Privacy Policy

This privacy policy explains how we collect, use, and protect your personal data in connection with our app "Whistle1" (Anpfiff1) and related websites.

1. Data Controller

2. Data Processing in the App

2.1 Local Save Games

Whistle1 stores save games and settings locally on your device. This data is not transmitted to our servers unless you use optional cloud features.

2.2 Online Leaderboard

When you upload your career results to the online leaderboard, the following data is processed:

• Your chosen player name (pseudonym)
• Game statistics (points, titles, seasons)
• Difficulty level
• Timestamp

Legal basis: Art. 6(1)(a) GDPR (consent)

3. Google Play Games Services (Android)

The Android version of Whistle1 uses Google Play Games Services for the following features:

• Sign-in: Automatic sign-in with your Google account
• Achievements: Unlocking achievements
• Cloud Save: Optional – save games to Google Cloud

By using Google Play Games Services, data is transmitted to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). For more information, see the Google Privacy Policy.

Legal basis: Art. 6(1)(a) GDPR (consent upon sign-in); Art. 6(1)(b) GDPR for purchase verification.

4. Apple App Store, Game Center & iOS

The iOS version of Whistle1 is distributed via the Apple App Store (for EU users: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; worldwide: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA). Apple is the independent controller (Art. 4(7) GDPR) for personal data processed in connection with your Apple ID, the App Store, Game Center and iOS.

4.1 App Store – Download, Update, Payment

When downloading, updating or purchasing, Apple processes under its own responsibility your Apple ID, purchase and download history, device and network information (including IP address and device identifiers) and payment information. As the developer we do not receive any direct identifying data (no Apple ID, no email address, no payment data), only aggregated statistics (e.g. App Store analytics, downloads per region) and revenue reports via App Store Connect.

Details: Apple App Store & Privacy.

4.2 Apple Game Center

Whistle1 integrates Apple Game Center for achievements, leaderboards and optional friend networking. When you use Game Center, Apple processes under its own responsibility in particular:

• Nickname, avatar, Game Center ID and, if applicable, Apple Arcade status
• Games played, timestamps and duration, scores, achievements, challenges
• List of Game Center friends and recent co-players, joint play times
• Device and software version, game controller usage
• Approximate location (derived from IP address)
• Interactions with Game Center UI (views, clicks)

As the developer we only receive from Apple your Game Center nickname, avatar and pseudonymous Game Center ID to display in in-game leaderboards and – only if you explicitly allow it – a list of related players (likewise pseudonymous). We receive no Apple ID, no email address and no payment data.

Details: Apple Game Center & Privacy.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment) for achievements and leaderboards; Art. 6(1)(a) GDPR (consent) for friend networking.

4.3 In-App Purchases via Apple StoreKit 2

See section 6 – In-App Purchases.

4.4 Crash Reports & Apple Diagnostic Data

iOS only transmits crash and diagnostic data to Apple and to us if you have enabled this in Settings → Privacy & Security → Analytics & Improvements. The data is pseudonymized and does not contain directly identifying content. We use it for bug fixing and product improvement.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in bug fixing); additionally Art. 6(1)(a) GDPR upon your voluntary opt-in.

4.5 TestFlight (Beta Program)

If you participate in the TestFlight beta program, Apple processes your TestFlight name or email address, your participation status and any feedback you send (including screenshots and crash logs). We receive pseudonymous tester IDs and the submitted feedback.

Legal basis: Art. 6(1)(a) GDPR (consent via TestFlight participation).

5. Steam (Valve Corporation)

The PC version of Whistle1 is distributed via Steam, operated by Valve Corporation, P.O. Box 1688, Bellevue, WA 98009, USA. Valve is the independent controller (Art. 4(7) GDPR) for personal data processed in connection with your Steam account, downloads, purchases, community features and gameplay via Steam.

5.1 Data processed by Valve

When you purchase, download or play Whistle1 via Steam, Valve processes under its own responsibility:

• Account data: email address, country of residence, Steam username, password, Steam ID
• Payment information (e.g. name, address, credit card or other payment data)
• Gameplay: playtime, progress, achievements, Steam leaderboards
• Device and connection data: IP address, operating system, hardware/device identifiers
• Crash reports and telemetry
• Community content: forum posts, Steam chat messages, reviews, user-generated content
• Cookies, pixels and advertising tags on the Steam websites

Details and rights (including data download via the Steam Privacy Dashboard): Valve/Steam Privacy Policy.

