Privacy

This is a translation provided for your convenience. In the event of any discrepancy, the German version shall prevail.

Last updated: 24 September 2026

This policy describes what data the Fluff Farm app processes, why it does so, and what rights you have.

1. Controller

Philipp Klose
Augustinergasse 1
35037 Marburg, Germany
Email: support@elephanttrails.de

There is no data protection officer. For an offering of this size, one is not required.

2. The principle

Fluff Farm can be played without registering. We do not ask for your name, your address or your date of birth. What is stored is essentially your progress in the game.

Four things go beyond that, and you decide about the last three yourself:

• your save game in the cloud, so that it survives a new phone
• your profile, if you add friends
• advertising, if you consent to it
• anonymous usage statistics, which you can switch off in the settings

3. What is processed in detail

3.1 Anonymous game account

On first launch, the app creates an anonymous account with Firebase Authentication. You receive a random identifier. This identifier contains nothing about you – it only distinguishes your device from others.

• Data: random user identifier, time of creation, IP address (technically unavoidable with every connection)
• Purpose: The save game has to be assignable to an account.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement)

3.2 Signing in with Google or Apple (optional)

If you sign in so that your save game survives a lost device, we receive a confirmation and your email address from Google or Apple respectively. Apple only discloses it the very first time and allows you to hide it.

• Data: email address, provider identifier
• Purpose: Your save game should be recoverable.
• Legal basis: Art. 6(1)(b) GDPR
• The email address is used for signing in only. We do not contact you and do not pass it on.

3.3 Save game in the cloud

Your progress is stored on your device and additionally backed up with Firebase Firestore.

• Data: number of animals, currency balances, buildings, purchased meadow plots, streak, play time, a random device identifier, chosen profile animal
• Purpose: Your save game should continue on a new device.
• Legal basis: Art. 6(1)(b) GDPR
• If two devices conflict, we keep the losing state for seven days so that nothing is quietly lost.

3.4 Profile and friends (optional)

You receive a friend code. Anyone you give this code to can add you and will then see your profile.

• Data: self-chosen display name, number of unlocked meadows, number of animals, streak, play time, chosen profile animal, collected cards
• Purpose: Friends should see how far you have come.
• Legal basis: Art. 6(1)(b) GDPR
• Important: Your display name is visible to your friends. Do not choose your real name if you would rather not. The name is checked automatically against a blocklist.
• If you remove a friend, you disappear from their list and they from yours.

3.5 Rainbow coins and purchases

You can earn or buy rainbow coins. The balance is held on the server, not on your device.

• Data: coin balance, a transaction history (what was credited or spent and when), and for a purchase additionally the product identifier and a receipt from Google
• Purpose: The balance has to be traceable and a purchase must not be redeemed twice.
• Legal basis: Art. 6(1)(b) GDPR, and for retaining the receipt additionally Art. 6(1)(c) GDPR
• The payment itself runs through Google Play. We see no payment data, no credit card number and no billing address.

3.6 Advertising (only with your consent)

The app contains optional video ads. There are no banner ads and no ads that interrupt you. You only see an ad if you tap a button that announces it.

We use Google AdMob for this.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Data: your device's advertising identifier, IP address, device type, operating system, approximate location (country)
• Purpose: delivery and billing of the ads
• Legal basis: Art. 6(1)(a) GDPR (consent)
• On first launch, a dialog from Google asks whether you agree. You can change this decision at any time in the settings under “Ad settings”.
• Anyone who makes the ad-free purchase sees no ads at all.

3.7 Anonymous usage statistics (can be switched off)

We measure how the game is used in order to balance it better.

• Provider: Google Firebase Analytics
• Data: start and end of a session, animals and buildings purchased including price and meadow, baskets collected, meadows unlocked, streak days, video ads started and completed, product identifier for a real-money purchase, plus device type, operating system and country
• What is NOT included: no name, no email address, no purchase amount in euros, no order number
• Purpose: balancing and troubleshooting
• Legal basis: Art. 6(1)(a) GDPR (consent)
• You can switch this off in the settings under “Anonymous usage statistics”. The switch additionally deletes what has been collected so far. A switch that only changes the future would not be a withdrawal of consent.

