Privacy policy

For the Schleimchen app (Android and iOS) and this website. Last updated: 3 November 2026. This is a translation; the German version is legally binding.

1. Controller

Moritz Lintterer
Wehrstraße 13
84508 Burgkirchen an der Alz
Germany
Email: [email protected]

Schleimchen is developed and published by Moritz Lintterer as a sole trader. No data protection officer has been appointed, as there is no obligation to do so.

2. Principles

Schleimchen only collects data needed for the game, purchases, ads in the free mode and fixing bugs. The publisher does not track you across other apps and does not sell data. The game does not ask for names, phone numbers, contacts, location, photos or the microphone. The game uses the camera only for the friend scan (section 5).

3. Save game on your device Active

The game stores your save game and settings locally on your device. As long as you do not use online features, no personal data is transferred to the publisher. If you delete the app or its data, the save game on your device is gone.

4. Online account and game server Planned

For cloud saves, guilds, the PvP arena, events, reports and messages, and so that runs, rewards and purchases cannot be manipulated, the game uses its own game server (Nakama, open-source software by Heroic Labs, run by the publisher). Server and database are hosted by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, as a processor in a data centre in the EU.

• Account: The game creates the account automatically as soon as you use online features. It is initially tied to a random device identifier generated by the app itself (not a hardware identifier). The game does not ask for your name, email address or phone number. If you like, you can additionally and voluntarily link the account with Google or Apple (see below).
• Data: random player ID and device identifier, only if you link your account: the user identifier from Google or Apple (see below), slime name (visible to others, for example in friend lists, guilds, leaderboards and the PvP arena), friend list, friend requests and blocks, player profile (your slime's look, highest floor, classes and class levels, PvP rating, saved loadouts; you choose whether others may see it: public, friends only or private), leaderboard entries (for example world boss damage), cloud save, guild membership, guild chat messages and contributions to the guild boss, PvP rating, history and loadout, event progress and reward claims, reports with their text, support ID, app version and device type, confirmations of watched reward ads, deletion code for the website (additionally stored on the server only as a hash for matching), timestamps, technical logs including IP address; later also run stock, battle results and purchase status (which tier is unlocked).
• Purpose: providing the online account, backing up your save game, running friends, profiles, leaderboards, guilds, chat, PvP and events, verifying progress and rewards on the server, handling reports, preventing abuse.
• Legal basis: Art. 6(1)(b) GDPR (providing the game); for abuse prevention, moderation and logs Art. 6(1)(f) GDPR.
• Retention and deletion: until you delete the account. You can do so at any time in the game under Settings › “Delete account” or on the website with the deletion code from the game, and it takes effect on the server right away; details under Delete account. Server logs and backups for at most 14 days. Reports by other players about one of your chat messages are kept for moderation.
• Recipients: Contabo processes the data as a processor under Art. 28 GDPR only on the publisher's instructions; the data stays in the EU. Other players only see the details named above as visible.

Linking your account with Google or Apple (voluntary)

Without linking, your save game only lives on this device and its random device identifier. If you want to take it to a new device or bring it back after reinstalling, you can link your game account with Google (on Android, “Sign in with Google” via the Android Credential Manager) or Apple (on iOS, “Sign in with Apple”) under Settings › “Link account”. This is voluntary; all game features also work without linking.

• Data: The user identifier (the “sub” ID from the sign-in token) from Google or Apple, tied to your game account and your cloud save. The game does not take over your name, email address or profile picture; the server clears these fields. For Apple, the server also stores a refresh token from Apple so that it can revoke the link with Apple when you delete your account; it is deleted together with the account.
• Purpose: taking your save game to a new device or restoring it after reinstalling (cloud save), recognising your account when you sign in.
• Legal basis: Art. 6(1)(b) GDPR (providing this feature of the game at your request; you trigger the link yourself).
• Retention and deletion: until you delete the account; deleting it (in the game or on the website, see above) also removes the link and the stored user identifier.
• Google and Apple as separate providers: During sign-in itself, Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA) or Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; Apple Inc., USA) process data under their own responsibility, for example that and when you sign in. Their privacy policies apply: Google, Apple. The publisher receives only the sign-in token with the user identifier from them.
• Third countries: Google and Apple may transfer data to the USA; the EU-US Data Privacy Framework or the providers' EU standard contractual clauses apply.
• Platform: Android offers only Google, iOS only Apple. Moving your save game between Android and iOS is therefore not possible.

5. Camera for the friend scan Planned

To add friends, the game can scan the star ring around a friend's slime with the camera. The game asks for the camera permission only when you tap "Scan a slime".

• Processing on the device only: The live camera images are analysed only on your device to read the ring. They are not stored, not uploaded and not shared.
• What goes to the server: Only the short-lived scan token read from the ring, so that the game server adds you as friends (see section 4, online account and friends). Legal basis: Art. 6(1)(b) GDPR.
• Permission: You can revoke camera access at any time in your device's system settings. Friends can also be added without a camera by using the friend code.

