App & website

Privacy policy

Deutsche Fassung →

How Harmotwine and this website process information, and the choices available to you.

Last updated: 8 November 2026. Applies to the Harmotwine app (de.lnck.harmotwine) and this website.

Usage analyticsEmail supportRetentionYour rights

1. Controller

2. Progress and settings

The app stores progress, completed puzzles, sound sculptures, preferences, consent decisions and unlocks locally. This is necessary to provide the game and remember your choices (Article 6(1)(b) GDPR; necessary device storage under section 25(2)(2) German TDDDG).

The local save is separate from the optional usage and progress analytics described in section 5. We do not operate a game-save server or our own cloud sync. Operating-system backups depend on your device settings and provider. The app requires no separate account and does not request access to contacts, camera, microphone or precise device location.

3. Advertising and consent (Google AdMob / UMP)

The app uses Google AdMob for optional rewarded videos. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States may also process information.

At app launch, Google's User Messaging Platform checks consent status and presents a privacy form when required. This connects to Google and processes technical connection data such as IP address and app, device and consent information to manage and respect privacy choices. The legal basis is Article 6(1)(c) GDPR where legally required, otherwise Article 6(1)(f), our interest in operating the app lawfully. Necessary storage of the decision is based on section 25(2)(2) TDDDG.

The advertising SDK is initialized only when you choose to load a video and the consent check is complete. The app requests non-personalized ads. These can still process IP address and approximate region, device and app identifiers, technical device information, ad interactions, diagnostic and performance information to deliver and measure ads, diagnose problems and prevent fraud. Non-personalized does not mean no data is processed.

Where consent is required, the relevant processing and non-essential device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG. The Google form explains your options and participating providers. Change your choices in the app's advertising privacy settings. Withdrawal applies to future processing. The first 24 levels do not require rewarded videos; Pro provides an alternative for later unlocks.

Development and test versions may use test ads. Test ads and consent checks can also connect to Google and process data; test mode does not make these services offline. See Google's privacy policy and Google partner services information.

4. In-app purchases

Pro is a one-time purchase through Apple App Store or Google Play. The store processes payment and store account information. We do not receive full payment details. The app processes product and purchase or transaction identifiers, purchase status and entitlement to verify, unlock and restore purchases (Article 6(1)(b) GDPR). We do not operate a receipt server. Stores retain transaction data under their own legal obligations and retention policies. See Apple's privacy information and Google's privacy policy.

5. Optional usage analytics (Firebase / Google Analytics)

The app includes Google Analytics for Firebase, provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with processing also possible by Google LLC in the United States. We use it to understand puzzle difficulty, where players get stuck or leave, and which controls and features work well, so we can improve the game.

Your choice: usage analytics collection is off by default. The app asks for separate, voluntary consent before enabling it. You can choose “Play without analytics” and keep playing, including using Pro, without consenting. Advertising consent and an in-app purchase do not enable analytics. The legal basis is Article 6(1)(a) GDPR and, for non-essential storage or access on your device, section 25(1) TDDDG.

Information collected after consent:

• App opens, screens viewed, sessions, foreground/background changes and use of features such as sound sculptures.
• Puzzle and world identifiers, starts, completions and exits, restarts, pauses, active play time, periodic progress checkpoints, move/hint/undo counts, first successful resonance, replay status and interaction mode. A random identifier groups events belonging to one puzzle attempt.
• App/content versions and build type, plus SDK-generated information such as a pseudonymous app-instance identifier, event timestamps, device model, operating system, language and technical app information. The SDK may also collect automatic events, for example first opens, app updates and in-app purchase events where supported.
• Approximate geographic information derived from the IP address used to connect to Google. This does not require access to your device's precise location. Google states that for traffic from the EU, Switzerland or the UK it uses the IP address for geographic derivation and discards it before logging.

This information is pseudonymous, not anonymous: the app-instance identifier can link activity from the same installation. Our game events do not include your name, email address, raw touch coordinates, recordings, payment details or a copy of your saved game. The app does not set a personal account User-ID. Analytics advertising storage, ad user data and ad personalization are denied in the app's Firebase consent configuration. This analytics choice is separate from AdMob's processing in section 3.

Changing your mind: switch off “Analytics” in the app settings at any time. This stops further analytics collection; it does not automatically delete information already received by Google. The SDK may temporarily store events on the device for later delivery while collection is enabled. For retention and erasure requests, see sections 9 and 10.

