Three Oaks Studio

Privacy Policy

Privacy Policy

Last updated: August 2026

This is an English translation provided for convenience. The German version is the legally binding text.

Thank you for your interest in our games and this website. Protecting your personal data matters to us. Below we explain, in accordance with the General Data Protection Regulation (GDPR), which data we process, for what purpose and on what legal basis — both on this website and in our games.

1. Controller

Andre Potgeter – Three Oaks Studio
Am Ems-Vechte-Kanal 48
48531 Nordhorn, Germany
Email: info@threeoaks-studio.de
Phone: +49 5921 8537351

2. Legal bases for processing

We process personal data on the basis of Art. 6(1) GDPR, in particular: to perform a contract or take pre-contractual steps (lit. b), to comply with legal obligations (lit. c), on the basis of your consent (lit. a), and to pursue our legitimate interests (lit. f), such as providing a secure and functional service.

3. Use of this website

3.1 Server log files

When you access this website, information transmitted by your browser is recorded automatically: IP address, date and time of access, the page or file requested, the volume of data transferred, the referrer URL, and details of your browser and operating system. This data serves secure operation, error analysis and protection against misuse (Art. 6(1)(f) GDPR) and is deleted after a short period.

3.2 Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The provider processes the data referred to above on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.

3.3 Cookies

This website does not use marketing or analytics cookies to display its content. Technically necessary cookies may be set in connection with the content management system (for example when logging into the administration area); these are required for operation (Art. 6(1)(f) GDPR). Should services requiring consent (for example audience measurement) be added in future, we will obtain your consent beforehand and update this policy.

3.4 Contacting us

If you contact us by email, we process the details you provide (for example name, email address, content of your message) in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once it is no longer required and no statutory retention obligations prevent deletion.

4. Data processing in our games

Our games are intended for persons aged 16 and over and are not directed at children. Depending on the game and the features you use, we process the following data:

4.1 Game account and saved progress

If you create an account, we process the data required for it (for example email address, a hashed password, a player identifier) together with your saved progress in order to provide cloud saves and synchronisation between your devices (Art. 6(1)(b) GDPR). Game data is stored on our servers at Hetzner Online GmbH (located in Germany).

4.2 Signing in with Apple or Google

You may optionally sign in using “Sign in with Apple” (Apple Inc., One Apple Park Way, Cupertino, CA, USA) or “Sign in with Google” (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). In doing so we receive a unique user identifier and — depending on what you release — your email address in order to create the account (Art. 6(1)(b) GDPR). The sign-in process itself is subject to the privacy policies of Apple and Google respectively.

4.3 In-app purchases

Purchases and subscriptions are processed exclusively through the Apple App Store or Google Play. Payment handling and the processing of your payment data are carried out by Apple or Google; we receive no complete payment data, only confirmation of a purchase or an entitlement status (Art. 6(1)(b) GDPR).

To manage purchases and subscriptions we use the service RevenueCat, Inc. (San Francisco, CA, USA). RevenueCat processes pseudonymous user and purchase identifiers on our behalf in order to make your purchase status available across devices (Art. 6(1)(b) and (f) GDPR).

4.4 Advertising

We display advertising in some of our games. For this purpose we use Google AdMob, a service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Device and usage information as well as an advertising identifier (for example the Advertising ID) may be processed in order to serve advertising, prevent fraud and measure advertising performance. Further information can be found in Google’s privacy policy.

We use personalised advertising only with your consent (Art. 6(1)(a) GDPR), which we request within the game and which you may withdraw at any time. On iOS this additionally takes place via Apple’s App Tracking Transparency prompt. Without consent, only non-personalised advertising is served.

5. Transfers to third countries

Some of the providers named above (including Apple, Google and RevenueCat) may process data in the USA. Where data is transferred to the USA, such transfer is based on an adequacy decision of the EU Commission (EU–US Data Privacy Framework, where the provider is certified) and/or on the EU Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR. Despite these safeguards, a level of data protection lower than that in the EU may exist in third countries.

6. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (for example under commercial and tax law). Account and saved-game data is deleted when you delete your account or when the data is no longer required.

7. Your rights

Subject to the statutory requirements, you have the following rights:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to info@threeoaks-studio.de is sufficient.

8. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority includes the State Commissioner for Data Protection and Freedom of Information of Lower Saxony (Landesbeauftragte für Datenschutz und Informationsfreiheit Niedersachsen).

9. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. This website is transmitted in encrypted form via HTTPS.

10. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our processing activities change (for example when new features or services are introduced). The current version published here applies in each case.