Privacy Policy – Block Puzzle Brain Games (iOS and Android)

Last updated: 25 October 2026

1. Scope and overview

This Privacy Policy applies to the game “Block Puzzle Brain Games” for iOS and Android and to the related services provided through api.peppertools.de.

Block Puzzle Brain Games is a puzzle game. It needs no account and no sign-in. Your progress, your Gold Blocks, your items from the shop and your settings are stored on your device. Data leaves your device only when you use one of the functions described in this policy: the backup of your progress, recognition of your installation, advertising, gifts, ideas and bug reports, the display of more games, and purchases with real money.

The game shows ads through Google AdMob. In the European Union, the European Economic Area, Switzerland and the United Kingdom we ask for your consent before the first ad is shown. We do not sell personal data.

2. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Charles Imilkowski

PepperTools

Stubbenweg 29

27753 Delmenhorst

Germany

Email: support@peppertools.de

No data protection officer has been appointed.

3. Data stored locally on your device

The game stores on your device:

  • your progress: completed levels per theme, unlocked themes and the layers of your towers;
  • your Gold Block balance;
  • your items from the shop: your stock of Hammer, Colour vacuum, Time freeze, +30 seconds, Level skip and Theme keys, and the levels in which you stopped the time;
  • which purchases with real money are unlocked for your installation;
  • which gifts have already been credited;
  • your settings: language, volume and vibration;
  • which hints you have already seen;
  • your decision regarding advertising consent;
  • how many ads and videos you have seen on the current day, and when the last one was;
  • when the game last asked you for a rating in the store;
  • the list of more games last fetched, with its pictures (section 11).

Uninstalling the app removes the local data. Exception on iOS: the token of your installation (section 5) is kept in the keychain. It remains after the app is deleted, so that a reinstallation is recognised as the same installation. A backup of your progress remains in your Google account or your iCloud (section 4).

The legal basis is Art. 6(1)(b) GDPR (provision of the game).

4. Backup of your progress

So that your progress survives a reinstallation, the app backs up its data through your device’s backup function:

  • on Android through the automatic backup to your Google account. The data from section 3 is backed up, except for the list of more games with its pictures and the token of your installation;
  • on iOS in the iCloud key-value storage of your Apple ID. Your game save is backed up.

The data is stored solely in your account with Google or Apple. We have no access to it. After a reinstallation the app retrieves the backup and takes it over if it contains more progress than the data on the device. You can turn the backup off in your device settings.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to preserve your progress.

5. Recognising your installation (device identity without an account)

Block Puzzle Brain Games has no account. So that our server can still recognise your installation, for example for reports, gifts and purchases, the app registers a pseudonymous device identity with api.peppertools.de once, on first start. You see nothing of this and do not have to enter anything.

The following is transmitted:

  • on Android: the Android ID of your device (Settings.Secure.ANDROID_ID) and an integrity verdict from Google Play (Play Integrity) confirming that the app is running unmodified on a genuine device;
  • on iOS: the app’s download confirmation signed by Apple (AppTransaction) and a random identifier generated by the app and kept in the iOS keychain;
  • device model, operating system version and app version;
  • the language and region setting of your device, for example “de-DE”;
  • the country of your store account (App Store or Google Play).

Our server stores the device numbers only in hashed form and returns a random token to the app. This token is stored securely on the device (iOS: keychain; Android: encrypted with a key from the Android Keystore) and sent along with later calls to api.peppertools.de. It contains no information about you as a person. In addition, the app receives a random purchase identifier that is used for purchases with real money (section 8). We do not link the Android ID with your device’s advertising ID.

The purpose is to assign your reports, gifts and purchases to your installation and to protect our services against abuse. The legal basis is Art. 6(1)(b) GDPR for providing these functions and Art. 6(1)(f) GDPR for abuse prevention. Our legitimate interest is to grant gifts and purchases only once per installation.

Google processes the Play Integrity verdict and Apple the AppTransaction under their own responsibility. For more information see the Google Privacy Policy and the Apple Privacy Policy.

A reinstallation or a change of device may result in a new identity. Reports and unredeemed gifts of the old identity are then no longer reachable from the app. You get purchases with real money back through Restore purchases (section 8).

6. Advertising with Google AdMob

6.1 Which ads there are

Block Puzzle Brain Games is free and financed by ads from Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. There are two kinds:

  • Ads after a level: never in the first theme, after that at most six times a day, never in the middle of a level.
  • Videos on your request: you start them yourself, in the main menu for Gold Blocks or in a level for 30 more seconds when the time has run out. No such video is shown without your tap.

6.2 Which data is processed

When loading and showing ads, Google processes in particular:

  • the advertising ID of your device (Android: Google Advertising ID; iOS: IDFA, only with your permission for app tracking);
  • IP address and the approximate location derived from it;
  • device model, operating system, language, screen size and network information;
  • app name and app version;
  • information about the ad: which ad was loaded, viewed, completed or tapped;
  • your consent decision.

