Privacy Policy – Color Sort (iOS and Android)

Last updated: 10 October 2026

1. Scope and overview

This privacy policy applies to the game "Color Sort" for iOS and Android and to the related services at api.peppertools.de.

Color Sort is a sorting game. It needs no account and no sign-in. Your game progress, your Lollis, your items from the shop and your settings are stored on your device. Data only leaves your device for the features described in this policy: recognising your installation, advertising, gifts, bug and wish reports, and purchases with real money.

Color Sort shows ads through Google AdMob. In the European Union, the European Economic Area, Switzerland and the United Kingdom we ask for your consent before the first ad. We do not sell personal data.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Charles Imilkowski

Stubbenweg 29

27753 Delmenhorst

Germany

Email: support@peppertools.de

No data protection officer has been appointed.

3. Data stored locally on your device

The game stores on your device:

  • your progress on the level map and in the individual minigames;
  • your balance of Lollis;
  • your items from the shop, for example tube designs, magic companions or the permanent extra tube;
  • which purchases with real money are unlocked for your installation and which receipts have already been credited;
  • which gifts have already been credited and what they gave you, for example level skips or a period without ads;
  • your settings: language and music volume;
  • your decision on consent to advertising;
  • when you first started the game, how many levels you have completed and how often you have seen ads on the current day.

This data is not transferred to us. Depending on your system settings it may be part of a device or cloud backup by Apple or Google. We do not operate these backups; the privacy terms of the respective provider apply to them.

Uninstalling the app removes the local data. Exception on iOS: the token of your installation and a random identifier (section 4) are kept in the keychain. They remain after the app is deleted, so that a reinstallation is recognised as the same installation.

The legal basis is Art. 6(1)(b) GDPR (provision of the game).

4. Recognising your installation (device identity without an account)

Color Sort has no account. So that our server can still recognise your installation, for example for reports, gifts and purchases, the app registers a pseudonymous device identity with api.peppertools.de once at first start. You see nothing of this and do not have to enter anything.

The following is transferred:

  • on Android: the Android ID of your device (Settings.Secure.ANDROID_ID) and an integrity attestation from Google Play (Play Integrity) confirming that the unmodified app runs on a genuine device;
  • on iOS: the app's download confirmation signed by Apple (AppTransaction) and a random identifier generated by the app itself and kept in the iOS keychain;
  • device model, operating system version and app version;
  • the language setting of your device;
  • the country of your App Store or Google Play account.

Our server stores the device numbers only in hashed form and returns a random token to the app. This token is stored securely on the device (iOS: keychain; Android: encrypted with a key from the Android Keystore) and sent with later requests to api.peppertools.de. It contains no information about you as a person. In addition, the app receives a random purchase identifier that is used for purchases with real money (section 7). We do not link the Android ID with your device's advertising ID.

The purpose is to assign your reports, gifts and purchases to your installation and to protect our services against abuse. The legal basis is Art. 6(1)(b) GDPR for providing these features and Art. 6(1)(f) GDPR for preventing abuse. Our legitimate interest is to grant gifts and purchases only once per installation.

Google processes the Play Integrity attestation and Apple processes the AppTransaction under their own responsibility. You can find more information in Google's privacy policy and Apple's privacy policy.

A reinstallation or a change of device may lead to a new identity. Reports and gifts of the old identity that have not yet been redeemed can then no longer be reached from the app. You can get lasting purchases with real money back with Restore purchases (section 7).

5. Advertising with Google AdMob

5.1 Which ads there are

Color Sort is free and is financed by advertising from Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. There are two kinds:

  • Ads after a level: never in the middle of a game. After installation the game shows no ads until the first day is over or you have completed ten levels.
  • Videos on request: You start them yourself with the video button on the map and receive Lollis for them. No such video is shown unless you tap it.

The game shows both kinds together at most five times a day.

5.2 Which data is processed

When loading and showing ads, Google processes in particular:

  • your device's advertising ID (Android: Google Advertising ID; iOS: IDFA, only with your permission for app tracking);
  • IP address and the approximate location derived from it;
  • device model, operating system, language, screen size and network information;
  • app name and app version;
  • information about the ad: which ad was loaded, viewed, completed or tapped;
  • your consent decision.

Google uses this data to select, deliver, measure and bill ads and to protect against fraud. With your consent, ads may be tailored to you; without consent, Google shows non-personalised or limited ads. How Google processes data from apps that use Google services is described by Google under "How Google uses information from sites or apps that use our services" and in Google's privacy policy.

