Privacy Policy
Version of 25 September 2026.
This English version is a convenience translation. In case of any discrepancy, the German version prevails.
1. Controller
Moritz Grillnberger, Austria
Email: support@infinidrop.app
2. What this is about
INFINIDROP is an online game. So that your game progress is saved across devices and you can play with others (guilds, arena, chat), we process personal data. Here you can find out which data that is, what we need it for, how long we keep it and what rights you have.
INFINIDROP is intended for persons aged 16 and over. We do not knowingly process data of persons under 16. If you believe that someone under 16 has created an account, write to us at support@infinidrop.app so that we can delete it.
3. Which data we process
3.1 Game account (anonymous)
On first launch, an anonymous game account is created automatically: a random account ID, your freely chosen player name (unique worldwide), your chosen profile picture (an in-game avatar, not a photo), technical session data and a random device ID generated by the game that binds your game progress to your device (not a hardware or advertising ID). Legal basis: Art. 6(1)(b) GDPR.
3.2 Game progress and game activity
To run the game, we store your game progress (including level, stage, currencies, equipment, companions, titles, achievements, arena points/league, guild membership, season results, last activity). Parts of it are visible to others as a public game profile — that is at the core of an online game with leaderboards. Members of your guild and your friends can also see whether you are online or when you were last active. Legal basis: Art. 6(1)(b) GDPR.
3.3 Chat messages
Messages in the guild chat are stored and shown to the members of your guild; only the 50 most recent messages are kept per guild, older ones are deleted automatically. There is an automatic word filter and a reporting function. If you report a message, we store the reason, the wording of the reported message and the accounts involved until the review has been completed. Legal bases: Art. 6(1)(b) and (f) GDPR (moderation, a safe gaming environment).
3.4 Fair play / anti-cheat
Our servers automatically check game progress for technically impossible values. Suspicious accounts may be flagged, excluded from public lists or, in the case of serious violations, banned. You are informed about a flag in the game and can appeal; bans are decided by a human. Legal basis: Art. 6(1)(f) GDPR (game integrity, fraud prevention).
3.5 Bug reports
If you report a bug in the game, we transmit your message, the category and technical information about the game state (e.g. version, level). After an account has been deleted, bug reports are kept without any link to the account. Legal basis: Art. 6(1)(f) GDPR (product improvement).
3.6 Local storage and technical access data
The game additionally stores your game progress, settings and login token locally on your device — technically necessary, not transmitted to third parties; the game is excluded from Android system backups. This website does not set cookies and does not load external fonts or trackers.
When you visit this website (host: Cloudflare) and when you use the game's online services (Supabase), technical access data is generated — IP address, time and browser or app client — which is processed briefly for delivery, security and troubleshooting (Art. 6(1)(f) GDPR).
3.7 Rewarded ads (Google AdMob)
In the game, you can voluntarily watch ad videos to receive bonus rewards. Before ads are shown, you are asked for your consent to personalised advertising (Google consent prompt, which you can withdraw at any time in the app settings under “Privacy settings (ads)”; Art. 6(1)(a) GDPR). In doing so, Google processes your device's advertising ID, an approximate location derived from the IP address as well as usage and diagnostic data of the ads (e.g. views, taps, loading times); details can be found in Google's privacy policy.
Without your consent, no ad videos are loaded — and therefore there is no bonus reward from them either. On iPhone and iPad, the operating system additionally asks you (App Tracking Transparency) whether ads may be personalised across devices; your game data is not affected by this. So that a reward is only credited after a video has been watched in full, the game transmits your account ID to Google for confirmation (no other profile data).
3.8 Linking your account with Google or Apple
You can voluntarily link your game account with a Google or Apple account; in doing so, we receive the account ID and email address as well as — where the provider sends them — the name stored there and, with Google, the address of your profile picture; both are stored with the sign-in but are not used in the game (Art. 6(1)(b) and (f) GDPR — protection against multiple accounts).
