Privacy policy

Updated: 22 October 2026

This policy explains how Wotaso GmbH processes personal data when you use the ScrollFight iOS app, the website at scrollfight.com, invitation links and support.

1. Controller

2. Data processed only on your device

Your selection of apps and websites, the corresponding opaque Apple tokens and the detailed Screen Time data are processed on your device using Apple Family Controls, Managed Settings and Device Activity. We do not receive the names of selected apps or websites or a list of content you visit.

Settings and onboarding information such as age, estimated usage, goals, survey answers, selected domains, analytics choice and local game state are stored locally on your device for the core service and are not sent to the ScrollFight game server. If you enable optional analytics, selected categorical onboarding answers, including the age group, are separately transmitted as described in section 5. You can remove local data by deleting the app; server-side data can be deleted separately in the app.

3. App account and game service

ScrollFight starts without an email address or conventional login. To provide the requested account, friend, recovery, league and game features, we process:

• a random user ID and device ID, a cryptographic hash of the device secret, access tokens and, if created, a hash of the one-time recovery code;
• your chosen display name, emoji, profile style and driver and kart appearance, which together form your in-game avatar;
• direct friend relationships and invitation data;
• aggregated daily usage minutes, score, race distance and legacy HP values, unlock duration and time, measurement coverage and verification status, game rounds, results, rewards and progress; and
• XP pack purchases (product and transaction identifier), and an Expo push token if you enable notifications.

Purpose and legal basis are the provision, security and recovery of the service you request and performance of our contract with you (Article 6(1)(b) GDPR). Security and abuse-prevention measures are additionally based on our legitimate interest in a reliable service (Article 6(1)(f) GDPR).

Your direct friends can see your display name, emoji, driver and kart appearance, HP, rank, progress and the game results intended for the relevant round. Depending on the reveal phase, they may see aggregated score values. They never receive your selected apps, websites or Apple Screen Time tokens. This disclosure is necessary for the friend and race features you request (Article 6(1)(b) GDPR).

4. Profile picture: your in-game driver

Your profile picture is always the driver you choose in the game. The app does not request camera or photo-library access and does not upload photos. If a profile photo was stored for your account with an earlier app version, it is no longer shown to anyone, including you, and no new photo can be uploaded. Any such photo stays in private storage and is deleted when you delete your account, or earlier if you ask us by email. We do not use facial recognition or biometric analysis.

Legal basis is performance of the requested profile feature (Article 6(1)(b) GDPR) and our legitimate interest in protecting players from unlawful or harmful content (Article 6(1)(f) GDPR). Cloudflare, Inc. acts as our processor under a data processing agreement.

Display names, reports, blocks and account restrictions

Display names are checked automatically against a list of offensive terms, links and contact details when you save them; a rejected name is not stored. If you report a player, we store your account identifier, the reported account, the category and reason you chose, your optional description, a snapshot of the reported name and the time. The reported player is not told who reported them. If you block a player, we store that block so you no longer see each other and cannot connect again. Moderation actions (for example resetting a name or restricting an account) are logged with time and outcome. These steps are taken by people, not by automated decision-making.

Legal basis is our legitimate interest and our duty to keep the community safe and to enforce our terms (Article 6(1)(f) and (b) GDPR). This data is only accessible to the responsible team and is not used for advertising or analytics.

5. Optional analytics

Analytics starts only after your voluntary choice. We then process pseudonymous product events, screen views, onboarding progress and answers, purchase-screen interactions and legacy experiment assignments and subscription lifecycle events (including trials, renewals and cancellations), app and build version, platform and the random ScrollFight user ID through AnalyticsCLI, a Wotaso-operated analytics system. We do not send selected apps, websites, Screen Time tokens, profile photos or feedback message text as analytics properties.

The legal basis is your consent (Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG). You can withdraw consent at any time in Settings → Data, legal & account → Optional analytics. We also store the current analytics choice and its update time with your account so that subscription analytics respects your choice. Unsent subscription events are removed when you withdraw consent or delete your account. Delivery attempts stop after three failures; the delivery queue is deleted after 30 days. Withdrawal has effect for the future and does not affect the lawfulness of earlier processing.

6. Error diagnostics and service security

For app and server stability, technical errors, stack traces, app and build version, operating-system information, operation labels and performance traces may be sent to our self-hosted GlitchTip instance. Default transmission of directly identifying data is disabled. Diagnostic events are stripped of account identities, free-text messages and signed request URLs where the SDK allows this. Native crash reporting may still include a pseudonymous installation identifier. Please do not include personal data in free-text feedback unless necessary.

We process this information on the basis of our legitimate interest in identifying faults, protecting the service and maintaining its availability (Article 6(1)(f) GDPR). If you submit feedback, we process the message and related technical context to respond and improve the service (Article 6(1)(b) or (f) GDPR, depending on the request).