We ourselves receive no personal data from Google, only aggregated reports on impressions and revenue.

5.3 Consent and withdrawal

In the European Union, the European Economic Area, Switzerland and the United Kingdom the app shows you a consent request through the Google User Messaging Platform before the first ad. There you decide whether Google and its advertising partners may use your data for personalised advertising. You can also decline consent there. Your decision is stored on your device.

You can change your decision at any time with effect for the future: in the app under Settings → Privacy → Privacy settings. Withdrawal does not affect the lawfulness of processing carried out before it.

The legal basis for personalised advertising is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. The legal basis for non-personalised advertising is Art. 6(1)(f) GDPR. Our legitimate interest is to be able to offer the game free of charge.

5.4 App tracking on iOS

On iOS the system additionally asks whether Color Sort may track your activity across apps and websites of other companies (App Tracking Transparency). If you decline, Google does not receive the IDFA. You can change the permission at any time in the iOS settings under Privacy & Security → Tracking.

5.5 Turning ads off

With the purchase No Ads (section 7) Color Sort no longer shows ads after levels. The same applies for the duration of a gift "without ads" (section 6). You can still watch videos that you start yourself to get Lollis. Only then does the app still load ads from Google, with the data listed in section 5.2.

6. Lollis, shop and gifts

Lollis are an in-game currency without monetary value. You receive them for completed levels, for videos you start yourself, and as a pack bought with real money (section 7). In the shop you exchange them for items such as level skips, tube designs, magic companions or the permanent extra tube. Lollis and these items are stored only on your device (section 3). No data is transferred during the exchange.

We may give you a gift, for example as thanks for a helpful report or as compensation if you complain about something in a report. A gift may contain Lollis, level skips, a period without ads after levels, or an item from the shop. When you open Report bugs and ideas in the settings, the app asks api.peppertools.de whether gifts are waiting for you. They appear at the top, and you redeem them yourself with a tap. The app does not ask for gifts on its own. In doing so, api.peppertools.de processes:

  • the pseudonymous device identity from section 4;
  • which gift we assigned to you and when you redeemed it.

The purpose is to credit each gift only once. The legal basis is Art. 6(1)(b) GDPR.

7. Purchases with real money (in-app purchases)

In the shop you can buy individual items with real money: No Ads and the Lolli Doubler permanently, and packs of Lollis that you can buy as often as you like. The purchase is handled on iOS through the Apple App Store and on Android through Google Play. Apple or Google processes your payment method and payment data under its own responsibility. We receive no credit card, bank account or other payment instrument data.

This is how a purchase works:

  • When you buy, the app passes the random purchase identifier of your installation (section 4) to the store, on iOS as an app account token, on Android as an obfuscated account identifier. This lets the purchase be assigned to your installation without us knowing your Apple or Google account.
  • After the purchase the app sends the receipt signed by the store to api.peppertools.de. The server checks the receipt with Apple or Google and acknowledges Google purchases to Google. Only then does the app unlock the item or credit the Lollis.
  • If a purchase remains incomplete, for example after a crash, the store delivers it again at the next start and the app reports it once more. Each receipt is credited only once.
  • Apple and Google report refunds and revocations directly to our server. A refunded lasting item is then no longer unlocked.

Restore: With Restore purchases in the settings the app sends the lasting purchases that your store account has saved for Color Sort to api.peppertools.de. This works after a reinstallation and on another device with the same Apple ID or Google account. The purchase then moves to the installation that restores it. The previous installation loses it. Bought Lollis cannot be restored, because the stores do not deliver consumed packs again.

In doing so, the respective store and api.peppertools.de process:

  • the product identifier of the item;
  • signed transaction data or a purchase token;
  • transaction or order identifier, time of purchase, price and currency, and refund status;
  • the pseudonymous device identity from section 4 and the purchase identifier;
  • when a purchase moves, the information from which installation it came.

The legal basis is Art. 6(1)(b) GDPR for performing the contract, Art. 6(1)(c) GDPR for statutory retention obligations and Art. 6(1)(f) GDPR for preventing duplicate unlocks and fraud. More information is contained in the privacy terms of Apple and Google.

8. Bug and wish reports

In the app under Settings → Report bugs and ideas you can voluntarily report a bug or wish for a feature. No account is needed; your report is assigned to your pseudonymous device identity from section 4 so that we can reply to you. The app only asks for your reports when you open this area.

When you send a report, the following is transferred to and stored at api.peppertools.de:

  • the report text you entered;
  • the kind of report (bug or wish);
  • the language set in the game;
  • app version, operating system version and model name of your device;
  • your later replies in the course of the report.

