Privacy Policy

Last updated: 8 November 2026

This privacy policy applies to the website toast-commando.schnedhuber.de and to the mobile game “Toast Commando” (Android package de.schnedhuber.toastkommando). It is available in German and English; in case of any discrepancy, the German version prevails.

In short: The game runs on your phone. There is no user account with us, and the game has no server of its own. The website sets no cookies and has no tracking. Data goes to Google when you buy something (Google Play), choose to watch an ad video for a reward (Google AdMob), use the cloud save (Google Play Games) or have consented to analytics in the game (Google Analytics for Firebase). The website is delivered via Cloudflare. If you sign up as a tester, Cloudflare and Google receive your email address. We do not sell data.

1. Controller

Controller within the meaning of the EU General Data Protection Regulation (GDPR):

Maximilian Schnedhuber
IT Service Schnedhuber
Talstraße 231
72250 Freudenstadt
Germany

Phone: +49 7441 5209002
Email: maximilian@schnedhuber.de

There is no data protection officer, as none is required. Please send privacy questions to the email address above.

2. Overview

What	Which data	Who processes it	When
Website	IP address, time, page requested, browser information	Cloudflare	on every visit
Tester sign-up	email address, time, bot protection check data, shortened hash of the IP address	Cloudflare, Google (Firebase App Distribution, Google Play)	only when you sign up
Test version	email address, device and installation information	Google (Firebase App Distribution)	only as an invited tester
Game progress	progress, settings, purchases in the game	only your device	always
Purchases	product, purchase identifier, purchase state	Google Play (Google), Apple App Store if available	only when you buy something or purchases are restored
Analytics in the game	app instance ID, game events, device and app information, approximate country	Google (Google Analytics for Firebase)	only with your consent
Reward videos	advertising ID, IP address, device and app information, consent	Google AdMob, Google UMP (Google)	consent check at start; ads only when you watch a video
Cloud save	Play Games profile, saved game	Google Play Games Services (Google), iCloud if available	only when you are signed in

The app does not request permissions for location, contacts, camera, microphone or storage. It uses vibration (for feedback in the game) and internet access (for ads, purchases, the cloud save and, with consent, analytics).

3. Website

The website is a static site. It is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; service Cloudflare Workers). Cloudflare acts as our processor (Art. 28 GDPR).

Which data: on every request Cloudflare processes technically necessary information: your IP address, date and time, the address requested, the amount of data transferred, the page visited before (referrer), browser and operating system.

Why: to deliver the site, keep it stable and fend off attacks (e.g. denial-of-service attacks). We only see aggregated figures in our Cloudflare account and do not analyse individual visitors.

Legal basis: legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). The site cannot be delivered without this data.

Retention: Cloudflare deletes these log data according to its own retention periods; we do not keep logs of our own.

No cookies, no tracking: the website sets no cookies, uses no analytics or marketing tools and embeds no third-party content (except the bot protection for the tester sign-up, section 4). The fonts are delivered by us together with the website (self-hosted); loading the page makes no connection to Google Fonts or other font providers.

Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

On the website you can choose to sign up as a tester for Toast Commando.

Which data: your email address and the time of sign-up.

Bot protection (Cloudflare Turnstile): to stop programs from signing up in bulk, Cloudflare Turnstile checks whether a human is sending the form. For this, Cloudflare processes your IP address and characteristics of your browser and device (e.g. browser type, language setting, screen information, technical behaviour of the page). Reading these characteristics is strictly necessary for the sign-up you requested (§ 25(2) no. 2 TDDDG). The legal basis for the processing is our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).

Limiting sign-ups: to limit the number of sign-ups per connection, we store a shortened hash of your IP address for no longer than one hour; it is then deleted. The legal basis is also Art. 6(1)(f) GDPR.

What happens to your email address:

It is sent to Google Firebase App Distribution. Google then sends you the invitation to the test by email (section 5).
It is stored in a database at Cloudflare (Cloudflare D1). This lets Maximilian Schnedhuber add it by hand to the tester list of Google Play (internal or closed test). Through this list, Google Play gives your Google account with this address access to the test version in the Play Store.

