Privacy Policy

Last updated: 26 October 2026

Polygamez respects your privacy. This Privacy Policy explains how we collect, use and protect information when you visit this website or use our mobile applications (the "App"), in particular PolyTowerz for iOS (App Store) and for Android (Google Play).

Sections 1 to 4 apply to the website and to both versions of the App. Section 5 applies only to the iOS App, section 6 only to the Android App.

• 1–3. General
• 4. Both Apps
• 5. iOS
• 6. Android

1. Privacy at a glance

General notes

The following notes provide a simple overview of what happens to your personal data when you visit this website or use our mobile App. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in the privacy policy below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Their contact details can be found in the section "Information on the responsible party" in this Privacy Policy.

How do we collect your data?

Some data is collected automatically or with your consent when you visit the website through our IT systems. This is primarily technical data (e.g. internet browser, operating system, or time of page access). The collection of this data takes place automatically as soon as you enter this website.

Data collection through use of the App

As part of your use of the App, we collect the following personal data:

• Usage data
• IP address
• Device identifier
• Random identifiers the App creates for you (no account, no name or email required)
• Game progress, where it is backed up or compared online (see sections 4 to 6)
• On Android only: crash reports, and the whole game save including the nickname you type (section 6)

The processing of this personal data is necessary to ensure the functionality of the App. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR, your consent within the meaning of Art. 6 para. 1 lit. a GDPR, or — where a contract has been concluded — the fulfilment of our contractual obligations (Art. 6 para. 1 lit. b GDPR).

What do we use your data for?

Part of the data is collected to ensure error-free provision of the website and the App. Other data may be used to analyse your usage behaviour.

What rights do you have regarding your data?

You have the right at any time to receive free information about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have a right of appeal to the competent supervisory authority. For these and other questions on the subject of data protection, you can contact us at any time.

2. Hosting

External hosting

This website is hosted by an external service provider (Hoster). The personal data collected on this website is stored on the Hoster's servers. This may primarily concern IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses, and other data generated via a website.

Hosting is provided by Google Ireland Limited ("Google"), a company registered and operated under Irish law (registration number: 368047) with registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Data processing may take place outside the European Union. Google is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as ensuring an adequate level of data protection (Art. 45 GDPR).

The use of the Hoster takes place for the purpose of contract fulfilment with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 para. 1 lit. f GDPR).

3. General information and mandatory disclosures

Data protection

The operator of these pages takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy.

When you use this website, various personal data is collected. Personal data is data with which you can be personally identified. This Privacy Policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the Internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data from access by third parties is not possible.

Information on the responsible party

The party responsible for data processing on this website and the App is:

Mustafa Karademir
Holbeinstraße 139
01309 Dresden
Germany

Phone: +49 1779 123 647
Email: contact.karademir@gmail.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Storage duration

Unless a more specific storage period has been stated within this Privacy Policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a justified request for deletion or revoke a consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, deletion takes place after these reasons no longer apply.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke a consent already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is carried out on the basis of Art. 6 para. 1 lit. e or f GDPR, you have the right at any time, for reasons arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defence of legal claims (objection pursuant to Art. 21 para. 1 GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is connected with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection pursuant to Art. 21 para. 2 GDPR).

Right of complaint to the competent supervisory authority

In the event of violations of the GDPR, those affected have a right of appeal to a supervisory authority, in particular in the Member State of their habitual residence, their workplace, or the place of the alleged violation. The right of appeal exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done insofar as it is technically feasible.

Information, deletion, and rectification

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipient, and the purpose of data processing and, if applicable, a right to correction or deletion of this data. For these and other questions on the subject of personal data, you can contact us at any time.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21 para. 1 GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data — apart from being stored — may only be processed with your consent or for the assertion, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

4. Mobile App disclosures (iOS and Android)

No account required

You do not need to create an account, and we do not ask for your email address or real name. The App creates random identifiers on your device (a player ID and an install ID) so that the services below can tell your copy of the game apart from others.

