Ovalings Sign in English Language

Privacy policy

Last updated: 18 October 2026. This policy applies to the Ovalings app and the website ovalings.app. It tells you which data we process, why, and what rights you have. If the German and English versions differ, the German version applies.

1. Controller

  • Luis Dominic Bodenbach, Vogelsbergstraße 27, 60316 Frankfurt am Main, Germany
  • Email: ovalings.support@proton.me
  • Contact form: in the app under Settings, Legal, Contact, and on the website

We are not required to appoint a data protection officer. You can reach us about any privacy question through the channels above.

2. Which data we process

  • Account: email address, password (only stored as an encrypted check value, never in plain text) and year of birth.
  • Profile: display name and friend code.
  • Game progress: diamonds, gold, energy and their bookings, eggs, Ovalings with their history, items, backdrops.
  • Playing together: friendships, marketplace offers, inbox messages.
  • Chat: your messages with room and time, whom you block, reports (who reported, the reported message, the reason), breaches of the rules in chat and for display names, and mutes (see section 18).
  • Leaderboard and events: your player level, the best Gene Score of your Ovalings, your highest stage per dungeon, your points, your group and your rank in events (see section 18).
  • Captcha: when you sign in, register, start as a guest or reset your password, a check result from Cloudflare Turnstile (see section 5).
  • Ovaling profiles: the three sentences in the profile and, for each AI call, your account ID, time, type of call, model, amount of text processed and cost (see section 7).
  • Reward videos: for each reward you collect, your account ID, the day, the place in the game, whether it came from a video or a monthly pass, Google's transaction ID and the reward (see section 9).
  • Purchases with real money: store (Apple or Google), receipt and order IDs, product, quantity, reference price, time, what was credited, for monthly passes the term and status of the subscription, for refunds the time, reason and what was taken back (see section 10). We do not receive payment data such as card numbers.
  • Parental approval (only under 18): the email address you enter for your parents, until they decide, then only the status, the monthly limit and the time of the decision (see section 10).
  • Contact form: your message, the topic, your email address and an encrypted check value of your IP address against spam.
  • Technical data: every connection to our server involves your IP address, the time and the request.
  • On your device: your sign-in (encrypted), your settings and cached images of your Ovalings.

We ourselves do not use analytics or tracking tools. Google's advertising SDK is built in for the reward videos, section 9 explains what it processes. The app does not access your location, contacts, photos, camera or microphone. When loading a video, Google's advertising SDK receives your device's IP address and may use it to estimate your approximate location (see section 9).

3. Purposes and legal bases

  • Account, game progress, friends, marketplace and inbox: so you can play Ovalings. The legal basis is the contract of use (Art. 6(1)(b) GDPR).
  • Year of birth: to enforce the minimum age of 16 and to lock purchases for players under 18 (Art. 6(1)(b) and (c) GDPR).
  • Confirmation emails and password reset emails: for your account (Art. 6(1)(b) GDPR).
  • Profiles: so every Ovaling gets its own description (Art. 6(1)(b) GDPR) and to limit the number of calls per account and day and the cost (Art. 6(1)(f) GDPR).
  • Reward videos: to credit the reward you choose exactly once and to keep the daily limits (Art. 6(1)(b) GDPR). For personalised ads and for Google storing information on your device we ask for your consent first (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
  • Purchases with real money: to verify purchases, credit them, run monthly passes and record refunds (Art. 6(1)(b) GDPR), and to keep receipts as long as tax and commercial law require (Art. 6(1)(c) GDPR).
  • Parental approval: to allow purchases by players under 18 only with their parents' consent and within their limit. A purchase by a minor only becomes effective once the parents approve it (Sections 107 and 108 German Civil Code). For your data the legal basis is the contract (Art. 6(1)(b) GDPR), for your parents' email address our and your legitimate interest in obtaining this approval (Art. 6(1)(f) GDPR).
  • Currency bookings and server logs: to detect fraud, abuse and errors and to run the game securely. The legal basis is our legitimate interest in a fair and secure game (Art. 6(1)(f) GDPR).
  • Contact form: to answer your request (Art. 6(1)(b) or (f) GDPR).
  • Chat, leaderboard and events: so you can write with others and compete with them (Art. 6(1)(b) GDPR). Checking messages, reports, mutes and blocking protect all players, especially young ones, and keep the tone friendly (Art. 6(1)(f) GDPR).
  • Captcha: to fend off automated sign-ups and abuse (Art. 6(1)(f) GDPR).
  • Deleting your account: to carry out your request (Art. 6(1)(c) GDPR together with Art. 17 GDPR).

