Skip to content

Untold Mysteries Privacy Policy

Last updated: May 3, 2026

1. Introduction and Overview

We are delighted that you are using our app, "Untold Mysteries." Protecting your personal data is an important concern for us. In this privacy policy, we inform you about what data we collect, how we use it, and what rights you have.

Our app was developed according to the principle of data minimization ("Privacy by Design"). We do not use advertising networks. However, for technical stability and continuous app improvement, we use selected third-party services (in particular Firebase Crashlytics, Firebase Analytics, and Apple Game Center / Google Play Games Services).

2. Data Controller

The data controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Benjamin Seeger and Maximilian Rosnauer GbR
Address:
Beinsteinerstraße 40
71394 Kernen im Remstal
Germany

Contact:
Email: info@stagworks.de
Phone: +49 174 7696867

3. General Data Processing & Hosting

3.1 Downloading the App
When downloading the app, the necessary information is transferred to the respective App Store (e.g., Apple App Store or Google Play). We have no influence over this data collection and are not responsible for it.

3.2 Backend Hosting (Oracle Cloud)
Our backend server and the associated databases are hosted by the cloud provider Oracle Cloud. Oracle provides the technical infrastructure (storage space and computing power) required for our app and the game to function.

All data sent to our backend (including IP addresses and game data) is processed on Oracle's servers. We have concluded a Data Processing Agreement (DPA) with Oracle in accordance with Art. 28 GDPR. In this agreement, Oracle commits to processing our users' data only according to our instructions and to complying with data protection regulations.

  • Server Location: Data Center Frankfurt am Main, Germany / EU. Since Oracle is a US-based company, a data transfer to the US cannot be entirely ruled out. However, Oracle is certified under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of data protection.
  • Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) in the secure and efficient provision of our app infrastructure.

3.3 Server Log Files and IP Addresses
When using the app and communicating with our servers, it is technically necessary for your device to transmit certain data to us. This includes, in particular, your IP address. This data is temporarily stored in the server's log files to ensure the stability and security of the server infrastructure.

  • Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) in the technical provision and security of the app.

3.4 Use of Firebase (Crashlytics and Analytics)
On iOS and Android devices, our app uses Firebase services provided by Google Ireland Limited (Google Building Gordon House, Barrow Street, Dublin 4, Ireland):

  • Firebase Crashlytics: Collects crash reports and technical diagnostic data (e.g., stack traces, app/device information, and technical log messages) so we can analyze issues and improve app stability.
  • Firebase Analytics: Collects in-app usage events (e.g., successful signup, game creation/join, and game completion including story ID and player count) so we can better understand usage patterns and improve the app.

Firebase Analytics is initially disabled in our app and is only enabled after consent is granted during onboarding. Firebase Crashlytics is used to ensure technical stability.

Data may be processed within Google's global infrastructure; processing outside the EU/EEA (in particular in the USA) cannot be fully excluded. Google provides appropriate safeguards (in particular Standard Contractual Clauses).

  • Legal Basis: For Crashlytics, legitimate interest (Art. 6(1)(f) GDPR) in app stability and security; for Analytics, your consent (Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG).

3.5 Platform Services for Achievements and Leaderboards (Apple Game Center / Google Play Games)
On iOS/Android, the app uses platform-specific game services (Apple Game Center and Google Play Games Services) to provide achievements and leaderboard features. In this context, player identifiers/profile names, scores, and achievement progress may be processed.

Apple and Google are independently responsible for data processing within these platform services. The respective provider privacy policies apply.

  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR) for requested game features and legitimate interest (Art. 6(1)(f) GDPR) in a consistent cross-platform player experience.

3.6 Integration of External Content (TheMealDB)
To provide you with specific content within the app (such as images of meals or recipes) in an appealing way, we load some of this content directly from the external database "TheMealDB" (themealdb.com).

When these images are loaded, the app establishes a direct connection to TheMealDB's servers. For technical reasons, your IP address is transmitted to these servers so that the image files can be sent to your device.

  • Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) in a functional and visually appealing design of our app. The European Commission has issued an adequacy decision for the United Kingdom, confirming a level of data protection comparable to that of the EU.

3.7 Data Security
Data transmission between your app and our servers is always encrypted (e.g., via TLS/HTTPS/WSS).

4. What Data We Process and Why

To provide you with the core functions of the game, we process the following personal data:

4.1 Profile and Authentication Data
When you register or log in to the app, we collect:

  • Username / Nickname
  • Gender
  • A secure token (JSON Web Token - JWT) is generated and stored on your device to identify your session.
  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).

4.2 Game Data and App Usage
To synchronize your game progress and enable multiplayer functionality, we process the following on our servers:

  • Current Game IDs, joined games, and assigned character roles and nicknames.
  • Your voting decisions ("Votes") in the game.
  • Shared hints within the same lobby ("Hint Sharing").
  • Game progress (played stories, collected points, unlocked achievements).
  • Leaderboard and statistics data (e.g., points, rank, number of games played, correct guesses, and, where available, country code from device locale settings).
  • Story ratings (1-5 stars) and optional review text.
  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).

4.3 Local Storage on Your Device
Certain data is stored exclusively locally in a database (Realm DB) on your device and is not transmitted to our servers. This includes:

  • Offline save games.
  • In-game notes that you create for characters.
  • Consent status (e.g., confirmation of the Terms of Service and Privacy Policy).
  • Local app settings (e.g., language).
  • Profile Picture: If you set a profile picture, it is stored exclusively locally on your device. The image is not transferred to our servers.

