Privacy policy

What data Carnival Chaos needs – and what it doesn’t.

This is a translation of our German privacy policy (Datenschutzerklärung), provided for convenience.

The short version

You need no email and no real name. The game creates a game account with a random number.
Other players see your player name and profile picture. Better not use your real name!
We show no ads and sell no data. There is no chat.
We look at which buttons get used and whether the game crashes – without your name. You can turn this off in the settings.
You can delete your account at any time. If anything is unclear, ask your parents!

1. Who is responsible?

The controller responsible for processing your data in the game Carnival Chaos and on this website is:

Patrick Barme
An den Röthen 20
61381 Friedrichsdorf
Germany
Email: kontakt@carnival-chaos.com

We are not required to appoint a data protection officer. If you have any questions about privacy, just email us at the address above.

2. Overview

What	Why	Legal basis	How long
Game account and progress	Save progress, play online, switch devices	Art. 6(1)(b) GDPR	until you delete the account
Name and profile picture for other players, friends, leaderboard	Multiplayer and friends	Art. 6(1)(b) GDPR	until you delete the account
Purchases (through Apple)	Deliver what you bought, handle refunds	Art. 6(1)(b) and (c) GDPR	until you delete the account, unless we must keep records
Usage and diagnostic data (can be turned off), also together with your game account	Find bugs, improve the game and offers, analyse purchases	Art. 6(1)(f) GDPR	90 days; the link to your game account until you delete it
Creator code (if you enter one)	Credit the creator with their share of purchases	Art. 6(1)(b) GDPR	14 days; on purchases until you delete the account
Connection data (IP address)	Connect you, prevent abuse	Art. 6(1)(b) and (f) GDPR	only briefly in memory, not in the database
Website visits	Deliver the site, protect it from attacks	Art. 6(1)(f) GDPR	briefly at the host
Emails to us	Answer your request	Art. 6(1)(b) and (f) GDPR	until the matter is closed

We show no ads, use no advertising ID (IDFA), do not track you across other apps or websites and never sell data. The game contains no analytics or advertising tools from other companies. It does not access your photos, camera, microphone, contacts or location.

3. Your game account

So that your progress isn’t lost and you can play online, the game automatically creates a game account the first time it contacts our server. You need no email address and no real name. We store:

a random account number and a friend code,
a checksum of your account code – only your device knows the code itself,
your player name (your choice, up to 16 characters; “Player” at first) and your profile picture (a character from the game with a colour and frame – there are no personal photos),
your game progress: characters, levels, coins, tickets, pass, quests, rewards, your squad line-up and similar game data,
trophies, rank, number of online matches and wins, and when the account was created and last used.

The account code lets you move your progress to another device. Treat it like a password.

The legal basis is Art. 6(1)(b) GDPR – saving and online play don’t work without this data. The account remains until you delete it (see Deleting your account).

4. What other players see

Every match runs on our server. So that you can play together, other players see:

in a match and during matchmaking: your player name, profile picture, your characters and their looks (skins), your hero and the result,
your friends: name, profile picture, friend code, trophies and league, and whether you’re online, looking for a match or playing (otherwise, when you were last around),
anyone who enters your friend code: your player name, so they can send you a request,
your group and the people you invite: name, profile picture and whether you’re online,
on the global leaderboard (top 50): rank, player name, profile picture and trophies. This list is public and can also be retrieved outside the game. Only your friends see the friends leaderboard.

There is no chat. Players can only communicate with ready-made pictures (emotes). Please don’t use your real name as your player name.

Inviting friends: if someone joins the game with your friend code, we note that you invited them, together with how many matches they’ve played – that’s how we know when rewards are due. You see the names, profile pictures and match counts of friends you invited.

The legal basis is Art. 6(1)(b) GDPR. Invitations are kept in memory for only 90 seconds; a group dissolves after three minutes without activity.

5. Sign in with Apple (optional)

You can link your game account to your Apple ID to restore it on a new device without the account code. We request neither your name nor your email address. We only store the identifier that Apple issues for our game. Apple handles the sign-in itself, under its own responsibility (Apple’s privacy policy). You can unlink it under Profile → Account. The legal basis is Art. 6(1)(b) GDPR.

6. Purchases

In-game purchases go through the App Store. Apple is the seller; we receive no payment details, no Apple ID and no billing address. So that we can deliver what you bought, the game sends the purchase receipt signed by Apple to our server. From it we store:

the transaction number, product, time of purchase, price and currency, App Store country, whether it was a test purchase, and any refund,
what the purchase contained, your ticket balance with its transactions, and what you own (e.g. skins or a season’s Gold Pass).

So that Apple can link a purchase to your game account, the game passes Apple an identifier derived from your account number when you buy. If Apple refunds a purchase, Apple tells our server. Before you buy an offer, we remember for 14 days which offer you chose, so we can deliver it correctly after payment.

