Privacy Policy – Bus Party (iOS and Android)

Last updated: 4 October 2026

1. Scope and overview

This Privacy Policy applies to the game "Bus Party" for iOS and Android and to the related services provided through api.peppertools.de.

Bus Party is a puzzle game. It needs no account and no sign-in. Your progress, your bus tickets, your items from the shop and your settings are stored on your device. Data leaves your device only when you use one of the functions described in this policy: recognition of your installation, advertising, gifts, bug reports and feature requests, and purchases with real money.

Bus Party shows ads through Google AdMob. In the European Union, the European Economic Area, Switzerland and the United Kingdom we ask for your consent before the first ad is shown. We do not sell personal data.

2. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Charles Imilkowski

PepperTools

Stubbenweg 29

27753 Delmenhorst

Germany

Email: support@peppertools.de

No data protection officer has been appointed.

3. Data stored locally on your device

The game stores on your device:

  • your progress (current level);
  • your bus ticket balance;
  • your items from the shop: your stock of helpers such as Hint, Tow truck and Skip level, your own town name and your choice of party hats;
  • which purchases with real money are unlocked for your installation;
  • which gifts have already been credited;
  • your settings: language, sound, music and the selected music track;
  • your decision regarding advertising consent;
  • how many ads you have seen on the current day.

This data is not transmitted to us. Depending on your system settings it may be part of a device or cloud backup by Apple or Google. We do not operate these backups; the privacy terms of the respective provider apply.

Uninstalling the app removes the local data. Exception on iOS: the token of your installation (section 4) and the list of credited gifts are kept in the keychain. They remain after the app is deleted, so that a reinstallation is recognised as the same installation and no gift is credited twice.

The legal basis is Art. 6(1)(b) GDPR (provision of the game).

4. Recognising your installation (device identity without an account)

Bus Party has no account. So that our server can still recognise your installation, for example for reports, gifts and purchases, the app registers a pseudonymous device identity with api.peppertools.de once, on first start. You see nothing of this and do not have to enter anything.

The following is transmitted:

  • on Android: the Android ID of your device (Settings.Secure.ANDROID_ID) and an integrity verdict from Google Play (Play Integrity) confirming that the app is running unmodified on a genuine device;
  • on iOS: the app's download confirmation signed by Apple (AppTransaction) and a random identifier generated by the app and kept in the iOS keychain;
  • device model, operating system version, app version and the language selected in the game;
  • on iOS additionally the country of your App Store account.

Our server stores the device numbers only in hashed form and returns a random token to the app. This token is stored securely on the device (iOS: keychain; Android: encrypted with a key from the Android Keystore) and sent along with later calls to api.peppertools.de. It contains no information about you as a person. In addition, the app receives a random purchase identifier that is used for purchases with real money (section 7). We do not link the Android ID with your device's advertising ID.

The purpose is to assign your reports, gifts and purchases to your installation and to protect our services against abuse. The legal basis is Art. 6(1)(b) GDPR for providing these functions and Art. 6(1)(f) GDPR for abuse prevention. Our legitimate interest is to grant gifts and purchases only once per installation.

Google processes the Play Integrity verdict and Apple the AppTransaction under their own responsibility. For more information see the Google Privacy Policy and the Apple Privacy Policy.

A reinstallation or a change of device may result in a new identity. Reports and unredeemed gifts of the old identity are then no longer reachable from the app. You get purchases with real money back through Restore purchases (section 7).

5. Advertising with Google AdMob

5.1 Which ads there are

Bus Party is free and financed by ads from Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. There are two kinds:

  • Ads after a level: at most three times a day, never in the middle of a game.
  • Videos on your request: you start them yourself in the main menu and receive bus tickets for them. No such video is shown without your tap.

5.2 Which data is processed

When loading and showing ads, Google processes in particular:

  • the advertising ID of your device (Android: Google Advertising ID; iOS: IDFA, only with your permission for app tracking);
  • IP address and the approximate location derived from it;
  • device model, operating system, language, screen size and network information;
  • app name and app version;
  • information about the ad: which ad was loaded, viewed, completed or tapped;
  • your consent decision.

Google uses this data to select, deliver, measure and bill ads and to protect against fraud. With your consent, ads may be tailored to you; without consent Google shows non-personalised or limited ads. How Google processes data from apps that use Google services is described in "How Google uses information from sites or apps that use our services" and in the Google Privacy Policy.

We ourselves receive no personal data from Google, only aggregated reports on impressions and revenue.