Analytics (Google Analytics for Firebase)

The App sends gameplay events to Google Analytics for Firebase, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for example: a level was started or finished, a tower was placed, a reward was collected). Firebase also processes an app-instance identifier, device and operating-system information, and your IP address, from which Google derives an approximate location (country or region). We do not send a user ID, your name or any other profile data. Where the law requires consent (for example in the EEA and the UK), we ask through Google's consent form when the App starts and respect your choice (the Android App sends no analytics events at all if you decline); you can change your choice at any time in the App's Settings. Legal basis: Art. 6 para. 1 lit. a GDPR where consent is required, otherwise Art. 6 para. 1 lit. f GDPR (our interest in improving the game). Data may be processed in the USA; Google is certified under the EU-U.S. Data Privacy Framework.

Advertising (Google AdMob)

The free App shows banner ads and optional rewarded video ads through Google AdMob (Google Ireland Limited). To deliver ads, measure them and detect invalid traffic, AdMob processes your device's advertising identifier, your IP address (and an approximate location derived from it), device information and your interactions with ads. Where the law requires consent, we ask through Google's consent form (Google User Messaging Platform) before personalised ads are shown; you can change your choice at any time in the App's Settings ("Privacy Options"). Platform-specific controls for the advertising identifier are described in sections 5 and 6. Legal basis: Art. 6 para. 1 lit. a GDPR where consent is required, otherwise Art. 6 para. 1 lit. f GDPR (financing the free game).

Referral programme

So that you can invite friends and receive in-game rewards for it, the App registers your random player ID and install ID with our referral server when it starts, together with your referral code and your best wave reached (used to decide when an invitation counts). The referral server runs on Supabase (Supabase, Inc.). To protect the rewards against fake installs, these requests carry a check from the platform that they come from a genuine copy of the App (Apple App Attest on iOS, Google Play Integrity on Android). No name, email or contact data is sent. Legal basis: Art. 6 para. 1 lit. b and f GDPR.

Co-op (playing with a friend)

When you host or join a co-op game, the App connects to our game server (mp.polygamez.karademir.app). It runs on a server we rent from Hetzner Online GmbH in Germany. While the game is being set up and played, the server receives: the name your partner sees (on iOS your Game Center alias, on Android your Google Play Games name, if you are signed in; otherwise a name the App makes up, like "Amber Warden 47"), the six-letter session code, a random player token the App creates, your game actions (for example where you build a tower), check values the two devices compare, your IP address, and a check that the request comes from a genuine copy of the App (Apple's App Attest service on iOS, Google Play Integrity on Android).

We need this to connect the two of you and keep both games in step (Art. 6 para. 1 lit. b GDPR). The server holds it in memory while the code is valid and the game runs, and drops it when the session ends. Two exceptions. If the two devices stop agreeing about the game, the server saves a small diagnostic file with the session code, the game actions and the check values (no names, no IP address) and deletes it after 30 days. Our web server logs IP addresses and deletes them after 14 days. Co-op data is not used for advertising and not passed on.

Your partner sees the name described above, nothing else about you. There is no chat. If you want a diagnostic file deleted before the 30 days are up, email us the session code.

Encryption

All data the App sends to the services in this Privacy Policy is encrypted in transit (HTTPS or secure WebSocket).

What we do not collect

We do not collect your email address, contacts, precise location, photos, or any other personally identifying information from within our games unless you choose to send it to us by email. The App does not ask for location permission; the only location information is the approximate location that Google derives from your IP address for analytics and ads, as described above. What happens to the nickname you can type in the App differs by platform (sections 5 and 6).

Deleting your data

To have your data deleted, email contact.karademir@gmail.com. Please include your referral code, which the App shows on its referral screen, so that we can find your records. We then delete the data we hold for you (on Android including your cloud save and its backup copies, see section 6, and on both platforms your referral record). Data held by Apple or Google under their own privacy policies (for example Game Center or Play Games scores) is managed in your Apple or Google account.