6. Advertising (Google AdMob with UMP) Planned

In the free “Basic” tier the game shows ads: once when an Auto-run starts, and voluntarily when you watch an ad for a reward: new jewels or new snacks from the merchant, an extra run when your run supply is empty, or double loot after a victory (both with a daily limit). Pro and Premium are ad-free. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

• Consent: Before the first ad, the game asks for your consent using Google's User Messaging Platform (UMP). Personalised ads are shown only with consent; without it AdMob shows non-personalised or limited ads. You can change your choice at any time with “Change ad consent” in the game's settings (the button appears where consent applies to you, for example in the EU).
• Data: the device's advertising ID (Android advertising ID or IDFA, the latter only if permitted by iOS), IP address, device type, operating system, app version, interactions with ads, approximate location derived from the IP address. On iOS the game asks for App Tracking Transparency (ATT) permission as soon as ads may be loaded; the IDFA is only used with your permission.
• Legal basis: For personalised ads and for storing and reading information on your device (such as the advertising ID), your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent AdMob only shows limited ads without such access; for these and for selecting non-personalised ads the legal basis is Art. 6(1)(f) GDPR (funding the free game).
• Google as a separate controller: Google also processes ad data for its own purposes (such as fraud prevention, measurement and, with consent, personalisation) under its own responsibility; Google's privacy policy applies.
• Confirmation of watched ads: So the server can check whether a Basic Auto-run is unlocked or an ad reward is due, AdMob sends a confirmation (server-side verification) with your player ID, the kind of reward and the ad event to the game server. For this, the game passes the player ID of your online account and the kind of reward to AdMob when it loads a rewarded ad; without signing in, neither is passed.
• Third country: Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. More: How Google uses information from apps.

7. In-app purchases (Google Play Billing, Apple StoreKit) Planned

The Pro and Premium tiers are one-time purchases. Payment is handled by Google (Google Play Billing) or Apple (StoreKit, Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). The publisher never receives payment details such as card numbers.

• Data: purchase receipt or purchase token, transaction ID, product, time of purchase, country/currency, status (valid, refunded).
• Purpose: verifying the purchase, unlocking the tier, restoring purchases on a new device.
• Legal basis: Art. 6(1)(b) GDPR; for keeping proof of purchase Art. 6(1)(c) GDPR.
• Retention: as long as the account exists; proof of purchase for up to 10 years where required by law.

8. Purchase verification by the game server Planned

Purchase receipts are verified by the game's own server (section 4) directly with Google (Google Play Developer API) or Apple (App Store). For this, the receipt, product and transaction ID are sent to the game server together with your player ID; it stores the result and the unlocked tier with your account. The store reports refunds to the server, which then removes the tier again. No additional service provider is used for purchase management. Legal basis: Art. 6(1)(b) GDPR.

9. Crash reports (Sentry) Optional

To fix crashes and bugs, Sentry (Functional Software, Inc., USA) may be used with data storage in the EU. A crash report would contain the error message and code location, device type, operating system, app version and time, but no player ID, no name and no save game; IP addresses would not be stored. It could be switched off in the settings. The legal basis would be Art. 6(1)(f) GDPR (a stable, bug-free game). Reports would be deleted after at most 90 days. Whether Sentry will be used has not been decided yet.

10. App stores Active

Downloads, updates, ratings and payments go through Google Play or the App Store. Google and Apple are responsible for this themselves; their privacy policies apply. The publisher only receives aggregated statistics from the stores (e.g. installs, crash rates) that do not identify you.

11. Support requests Active

If you send an email, your address, your message and any details you include (e.g. player ID, device) are processed to answer your request (Art. 6(1)(b) or (f) GDPR). The same applies to the contact form on the support page (name optional, email address, message): a Cloudflare Worker (Cloudflare, Inc., see section 12) forwards it to the publisher as an email and does not store it; your IP address is only used briefly to accept at most five messages per minute and so prevent abuse. Emails to [email protected] and messages from the form are forwarded by Cloudflare (Email Routing), as a processor, to the publisher's mailbox at Google (Gmail; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where they are stored and answered; Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework. The correspondence is deleted once the request is settled and no retention obligation applies, at the latest after two years.

12. This website Active

This website sets no cookies, uses no analytics and loads no third-party content; fonts and images are served from the same server. It is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages), as a processor; Cloudflare is certified under the EU-US Data Privacy Framework, which permits transfers of data to the USA. When you visit it, the host processes technically necessary data (IP address, time, page requested, browser) in server logs to deliver and secure the site (Art. 6(1)(f) GDPR). The form on the Delete account page sends the deletion code to the game server (section 4); the contact form goes to the Cloudflare Worker from section 11.

13. Children

Schleimchen is meant for players aged 13 and over and is not specifically directed at children under 13. The game does not ask for your age; personalised ads are only shown with consent given through the UMP prompt (section 6). If you are under 16, you may only give this consent with your parents' permission (Art. 8 GDPR); otherwise please decline personalised ads in the prompt.

14. Your rights

You can delete your online account and its data yourself at any time, in the game under Settings › “Delete account” or on the Delete account page with the deletion code from the game. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21, see below). You can withdraw consent at any time with effect for the future (Art. 7(3)); for ads via “Change ad consent” in the game's settings. Write to [email protected].

You are not obliged by law or contract to provide data. Without the data named in section 4 you cannot use the online features; the game itself also works offline. The publisher does not make automated decisions, including profiling, under Art. 22 GDPR.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for the publisher: Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

15. Notes for players in Japan

For users in Japan, the Japanese Act on the Protection of Personal Information (APPI) also applies. The publisher is based in Germany; the game server and database are located in the EU, where the GDPR applies. The EU and Japan have recognised each other as providing an adequate level of data protection. The website, the contact form and support emails also run through Cloudflare and Google, which may transfer data to the USA (sections 11 and 12). To protect the data, the publisher uses, among other things, encrypted connections (TLS), server access only with SSH keys behind a firewall, regular security updates and deletion of server logs after 14 days. Please send requests for disclosure, correction, deletion or suspension of use, as well as complaints, to [email protected].

16. Changes

This privacy policy will be updated as soon as a planned service becomes active or a service changes. The version published here applies; the game announces material changes.