EN
Coming soon

Try: offline, Pro, season pass, X-Wing, Stacks Tricky 120

Privacy policy

This translation is provided for your convenience. The German version is legally binding: German version

This privacy policy covers the Beasties app for iPhone and iPad and the website beasties.hohl.dev. In short: no ads, no tracking, no account. Your progress stays on your device, and the app sends us anonymous level statistics only if you agree.

Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Barnabas Hohl
Fehrenbachstr. 32
51067 Köln
Germany
Email: [email protected]

The app

What the app stores

Your solved levels, stars, saved games, daily challenges, season pass progress, your monster and your settings are stored only on your device. There is no account, and the games work offline. The app contains no advertising and no tracking. It sends data to us in only two cases: the optional anonymous statistics, if you switch them on (see below), and an email that you send yourself (see below).

App Store and purchases

Each time it starts, the app uses Apple’s StoreKit to load the price of Beasties Pro from the App Store and to check whether you own Pro. You buy and restore Beasties Pro through the App Store, and Apple handles the payment. We receive no payment details and no information that identifies you. Apple’s privacy policy applies to these connections. Level packs and eggs are paid for with stars you win in the app, not with money.

Crash reports and app analytics from Apple

If you have agreed in your device’s privacy settings to share analytics data with app developers, Apple provides us with aggregated usage figures and crash reports that do not identify you. Whether this data is shared is up to you and is handled by Apple.

Rating question

Now and then, after a won level, the app asks whether you like Beasties. Your answer is stored only on your device. Afterwards the app may show Apple’s rating prompt, a link to the App Store or the feedback form (see below). Ratings and reviews go to Apple and are subject to Apple’s terms.

Anonymous statistics (optional)

To find levels that are too hard or faulty, to see whether more levels are needed and to balance stars, tutorials and the season pass, Beasties can count how you play and send these counts to us. This is off until you agree. The app asks once, on the home screen after a few won levels; closing the question without an answer counts as “no”. You can switch the statistics on or off at any time under Settings → “Anonymous statistics”. Switching them off stops sending at once and deletes all counts not yet sent; “Reset progress” deletes them too. Only App Store versions send statistics; TestFlight test versions do not ask, count or send anything.

Only this is sent, about how levels go and how stars are earned and used:

  • per game, difficulty and level (and whether it was a daily challenge): how often it was reached for the first time, solved for the first time, solved with 1, 2 or 3 stars, lost, restarted or left unfinished, and how many helpers were bought
  • star totals: stars earned (per game from levels, from daily challenges, from the season pass) and stars spent (on helpers per game and kind, on level packs per game and difficulty, on monster eggs, on new daily cards), and which level packs were unlocked with stars
  • usage counts: tutorials started and finished or skipped per game, how often the Pro window was shown (per occasion), season pass stations collected
  • the app version, the app language and the build type (test build or App Store)

Nothing else: no purchases, no star balance, no device, user or installation ID, no advertising identifier, no name, no times, durations or order of your games, no location, no free text. The counts are added up on your device. The app sends them to our server beasties.hohl.dev as one encrypted request (https) at most once a day, at a random time; only if a transfer fails does it try again later. The server checks the request, adds the numbers to the daily totals of all players for the day the request arrives and does not keep the request itself; app version and language are stored separately from the level and star figures. Neither the IP address nor the user agent is stored with the statistics, and requests to the statistics address are not written to the server’s access log (see “Server log files”). The stored daily totals cannot be traced back to you.

During the transfer, your IP address is necessarily visible to Cloudflare, which provides the connection to our server as our processor (see “Hosting and Cloudflare”), and to the server. No one else receives the data. No third-party analytics service is used, and the statistics are not combined with data from other apps or websites (no tracking).

The legal basis is your consent (Art. 6(1)(a) GDPR; for counting on your device also § 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act). You can withdraw your consent at any time with the switch in Settings; this does not affect the lawfulness of processing before the withdrawal. Daily totals are deleted after 24 months at the latest, data from test builds after 90 days.

Deleting your data

“Reset progress” in Settings resets your progress in the app. If you remove the app, iOS deletes all its data. Like all app data, it can be part of a backup of your device in iCloud or on your computer, if you use one; that backup is managed by Apple or by you.

Feedback and bug reports

“Send feedback” and “Report a bug” in Settings, and “Write feedback” after the rating question, open a form in the app. When you tap “Send”, the app prepares an email to [email protected] in your mail app. It contains what you wrote and, unless you switch off “Attach device info”, the app version, whether you use Beasties free or with Pro, the iOS version, the device model, the app language and the language and region setting of your device. You see the whole email before you send it; nothing goes out unless you send it yourself. If no mail app is set up, the app copies your message to the clipboard and shows the address. How we handle your email is explained under “Contact by email”.