Google uses this data to select, deliver, measure and bill ads and to protect against fraud. With your consent, ads may be tailored to you; without consent Google shows non-personalised or limited ads. How Google processes data from apps that use Google services is described in “How Google uses information from sites or apps that use our services” and in the Google Privacy Policy.

We ourselves receive no personal data from Google, only aggregated reports on impressions and revenue.

6.3 Consent and withdrawal

In the European Union, the European Economic Area, Switzerland and the United Kingdom the app shows you a consent request through the Google User Messaging Platform before the first ad. There you decide whether Google and its advertising partners may use your data for personalised advertising. Your decision is stored on your device.

You can change your decision at any time with effect for the future: in the app under Settings → Privacy settings. Withdrawal does not affect the lawfulness of processing carried out before it.

The legal basis for personalised advertising is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. The legal basis for non-personalised advertising is Art. 6(1)(f) GDPR. Our legitimate interest is to be able to offer the game free of charge.

6.4 App tracking on iOS

On iOS the system additionally asks you whether Block Puzzle Brain Games may track your activity across other companies’ apps and websites (App Tracking Transparency). If you decline, Google does not receive the IDFA. You can change the permission at any time in the iOS settings under Privacy & Security → Tracking.

6.5 Turning ads off

With the purchase “No ads” (section 8) the game shows no more ads after levels. You can still watch the videos you start yourself. Only then does the app still load ads from Google, with the data listed in section 6.2.

7. Gold Blocks, shop and gifts

Gold Blocks are an in-game currency with no monetary value. You receive them for completed levels and for videos you start yourself in the main menu. In the shop you exchange them for items such as Hammer, Colour vacuum, Time freeze, +30 seconds, Level skip or a Theme key. Gold Blocks and these items are stored only on your device (section 3). No data is transmitted to us for this.

We may give you a gift, for example as a thank-you for a helpful report or as compensation if you complain about something in a report. A gift contains Gold Blocks. When you open Ideas and bugs, the app asks api.peppertools.de whether gifts are waiting for you. They appear at the top there, and you redeem them yourself with a tap. The app never asks for gifts on its own. In doing so api.peppertools.de processes:

  • the pseudonymous device identity from section 5;
  • which gift we assigned to you and when you redeemed it.

The purpose is that every gift is credited only once. The legal basis is Art. 6(1)(b) GDPR.

8. Purchases with real money (in-app purchases)

In the shop you can buy single items with real money: “No ads”, the “Starter pack” and packs of Gold Blocks. The purchase is processed on iOS through the Apple App Store and on Android through Google Play. Apple or Google processes your payment method and payment data under their own responsibility. We do not receive credit card, bank account or other payment instrument data.

This is how a purchase works:

  • When you buy, the app hands the random purchase identifier of your installation (section 5) to the store, on iOS as the app account token, on Android as the obfuscated account ID. This lets the purchase be assigned to your installation without us knowing your Apple or Google account.
  • After the purchase, the app sends the purchase receipt signed by the store to api.peppertools.de. The server checks the receipt with Apple or Google, acknowledges Google purchases to Google and unlocks the item for your installation. Only then does the app credit the item and complete the purchase in the store.
  • Apple and Google report refunds and revocations directly to our server. The item concerned is then no longer unlocked on the server.

Restoring: With Restore purchases the app sends the purchases that your store account holds for Block Puzzle Brain Games to api.peppertools.de. This works after a reinstallation and on another device with the same Apple ID or Google account. The purchase then moves to the installation that restores it. The previous installation loses it.

We can also give you an item from the shop as a gift, for example as compensation after a report. It is then assigned to your installation like a purchase.

In doing so the respective store and api.peppertools.de process:

  • the product identifier of the item;
  • signed transaction data or a purchase token;
  • transaction or order identifier, time of purchase, price and currency, and refund status;
  • the pseudonymous device identity from section 5 and the purchase identifier;
  • when a purchase moves, which installation it came from.

The legal basis is Art. 6(1)(b) GDPR for performance of the contract, Art. 6(1)(c) GDPR for statutory retention obligations and Art. 6(1)(f) GDPR for preventing duplicate unlocks and for fraud prevention. For more information see the privacy terms of Apple and Google.

9. Ideas and bug reports

In the app, under Settings → Ideas and bugs, you can voluntarily report a bug or request a feature. No account is needed; your report is assigned to your pseudonymous device identity from section 5 so that we can reply to you.

When you submit a report, the following is transmitted to api.peppertools.de and stored there:

  • the report text you entered;
  • the type of report (bug or feature request);
  • the language selected in the game;
  • app version, operating system version and model name of your device;
  • your later replies in the course of the report.

You decide what the report text contains. Please include only what is needed to describe the problem or wish. The function does not accept screenshots or file attachments.

The purpose is to process your report, fix bugs and develop the game further. The legal basis is Art. 6(1)(b) GDPR for handling your request and Art. 6(1)(f) GDPR for our legitimate interest in a working game. Device model, operating system version and app version are transmitted because a bug usually cannot be classified without them.