7. Notifications

If you enable notifications, we store an Expo push token linked to your random user ID and send the token and notification content through the Expo Push Service (650 Industries, Inc.) to Apple Push Notification service. Permission is voluntary and can be withdrawn in the app or iOS settings. The token is removed from our account database when you disable notifications in the app or delete your account.

Legal basis is performance of the notification feature you request (Article 6(1)(b) GDPR).

8. Purchases

Payments are processed by Apple. RevenueCat, Inc. helps us verify and credit in-app purchases. Apple and RevenueCat provide us with a pseudonymous app user or subscriber identifier, product ID, transaction and entitlement status, purchase and expiry time and related technical transaction data. We do not receive your full payment-card or bank details.

Processing is necessary to perform the purchase contract, credit purchases and prevent fraud (Article 6(1)(b) and (f) GDPR). Apple processes payment data under its own responsibility; RevenueCat acts as our processor for entitlement management. See Apple's privacy policy and RevenueCat's privacy information.

9. Website, invitation links and local storage

When you open our website, API or an invitation page, the necessary request data is processed, including IP address, time, requested URL, referrer, user agent and response status. We use it to deliver the page, retrieve an invitation preview, maintain security and diagnose faults (Article 6(1)(b) or (f) GDPR).

The website stores your analytics choice and its version in local storage. This is necessary to remember the privacy setting you requested (Section 25(2)(2) TDDDG). Optional landing-page analytics, where enabled, starts only after consent and processes page path and store-link clicks (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can reopen “Analytics settings” in the website footer at any time.

10. Recipients and international transfers

We use processors for EU/EEA hosting and infrastructure, Cloudflare R2 for private storage of any profile photos stored with earlier app versions, RevenueCat for purchases and legacy subscriptions, Expo and Apple for push delivery, and service providers supporting our self-hosted monitoring and analytics infrastructure. Data is also disclosed where required by law. Other users receive only the friend and race data described above.

We also use Discord for operational notifications in our Wotaso server. Subscription notifications contain the event identifier and type, product identifier, store and environment; customer identifiers, subscriber attributes and prices are excluded. GlitchTip notifications contain the project, error summary, technical context and a link to the issue. New feedback may be forwarded through AnalyticsCLI to a private operator channel with its project, message, source, category and optional rating. Separate user identifiers, contact fields, metadata and page URLs are excluded; recognizable email addresses, URLs and credential patterns in message text are removed on a best-effort basis. This does not guarantee anonymization of arbitrary free text. See Discord's privacy policy.

Some providers are based in the United States or may involve access from third countries. Where required, transfers rely on an adequacy decision (including an applicable EU–US Data Privacy Framework certification) or the European Commission's Standard Contractual Clauses under Article 46 GDPR, together with supplementary safeguards where necessary. You may request further information from us.

11. Retention and deletion

• Account and game data is retained while your ScrollFight account exists. Account deletion in the app deletes the account database records, friend links, push tokens and any profile photo stored with an earlier app version.
• Reports, blocks and moderation logs are kept as long as needed to handle reports, protect players and recognise repeated violations. They are deleted automatically when the reporting, blocking or affected account is deleted.
• Recovery-code hashes are removed when used, replaced or when the account is deleted.
• Optional AnalyticsCLI raw events are retained for up to 400 days; aggregated analytics is retained for up to three years. This supports comparisons across onboarding and subscription cycles. Shorter project-specific retention takes precedence. AnalyticsCLI backups expire within the provider's baseline backup retention of 90 days.
• GlitchTip error and performance events use a 90-day retention period. Technical API container logs rotate at 10 MB per file, with at most three files; older files are automatically removed. The time covered by those logs depends on request volume.
• Discord notifications are separate copies and are not automatically removed when an account, feedback record or diagnostic event is deleted from its original system. Contact us using the details below so we can locate and, where required, remove notification copies as part of a deletion request.
• Consent records remain locally until reset, replaced by a new consent version or app deletion. Withdrawal stops future optional analytics; already collected data remains subject to these retention periods and your right to request erasure.
• Transaction and business records may be retained beyond account deletion where required by statutory tax and commercial retention duties or for the establishment, exercise or defence of legal claims.

Deleting a ScrollFight account does not automatically cancel a subscription billed by Apple; subscriptions must be managed separately in your Apple account settings.

12. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object at any time to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation. You may withdraw consent at any time with effect for the future.

Send requests to kontakt@wotaso.com. Because the account has no email login, we may need information from the app to verify that a request concerns your account.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

13. Required data, automated decisions and minors

Core account and game data is required for online leagues, friendships and recovery; without it, those features cannot be provided. Analytics and notifications are optional. Game scores and rankings are calculated automatically from the game rules, but there is no automated decision-making producing legal or similarly significant effects within Article 22 GDPR.

If you are under 16, analytics consent must be given or authorised by the holder of parental responsibility where Article 8 GDPR applies. Paid purchases by minors also require the necessary consent under applicable law and Apple's purchase rules.

14. Changes

We update this policy when the service, providers or legal requirements change. The current version and date are always available on this page.