Privacy Policy

for the app “Flea Market Tycoon” (iOS and Android) · Last updated: 27 October 2026

This is a translation for your convenience. The German version is legally binding.

1. Controller

2. The most important points in brief

3. Data on your device

Your game progress (e.g. money, storage, progress) and your settings (e.g. sound, language, your consent decision, whether the introduction has been shown) are stored locally in the app data on your device. This data only leaves your device as described in sections 4 to 6.

If you allow notifications, the app schedules local reminders, for example when a waiting time has expired. These reminders are created exclusively on your device; no data is sent to servers for this. You can withdraw this permission at any time in your device’s system settings.

Legal basis: Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG (storage is necessary so that you can use the game).

4. Leaderboard and cloud backup (online features)

As long as the online features are switched on (default), the app uses services from Firebase (Google) to back up your progress online and to provide a leaderboard. You can turn them off at any time under Settings → Leaderboard & cloud backup.

4.1 Anonymous user ID (Firebase Authentication)

When the app starts, it automatically creates an anonymous, random identifier (user ID). It contains no name and no email address. The identifier is stored on your device and is used to link your online progress, your leaderboard entry and your friendships to you.

4.2 Cloud save (Cloud Firestore)

Your complete game progress (e.g. money, diamonds, inventory, progress and, if applicable, your display name, the list of players you have hidden on the leaderboard and friend codes from an earlier test version until they have been turned into friend requests) is additionally stored online so that it is not lost if you reinstall the app. Security rules ensure it can only be accessed with your own user ID.

4.3 Leaderboard (Cloud Firestore)

A leaderboard entry is only published if you choose a display name: display name, score (company value), reputation, number of restarts and the time of the last update. This entry is publicly visible to all players of the app. Please choose a name that does not reveal your identity. When you set a name, the app automatically checks it for inappropriate terms; this check only runs on your device. Names of other players that fail this check are shown as “Unknown dealer”. Entries with inappropriate names may be removed.

4.4 Friend requests

Your friend code is your user ID. With this code, or through the “⋮” menu next to a leaderboard entry, you can send other players a friend request. For this we store in Cloud Firestore the user IDs of both of you, who sent the request, whether it was accepted, and the time of the request. Only the two of you can access this information. The other person sees the request together with your display name from the leaderboard; once it is accepted, you both see each other’s leaderboard entry under “Friends”. If the other person declines, you withdraw the request or either of you removes the friendship, the record is deleted. The app automatically declines requests from players you have hidden.

4.5 Reporting and hiding entries

Using the “⋮” menu next to a leaderboard entry or a friend request, you can hide a player – they will then no longer appear on your leaderboard; this is only noted in your own game progress (see 4.2). You can also report an entry, for example because of an offensive name. In that case we store the reported player’s user ID and display name, the reason you selected, your user ID and the time. Only the provider can see the report; it is used to review and remove inappropriate entries. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a leaderboard free of offensive or inappropriate content).

4.6 Turning off online features and deleting data

If you turn off the online features, your cloud save, your leaderboard entry and all your friendships and friend requests are deleted, your display name and hidden players are removed from your local game progress, and the anonymous identifier is signed out or – where technically possible – deleted. Your progress on the device is kept. The deletion is only carried out if the server confirms it; otherwise you receive an error message and can try again.

Legal basis: Art. 6(1)(b) GDPR (providing the cloud backup, leaderboard and friends features you use) and Section 25(2) No. 2 TDDDG. Providing the data is neither legally nor contractually required; without online features, only the leaderboard, friends and cloud backup are unavailable.

5. Statistics and crash reports (only with your consent)

When you first start the app, it asks whether you would like to share anonymous statistics and crash reports. “Agree” and “Decline” are equal options; without consent you play exactly the same. Until you agree, none of this is collected or transmitted.

5.1 Firebase Analytics

With your consent, the app records events such as: lot bought or item sold (with product category and price), feature unlocked, restart (prestige) with count, introduction completed and in-app purchase (product, amount, currency). In addition, Firebase automatically collects technical information: a random app instance ID, app and operating system version, device model, language setting, approximate location (country/region) and events such as first launch, sessions and app updates. For technical reasons, the IP address is sent to Google during transmission; according to Google, it is only used to derive approximate location data and is not stored in Analytics. Analytics does not use advertising identifiers (e.g. IDFA/advertising ID). Purpose: to improve the app and balance it better.

5.2 Firebase Crashlytics

With your consent, technical diagnostic data is transmitted in the event of a crash: error log (affected part of the program), device model, operating system and app version, state of the device at the time of the crash and a random installation identifier. Purpose: to find and fix errors.