4. Storage on your device

The app stores your sign-in, your settings (language, sound, appearance) and images of your Ovalings on your device. This is necessary for the app to work the way you want to use it (Section 25(2) no. 2 TDDDG). No consent is needed for this. If you delete the app, this data is gone. Section 9 explains what Google's advertising SDK stores on your device.

The website does not set cookies and uses no analytics or advertising services. If you choose a language on the website, your browser remembers this choice (local storage, key ovalings.lang) so the start page greets you in your language. This is necessary for the function you asked for (Section 25(2) no. 2 TDDDG). You can delete the entry in your browser at any time.

If you sign in on the website, your browser keeps the session (local storage, key ovalings.session) and images of your Ovalings (key ovalings.portraits), so you stay signed in and the images are not drawn again each time. This is also necessary for the function you asked for (Section 25(2) no. 2 TDDDG). When you sign out, the website deletes both entries. Signing in, registering and the settings of your account work on the website through the same servers as in the app (Supabase, section 5), it is the same account with the same data.

5. Recipients

  • Supabase: our server runs at Supabase (Supabase Pte. Ltd.), data centre in Frankfurt am Main, Germany. Supabase processes the data only on our behalf and according to our instructions (processing under Art. 28 GDPR).
  • Anthropic: writes the profiles (Anthropic, PBC, model Claude Haiku) on our behalf (Art. 28 GDPR, data processing agreement as part of Anthropic's commercial terms). Section 7 explains what we send there.
  • Google AdMob: shows the reward videos (Google Ireland Limited). Google is itself responsible for the data it processes in doing so (independent controller under Google's ads data protection terms, not on our behalf). Details in section 9.
  • Resend: sends the emails of Ovalings on our behalf (Art. 28 GDPR): account confirmation, password reset and the email to your parents when you are under 18 and ask for approval of purchases (section 10). For this Resend receives the recipient address and the content of the email. The data processing agreement is part of Resend's terms.
  • Other players: others can see your display name, your showcase, your backdrop and your marketplace offers. Only your friends can see your profile with your collection. Everyone in the same room sees your chat messages with your display name. The leaderboard shows your display name and your value if you are in the top 100, among friends always. In an event, the others in your group see your display name, your points and your rank. Everyone who looks at an Ovaling can see its profile. Nobody can see your email address. Anyone who knows the ID of an Ovaling can view it on ovalings.app: look, stats, level, attacks, passive and profile. Your account, your display name and the Ovaling's nickname never appear there.
  • Apple and Google: they distribute the app and handle in-app purchases. They are responsible for this themselves and their privacy policies apply. Our server checks every receipt with them to verify a purchase, and they notify us of renewals, cancellations and refunds. We only receive the information we need for this, no payment data.
  • Cloudflare: Cloudflare, Inc. delivers the website ovalings.app on our behalf (Art. 28 GDPR, data processing agreement as part of Cloudflare's terms). For every visit Cloudflare processes technically necessary data such as IP address, time, requested address and browser identifier to deliver the site and to fend off attacks. We do not analyse visits ourselves. When you sign in, register, start as a guest or reset your password, Cloudflare Turnstile checks in the app whether a human is making the request. For this Cloudflare processes your IP address and technical information about your device and browser, but sets no advertising or analytics cookies. We only receive the result of the check.
  • GitHub: an earlier address of the website with the legal texts can still be reached on GitHub Pages (GitHub, Inc.). GitHub stores the IP address of every visit for security purposes.