Children

Our games are intended for players aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe that we may have collected such data, please contact us so that we can delete it.

5. iOS App: Apple services

Game data & iCloud sync

Game progress, level completion, in-game currency, and settings are stored locally on your device and, optionally, synced via iCloud using Apple's CloudKit framework. We do not access or store this data on our own servers.

Diagnostic data

Anonymous crash logs and performance metrics may be collected via Apple's standard diagnostics service, only if you have opted in through iOS Settings → Privacy & Security → Analytics & Improvements.

App Tracking Transparency (ATT) & advertising

Some of our games may display advertising. Where advertising networks would collect the Identifier for Advertisers (IDFA) or comparable cross-app identifiers, this only occurs after your explicit consent via Apple's App Tracking Transparency prompt. You can revoke this consent at any time in iOS Settings → Privacy & Security → Tracking.

Apple Game Center & StoreKit

Our games may use Apple Game Center (leaderboards and achievements) and Apple StoreKit (in-app purchases). These services are operated by Apple Inc. and are governed by Apple's privacy policy. We receive only anonymised result data (e.g. high-score submissions) and transactional confirmations; we do not receive your Apple ID, payment details, or contact information.

Co-op and App Attest

In co-op, your partner sees your Game Center alias if you are signed in to Game Center, otherwise a generated name. The referral and co-op requests are checked with Apple's App Attest service (section 4).

6. Android App: Google services

Game data & cloud save (Google Firebase)

Your game is stored on your device. So that it survives a reinstall or a new device, the App also backs up the complete game save to Google Cloud Firestore, operated by Google Ireland Limited. For this, the App signs in to Firebase Authentication anonymously: Firebase creates a random user ID, without any name, email or password from you. The backup contains your game progress, level completion, in-game currency, settings, the random player and install IDs, the co-op name, and the nickname you typed in the App, if you entered one. When an update would remove progress from the cloud copy, the previous copy is kept as a backup (up to five copies). Only your own App can read or write your copy. Legal basis: Art. 6 para. 1 lit. b GDPR. The cloud copy is kept until you ask us to delete it (section 4). "Delete Everything" in the App's Settings resets your game and overwrites the cloud copy with the empty game, but does not remove the cloud document itself; to remove it, email us.

Crash reports (Firebase Crashlytics)

If the App crashes, Firebase Crashlytics (Google Ireland Limited) sends a crash report: the technical state of the App at the time of the crash, device model, Android version and a random Crashlytics installation identifier. It contains no name or contact data. We use it only to find and fix errors (Art. 6 para. 1 lit. f GDPR).

Advertising ID

On Android, AdMob and Firebase use the Android Advertising ID (section 4). You can reset or delete it at any time in your device's settings (Settings → Privacy → Ads, or Settings → Google → Ads, depending on the device).

Google Play Games Services

Leaderboards use Google Play Games Services, operated by Google. When you are signed in to Play Games, Google provides the App with your Play Games player ID and display name, and the App submits your scores to Google's leaderboards, where other players can see them with your Play Games name. In co-op, your Play Games display name is the name your partner sees. If you are not signed in, leaderboards stay local and co-op uses a generated name. Play Games is governed by Google's privacy policy.

Google Play Integrity and install referrer

Referral and co-op requests are checked with Google Play Integrity, which tells our servers whether the request comes from a genuine copy of the App installed from Google Play (Art. 6 para. 1 lit. f GDPR: preventing fraud and abuse). If you installed the App through a friend's invitation link, the App reads the referral code from the Google Play Install Referrer service to credit the invitation.

On-device AI

AI features in the Android App run entirely on your device (Gemini Nano via Google's on-device AI, where your device supports it). Nothing you do with these features is sent to us or to a server.

Highlight clips

You can record a video clip of your own gameplay. Recording starts only when you tap Record and confirm Android's screen-recording prompt. The clip is video only, without audio, stays on your device, and leaves it only if you share it yourself through Android's share sheet.

Source of the GDPR template sections: e-recht24.de