5.2 Data we receive as the developer

Via Steamworks we only receive from Valve:

• Your Steam ID and persona name (pseudonyms) when you use Steam leaderboards or achievements
• Achievement and leaderboard data from your playthrough
• Aggregated statistics and anonymized crash reports
• Purchase and license verifications (product ID, transaction token) – no payment data

We receive no direct identifying data (name, email, address) and no payment data.

5.3 Steam Cloud (optional)

If you enable Steam Cloud, your save games are stored encrypted on Valve's servers. This is optional and can be disabled in your Steam settings.

5.4 Steam Community features

If you publish screenshots, reviews, guides, forum posts or Workshop content for Whistle1 via Steam, processing is carried out solely by Valve. Such content is publicly visible to other users.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment) for purchase and provision of the game; Art. 6(1)(a) GDPR (consent) for optional community and cloud features.

6. In-App Purchases

Whistle1 offers optional in-app purchases. Payment processing is handled exclusively by the respective platform. We do not receive any payment data (no credit card numbers, no PayPal account, no bank details). Our servers only receive server-verifiable purchase tokens to prevent duplicate rewards and manipulation (hardened IAP system with transaction tracking and audit log).

6.1 Google Play Billing (Android)

• Purchase confirmation (product ID, timestamp)
• Transaction ID / purchase token for verification

Provider: Google Ireland Limited / Google LLC (see section 3).

6.2 Apple StoreKit 2 (iOS)

On iOS, in-app purchases and subscriptions are handled exclusively via Apple's StoreKit 2 interface. From Apple we receive:

• Product ID and purchase timestamp
• Signed transaction/receipt ID (JWS) for server-side purchase verification

Provider: Apple Inc. / Apple Distribution International Ltd. (see section 4).

6.3 Steam (Valve)

Purchases of the PC version and any DLC/additional content are billed exclusively by Valve. We only receive the purchase and license verification via Steamworks.

Legal basis (all platforms): Art. 6(1)(b) GDPR (contract fulfillment).

7. Advertising (Google AdMob)

The free Android version of Whistle1 displays ads via Google AdMob. No advertising is shown on iOS or in the Steam version. When AdMob is used, the following data may be processed:

• Your device's advertising ID
• Approximate location (based on IP address)
• Device and app information
• Interactions with advertisements

You can disable personalized advertising in your device's Google settings. With the "Ad-Free" purchase, no ads will be displayed.

More information: Google Advertising & Privacy

Legal basis: Art. 6(1)(a) GDPR (consent via consent dialog).

8. Analytics & Crash Reports

We use anonymized or pseudonymized crash reports and basic usage statistics to fix bugs and improve the app. Depending on the platform, this data is collected through the following services:

• Android: Google Play Console / Android Vitals (anonymized)
• iOS: Apple Analytics & crash logs – only if you enabled this in iOS settings
• PC (Steam): Steamworks crash reports (anonymized)

No directly identifying data is collected. IP addresses – where captured at all – are processed in truncated form.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in app stability and improvement).

9. International Data Transfers

Where data is transferred to providers in the United States (Apple Inc., Google LLC, Valve Corporation), the transfer is based on appropriate safeguards under Chapter V GDPR:

• EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023) for self-certified companies.
• Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), supplemented by additional safeguards where necessary.

Apple Inc. and Google LLC are certified under the EU–US Data Privacy Framework. For Valve Corporation, Standard Contractual Clauses apply; further information is available in Valve's privacy policy.

10. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority.

11. Contact

For privacy-related questions, contact us at:

12. Whistle1 World Tournament Edition

This policy also applies to the app Whistle1 World Tournament Edition (in German "Anpfiff1 Retro WM Edition", package com.anpfiff1.wmedition). Sections 1 to 11 apply accordingly. This app shows no advertising (section 7) and uses no third-party analytics or tracking services (the optional, anonymous counters in 12.5a run on our own server). No account or login is required. The following points concern the World Tournament Edition only.

12.1 Device identifier

On first launch the app creates a random identifier and stores it on the device. It is not an advertising ID and is not linked to your Google account. It is only used to assign the online features below to your device and to delete them on request.