We do not sell data. For advertising we only pass on what section 9 describes.

6. Transfers outside the EU

Supabase is based in Singapore and uses service providers, including Amazon Web Services in the USA. Your game data is stored in Frankfurt, but access from these countries is possible, for example for maintenance and support. The safeguard is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can get a copy on request. GitHub transfers data to the USA on the basis of the adequacy decision for certified companies (EU-US Data Privacy Framework) and standard contractual clauses. Anthropic processes the information for the profiles in the USA, on the basis of the Standard Contractual Clauses. Resend processes the emails mainly in the USA, on the basis of the adequacy decision for certified companies (EU-US Data Privacy Framework) and the Standard Contractual Clauses. Google may transfer data to the USA, also on the basis of the EU-US Data Privacy Framework. Cloudflare may transfer data to the USA on the basis of the adequacy decision for certified companies (EU-US Data Privacy Framework) and the standard contractual clauses.

7. AI-written profiles

The three sentences in an Ovaling's profile are written by an AI: Claude Haiku by Anthropic. The call only goes through our server, never directly from the app. We only send information calculated from the Ovaling's ID: family, egg, rarity, epithet, appearance (body, eyes, skin, marking, brows, rare parts), the stats as a rough level, rank within its rarity, usefulness in fights, number of attack slots and the passive. For a translation, the finished English profile is added. Your name, your email address, the Ovaling's nickname or other information about you are not sent.

The AI decides nothing in the game. Stats, odds and loot are calculated by our code alone, the AI only writes the text. The profile is created when the owner looks at the Ovaling for the first time and is stored with the Ovaling. It stays as long as the Ovaling exists. To limit costs, we store which account triggered each call (see section 2), until you delete your account. After that only the time, model, amount and cost remain, without any link to you.

Anthropic does not use the information sent to train its models and deletes it after 30 days at the latest. Longer, up to two years, only if Anthropic's safety systems classify a call as a breach of its usage policies, or if the law requires it.

8. Viewing Ovalings on the website

If you enter the ID of an Ovaling on ovalings.app, your browser sends the ID and the chosen language to our server at Supabase in Frankfurt. The ID is part of the address after the # sign and is therefore not sent to Cloudflare. We do not store which IDs were viewed. To protect against mass requests the server stores a keyed hash of your IP address (HMAC, not reversible without the key) with a counter for at most 24 hours. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Supabase logs calls technically for troubleshooting and security, for at most 7 days.

9. Advertising

Ovalings only shows ad videos that you start voluntarily to get a reward, such as double loot after a fight, energy, diamonds or a spin of the lucky wheel. There are no ads between actions and no banners. Players with a monthly pass get the same rewards without a video.

The videos come from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Where required, for example in the EU, the app uses Google's consent form at start-up to ask whether Google may use data for personalised ads and store information on your device. You can change your choice at any time in the settings under "Ad privacy options". Without consent, Google only shows non-personalised ads or none. We only allow ads that are suitable for teenagers. You can consent to personalised advertising yourself from the age of 16 (Art. 8 GDPR), and you cannot play Ovalings if you are younger. On the iPhone the app does not ask for tracking across apps (App Tracking Transparency), so Google does not receive an advertising ID there.

What Google processes when loading and showing a video (such as device identifiers, IP address, information about the device and the ad) is decided by Google itself, and Google's privacy policy applies. When a video is loaded, we only pass Google your account ID and the place in the game, for double loot also the ID of the fight. After the video, Google tells our server that you have earned the reward. Our server checks the signature of this message and credits the reward exactly once per transaction. Section 2 lists what we store. These records stay until you delete your account.

10. Purchases with real money

Purchases go through Apple's App Store or Google Play. After a purchase, the app sends the receipt to our server. The server checks with Apple or Google whether the purchase is genuine and paid, and only then credits the content, exactly once per receipt. Apple and Google also notify us of renewals, cancellations and refunds.

