Legal
Privacy Policy
Little Witch: Monstergarden
This policy applies to the app Little Witch: Monstergarden for Android and iOS. The website aurax-interactive.de is covered by its separate website privacy policy.
1. Controller
AURAX Interactive, owner Benjamin Hakbilir, Hafenstraße 6, 26603 Aurich, Germany.
Email: benny@aurax-interactive.de
Phone: +49 4941 9806605
A data protection officer is not legally required and has not been appointed. Please send any request directly to the address above.
2. In short
You do not need an account to play and you do not have to register. We do not collect names, addresses or email addresses. Your save game stays on your device. Data leaves your device in four cases only: when you watch an optional rewarded video, when you buy something in the shop, when the app crashes, and — if you agree — for pseudonymous usage statistics that show us where the game is getting stuck.
3. Processing at a glance
| Data | Purpose | Recipient | Legal basis |
|---|---|---|---|
| Save game, settings, collection | Keeping your progress | nobody — stays on the device | Art. 6(1)(b) GDPR |
| Advertising ID, IP address, device identifiers, ad interaction | Serving and billing rewarded videos | Google (AdMob) | Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG |
| Anonymous user ID, purchase history | Unlocking and restoring purchases | RevenueCat, Google Play, App Store | Art. 6(1)(b) GDPR |
| App instance ID, device, OS, version, country, in-game events | Understanding where the game is getting stuck | Google (Firebase Analytics) | Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG |
| Crash log, device, OS, app version, installation identifier | Finding and fixing crashes | Google (Firebase Crashlytics) | Art. 6(1)(f) GDPR |
4. Save game and local storage
Your progress, your plant collection, unlocked music tracks, frames and all settings are stored exclusively on your own device (the app's local storage). This data is not transmitted to us or to any third party. It is deleted when you uninstall the app or use “Reset everything” inside the game.
5. Advertising (Google AdMob)
The app uses Google AdMob for optional rewarded videos. A video only plays if you start it yourself — for example to get extra moves or a heart. There are no banner ads and no interstitials between levels.
The following may be processed: your device's advertising identifier (Android Advertising ID or Apple IDFA), IP address, coarse location derived from the IP address, device identifiers and your interaction with the ad.
On first launch, Google's consent form (UMP) is shown where required under the GDPR and the German TDDDG. The legal basis for personalised advertising is your consent under Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG. You can withdraw it at any time — in the game under Settings, and through your device's advertising settings, where you can also reset or delete the advertising ID. Without consent, videos are served in non-personalised form only.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. More information: policies.google.com/privacy
6. App Tracking Transparency (iOS only)
On iPhone and iPad, the app asks you on first launch via the system App Tracking Transparency (ATT) dialog whether it may track your activity across other companies' apps and websites. The advertising identifier (IDFA) is only used for personalised advertising if you choose “Allow” there.
If you decline, you still get rewarded videos, but without personalisation and without the IDFA. You can change your choice at any time under Settings → Privacy & Security → Tracking. Independently of this, iOS provides the vendor identifier (IDFV), which is deleted once you remove all apps from this developer.
7. In-app purchases (RevenueCat)
In-app purchases are managed through RevenueCat, Inc., 1 Letterman Drive, San Francisco, CA 94129, USA. An anonymous, randomly generated user ID and your purchase history are processed. No real names and no payment data are processed.
The payment itself is handled by Google Play or the App Store. We do not receive any payment, account or credit card data, nor your Apple ID or Google account. The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract).
Privacy information: revenuecat.com/privacy
8. Usage statistics (Google Analytics for Firebase)
The app uses Google Analytics for Firebase to understand how the game is played — for instance which levels are abandoned often, or which features nobody finds. We only ever see aggregated figures, never individual people.
The following may be processed: a randomly generated app instance ID, device type and model, operating system and app version, language and country setting, coarse origin derived from the IP address, on iOS the vendor identifier (IDFV), and in-game events such as level start, level completion, play time and purchases.
The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG. Statistics only start once you have agreed in the consent form on first launch. You can withdraw your consent at any time with effect for the future, in the game under Settings; no further events are transmitted after that.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. More information: firebase.google.com/support/privacy
9. Crash reports (Firebase Crashlytics)
If the app crashes, Firebase Crashlytics creates a technical report so that we can find the fault and fix it in an update. The report contains nothing from your save game and no detail that would let us contact you.
The following may be processed: the technical state at the moment of the crash (stack trace), device type and model, operating system and app version, device state values such as free memory, battery level and screen orientation, the time of the crash, and a randomly generated Crashlytics installation identifier.
Unlike the usage statistics, this service is not tied to your consent: it works regardless of what you chose on first launch. The legal basis is our legitimate interest in a stable, crash-free app under Art. 6(1)(f) GDPR. You may object to this processing under Art. 21 GDPR; an email to the address given in section 1 is enough.
If you have consented to the usage statistics, the crash report may additionally contain a short trail of the last in-game events before the crash. Without your consent, that part is omitted.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. More information: firebase.google.com/support/privacy
10. What the app does not do
There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR. The app does not access contacts, photos, microphone, camera, calendar or precise location. It contains no push notifications, no social logins and no links to social media accounts. No data is sold.
11. Recipients and transfers to third countries
Recipients are Google (AdMob, Firebase Analytics and Firebase Crashlytics), RevenueCat, Inc. and Google or Apple as the operator of the respective store. Transfers to the USA may occur. They are based on standard contractual clauses under Art. 46 GDPR or on the European Commission's adequacy decision for the EU-US Data Privacy Framework, insofar as the provider participates in it. We do not sell data and do not pass it on for third parties' own purposes.
12. Retention
Local save games remain until you delete them or remove the app. Event data held in Firebase is deleted automatically after the retention period configured there. Crash reports are deleted by Google after the period set by Firebase Crashlytics. How long Google and RevenueCat store the data arising on their side beyond that is governed by their own privacy notices; we have no influence over this.
13. Children
The app is not directed at children under 13 and is not part of the App Store Kids Category. We do not knowingly collect personal data from children. If you believe we hold data from a child, please write to us — we will look into it and delete it.
14. Your rights
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interest — in our case the crash reports (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR)
An email to benny@aurax-interactive.de is enough; we reply within one month. As we do not operate accounts, we usually hold no data that can be linked to you — in that case we will tell you so and explain how to request the data from Google or RevenueCat.
The competent supervisory authority is Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
15. Changes to this policy
We update this policy whenever the services built into the app change. The current version is always available at this address. We announce material changes on the next app launch.
Last updated: 4 October 2026 · Applies to Little Witch: Monstergarden,
package name de.aurax.littlewitch