and to fend off attacks; Cloudflare does not state a fixed period. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework, with the EU standard contractual clauses as a fallback.

No cookies, no analytics, no third-party fonts

The website uses no cookies and no analytics or marketing services. Fonts and images are served from our own server.

Your browser alone remembers three settings in local storage: whether you turned off the “Knirt cameos” at the bottom of the page (“knirt-auftritte”), whether you read the blog in light or dark mode (“knirt-thema”) and whether you dismissed the hint about the other language (“knirt-sprache-hinweis”). These entries contain no identifier and are never sent to us or anyone else; you can delete them in your browser settings.

Contact by email

If you email us, we process your address and message to reply (Art. 6(1)(b) or (f) GDPR). Emails to knirtgames.de addresses are forwarded via Cloudflare Email Routing to our mailbox at Microsoft (Outlook.com). We delete your email once your request is dealt with. We keep it longer only where tax or commercial law requires it (usually up to six years).

Our profiles on Instagram, TikTok and YouTube

At the bottom of the page we link to our profiles on Instagram, TikTok and YouTube (@knirtgames on each). These are plain links: nothing is sent to these platforms unless you click.

If you visit our profiles there, the providers process your data under their own responsibility and their own privacy policies. They often set cookies, also use the data for advertising and in part transfer it to countries outside the EU, such as the USA. Meta and Google are certified for this under the EU-US Data Privacy Framework. TikTok also stores data in Malaysia and Singapore and relies on adequacy decisions of the European Commission and on the EU standard contractual clauses. The providers are Meta Platforms Ireland Limited (Instagram, Merrion Road, Dublin 4, D04 X2K5, Ireland), TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) and Google Ireland Limited (YouTube, Gordon House, Barrow Street, Dublin 4, Ireland). We use the profiles to present KnirtGames and to stay in touch with you (Art. 6(1)(f) GDPR).

The platforms show us aggregated statistics about our profiles, for example how often a video was watched. For these statistics we are jointly responsible with the provider on Instagram and TikTok (Art. 26 GDPR). Meta and TikTok provide the agreements on this; under them the provider mainly takes care of your rights. You can exercise them with the provider or with us. If you send us a message or comment there, we use it only to reply.

4. Knirt app

Download and purchases via Google Play

You get the app from Google Play (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes data under its own responsibility, e.g. for the download, Android crash statistics and payments. In-app purchases use Google Play Billing.

Unlocking purchases (RevenueCat)

To keep purchased games unlocked, we verify purchases via RevenueCat (RevenueCat, Inc., USA). This involves purchase receipts, a random app user ID and the products bought. The legal basis is performance of the purchase contract (Art. 6(1)(b) GDPR). For transfers to the USA, the EU standard contractual clauses apply (Art. 46(2)(c) GDPR), as agreed in RevenueCat’s data processing agreement.

Statistics and crash reports (PostHog) – only with your consent

On first launch the app asks whether it may send anonymous usage statistics. Only if you agree does it send to PostHog (PostHog Inc., processing on servers in the EU), for example: “round started/finished/abandoned”, “mini-game started”, “purchase page viewed”, “purchase”, plus crash reports. This includes a random identifier, device type, operating system and app version. PostHog briefly derives the approximate country and city from the IP address; the IP address itself is then discarded and not stored. Names and card contents are never transmitted.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the app under Settings → “Statistics”; after that nothing is sent. The data is held at PostHog Cloud EU (servers in Frankfurt) and stored there for one year. While statistics are switched on, you can see your statistics ID in the app under Settings. Send it to us if you want us to delete your data. Without it we cannot tell which data belongs to you.

What stays on your phone

Player names, profile pictures and drawings, game statistics, settings and the “18+” confirmation are stored only on your device. We never receive this data.

Permissions

• Camera and photos: only when you take or pick a profile picture. The picture stays on the device.
• Notifications: reminders (e.g. on Friday evening) if you allow them. They are scheduled on the device; there is no push server.
• Motion sensor: in the Forehead Guess mini-game, to detect tilting the phone. On the device only.

Rating and sharing

When the app asks for a rating, it uses Google Play’s rating dialog. If you share a “party recap”, the image goes through your phone’s share menu to the app you choose.

What doesn’t exist

No user account, no ads or advertising IDs, no access to your location, microphone or contacts.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just send us an email.

Right to object: Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You don’t have to give us any data: the website and the app work without emailing us and without agreeing to statistics. We make no automated decisions about you and do no profiling (Art. 22 GDPR).

You can also lodge a complaint with a data protection authority. Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf (www.ldi.nrw.de).

Last updated: 10 October 2026