Three Oaks Studio

Privacy Policy

Privacy Policy

🇩🇪 Deutsche Fassung · 🇬🇧 English

Last updated: November 2026

This is an English translation provided for convenience. The German version is the legally binding text.

Thank you for your interest in our games and this website. Protecting your personal data matters to us. Below we explain, in accordance with the General Data Protection Regulation (GDPR), which data we process, for what purpose and on what legal basis — both on this website and in our games.

1. Controller

Andre Potgeter – Three Oaks Studio
Am Ems-Vechte-Kanal 48
48531 Nordhorn, Germany
Email: support@threeoaks-studio.de
Phone: +49 5921 8537351

2. Legal bases for processing

We process personal data on the basis of Art. 6(1) GDPR, in particular: to perform a contract or take pre-contractual steps (lit. b), to comply with legal obligations (lit. c), on the basis of your consent (lit. a), and to pursue our legitimate interests (lit. f), such as providing a secure and functional service.

3. Use of this website

3.1 Server log files

When you access this website, information transmitted by your browser is recorded automatically: IP address, date and time of access, the page or file requested, the volume of data transferred, the referrer URL, and details of your browser and operating system. This data serves secure operation, error analysis and protection against misuse (Art. 6(1)(f) GDPR) and is deleted after a short period.

3.2 Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The provider processes the data referred to above on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.

3.3 Cookies

This website does not use marketing or analytics cookies to display its content. Technically necessary cookies may be set in connection with the content management system (for example when logging into the administration area); these are required for operation (Art. 6(1)(f) GDPR). Should services requiring consent (for example audience measurement) be added in future, we will obtain your consent beforehand and update this policy.

3.4 Contacting us

If you contact us by email, we process the details you provide (for example name, email address, content of your message) in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once it is no longer required and no statutory retention obligations prevent deletion.

4. Data processing in our games

Our games are intended for persons aged 16 and over and are not directed at children. Depending on the game and the features you use, we process the following data:

4.1 Game account and saved progress

If you create an account, we process the data required for it: user name, email address, a hashed password (we never store your password in plain text), a player identifier, your player name and device keys that keep your devices signed in. To confirm your email address and to reset your password, we send you emails containing a time-limited link.

We also process your saved progress in order to provide cloud saves, leaderboards, multiplayer matches and synchronisation between your devices (Art. 6(1)(b) GDPR). Your player name is visible to other players in leaderboards and in multiplayer. Game data is stored on our servers at Hetzner Online GmbH (located in Germany).

We also store gameplay statistics for your account (e.g. rounds played, days reached, kills, results in events and duels including your rating). We use them for leaderboards, matchmaking, game balance and fraud detection (Art. 6(1)(b) and (f) GDPR).

Once you have chosen a player name, your name and your player profile (rank, your character’s appearance, weapons, best results, awards) are visible to others on leaderboards and on a profile card, which can be viewed without signing in.

During the first 14 days after your account is created, we also store which steps you reach in the game, such as the main menu, tutorial steps, starting a round, the day reached, the end of a round, your first upgrade in the headquarters and whether you come back, each with a timestamp and the app version. This lets us see where new players get stuck and improve the first steps in the game (Art. 6(1)(f) GDPR). No device identifiers or third parties are involved. We delete these entries after 30 days, at the latest together with your account. Before you sign in, we only count anonymously how often the sign-in screen is opened, without any reference to you. For analysis we only keep aggregated daily figures that cannot be linked to any account.

If you create a new account in the browser after following an advertising link, we store with your account which source and campaign the link came from (the source, medium, campaign and ad details contained in the link). This shows us which advertising brings new players, and we only evaluate it as totals per campaign. We do not use click or advertising identifiers for this and do not pass this information on to advertising networks. The legal basis is our legitimate interest in evaluating our advertising (Art. 6(1)(f) GDPR). The information is deleted together with your account.