5.3 Consent and withdrawal

In the European Union, the European Economic Area, Switzerland and the United Kingdom the app shows you a consent request through the Google User Messaging Platform before the first ad. There you decide whether Google and its advertising partners may use your data for personalised advertising. Your decision is stored on your device.

You can change your decision at any time with effect for the future: in the app under Settings → Privacy policy → Privacy settings. Withdrawal does not affect the lawfulness of processing carried out before it.

The legal basis for personalised advertising is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. The legal basis for non-personalised advertising is Art. 6(1)(f) GDPR. Our legitimate interest is to be able to offer the game free of charge.

5.4 App tracking on iOS

On iOS the system additionally asks you whether Bus Party may track your activity across other companies' apps and websites (App Tracking Transparency). If you decline, Google does not receive the IDFA. You can change the permission at any time in the iOS settings under Privacy & Security → Tracking.

5.5 Turning ads off

With the purchase "Ad-free forever" (section 7) Bus Party shows no more ads after levels. The same applies for the duration of an "ad-free" gift (section 6). You can still watch the videos you start yourself in the main menu to get bus tickets. Only then does the app still load ads from Google, with the data listed in section 5.2.

6. Bus tickets, shop and gifts

Bus tickets are an in-game currency with no monetary value. You receive them for completed levels and for videos you start yourself. In the shop, which you reach from the main menu through Redeem bus tickets, you exchange them for items such as Hint, Tow truck, Skip level or your own town name. Bus tickets, these items and your town name are stored only on your device (section 3). No data is transmitted for this.

We may give you a gift, for example as a thank-you for a helpful report or as compensation if you complain about something in a report. A gift can contain bus tickets, a jump of several levels or a period without ads after levels. When you open Bugs & Ideas, the app asks api.peppertools.de whether gifts are waiting for you. They appear at the top there, and you redeem them yourself with a tap. The app never asks for gifts on its own. In doing so api.peppertools.de processes:

  • the pseudonymous device identity from section 4;
  • which gift we assigned to you and when you redeemed it.

The purpose is that every gift is credited only once. The legal basis is Art. 6(1)(b) GDPR.

7. Purchases with real money (in-app purchases)

In the shop you can buy single items with real money, for example "Ad-free forever", "Permanent parking spot" or "Party hats". The purchase is processed on iOS through the Apple App Store and on Android through Google Play. Apple or Google processes your payment method and payment data under their own responsibility. We do not receive credit card, bank account or other payment instrument data.

This is how a purchase works:

  • When you buy, the app hands the random purchase identifier of your installation (section 4) to the store, on iOS as the app account token, on Android as the obfuscated account ID. This lets the purchase be assigned to your installation without us knowing your Apple or Google account.
  • After the purchase, the app sends the purchase receipt signed by the store to api.peppertools.de. The server checks the receipt with Apple or Google, acknowledges Google purchases to Google and unlocks the item for your installation.
  • Apple and Google report refunds and revocations directly to our server. The item concerned is then no longer unlocked.
  • The first time you open the shop after each start, the app asks api.peppertools.de which items are unlocked for your installation. This is how a refund or a gift from the shop shows up.

Restoring: With Restore purchases the app sends the purchases that your store account holds for Bus Party to api.peppertools.de. This works after a reinstallation and on another device with the same Apple ID or Google account. The purchase then moves to the installation that restores it. The previous installation loses it.

We can also give you an item from the shop as a gift, for example as compensation after a report. It is then assigned to your installation like a purchase.

In doing so the respective store and api.peppertools.de process:

  • the product identifier of the item;
  • signed transaction data or a purchase token;
  • transaction or order identifier, time of purchase, price and currency, and refund status;
  • the pseudonymous device identity from section 4 and the purchase identifier;
  • when a purchase moves, which installation it came from.

The legal basis is Art. 6(1)(b) GDPR for performance of the contract, Art. 6(1)(c) GDPR for statutory retention obligations and Art. 6(1)(f) GDPR for preventing duplicate unlocks and for fraud prevention. For more information see the privacy terms of Apple and Google.

8. Bug reports and feature requests

In the app, under Settings → Bugs & Ideas, you can voluntarily report a bug or request a feature. No account is needed; your report is assigned to your pseudonymous device identity from section 4 so that we can reply to you.

When you submit a report, the following is transmitted to api.peppertools.de and stored there:

  • the report text you entered;
  • the type of report (bug or feature request);
  • the language selected in the app;
  • app version, operating system version and model name of your device;
  • your later replies in the course of the report.