Legal basis: you sign up to take part in the test at your own request (Art. 6(1)(b) GDPR). Providing the email address is voluntary; without it we cannot invite you to the test.

Retention: until the test ends or you unsubscribe. We then delete the address from the database at Cloudflare and from the tester lists.

Unsubscribe: by email to maximilian@schnedhuber.de or via the link in Google’s invitation.

5. Test version (Firebase App Distribution)

Before and alongside the release, we distribute test versions to invited testers via Google Firebase App Distribution (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). Testers receive invitations by email from Google and then new test builds.

For this, Google processes the testers’ email addresses, whether and when the invitation was accepted, and installation information (e.g. device model, Android version, installed test version). If you send feedback via App Distribution, we receive it together with your email address. The legal basis is taking part in the test (Art. 6(1)(b) GDPR).

The test version contains no ads, no real purchases and no cloud save; purchases are only simulated there. The analytics described in section 8 work the same way in the test version as in the store version: only with your consent.

Testing via Google Play (internal or closed test): here you download the test version from the Play Store with your Google account. Sections 6 to 11 apply to this version as to the released app.

6. Game progress on your device

Your progress (e.g. worlds, weapons, coins, butter, outfits, pets, settings such as sound and eco mode) and the list of purchases already credited are stored locally in the app’s storage on your device. We do not receive this data.

Purpose and legal basis: providing the game you want to use (Art. 6(1)(b) GDPR); storing it on the device is strictly necessary for this (§ 25(2) no. 2 TDDDG).

Deletion: the data is deleted when you uninstall the app or clear the app data in your device settings.

Android backup: the app allows Android’s automatic backup. If you have turned on backup to your Google account, Android may include the game progress and restore it on a new device. You control this in the Android settings (Google → Backup); Google is responsible for it.

7. Purchases

You can choose to buy content in the game (e.g. Butter, Golden Toaster, Monthly Card, Battle Pass Premium, No-Video Pass). Payment is handled exclusively by the store you downloaded the game from.

Google Play: Google processes the purchase, payment data and your Google account via Google Play Billing as an independent controller. We never see your payment details, name or email address.

Apple App Store (if available): if the game is released in the Apple App Store, purchases there are made via Apple’s in-app purchase. Apple then processes the purchase, payment data and your Apple Account as an independent controller; here, too, we never see payment details.

What the app receives: which product was bought, a purchase identifier from the store (with Google “purchaseToken”), the purchase state (paid or pending) and the prices shown by the store in your local currency.

Why: to credit the purchase in the game, count it exactly once and restore purchases after a reinstall. The purchase identifiers are stored for this in the game progress on your device and, if you use it, in the cloud save (section 10).

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

As the developer we receive purchase reports from the store (e.g. order number, product, price, country) for accounting, taxes and refunds. The legal basis is our legal obligations (Art. 6(1)(c) GDPR). We keep them as long as tax and commercial law require.

Privacy policies: Google, Apple.

8. Analytics in the game (Google Analytics for Firebase)

To see where the game is too hard, too easy or buggy, the game uses Google Analytics for Firebase (Firebase SDK). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google acts as our processor (Art. 28 GDPR).

Only with consent: on first start, the game asks you on a separate consent screen whether you agree to analytics. Without your consent the game collects no analytics data and sends nothing to Google Analytics. The game works the same either way.

Which data:

game start and session length;
progress (world and level reached);
purchases: product, price and currency, but no payment data;
reward videos watched;
the app instance ID (a random identifier of this installation generated by Firebase);
device and app information (e.g. device model, operating system and version, language, app version);
the approximate country, which Google derives from your IP address.

Your device’s advertising ID is not used for analytics.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Withdrawal: you can withdraw your consent at any time in the game settings. The game then stops collecting analytics data. The withdrawal applies to the future; it does not affect the lawfulness of processing before the withdrawal.

Retention: Google Analytics keeps event data relating to individual installations for two months and then deletes it. We may keep aggregated reports without reference to individual installations (e.g. “how many players reach world 5”) for longer.

Privacy policies: Google, Firebase.

9. Optional reward videos (Google AdMob)

The game shows no banners and no forced ads. An ad video from Google AdMob is only shown when you start a video yourself to get a reward (buttons with ▶), e.g. double money for 10 minutes. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With the No-Video Pass you get the rewards without videos; the ads are then no longer needed.