Guest account: With an invitation link you can join a round as a guest without registering. For this we create a guest account that contains only your player name, a player identifier, a device key and your saved progress – no email address and no password. To prevent mass creation, we count your IP address in the server’s memory for no more than 24 hours. Guest accounts that you do not convert into a regular account are deleted together with their progress 30 days after they were created. An invitation link contains only the round code, a key for that round and the player name of the person inviting you; we do not access your contacts.

4.2 Signing in with Apple or Google

You may optionally sign in using “Sign in with Apple” (Apple Inc., One Apple Park Way, Cupertino, CA, USA) or “Sign in with Google” (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) — in our apps and in the browser — or link an existing account to them in the settings. In doing so we receive a unique user identifier from the respective provider and — depending on what you release — your email address (with Apple possibly an anonymised relay address). If this address, confirmed by the provider, matches the confirmed email address of an existing account, we link the sign-in to that account (Art. 6(1)(b) GDPR).

For “Sign in with Apple” we additionally store an encrypted token that we use to revoke the link with Apple when you delete your account (Art. 6(1)(b) and (c) GDPR). The sign-in process itself is subject to the privacy policies of Apple and Google respectively.

4.3 Security features of your account

To protect your account we process the following data (Art. 6(1)(b) and (f) GDPR):

  • Two-factor protection (optional): a secret for your authenticator app, which we store encrypted, and recovery codes, which we store only as a check value (hash).
  • Passkeys (optional): the public key of your passkey, a device label (for example “iPhone · Safari”) and the times it was created and last used. Biometric characteristics such as your face or fingerprint never leave your device and are not processed by us.
  • Protection against misuse: we count failed sign-in attempts per account as well as sign-in attempts per IP address and temporarily block sign-in after too many attempts.
  • Security emails: we notify you by email of new sign-ins and of changes to your password, two-factor protection, recovery codes, passkeys or linked sign-in methods. The message contains the time, the device type and a shortened IP address. You can turn off the emails about new sign-ins in the game under Settings → General.

4.4 Sending emails

To send our emails (address confirmation, password, security and deletion notices) we use the email service of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Your email address, user name and the content of the message are processed on our behalf (Art. 28 GDPR).

4.5 Purchases

In our apps, purchases and subscriptions are processed through the Apple App Store or Google Play. Purchases in the browser (e.g. Endless Shelter on endless-shelter.com or Empire: Rome on empire-rome.threeoaks-studio.de) are sold to you by our reseller Paddle.com Market Limited (30 Old Bailey, London EC4M 7AU, United Kingdom) as Merchant of Record. For this purpose Paddle processes, as an independent controller, the details entered in the checkout (e.g. email address, country, payment details) to handle payment, invoicing, taxes, refunds and fraud prevention; Paddle’s privacy policy applies (paddle.com/legal/privacy). So that we can assign a purchase to your game account, we send Paddle your player ID, the game language and, if confirmed, your email address to pre-fill the checkout. When you open the shop or a purchase offer in the browser, a script from Paddle is loaded, which gives Paddle your IP address. Your payment data is processed by the respective provider; we receive no complete payment data, only confirmation of a purchase or an entitlement status and, for purchases in the browser, notices of refunds and chargebacks (Art. 6(1)(b) GDPR).

To manage purchases and subscriptions we use the service RevenueCat, Inc. (San Francisco, CA, USA). RevenueCat processes pseudonymous user and purchase identifiers on our behalf in order to make your purchase status available across devices and to credit purchases to your game account (Art. 6(1)(b) and (f) GDPR). Besides purchases in our apps, this may also apply to purchases in the browser made through Paddle.

4.6 Advertising

We display advertising in some of our games. For this purpose we use Google AdMob, a service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Device and usage information as well as an advertising identifier (for example the Advertising ID) may be processed in order to serve advertising, prevent fraud and measure advertising performance. Further information can be found in Google’s privacy policy.

We use personalised advertising only with your consent (Art. 6(1)(a) GDPR), which we request within the game and which you may withdraw at any time. On iOS this additionally takes place via Apple’s App Tracking Transparency prompt. Without consent, only non-personalised advertising is served.