You decide the content of the report text yourself. Please only include what is needed to describe the problem or wish. The feature does not accept screenshots or file attachments.

The purpose is to process your report, fix bugs and develop the game further. The legal basis is Art. 6(1)(b) GDPR for processing your request and Art. 6(1)(f) GDPR for our legitimate interest in a working game. Device model, operating system and app version are sent along because a bug usually cannot be classified without them.

You can withdraw a report yourself as long as we have not processed it yet; it is then deleted permanently together with its history. As soon as we have set a status or replied, it remains. The game can be used without restriction without this feature.

9. API communication and server logs

Connections to api.peppertools.de produce technically necessary connection and log data. This may include:

  • IP address;
  • date and time;
  • HTTP method, requested API path, status code and amount of data transferred;
  • device and operating system information and user agent;
  • correlation identifier, platform used and limited technical error details;
  • transaction and status identifiers required for purchase events.

This data serves to deliver the service, analyse errors, ensure stability, limit request rates, prevent abuse and fraud, and maintain IT security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the game and its interfaces.

API application and error logs are normally kept for seven days. Technical server access logs are regularly kept for up to 30 days. In the case of a specific security incident, affected extracts may be kept longer until it has been resolved. We do not intentionally write authentication tokens into logs.

10. Hosting, recipients and processors

We only transfer personal data if this is necessary for a described feature, secure operation or a legal obligation. Recipients may be:

  • WIIT AG, Joachim-Erwin-Platz 3, 40212 Düsseldorf, Germany, as the infrastructure and hosting provider of our rented server;
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for advertising (AdMob), the consent request (User Messaging Platform), Play Integrity, and purchases, purchase verification and purchase notifications through Google Play;
  • Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, for the AppTransaction and purchases, purchase verification and purchase notifications through the App Store.

Where service providers act on our behalf, they are contractually bound to data protection, confidentiality and appropriate security measures. When delivering ads, Google is an independent controller and bound by its own statutory data protection obligations.

11. Transfers to third countries

Our own server is operated in Germany. With Google and Apple, processing by affiliated companies or sub-processors outside the European Union or the European Economic Area, in particular in the USA, cannot be ruled out. Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework. Where there is no adequacy decision of the EU Commission for a recipient country, transfers take place on the basis of appropriate safeguards, in particular the EU Commission's standard contractual clauses under Art. 46 GDPR.

12. Retention period

  • Local game data: until you uninstall the app; on iOS the token and random identifier remain in the keychain (section 3).
  • Device identity on our server: as long as the installation is used; we delete it on request (section 15).
  • Gifts and redemptions: as long as the associated device identity exists.
  • Unlocks of lasting purchases: as long as the associated device identity exists or until the purchase moves to another installation.
  • Bug and wish reports: until they are resolved and beyond, as long as the report is relevant for error analysis and further development. Reports you withdraw are deleted immediately. When the device identity is deleted, the personal reference is removed and the reported content is kept anonymised.
  • Purchase and transaction data: as long as a statutory retention obligation, an open refund or a specific legal claim requires it; documents relevant for accounting and tax purposes for up to ten years.
  • API application and error logs: normally seven days. Server access logs: regularly up to 30 days.
  • Advertising data at Google: according to the information in Google's privacy policy.

13. Children

Color Sort is not directed at children under 13. We do not knowingly collect personal data from children under 13. In the European Union, only users who can consent to data processing themselves under the law of their country receive personalised ads; for younger users Google shows non-personalised ads. If you believe that a child has sent us data, write to support@peppertools.de.

14. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future.

To do so, contact support@peppertools.de. Since Color Sort has no account, we can only assign your data on the server through the device identity; we will then tell you which information we need for this.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

15. Deletion

  • You remove local data by uninstalling the app; for the exception on iOS see section 3.
  • You withdraw consent to advertising in the app under Settings → Privacy → Privacy settings.
  • You can reset or delete your device's advertising ID in the system settings.
  • You can request deletion of your device identity and the related data on our server by email to support@peppertools.de with the subject "Deletion Color Sort". After deletion your reports and gifts can no longer be reached from the app. You can then get lasting purchases with real money back with Restore purchases. Data we are legally required to retain is only deleted after the retention period has expired.

16. Changes to this privacy policy

We adapt this policy when the game or the legal situation changes. The current version is available in the app under Settings → Privacy and on the game's page at www.peppertools.de. The date at the top shows when it was last updated.