You can withdraw a report yourself as long as we have not yet processed it; it is then permanently deleted together with its history. Once we have assigned a status or replied, it remains. The game can be used without restriction without this function.

10. Request for a rating

After the first completed theme and later at longer intervals, the game asks you for a rating in the App Store or on Google Play. For this the operating system shows the rating dialog of Apple or Google. The store decides whether it appears. The game does not learn whether or how you rate, and transmits no data to us for this. Apple or Google processes a rating under its own privacy terms.

11. API communication and server logs

Connections to api.peppertools.de generate technically necessary connection and log data. This may include:

  • IP address;
  • date and time;
  • HTTP method, requested API path, status code and amount of data transferred;
  • device and operating system information and user agent;
  • correlation identifier, platform used and limited technical error details;
  • for purchase events, the required transaction and status identifiers.

More games: In the main menu the game shows other games by PepperTools. For this it fetches the list from api.peppertools.de at most once a day and loads the pictures for it from www.peppertools.de. The game sends only its platform, no device identifier and nothing about which games you tap. Only the connection data listed here is generated. Tapping a game opens the App Store or Google Play, where the privacy terms of Apple or Google apply.

This data serves the delivery of the service, error analysis, stability, rate limiting, abuse and fraud prevention and IT security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the game and its interfaces.

API application and error logs are regularly stored for seven days. Technical server access logs are regularly stored for up to 30 days. In the event of a specific security incident, affected extracts may be kept longer until the incident is resolved. We do not intentionally write authentication tokens to logs.

12. Hosting, recipients and processors

We transfer personal data only where this is necessary for a described function, secure operation or a legal obligation. Recipients may be:

  • WIIT AG, Joachim-Erwin-Platz 3, 40212 Düsseldorf, Germany, as infrastructure and hosting provider of our rented server;
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for advertising (AdMob), the consent request (User Messaging Platform), Play Integrity, and purchases, purchase verification and purchase notifications through Google Play;
  • Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, for the AppTransaction, and purchases, purchase verification and purchase notifications through the App Store.

Where service providers act on our behalf, they are contractually bound to data protection, confidentiality and appropriate security measures. When delivering ads, Google is an independent controller bound by its own statutory data protection obligations.

13. Transfers to third countries

Our own server is operated in Germany. For Google and Apple, processing by affiliated companies or sub-processors outside the European Union or the European Economic Area, in particular in the USA, cannot be excluded. Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework. Where no adequacy decision of the EU Commission exists for a recipient country, transfers are based on appropriate safeguards, in particular the EU Commission’s Standard Contractual Clauses under Art. 46 GDPR.

14. Retention periods

  • Local game data: until you uninstall the app; on iOS the token remains in the keychain (section 3).
  • Backup of your progress: in your Google account or your iCloud until you delete it there or turn the backup off; the terms of Google or Apple apply.
  • Device identity on our server: as long as the installation is in use; we delete it on request (section 17).
  • Gifts and redemptions: as long as the associated device identity exists.
  • Unlocked purchases: as long as the associated device identity exists or until the purchase moves to another installation.
  • Ideas and bug reports: until resolved and beyond, as long as the report is relevant for error analysis and further development. Reports you withdraw are deleted immediately. When the device identity is deleted, the personal reference is removed and the reported content is kept in anonymised form.
  • Purchase and transaction data: as long as a statutory retention obligation, an open refund or a specific legal claim requires it; records relevant under accounting and tax law for up to ten years.
  • API application and error logs: regularly seven days. Server access logs: regularly up to 30 days.
  • Advertising data at Google: as stated in the Google Privacy Policy.

15. Children

Block Puzzle Brain Games is not directed at children under 13. We do not knowingly collect personal data from children under 13. In the European Union, personalised advertising is shown only to users who can consent to data processing themselves under the law of their country; younger users are shown non-personalised ads by Google. If you believe a child has provided us with data, write to support@peppertools.de.

16. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

To do so, contact support@peppertools.de. Since Block Puzzle Brain Games has no account, we can only assign your data on the server through the device identity; we will tell you which details we need for this.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

17. Deletion

  • You remove local data by uninstalling the app; for the exception on iOS see section 3.
  • You delete the backup of your progress in the settings of your device, your Google account or your iCloud.
  • You withdraw advertising consent in the app under Settings → Privacy settings.
  • You can reset or delete your device’s advertising ID in the system settings.
  • You can request deletion of your device identity and the associated data on our server by email to support@peppertools.de with the subject “Deletion Block Puzzle”. After deletion, your reports and gifts are no longer reachable from the app. You get purchases with real money back afterwards through Restore purchases. Data we are legally required to keep is deleted only when the retention period ends.

18. Changes to this Privacy Policy

We update this policy when the game or the legal situation changes. The current version can always be found in the game under Settings → Privacy policy and on www.peppertools.de. The date at the top shows the status.