Last updated: 8 November 2026. In case of doubt, the German version prevails.
AI & Workflow Solutions UG (haftungsbeschränkt), c/o The Grey House Coworking, Lindauer Straße 2–4, 87600 Kaufbeuren, Germany. Email: kontakt@semesto.de
When the app contacts our server, your IP address is processed to answer the request. Our web server keeps no access logs. To prevent abuse (rate limiting) we store the IP address only as a keyed hash for at most 24 hours. Legal basis: Art. 6(1)(f) GDPR (operational security).
On first launch our server creates a random user and device identifier and an access token, and stores the app version, platform (iOS/Android) and device language. The token is kept in your device's secure keychain/keystore; the server stores only its hash. Legal basis: Art. 6(1)(b) GDPR (providing the game).
We store your rounds (start time, random seed, moves, score, duration and time-zone offset for the daily streak), your profile (best score, games played, coins, streak, sound/vibration/music settings) and your positions in the daily leaderboard and weekly league. Leaderboards only show a pseudonym such as “Player 4F2A”. Every round is re-calculated on the server to prevent cheating. Piece selection adapts to your game history (e.g. slightly easier after several losses); ad or purchase data is never used for it. Legal basis: Art. 6(1)(b) GDPR; for cheat prevention Art. 6(1)(f) GDPR (fair leaderboards).
If you link an email address, we store it and send you a 6-digit sign-in code. The code is stored only as a hash and expires after 10 minutes. Emails are sent via Resend (Resend, Inc., USA) as our processor on the basis of the EU Commission's Standard Contractual Clauses. We use your email only for signing in – no newsletter, no sharing. Legal basis: Art. 6(1)(b) GDPR.
Bloxplosion is funded by ads served by Google AdMob, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before the first ad we ask for your consent through Google's User Messaging Platform (IAB TCF); on iOS additionally through Apple's App Tracking Transparency.
Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). You can withdraw consent anytime in Settings → Privacy settings. More: Google Privacy Policy, How Google uses data from partner apps.
Our server is located in Germany at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, acting as our processor.
Account and game data are kept as long as your account exists. When you delete your account in the app, all data is deleted immediately; it disappears from our backups within 14 days. Sign-in codes expire after 10 minutes, IP hashes are deleted after 24 hours.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and you can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Export and deletion are available directly in the app. You may also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Providing the data under 3 b) and c) is necessary to use Bloxplosion, as it is played online. We use no other analytics or tracking services. Bloxplosion is not directed at children; persons under 16 should only consent to personalized ads with the approval of a parent or guardian. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.