Per-game privacy notices
Separate notices cover the mobile and web versions of each game:
1. Controller
c/o COCENTER
Koppoldstr. 1
86551 Aichach
Germany
Email: akandogames@gmail.com
Akando Games is the games brand of Akando Studio.
2. Hosting and DNS
This website, its API, and its database run on a server supplied by Hetzner Online GmbH within the European Union. The domain also uses Hetzner DNS. A request necessarily processes connection data such as the IP address, time, requested resource, and browser information to deliver the site and defend it against attacks. Processing is based on Art. 6(1)(f) GDPR and the legitimate interest in stable and secure operation. General access logging is not enabled; firewall and security logs are limited to what is operationally necessary.
3. No cookies, no advertising, no tracking
This site sets no cookies, uses no advertising or tracking services, and loads nothing from third-party servers. Fonts, images, and scripts all come from akandogames.com. There is no cookie banner because there is nothing to consent to.
4. Game usage statistics
So we can see how much the games are played, web builds and explicitly enabled Android builds send sparse usage signals to our own API. What is recorded is the game, a random session key generated by the server, start and duration, platform, device class, display language, and build number. Web games may additionally report limited technical game events; Tenweave on Android reports coarse level results and loading diagnostics only with a separate gameplay-diagnostics opt-in; individual tile selections are never sent.
The session key is not persistently stored on the device and cannot link visits, games, or devices. No account, installation, advertising, or device identifier, device model, or location is sent. The IP address is necessarily processed for transmission and briefly in memory for abuse rate limiting, but is not stored with the session. The legal basis for this connection data and web statistics is Art. 6(1)(f) GDPR (our interest in secure operation and improving our own games). Web telemetry stores or reads no telemetry identifier on the device, so it requires no additional consent under §25 TDDDG.
Android telemetry is off by default. A one-time dismissible dialog appears when continuing after the first completed level; either choice continues play. Reporting can also be enabled in Settings. Session-only reporting and gameplay diagnostics are separate choices; older session-only consent never enables the latter. No analytics choice is required to start or continue playing. Its legal basis is consent under Art. 6(1)(a) GDPR, which can be withdrawn in the game Settings at any time for future processing. Raw records are folded into per-game daily totals after 90 days and then deleted. If a browser reports Do Not Track or Global Privacy Control, the web game sends nothing.
5. Web games and local storage
The web builds keep progress and settings locally in the browser. That data stays on the device, is never uploaded, and can be erased through the browser’s site-data settings. Loading a game creates the same technically necessary server connection data as any other page request.
6. Beta registrations
Registration uses a double opt-in. When the form is submitted we first store only a pending registration containing the normalised email address, the selected games, the time, the version of this policy, and a hashed confirmation token. A pending registration is valid for 24 hours and is then deleted automatically. Your address is added to the beta list only when you follow the confirmation link sent to it. Without confirmation it is not kept — which means nobody can register an address they do not control.
After confirmation we store the normalised email address, selected games, subscription timestamps, consent timestamp, and policy version. The purpose is to manage and send beta invitations. Processing is based on consent under Art. 6(1)(a) GDPR. Registration is voluntary. Data remains until consent is withdrawn or until the relevant beta and a reasonable follow-up period have ended.
7. Withdrawal and erasure
The removal form can remove one game subscription or the complete email record. To prevent unauthorised deletion we send a single-use confirmation link valid for 60 minutes. Only a hash of the token is stored.
8. Email through Gmail
Registration confirmations, removal confirmations, and later beta messages are sent through akandogames@gmail.com. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes the recipient address, message content, and technical delivery data. Processing in third countries cannot be ruled out. The legal basis is Art. 6(1)(a) GDPR for beta messages and Art. 6(1)(f) GDPR for securely confirming a requested registration or deletion.
9. Support email
If you contact us, we process the sender address, content, and technical metadata to handle the request. The legal basis is Art. 6(1)(b) or (f) GDPR depending on the request. Correspondence is deleted when no longer needed and when no statutory retention duty applies.
10. Administration area
The game catalogue and usage statistics are maintained in Akando Studio's password-protected administration area. Access is restricted to authorised administration accounts. It processes no personal data about visitors to the public site beyond what the sections above already describe.
11. Recipients
Recipients of technically necessary data may include Hetzner Online GmbH for hosting and DNS and Google Ireland Limited for email delivery. Data is not sold or used for personalised advertising.
12. Rights and complaints
Subject to the GDPR, rights include access, rectification, erasure, restriction, portability, and objection. Consent may be withdrawn at any time for future processing. Complaints may be made to the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany.
13. Changes
This notice is updated when features, providers, or legal requirements change.