4.7 Chat and reports

You can chat with other players in the lobby of open rounds, in private rooms and during a match. Chat messages are only forwarded to those present and are not stored permanently; links, email addresses and phone numbers are hidden automatically. If you report a player, we store the report together with their most recent messages from the room as evidence so that we can review violations. Players you ignore are stored in your account. You can turn the chat off in the settings (Art. 6(1)(b) and (f) GDPR).

4.8 Support requests and error reports

If you write to us via the in-game support section, we store your message, our reply and technical details that help us handle it: support ID, app version, platform, language, game progress (e.g. trophies or campaign), screen size and browser or device identifier (Art. 6(1)(b) GDPR).

Central support desk. We handle support requests from all our games and emails to support@threeoaks-studio.de in one place, our support desk at support.threeoaks-studio.de. It runs on our server in Germany (Hetzner Online GmbH). There we see for a request, where needed to handle it, the status of your game account (e.g. sign-in method, app version, progress), your purchases (without payment details) and technical error messages. Only persons authorised by us have access.

AI-assisted reply drafts. To draft replies and categorise requests we use an AI model by Anthropic (contracting party and processor: Anthropic Ireland, Limited, Ireland; data may be processed in the USA). We transmit only the text of your request, the language and the details about your game account needed for the reply; we automatically remove email addresses, phone numbers, support IDs, order numbers and identifiers beforehand. Anthropic processes this data only on our behalf, does not use it to train its models under its contractual terms and deletes it after 30 days at the latest, except for content that violates Anthropic’s usage policies. Replies created with the help of AI are labelled as such. Decisions about your account, purchases, refunds, suspensions or deletions are always made by a human; no solely automated decision within the meaning of Art. 22 GDPR takes place. The legal basis for using AI and for protection against spam and abusive mass requests is our legitimate interest in handling requests quickly and securely (Art. 6(1)(f) GDPR).

If a technical error occurs in the game, the game sends an error report to our server: error message, location of the error, browser or device identifier and screen size. These reports go into the server log, are used solely to fix errors and are deleted together with the log after a short time (Art. 6(1)(f) GDPR).

4.9 Protection against manipulation (Android)

In the Android app we use the Play Integrity API of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) to check that the app is unmodified and running on a genuine device. Google processes device and app information for this purpose; we only receive the result of the check (e.g. “app recognised”, “device meets integrity requirements”) and store it with a timestamp in your account. This serves to protect against fraud and manipulation, in particular for rewards and purchases (Art. 6(1)(f) GDPR).

4.10 Deleting your account

You can delete your account at any time in the game under Settings → General → “Delete account”; in the browser you additionally confirm the deletion via a link we send you by email. Alternatively, a message to support@threeoaks-studio.de is sufficient. This also applies to Endless Shelter (app and endless-shelter.com); instructions are available at endless-shelter.com/api/account-deletion.

On deletion we remove your account together with your saved progress, device keys, passkeys, security settings and your leaderboard entries. Any link with “Sign in with Apple” is revoked with Apple at the same time. Data that we must retain for legal reasons (for example relating to purchases), as well as briefly kept server logs and backups, is deleted once the respective period has expired.

4.11 Game server logs

Our game servers log technical events such as sign-ins, failed sign-in attempts, account changes, account deletions and joining game rooms. An entry contains the time, IP address, player ID and player name. The logs serve secure operation, error analysis and the prevention of abuse (Art. 6(1)(f) GDPR). They are limited in size and deleted after 14 days at the latest.

4.12 Storage on your device

The game stores the data it needs to work on your device (in the browser: in local storage): your sign-in, your game progress, your settings (e.g. language, volume, graphics) and hints you have already seen. This storage is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG). We do not use cookies for advertising or analytics in these games; for the measurement of ad campaigns in the iOS app see section 4.13.