You decide what the report text contains. Please include only what is needed to describe the problem or wish. The function does not accept screenshots or file attachments.

The purpose is to process your report, fix bugs and develop the game further. The legal basis is Art. 6(1)(b) GDPR for handling your request and Art. 6(1)(f) GDPR for our legitimate interest in a working game. Device model, operating system version and app version are transmitted because a bug usually cannot be classified without them.

You can withdraw a report yourself as long as we have not yet processed it; it is then permanently deleted together with its history. Once we have assigned a status or replied, it remains. The game can be used without restriction without this function.

9. API communication and server logs

Connections to api.peppertools.de generate technically necessary connection and log data. This may include:

  • IP address;
  • date and time;
  • HTTP method, requested API path, status code and amount of data transferred;
  • device and operating system information and user agent;
  • correlation identifier, platform used and limited technical error details;
  • for purchase events, the required transaction and status identifiers.

This data serves the delivery of the service, error analysis, stability, rate limiting, abuse and fraud prevention and IT security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the game and its interfaces.

API application and error logs are regularly stored for seven days. Technical server access logs are regularly stored for up to 30 days. In the event of a specific security incident, affected extracts may be kept longer until the incident is resolved. We do not intentionally write authentication tokens to logs.

10. Hosting, recipients and processors

We transfer personal data only where this is necessary for a described function, secure operation or a legal obligation. Recipients may be:

  • WIIT AG, Joachim-Erwin-Platz 3, 40212 Düsseldorf, Germany, as infrastructure and hosting provider of our rented server;
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for advertising (AdMob), the consent request (User Messaging Platform), Play Integrity, and purchases, purchase verification and purchase notifications through Google Play;
  • Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, for the AppTransaction, and purchases, purchase verification and purchase notifications through the App Store.

Where service providers act on our behalf, they are contractually bound to data protection, confidentiality and appropriate security measures. When delivering ads, Google is an independent controller bound by its own statutory data protection obligations.

11. Transfers to third countries

Our own server is operated in Germany. For Google and Apple, processing by affiliated companies or sub-processors outside the European Union or the European Economic Area, in particular in the USA, cannot be excluded. Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework. Where no adequacy decision of the EU Commission exists for a recipient country, transfers are based on appropriate safeguards, in particular the EU Commission's Standard Contractual Clauses under Art. 46 GDPR.

12. Retention periods

  • Local game data: until you uninstall the app; on iOS the token and the gift list remain in the keychain (section 3).
  • Device identity on our server: as long as the installation is in use; we delete it on request (section 15).
  • Gifts and redemptions: as long as the associated device identity exists.
  • Unlocked purchases: as long as the associated device identity exists or until the purchase moves to another installation.
  • Bug reports and feature requests: until resolved and beyond, as long as the report is relevant for error analysis and further development. Reports you withdraw are deleted immediately. When the device identity is deleted, the personal reference is removed and the reported content is kept in anonymised form.
  • Purchase and transaction data: as long as a statutory retention obligation, an open refund or a specific legal claim requires it; records relevant under accounting and tax law for up to ten years.
  • API application and error logs: regularly seven days. Server access logs: regularly up to 30 days.
  • Advertising data at Google: as stated in the Google Privacy Policy.

13. Children

Bus Party is not directed at children under 13. We do not knowingly collect personal data from children under 13. In the European Union, personalised advertising is shown only to users who can consent to data processing themselves under the law of their country; younger users are shown non-personalised ads by Google. If you believe a child has provided us with data, write to support@peppertools.de.

14. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

To do so, contact support@peppertools.de. Since Bus Party has no account, we can only assign your data on the server through the device identity; we will tell you which details we need for this.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

15. Deletion

  • You remove local data by uninstalling the app; for the exception on iOS see section 3.
  • You withdraw advertising consent in the app under Settings → Privacy policy → Privacy settings.
  • You can reset or delete your device's advertising ID in the system settings.
  • You can request deletion of your device identity and the associated data on our server by email to support@peppertools.de with the subject "Deletion Bus Party". After deletion, your reports and gifts are no longer reachable from the app. You get purchases with real money back afterwards through Restore purchases. Data we are legally required to keep is deleted only when the retention period ends.

16. Changes to this Privacy Policy

We update this policy when the game or the legal situation changes. The current version can always be found at this address. The date at the top shows the status.