Creator codes: If you enter a creator’s code in the Shop, we keep it with your game account for 14 days and note it on purchases made during that time, so the creator gets their share. It doesn’t change prices or contents, and you can remove the code in the Shop at any time.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention obligations. When you delete your account, we delete this information too, unless the law requires us to keep it. Apple handles payments and refunds: reportaproblem.apple.com.

7. Usage and diagnostic data

So that we can find bugs and crashes and improve the game, it sends usage and diagnostic data to our own server – not to other companies. For this, the game creates a random device identifier on your device. We collect:

at start-up: device type, estimated model (from the screen size), iOS version, screen size, language, app version, loading time,
which screens you open and which buttons you tap (the button’s identifier – never what you type),
start and end of matches: mode, map, hero, line-up, placement, crystals, KOs, duration,
purchases and spending in the game: item, price and whether coins, tickets or real money were used (no payment details), plus which offers were shown in the Shop and which were bought,
error messages, crashes, frame rate and dropped connections.

Together with your game account: When the game asks our server for your ticket balance or reports a purchase, it sends the device identifier along. Our server then remembers which game account it belongs to. This lets us analyse purchases and gameplay together – for example how many new players buy something in their first days, which offers are seen and bought, and how much a player spends in their first month. The server also notes purchased offers with the device’s usage data. Your name, account code and friend code are not part of the usage data. We only analyse this ourselves to improve the game and its offers – never for advertising and never for other companies.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a stable, fair game that’s fun to play and pays for itself. Usage and diagnostic data is deleted after 90 days, the link to your game account together with the account.

Turning it off: under Profile → Settings → “Share usage data”. The game then sends nothing more – including no device identifier to the shop server – and anything still waiting on the device is deleted. If you want us to delete data that was already sent, send us your device identifier – it’s shown below the switch, and tapping copies it.

Separately, the game keeps a note of the last screens and errors only on your device to help trace problems. These notes are never sent.

8. On your device

On your device, the game stores your progress, player name, account code and settings (sound, music, vibration, language) – in the app’s storage and, as a backup, in iOS app settings. This is needed for the game to work. When you delete the app, all of it is removed from the device.

Reminders are scheduled directly on your device – only if you allow them, at most one a day and never with ads. No server sends you messages. You can turn them off under Settings → Notifications → Carnival Chaos.

9. Connection data and abuse protection

When the game talks to our server, your IP address is technically required. We do not store it in our database. To prevent abuse (such as mass account creation), the server briefly counts in memory how many requests come from an address; after that it is forgotten. Server error messages may contain an account number; they are kept only for a limited time by our host. The legal basis is Art. 6(1)(b) and (f) GDPR.

10. This website

When you visit this website, your browser sends technically necessary information: IP address, date and time, the page requested, your browser and, if applicable, the page you came from. Our host processes it to deliver the site and protect it from attacks. We don’t analyse it. The legal basis is Art. 6(1)(f) GDPR.

This website sets no cookies, stores nothing on your device, uses no analytics tools and loads no content from other servers (even the font is hosted by us).

Email: if you write to us, we use your address and message only to reply, and delete them once the matter is closed. Cloudflare forwards mail sent to our address to our mailbox at Google (Gmail).

11. Who else receives data

Fly.io, Inc. (Chicago, USA) runs our game server and database in a data centre in Frankfurt am Main, Germany – as a processor under Art. 28 GDPR.
Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) delivers this website and forwards emails to us – also as a processor.
Google provides the mailbox where emails to us arrive (Gmail).
Apple runs the App Store, processes payments and handles “Sign in with Apple” – under its own responsibility.

Fly.io, Cloudflare and Google are US companies or belong to one, so access from the USA can’t be entirely ruled out. All three are certified under the EU-US Data Privacy Framework, which ensures an adequate level of protection under Art. 45 GDPR.

We don’t pass data on to anyone else – unless the law requires us to.

12. Children

Carnival Chaos is also played by children. That’s why the game gets by with as little data as possible: no email, no real name, no photos, no chat, no ads. If you are under 16, please talk to your parents before you buy anything or change settings. Parents can write to us at any time if they want us to delete their child’s data. More on the For parents page.

13. Deleting your account

Under Profile → Account → “Delete account” (tap twice) you delete your game account on our server – including progress, friends, rank, invitations, Sign in with Apple, purchases and items. We also delete the link between your device identifier and the account. The usage and diagnostic data itself disappears by itself after 90 days (or right away if you send us your device identifier).

Your progress stays on the device. If you keep playing, the game automatically creates a new account. If you don’t want any data with us at all, delete the app as well after deleting the account.

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21) – in particular to processing based on our legitimate interest. To exercise them, email us at kontakt@carnival-chaos.com.

Because we don’t know who you are, we need a pointer to find your data: your friend code (for the game account) or your device identifier (for usage data). Never send us your account code.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

15. Changes

When the game changes, we update this policy. The version on this page always applies.

Last updated: October 9, 2026