4.4 Visibility to Other Players (Multiplayer Functions)
Since "Untold Mysteries" is a collaborative game, it is essential for the game mechanics that certain data is shared with other players.

When you create or join a game, your chosen username, assigned character role, and game-related actions (e.g., voting decisions or shared hints) are visible to the other participants in the same game session ("Lobby").

Additionally, leaderboard features (depending on availability, global or country-based) may show your player name, score, rank, and, where applicable, country code to other users. There is no further publication of your profile to uninvolved third parties.

  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR), as this visibility constitutes the core of the multiplayer gaming experience.

4.5 Contacting Us (Feedback and Bug Reports)
In our app, we offer you the opportunity to contact us via the "Report a Bug" or "Send Feedback" buttons. When you use these features, the app transfers your request to the default email app on your device.

When you send the email to us, we process the personal data you provide (e.g., your email address, your name if applicable, and the content of your message). We process and store this data exclusively for the purpose of handling your request, troubleshooting (bug tracking), and improving our app. This data is not shared with third parties.

  • Legal Basis: Legitimate interest (Art. 6 (1) (f) GDPR) in answering user inquiries and the technical and content-related optimization of our app. If the contact relates to a specific support request regarding your user account, the performance of a contract (Art. 6 (1) (b) GDPR) also serves as the legal basis.

4.6 Obligation to Provide Certain Data
To use essential app functions (account, multiplayer, synchronization), the provision of certain data is required, in particular username, gender, and technical session data. Without this data, no user account can be created and the service cannot be fully provided.

4.7 No Automated Decision-Making
No solely automated decision-making, including profiling pursuant to Art. 22 GDPR, takes place.

5. Required Device Permissions

To use the app's features, the app must access certain functions on your device:

  • Internet Access: Strictly required for communication with our game server (synchronization, multiplayer functions, downloading story images).
  • Camera / Photo Gallery: This permission is only requested if you wish to set a local profile picture. The image is not uploaded to the internet.

6. Data Sharing with Third Parties / System Functions

The app uses native system functions (via OS share dialogs or app handoff mechanisms), for example to share invitation links for games via WhatsApp, messenger apps, email, or SMS, or to open external websites (such as legal texts) in the browser. In doing so, the app transfers the content you selected (e.g., an invitation link including game code or story ID) to your device's operating system and the target app you choose. A transfer only occurs when you actively trigger this action.

6.1 Links to External Websites and Services (e.g., YouTube)
Our app contains links to external websites and platforms, such as YouTube. When you click on such a link, you leave our app and are redirected to the respective third-party provider. We have no influence over what data is collected there and how these platforms handle your data. The respective operator (e.g., Google Ireland Limited for YouTube) is solely responsible for data processing on the linked platforms. The privacy policy of the respective provider applies.

7. Your Rights as a Data Subject

Under the GDPR, you have comprehensive rights, which we have integrated directly into the app:

  • Right of Access (Art. 15 GDPR): You have the right to receive information about your data processed by us. We have provided an export function in the app for this purpose. You can download a machine-readable JSON file at any time, which summarizes all data stored locally on your device and on the server (cleared of sensitive security tokens).
  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You can delete your account and all associated data at any time. Using the account deletion function in the app sends a request to our server, which deletes all data relating to your profile on the server. At the same time, all local app data (Realm database) on your device is irrevocably deleted.
  • Other Rights: You also have the right to rectification (Art. 16 GDPR), the right to restriction of processing (Art. 18 GDPR), and the right to data portability (Art. 20 GDPR).
  • Right to Withdraw Consent (Art. 7(3) GDPR): Where we rely on your consent for processing (e.g., Analytics), you may withdraw that consent with effect for the future (e.g., by contacting us or as part of account deletion).
  • Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

8. Data Retention

We store your personal data only for as long as necessary to provide the app and the game, or until you actively delete your account. Upon triggering the deletion function in the app (see Section 7), your personal data on our servers and local app data on your device are removed. Exceptions are server log files (see Section 3.3), which are automatically deleted after a maximum of 14 days to ensure security. Data you transmit to us by email contact (e.g., via "Report a Bug" or "Send Feedback") will be deleted as soon as the respective conversation has ended and your request has been conclusively resolved, unless statutory retention obligations prevent deletion.

For data processed in third-party services (in particular Firebase Crashlytics/Firebase Analytics and Apple Game Center/Google Play Games), the providers' own retention and deletion periods also apply.

9. US-Specific Privacy Disclosures

9.1 California Privacy Rights (CCPA/CPRA)
We do not "sell" or "share" your personal information for cross-context behavioral advertising, as those terms are defined under California law. We only collect the minimal data necessary to provide the game functionality. You have the right to request access to and deletion of your data via the in-app tools described in Section 7.

9.2 Children's Privacy (COPPA)
Our app is not intended for children under the age of 13. We do not knowingly collect personal data from children under this age. If you believe we have inadvertently collected such data, please contact us so we can delete it immediately.

9.3 "Do Not Track" Signals
Because we do not track you across third-party websites or use advertising trackers, we do not respond differently to "Do Not Track" (DNT) browser/device signals.

10. Changes to the Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The current version can always be found within the app.

← Back to Home