If you get a refund, we take back the content of the purchase, at most until your balance reaches 0. If diamonds are missing because they were already spent, we note the shortfall. From the second such refund on, further purchases are locked until you settle the shortfall with diamonds.

If you are under 18, purchases are locked until your parents unlock them. To do this, you enter your parents' email address in the app. We send them an email through Resend with your display name and two links, one to approve with a monthly limit and one to decline or withdraw the approval later. We only store a check value of the links. We delete the address as soon as your parents have decided, at the latest after 7 days. After that we only store whether purchases are approved, the limit and the time.

Guest accounts cannot make purchases with real money.

11. How long we keep data

  • Account and game progress: until you delete your account. We then mark it for deletion for 30 days. During this time others no longer see you, and you can cancel the deletion by signing in. After that we delete everything that belongs to your account, including your messages sent through the contact form, and your account ID and nicknames are removed from the history of Ovalings you sold. Guest accounts are deleted right away. Ovalings, eggs and items you sold to others belong to them and stay with them, as do the profiles of those Ovalings.
  • Reward videos: until you delete your account.
  • Parents' email address: until they decide, at most 7 days. Resend keeps the email sent as long as our contract with Resend runs, and at most 90 days after it ends.
  • Information sent to Anthropic: kept there for at most 30 days (exceptions in section 7).
  • Contact form: until your request is resolved, then for at most one year.
  • Chat: messages 30 days. Breaches 30 days, mutes until 30 days after they end. Reports until we have handled them, then 30 days. Blocked accounts until you unblock them or delete your account.
  • Leaderboard and events: as long as your account exists.
  • Server logs: at most 7 days.
  • Counters against mass requests on the website: at most 24 hours.
  • Records of purchases: as long as tax and commercial law require (up to ten years). If you delete your account, they are kept without any link to your account.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw any consent at any time with effect for the future, your consent for ads directly in the settings. Otherwise just write to us through the contact form or by email.

You can also lodge a complaint with a data protection supervisory authority, for example in the country where you live (Art. 77 GDPR).

13. Children and young people

Ovalings is for players aged 16 and over. For players under 18, purchases with real money are locked until their parents unlock them (section 10). In-app purchases go through Apple and Google, where their family settings also apply.

14. Do you have to provide data?

For an account we need your email address, a password and your year of birth. Without them you cannot play Ovalings. Everything else is created while you play. Reward videos and purchases are voluntary.

15. Automated decisions

What an egg contains is decided by chance on our server, using the odds shown in the shop. This is not a decision about you as a person. The AI-written profile also only describes the Ovaling, not you. We do not create profiles about you.

16. Security

All connections are encrypted. Your sign-in is stored encrypted on your device. Values such as diamonds and Ovalings are only written by the server, and each account can only see its own data in the database. Rewards and purchases are only credited by the server, after the verified message from Google AdMob or after checking with Apple or Google.

17. Deleting your account

In the app: Settings, Account, Delete account. Without the app: use the contact form on the website with the topic Delete account. We will then delete your account with all its data, after a 30-day period in which you can change your mind (see section 11). A running monthly pass does not end at the store because of this. Cancel it beforehand in the App Store or on Google Play.

18. Chat, leaderboard and events

Chat is available from player level 10, not for guests. There are rooms per language and no private messages. Before saving, our server checks every message against a list of banned words and for phone numbers, without AI. We do not store rejected messages. We count breaches, and three in one day mute you for 24 hours. If a message sounds as if you yourself are not doing well, the app shows you helplines for your country. The app reads which country that is only on your device, from its settings.

You can report messages and block players. Whoever was reported does not learn who reported them. If three different accounts report the same message, it is hidden for everyone. Only we see reported messages, to decide whether the rules were broken.

Only signed-in accounts appear in the leaderboard and in events, no guests and no accounts marked for deletion. Section 11 says how long we keep this data.

19. Changes

If the app or the law changes, we will update this policy. The current version is always available in the app and on the website.