Consent (Google User Messaging Platform): at start, the app uses the Google User Messaging Platform (UMP) to check whether consent is required for you (e.g. in the European Economic Area, the United Kingdom and Switzerland) and then shows the consent form. Your IP address and device information are sent to Google to determine your region; your choice is stored on your device.

Personalised ads (tailored to your interests) are only shown with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Without consent, AdMob shows only non-personalised or limited ads where Google offers them in your region. Even then Google processes data such as the IP address to deliver the ad, prevent fraud and count ads. If no ad is possible, there is no video; the game continues normally.

Withdrawal: you can change or withdraw your choice at any time in the game under Settings → “Privacy settings (ads)” → “Change”. The withdrawal applies to the future.

Which data AdMob processes:

advertising ID (Android advertising ID); you can reset or delete it in the Android settings (Privacy → Ads);
IP address, device type, operating system, language, app identifier and version;
interactions with the ad (viewed, closed early, tapped), diagnostic and performance data.

Google also processes this data for its own purposes as an independent controller. The game itself only learns whether a video is available and whether you watched it to the end (then you get the reward). From Google we only receive aggregated reports (e.g. number of videos and revenue), no data about individual people.

More: How Google uses information from sites or apps that use its services, My Ad Center.

10. Cloud save

So that your progress and purchased content survive a reinstall or a new phone, the game can save your progress in the cloud.

Google Play Games Services: on Android, the game saves your progress via “Saved Games” of Google Play Games in your Google account. If you are signed in to Google Play Games on your device, the game signs you in automatically; otherwise via the “Sign in” button in the settings. Without sign-in there is no cloud save; the game still works completely.

iCloud (if available): if the game is released for iPhone and iPad, your progress can be saved in your iCloud storage at Apple, provided iCloud is turned on on your device.

What is saved: the whole game progress (as in section 6, including the purchase identifiers), plus a short description (e.g. world and level), a progress value and the play time. The game reads your Play Games display name to show “Signed in as …” in the settings; it is not shared.

Where: in Google Play Games storage in your Google account or in your iCloud. We have no access to your saved games.

Legal basis: providing the feature you use (Art. 6(1)(b) GDPR).

Deletion: in Google Play Games you can sign out and delete your game data, and also via your Google account (myaccount.google.com). You manage iCloud data in your device’s iCloud settings.

11. Crash reports via the stores

The app contains no crash reporting tool of its own. If you have allowed your device to send usage and diagnostics data, Google Play (or Apple, if available) provides us with aggregated crash and performance reports (e.g. device model, operating system version, error message) without names or contact details. We use them only to fix bugs (legitimate interest, Art. 6(1)(f) GDPR).

12. What we do not do

no user account with us and no server of our own for the game;
no tracking and no cookies on the website, no analytics in the game without your consent;
no selling of data and no sharing with third parties other than the providers named in this policy;
no collection of location, contacts, photos or other files.

13. Recipients and transfers outside the EU

The only recipients of your data are the providers named: Cloudflare (sections 3 and 4), Google (sections 4, 5 and 7 to 11) and, if the game is released there, Apple (sections 7, 10 and 11).

These providers may also process data in the USA and other countries outside the EU. Google LLC and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); they also use the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

14. Children and teenagers

The game is intended for teenagers aged 13 and over and for adults. We do not knowingly collect personal data from children under 13.

If you are under 16, you may only consent to analytics (section 8) and personalised ads (section 9) with your parents’ approval (Art. 8 GDPR); some countries set a lower age limit. Purchases require parental approval; Google Play offers parental controls and purchase approval for this (Family Link).

Parents who believe their child has given us data can contact maximilian@schnedhuber.de.

15. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Withdrawal: you can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); for analytics and ads directly in the game (sections 8 and 9).

As we store hardly any data about you ourselves, most requests concern the data held by Google or Apple; you can view and delete it in your Google account or Apple Account. For anything else, write to maximilian@schnedhuber.de.

Right to complain: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

16. Changes

If the website or the game changes so that other data is processed, we will update this policy. The version published here applies. For new processing that requires consent, we will ask you in the game first.