4.13 Measurement of ad campaigns (iOS app)

In our iOS app we would like to measure whether you came to Endless Shelter through one of our ads (Google Ads). For this we use Google Analytics for Firebase by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – but only if you consented when you first started the app (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). In that case we record the first launch of the app, sessions and general usage events, a random identifier of this app installation as well as device type, operating system, app version, language and the approximate location derived from the IP address (country/region; Google Analytics does not store the IP address itself). We do not read your advertising ID (IDFA), and we do not use the data for personalised advertising. Google receives the results so that it can show us how effective our campaigns are (installs per campaign). The data is deleted after 2 months. This may involve a transfer to the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission). You can withdraw your consent at any time in the app under Settings › General › Ad measurement; from then on the app records nothing. This measurement does not take place in the Android app or in the browser.

4.14 Beta sign-up in the browser

During a beta test, new accounts in the browser version of individual games are by invitation only. If you sign up, we store your email address, your language and the time of your sign-up, confirmation and invitation. The legal basis is your consent (Art. 6(1)(a) GDPR).

After you sign up, we send you a confirmation link. You only join the list once you click it. Without confirmation, we delete the entry after 7 days. When a place is free, you receive a personal invitation link by email, which you can use once to create an account. The link is valid for 30 days. If you accept the invitation, we link the entry to your account.

You can withdraw your consent at any time, for example by email to support@threeoaks-studio.de. We then delete your entry. This does not affect the lawfulness of processing before the withdrawal. We use the service named in section 4.4 to send these emails.

5. Transfers to third countries

Some of the providers named above (including Apple, Google, RevenueCat, Paddle and Anthropic) may process data in the USA; Paddle is based in the United Kingdom, for which an adequacy decision of the EU Commission exists. Where data is transferred to the USA, such transfer is based on an adequacy decision of the EU Commission (EU–US Data Privacy Framework, where the provider is certified) and/or on the EU Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR. For Anthropic, any transfer to the USA is based on the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement with Anthropic. Despite these safeguards, a level of data protection lower than that in the EU may exist in third countries.

6. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (for example under commercial and tax law). Account and saved-game data is deleted when you delete your account or when the data is no longer required. Guest accounts (joining via an invitation link without registering) are deleted 30 days after they were created unless they have been converted into a regular account.

In our games, the following periods apply:

  • Account, game progress, gameplay statistics, purchases and ignore list: until your account is deleted
  • Results of the device check (section 4.9): 90 days
  • Chat reports including the evidence messages: 12 months
  • Support requests including our notes and reply drafts in the support desk: 24 months after the last reply, at the latest when your account is deleted
  • Texts transmitted to Anthropic to create a reply draft: no longer than 30 days (for the exception see section 4.8)
  • Access logs of the support desk: 14 days
  • Purchase events from our payment service provider RevenueCat (pseudonymous purchase and user ID): 24 months, also after an account is deleted, to process refunds and prevent fraud
  • Links in emails (confirmation, password, deletion): one week after expiry or use
  • First steps of new accounts (section 4.1): 30 days
  • Data from Google Analytics for Firebase (iOS app, only with consent): 2 months
  • Beta sign-up (section 4.14): unconfirmed entries 7 days, confirmed entries until the end of the beta test or until you withdraw your consent
  • Server logs: see section 4.11

7. Your rights

Subject to the statutory requirements, you have the following rights:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to support@threeoaks-studio.de is sufficient.

8. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority includes the State Commissioner for Data Protection and Freedom of Information of Lower Saxony (Landesbeauftragte für Datenschutz und Informationsfreiheit Niedersachsen).

9. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. This website and our games are transmitted in encrypted form via HTTPS. Passwords are stored only as a hash, two-factor secrets in encrypted form.

You share responsibility for the security of your access credentials. We recommend a long password used only for our game, together with two-factor protection, a passkey or signing in with Apple or Google. Details are set out in our Terms of Use (section 4).

10. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our processing activities change (for example when new features or services are introduced). The current version published here applies in each case.