Last updated: October 13, 2026
The responsible party according to Art. 4(7) General Data Protection Regulation (GDPR) is:
Keitgen GmbHOur legal notice (Impressum) required by German law can be found here: Impressum
Certain information gets collected automatically as soon as you use this app. The following gives you an overview of what type of information is being collected.
When you download the app from the Apple App Store or Google Play, your user data is transmitted to the store to validate your purchase. This data can include but is not limited to your e-mail address, your payment information, and details about the device used to make the purchase. This data gets exclusively collected and processed on the servers of the store and we have no control over this data, nor can we view it.
The app sends anonymous usage statistics and crash reports to our own server analytics.keitgen.de (Countly, self-hosted, in Frankfurt, Germany). Usage statistics show how the app is used, for example games started and finished, puzzle type, hints, settings, purchases made in the app and screens opened, plus app version, device model, operating system, language and country. Crash reports contain the technical error and the device state at that moment (memory, storage, battery).
This information is used so that we can a) offer you the functionality of the app, b) improve the functionality of the app, and c) prevent misuse and discover errors.
An identifier groups the data of one installation. The app creates it at random; installations first started with an older app version may still use an identifier that the operating system provides for our apps only. It is not your advertising identifier. We never send names, email addresses or account data. The server uses your IP address only at the moment of receipt to determine your country. It does not store it, not even in its logs. Only the country is kept, not your city, region or coordinates. No third-party analytics provider receives this data, and it is never sold or shared.
We deem the processing to be lawful to uphold the existing usage contract you implicitly agreed to by downloading the app (Art. 6(1b) GDPR). Furthermore we deem the processing to be lawful to pursue our interest in offering a working, error-free app, with the goal to constantly improve our offering (Art. 6(1f) GDPR), which outweighs the privacy interests of the user, because the data contains no names, email addresses or account data.
We hand out activation links that contain a code. The code unlocks Premium or restores a daily-challenge streak. Only when you open such a link, the app sends the code and a device identifier to our own server api.sudokubyjoseph.app. On iPhone and iPad this is the identifier that the operating system provides for our apps only. On Android it is the Android ID, which the system creates per app and device. It is not your advertising identifier.
The server stores the device identifier with the code, the time of the first activation and the time of the last check. We use this to enforce the number of devices a code is valid for and its expiry date.
While a code is active, the app checks it with the server again: at app start and about once an hour while the app runs. Each check sends the device identifier, the name stored for the code and, depending on the app version, the code itself. If you never open an activation link, the app sends nothing to this server.
We deem the processing to be lawful to provide the features that the code unlocks (Art. 6(1b) GDPR).
The free version of the app is funded by advertising. Ads are served through Google AdMob, a service of Google Ireland Ltd. and Google LLC. On iPhone and iPad, ads may also be delivered through AdMob's mediation by the partner ad network Pangle, operated by ByteDance.
When an ad is requested, these advertising partners receive certain data from your device: device information (such as model and operating system version), your IP address (used to derive your approximate location and to prevent fraud), data about your interaction with ads (such as impressions and clicks), and, on Android only, your device's advertising identifier.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you will be shown a consent dialog (Google's User Messaging Platform) when you first launch the app. Personalized advertising is only used with your consent (Art. 6(1a) GDPR). Without consent, you will be shown non-personalized ads based only on your approximate location and the current content (Art. 6(1f) GDPR). You can review and change your choice at any time in the app under Settings → Ad Privacy Options.
On iPhone and iPad, the app does not use Apple's advertising identifier (IDFA) and does not perform cross-app tracking; it never requests the App Tracking Transparency permission.
On Android, the Google Mobile Ads SDK in the app can read the Android advertising ID, so our advertising partners can receive it. In the European Economic Area, the United Kingdom and Switzerland it is used for personalized advertising only with your consent, as described above. In every country you can switch off ad personalization, or reset or delete the advertising ID, in the Android system settings.
All ads can be permanently removed with the Premium subscription.
For details on how our advertising partners process data, please refer to their privacy policies:
The app fetches a small configuration file with the settings for ad display from our web server sudokubyjoseph.app. This request carries no identifier.
Our web servers sudokubyjoseph.app (this website) and api.sudokubyjoseph.app are hosted at DigitalOcean. They write standard access logs for every request, also when you visit this website: IP address, time, requested address, status, referrer and user agent. The logs are kept for 14 days and then deleted. We use them to operate and secure the servers (Art. 6(1f) GDPR).
This applies to these two servers only. The analytics server analytics.keitgen.de, described above, does not store your IP address.
As permitted by law you have the right to be provided at any time with information about any of your personal data which is stored, as well as its origin, the recipient, and the purpose for which it was processed. You also have the right to have this data corrected, blocked, or deleted. You can contact us at any time using the address .
Should you have any questions about this privacy policy, do not hesitate to send an e-mail to: .