12.2 Worldwide leaderboard

After a finished tournament the app offers a form on the leaderboard screen. The result is only sent to our server when you tap "Submit Highscore" there; without that step nothing leaves the device. Tournaments in which values were changed in the editor or a third-party database is loaded cannot be submitted. We process:

• the coach name entered in the form (free choice, no real name needed)
• optionally your email address: never public, only used for questions about your entry, deleted automatically after 90 days
• nation, strength group, difficulty level, round reached and final placement
• match record (wins, draws, losses, goals, clean sheets), popularity values and score
• platform, app version, game language, time
• the device identifier and a hash of the IP address (keyed, to prevent abuse)

Publicly visible are coach name, nation, strength group, result, record, difficulty level, score, platform and date: in the game, on anpfiff1.de/wm-bestenliste.en.html and in our community Discord channel (see 12.7). The device identifier and IP hash are never shown. Coach names with offensive content are rejected or hidden by us. With the same tap the app also submits the score to the Google Play Games leaderboard (section 3) if you are signed in there.

Legal basis: Art. 6(1)(a) GDPR (consent by submitting, revocable at any time via 12.8) and Art. 6(1)(f) GDPR (protection against manipulation). Retention: email 90 days, everything else until you delete the data (12.8).

12.3 Cloud saves and changing devices

With the Pro version, save games are additionally stored on our server after saving; you can turn this off under "Cloud sync" in the game options. Your own editor databases are backed up only when you tap the button. We store the file, its size, a checksum and details of the save (e.g. coach name, nation, matchday). With a transfer code (valid for 7 days) you link a second device, which then accesses the same saves. Legal basis: Art. 6(1)(b) GDPR. Retention: until deleted, at the latest one year after the last change. On our server, save games are not included in backups. On your phone, Android backup (a setting of your device, Google account) may back up the local save game together with the device identifier and unlocks.

12.4 Sharing editor databases

If you publish a database via "Share online", we store it together with the name, author and description you entered and the device identifier. Name, author, description and content are visible to and downloadable by all players. For "Like" and "Report" we store the device identifier so that each vote counts once; after three reports a database is hidden until reviewed. Legal basis: Art. 6(1)(a) GDPR (publication at your request) and (f) (protection against unlawful content). Retention: until deleted by you or us.

12.5 Error reports

The app collects error messages on the device only. A report is sent when you view it in the options and tap "Send report", or automatically at start-up if you agreed to "Send anonymous error reports and usage counters?". It contains exactly the text shown in the options (app version, operating system, device model, language, error messages) and no device identifier. Legal basis: Art. 6(1)(a) GDPR. Retention: 180 days.

12.5a Usage counters

Only with the same consent, the app counts individual events such as "demo match finished", "first match finished" or "tournament finished". It sends the event, the app version and the platform. Only daily totals per event, version and platform are stored, without any device identifier or IP address; they cannot be traced back to you. You can withdraw consent at any time under Options, "Error report". Legal basis: Art. 6(1)(a) GDPR.

12.6 Contact form

Messages sent via the contact form in the main menu are stored with your email address, app version and platform and forwarded to our support mailbox so we can reply. Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: one year, earlier on request.

12.7 Recipients

• Hosting: server and database are hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, where technically required server log files with IP addresses are kept for 7 days.
• Discord: new leaderboard entries and the current top 10 are posted automatically to the #wm-highscores channel of our Discord server (Discord Inc., San Francisco, USA). Only the already public details from 12.2 are transferred. For new error reports a short note (number, first error line, app version) goes to a non-public moderation channel. Legal basis: Art. 6(1)(f) GDPR; transfers to the USA rely on the safeguards named in section 9.
• Google: in-app purchases, achievements and the Play leaderboard are handled by Google (sections 3 and 6). Purchase data (payment methods, receipts) does not reach our server; the leaderboard submission only states whether the Pro version is unlocked (yes or no).

No data is passed on for advertising or any other purpose. All connections are encrypted (HTTPS).

12.8 Deletion

Under Options → Game Options → Privacy & Account → "Delete Account & Data" the app deletes your local save games and requests deletion of all data linked to your device identifier on our server: leaderboard entries, cloud saves, shared databases, likes, reports and transfer codes. The device then receives a new identifier. Database backups are overwritten after at most 14 days, backups of shared databases after at most five weeks. For contact form messages or any other request, an email to info@digitale-manufaktur-rudolstadt.de is enough. Your rights under section 10 apply in full.

Last updated: October 2026
Version: 2.1 (Android, iOS & Steam; WM Edition)