Confirmation email: After you link your account for the first time, we send you one confirmation email to the address provided and verified by Google or Apple. It confirms the link, explains how to restore your game progress on another device and names the way to have your data deleted as well as our support contact. The email contains no advertising, and we do not send any further emails of this kind. So that it arrives in your language, we store the language selected in the game (language code) in your profile. We do not additionally store your email address for this; we only note that and when the confirmation was sent. Sending is handled by Cloudflare as a processor; if you use Apple's “Hide My Email”, delivery runs via Apple's relay service (Art. 6(1)(b) GDPR).
3.9 In-app purchases
Purchases are processed via Google Play or the Apple App Store — we do not receive any payment data, only product and order IDs, the subscription status (such as renewal, expiry, refund) and the cumulative purchase value of your account, via our service provider RevenueCat (Art. 6(1)(b), (c) and (f) GDPR).
3.10 Push notifications
You only receive notifications if you switch them on in the game's settings (default: off). Your device then generates a pseudonymous push ID (token), which we store in your account (Supabase, EU) and via which Google Firebase Cloud Messaging delivers the message — on Apple devices, delivery additionally runs via Apple's push service (APNs). We use Firebase only for delivery; its analytics features are switched off. We only send game events and notices about INFINIDROP (e.g. a lucky hour, a chest ready to open), no third-party advertising. If you switch notifications off, we delete the ID immediately; it is also deleted together with your account. Legal basis: Art. 6(1)(a) GDPR (consent, which you can withdraw at any time).
3.11 Friends and invitations
You have a personal invite code. If someone redeems it, we store the connection between your accounts (inviter, invitee, status) in order to pay out the invitation reward once. We store friend requests and friend lists so that you can find each other; friends see your name, avatar, level and online status. Declined requests remain stored in hidden form for 7 days and are not recognisable to the other side. Legal basis: Art. 6(1)(b) GDPR.
4. Where your data is stored
Our game database runs at Supabase on servers in the European Union; a data processing agreement (Art. 28 GDPR) is in place with Supabase.
5. Recipients
| Service | Purpose | Note |
|---|---|---|
| Supabase | Database, login, server logic | EU hosting, data processing agreement |
| Google Play | App distribution, purchase processing, sign-in with Google | Google's own privacy policy |
| Apple App Store | App distribution, purchase processing, sign-in with Apple, push delivery (APNs) | Apple's own privacy policy |
| RevenueCat | Purchase receipt validation | USA — EU standard contractual clauses |
| Google AdMob | Rewarded ads | only with consent, on iOS additionally with the system tracking prompt; Google's own privacy policy |
| Google Firebase (Cloud Messaging) | Delivery of push notifications (3.10) | only after opt-in; Google's own privacy policy |
| Cloudflare | Hosting of this website, email forwarding, sending the confirmation email (3.8) | EU standard contractual clauses / Data Privacy Framework |
| Google (Gmail) | Mailbox for support requests to support@infinidrop.app | Google's own privacy policy |
6. Retention periods and account deletion
- Game progress and profile: as long as your account exists.
- You can delete your account at any time directly in the game (Settings → Delete account): deactivated and restorable for 90 days, then permanently deleted. Immediate permanent deletion on request via support.
- Anonymous, unlinked accounts without significant progress (stage 5 or below, no rebirth) and without purchases are deleted automatically after 90 days of inactivity.
- Guild chat: only the 50 most recent messages per guild. After an account has been deleted, your chat messages and bug reports are kept without any link to the account (anonymised).
- Push ID: until you switch notifications off or your account is deleted.
- Friend and invitation data, fair-play monitoring data and the record of the confirmation email: until the account is deleted (invitations you issued remain with the invitee afterwards, without any link to you). Tower log: 90 days.
- Purchase records: kept after the account has been deleted, without any link to the account, for the statutory tax retention period of 7 years (§ 132 of the Austrian Federal Fiscal Code, BAO).
- Backups: daily backups of the game database exist and are overwritten after 7 days.
7. Your rights
Access, rectification, erasure, restriction, data portability, objection (Art. 15–21 GDPR) and withdrawal of any consent given at any time — simply write to support@infinidrop.app. Complaints: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
8. Changes
We adapt this policy when the game or the services change (e.g. when new features are activated); you can always find the current version on this page.