The website beasties.hohl.dev

Hosting and Cloudflare

The website and the app’s statistics address run on the operator’s own server in Germany (self-hosting). No external hosting provider is involved. The connection from the internet to the server runs through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare provides the encrypted connection (https), caches content of the website and protects against attacks. All requests pass through Cloudflare’s servers; Cloudflare processes your IP address and the data of each request. If a request looks suspicious, Cloudflare may set a technically necessary cookie to protect against automated access (such as __cf_bm or cf_clearance).

Cloudflare also asks your browser, through Network Error Logging (NEL), to report failed connections to Cloudflare (a.nel.cloudflare.com). Such a report contains your IP address, the requested address and the type of error. It is used to detect connection problems.

Cloudflare acts as our processor; a data processing agreement is in place. For the website, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is reliable and secure delivery of the website without exposing the server directly to the internet. For the transfer of the app statistics, the legal basis is your consent (see “Anonymous statistics”).

Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision for this framework. In addition, the Commission’s standard contractual clauses have been agreed.

Server log files

When you open a page, the server automatically stores access data in its access log:

  • IP address
  • date and time of the request
  • requested address (URL)
  • referrer (the previously visited page, if sent)
  • browser and operating system (user agent)
  • HTTP status code and amount of data transferred

If an error occurs while a request is processed, the server software may also log an error message, which can contain your IP address. The data is processed to ensure security and technical operation, for example to find errors and detect attacks. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR.

The log files are limited to 15 MB in total. Once that size is reached, the oldest entries are deleted continuously. In addition, they are deleted completely whenever the server environment is recreated, for example for an update of the web server. How long an entry is kept therefore depends on the number of requests.

Exception: requests that the app sends to the statistics address (https://beasties.hohl.dev/wp-json/beasties/v1/stats) are not written to the access log.

Cookies and browser storage

The website sets no cookies for visitors. Only logging in to the WordPress admin area sets technically necessary login cookies; this concerns the operator alone. For Cloudflare cookies, see “Hosting and Cloudflare”.

If you choose between light and dark mode, your browser keeps that choice in its local storage (localStorage, entry “hohl.theme”) so it stays for your next visit. The entry never leaves your device and is removed as soon as you choose “System” again. This storage is strictly necessary to provide the function you asked for (§ 25(2) no. 2 TDDDG).

If you open https://beasties.hohl.dev/ without a language in the address, the server forwards you to the language version that matches your browser’s language setting. Nothing is stored for this.

The search on the website runs in your browser: your browser loads a search index from the server, and results appear as you type, without your search terms being sent. Only if you press Enter without choosing a result, or open the link to all results, is your search term sent to the server as part of the address (URL) and stored in the access log like any address. If nothing is found, the search offers a link that opens an email to us in your mail app with your search term as the subject.

No tracking, no third-party content

The website uses no visitor counting and no tracking services and shows no advertising. There is no comment function, no contact form, no newsletter, no social media plugins and no embedded videos.

Fonts, images and everything else load from the operator’s own server. No content from Google Fonts, content delivery networks or other third parties is embedded. The SEO plugin in use (Rank Math) sends no visitor data to third parties. Connections to third parties only arise as described under “Hosting and Cloudflare” or when you follow a link, for example to the App Store; the privacy terms of that provider then apply.

Contact by email

If you email us, for example at [email protected] (also through the app’s feedback form) or at another address at hohl.dev, we process your email address, your name if given and the content of your message, including attachments and any device info, to handle your request. Emails to addresses at hohl.dev are forwarded through Cloudflare’s Email Routing service to a mailbox of the operator at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail), and stored there. Google may also transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering your request. Where a contract is concerned, the legal basis is Art. 6(1)(b) GDPR. We delete your emails once the request is settled and no statutory retention duties apply.

The contact form on hohl.dev is covered by the hohl.dev privacy policy.

Recipients and transfers to third countries

Recipients of personal data are:

  • Cloudflare, Inc. as our processor for the connection to the server, including the transfer of the app statistics, and for forwarding emails
  • Google Ireland Limited (Gmail) as the operator’s email provider for emails you send us

Apple processes data under its own responsibility when you use the App Store, StoreKit, the rating prompt or a backup of your device, not on our behalf. From Apple we only receive the aggregated figures described under “Crash reports and app analytics from Apple”.

Transfers to the USA are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework. There is no automated decision-making, including profiling. You are neither legally nor contractually required to provide data; without an email address, however, we cannot reply to you.

Your rights

You have the following rights towards the controller regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object

Where processing is based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. The data will then no longer be processed unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

An informal message to [email protected] is enough to exercise your rights. The stored daily totals of the anonymous statistics cannot be assigned to any person; requests for access or erasure therefore cannot cover them. Withdrawing your consent stops all further sending.

Updates

This privacy policy is dated 19 October 2026. It will be updated when the app, the website or the legal requirements change.