5.3 Withdrawal

You can withdraw your consent at any time with effect for the future under Settings → Statistics & crash reports. Collection then stops immediately and the local Analytics identifier is reset. The lawfulness of the processing carried out until then remains unaffected.

Legal basis: consent, Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

6. Reward videos (Google AdMob)

At some points, the app offers optional reward videos (e.g. to shorten a waiting time or receive in-game money). A video only starts when you tap it yourself. In most places there is a free bonus without a video first; only the hot-air balloon that now and then flies across the map offers its reward for a video alone. For these videos we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Which data: To deliver and bill a video, Google processes technical information such as IP address, device model, operating system and app version, language setting, approximate location and device identifiers (e.g. the App Set ID and – only with your permission – the advertising ID: IDFA on iOS, advertising ID on Android) as well as information about your interaction with the video. With your consent, Google also uses this data to show you more relevant (personalized) ads; without consent, only non-personalized videos are shown, which may still use technically necessary data (e.g. for fraud prevention and frequency capping).

Consent: Before videos are loaded, the app asks for your decision via Google’s consent platform (User Messaging Platform). On iOS, the system also asks before the first video whether the app may track your activity across other companies’ apps (App Tracking Transparency); if you decline, the IDFA is not transmitted. You receive the rewards in any case. You can change your ad consent at any time under Settings → Change ad consent, and the tracking permission in the iOS settings.

Responsibility: Google processes the data for delivering and measuring ads as an independent controller. More information: policies.google.com/technologies/ads and policies.google.com/privacy.

Legal basis: for storing and reading information on your device and for personalized ads, your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for delivering non-personalized videos that you request yourself, our legitimate interest in financing the free app (Art. 6(1)(f) GDPR) and Section 25(2) No. 2 TDDDG.

7. In-app purchases

Purchases in the app are handled entirely through the Apple App Store or Google Play. Payment data (e.g. card details) is processed exclusively by Apple or Google, not by the provider of this app; their privacy policies apply. The app receives a purchase confirmation (product and time) from the respective store in order to credit you with diamonds or money. The provider does not operate its own server for this. Legal basis: Art. 6(1)(b) GDPR.

8. Visiting this website

This website is delivered via Firebase Hosting (Google). When you visit it, the hosting provider processes access data in server logs for technical reasons (IP address, date and time, page visited, browser and device information). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of these pages).

9. Recipients and transfers to third countries

For authentication, database, Analytics, Crashlytics and hosting we use Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data as a processor under Art. 28 GDPR. The database (Cloud Firestore) is located in the EU (multi-region “eur3”, Belgium/Netherlands). Some processing (e.g. authentication, Analytics, Crashlytics) may also be carried out by Google LLC in the USA. The transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Google LLC is certified) and additionally on standard contractual clauses.

For in-app purchases, Apple and Google are independent controllers (see section 7), and Google is for reward videos (see section 6). Beyond that, we do not pass on any data to third parties.

10. Storage period

• Data on your device: until you uninstall the app or delete the data.
• Cloud save, leaderboard entry, user ID: until you turn off the online features (deletion, see 4.6) or the service is discontinued.
• Friend requests and friendships: until the request is declined or withdrawn or the friendship is removed, at the latest until one of you turns off the online features (see 4.6).
• Leaderboard reports: until they have been reviewed, at the latest three months after receipt.
• Analytics event data: 2 months.
• Crashlytics reports: 90 days.
• Reward video data: according to Google’s retention periods (see section 6).
• Server logs of this website: only as long as necessary for operation and security.

11. Your rights

Under the GDPR you have the right to:

• access the data stored about you (Art. 15 GDPR)
• rectification of incorrect data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent you have given (Art. 7(3) GDPR)

You can delete data and withdraw consent directly in the app under Settings. For all other requests, write to mschmitz.apps@gmail.com. Because the app does not know you by name, we can only assign requests if you tell us your user ID (which you can copy in the settings); to prevent misuse, we only provide information if you credibly show that the user ID belongs to you.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (www.ldi.nrw.de).

12. Data security

Data transmission between the app and online services is encrypted (TLS). Access to online data is restricted by security rules: your cloud save can only be accessed by you; only your leaderboard entry is publicly visible.

13. Children and young people

The app is not specifically aimed at children under 16. Should personal data of children nevertheless have been collected without the consent of their parents or guardians, parents should contact the email address above so that the data can be deleted.

14. Changes to this policy

This privacy policy will be updated when the app or the legal situation changes. You can always find the current version here and in the app under Settings → Privacy policy.