Further information: Firebase privacy and security, Google's privacy policy, Google Analytics regional data handling and the Google Ads Data Processing Terms, which include Google Analytics.

6. Website and Cloudflare

Cloudflare Pages hosts this website. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes technical request data such as IP address, time, requested resource, HTTP status, browser/device details and referring page where available, to deliver and protect the website. This is based on Article 6(1)(f) GDPR, our legitimate interest in secure, reliable hosting.

We include no web analytics, advertising, remotely loaded fonts or social plugins. Our website code sets no cookies and stores no browser data. Hosting security measures may require additional processing in individual cases. See Cloudflare's privacy policy.

7. Email support

When you email us, we process your email address, message and any voluntarily supplied information to respond. The legal basis is Article 6(1)(b) GDPR for contract-related requests, otherwise Article 6(1)(f), our interest in answering enquiries. Privacy-rights requests rely on Article 6(1)(c). Incoming mail to support@harmotwine.app is forwarded through Cloudflare Email Routing (Cloudflare, Inc.; address in section 6) to our Google Gmail mailbox (Google Ireland Limited; address in section 5). These providers process sender/recipient addresses, message content, attachments and technical delivery/security information to route, protect, deliver and store correspondence. See Cloudflare’s privacy policy and Google’s privacy policy. Please do not send passwords or full payment details.

8. Recipients and international processing

Depending on the feature used, recipients include Cloudflare for hosting and email routing, Google for consent management, ads, optional analytics and Gmail correspondence, Apple or Google for purchases, and Discord when you join the community (section 12). We do not sell your data. Disclosure may also be necessary to meet legal duties.

These services may process data outside the EU/EEA, including in the US. Cloudflare explains transfer safeguards and EU standard contractual clauses in its Data Processing Addendum. Google explains its transfer frameworks. Where applicable to the recipient, safeguards include adequacy decisions such as the EU-US Data Privacy Framework or standard contractual clauses. Contact us for information about safeguards.

9. Retention and deletion

Google Analytics is configured with a 14-month retention period for detailed analytics data. For user identifiers, new activity may restart this period. Expired data is deleted through Google’s monthly deletion process. This setting does not apply to standard aggregated reports, which may remain available for longer. See Google Analytics retention information. Withdrawing consent stops further collection but does not itself erase previously collected data; you can contact us about erasure under section 10.

Local progress and settings remain until you delete app data or remove the app together with its data. Backups may retain copies that must be managed separately. We cannot remotely delete your local progress.

Support correspondence is retained for as long as needed to resolve and document your request, unless legal retention duties or the establishment or defence of claims require longer storage; it is then deleted. Technical hosting data and information held by Google or the stores follow the respective service-specific retention criteria for operations, security, consent records or legal duties described in the linked policies. Uninstalling the app does not automatically erase information already held by these providers.

10. Your rights

Subject to GDPR requirements, you have rights of access, rectification, erasure, restriction and portability. You may withdraw consent for future processing. You may object to legitimate-interest processing on grounds relating to your particular situation (Article 21 GDPR), and object to direct marketing at any time.

Contact support@harmotwine.app and describe the relevant interaction. We request only information necessary to locate the data and, when needed, verify identity. Without an account, we cannot associate local game data with you. You may complain to a supervisory authority, including where you live. Our competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA).

11. Voluntary provision and updates

We do not use automated decision-making with legal or similarly significant effects. No personal profile or account is needed to play. Contact details are required only if you want a response; necessary technical data is processed when you use the relevant online services. We update this policy when features or services change.

12. Optional Discord community

The website links to our Discord community without embedding Discord content. Joining is optional. For platform processing, including accounts, technical data, international transfers and retention, see Discord’s privacy policy. Discord Netherlands BV is the platform controller for EEA users.

As server operator, we use your visible profile, posts, reactions and moderation information to respond to feedback, provide community help and keep the space safe (Article 6(1)(f) GDPR: our legitimate interest in community communication and moderation). Contract-related support relies on Article 6(1)(b). Posts in community channels are visible to other members; anyone with the public invitation can join. Do not post private purchase or payment information.

Posts remain available for ongoing discussions until removed. We retain moderation information only as needed to enforce rules or resolve disputes, subject to legal duties. You can delete your own messages or contact us about data we control. Leaving the server does not automatically delete posts. Email support is available without Discord.