3.8 Reminders

The app can remind you when your fluff basket is full. These reminders are created on your device. Nothing is sent to a server, and we do not learn whether you open them.

• Legal basis: Art. 6(1)(a) GDPR
• Can be switched off in the app settings and in your device settings.

3.9 Reports

If you report an inappropriate player name, we store your identifier, that of the reported player, and the time.

• Purpose: to follow up on misuse
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a usable service)

3.10 Protection against misuse

Requests to our server are verified with Firebase App Check. Google Play or Apple respectively confirms that the request comes from a genuine, unmodified app.

• Data: a technical verification token, no user data
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing automated access)

3.11 Invitations (optional)

You can invite friends. For that you receive a link containing your friend code – for example https://fluff-farm.web.app/e/JAPT98. Whether you pass it on is up to you.

If you share the link. The app opens the share menu of your device for this. We have no access to your contacts, we send nothing ourselves, and we do not learn to whom – or whether – you sent anything. The image that goes with it shows an animal, a sentence and the link; it does not contain your player name.

If someone opens the link. The page behind it only checks the form of the code and looks nothing up. Android devices are forwarded to the Play Store listing, everyone else gets a page with the code to copy down.

• Data: IP address and technical details of the browser (technically unavoidable with every connection, processed by Google as the operator of the servers)
• What does NOT happen: no cookie, no record per visit, no storage of the IP address by us. The only thing counted is a daily total per operating system – a figure of the form “41 opened today, 33 of them Android”. Nobody can be identified from that.
• Purpose: delivering the invitation and recognising whether this route is used at all
• Legal basis: Art. 6(1)(f) GDPR

The install referrer (Android only). If you install the app from the Play Store via an invitation link, Google passes on the value contained in that link once. With us that is exclusively our own invitation code, nothing else. The app reads it exactly once on first launch, redeems the code and discards it afterwards.

• Data: the invitation code from the link
• Purpose: the invited player should receive the bonus without typing six characters
• Legal basis: Art. 6(1)(b) GDPR

If an invitation is accepted. A connection between two accounts is created: a friendship and, if the invited player is new, a referral.

• Data: the two random user identifiers, the time, the route by which the code arrived, a sequential number and the progress of the referral
• Purpose: the bonus depends on it, and it must not be paid out twice
• Legal basis: Art. 6(1)(b) GDPR

Once a week we tally from this how many new players brought someone along. That evaluation contains only figures, no identifiers.

4. Processors and transfers to third countries

The servers are located in the European Union (Frankfurt region). Google may nevertheless transfer data to the USA.

• Google Ireland Limited (Firebase Authentication, Firestore, Cloud Functions, Analytics, App Check, AdMob, Hosting) – we have a data processing agreement in place.
• Google Ireland Limited / Google Payment – handling of purchases in the Play Store. Here Google is an independent controller.
• Apple Inc. – only for “Sign in with Apple” on iOS.

Transfers to the USA are based on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework or on standard contractual clauses pursuant to Art. 46 GDPR.

5. How long data is stored

6. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21).

You may withdraw consent you have given at any time with effect for the future. For advertising and statistics you can do this directly in the app settings.

For everything else, write to us at support@elephanttrails.de. We will respond within one month.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, for example with the authority responsible for us in Hesse.

7. Deleting your account and data

This is how you delete your account and all data belonging to it:

• In the app: Settings → Delete account
• By email: support@elephanttrails.de with the subject “Delete account”. You will find your code in the friends section under “Your code” – tell it to us so that we can find your account.

The following will then be deleted: game account, save game, backups, profile, friendships, coin balance and transaction history. Purchase receipts are retained because of the statutory retention obligation under tax law, but without any reference to your account.

Deletion is final. Rainbow coins you have paid for are gone afterwards.

8. Children

Fluff Farm is a calm game and children like it too. If you are under 16 years old, we may only process advertising and usage statistics with your parents' consent. Please ask them before you tap “Agree” in the advertising dialog.

Parents can reach us at support@elephanttrails.de and may at any time request that we delete their child's data.

9. Changes

If something changes in the app that is described here, we will update this policy. The version currently in force is available at elephanttrails.de/fluff-farm/en/privacy.