1. Controller
The controller is Martin Günther, sole proprietor (Mava Forge), Carl-von-Ossietzky-Str. 117, 09127 Chemnitz, Germany. Privacy requests: info@playtailway.com; support and deletion: support@playtailway.com.
2. Website and Cloudflare
Cloudflare delivers and protects this static website. It may process IP address, access time, requested file, response status, browser, connection, and security information. Our legal basis is Art. 6(1)(f) GDPR: secure and reliable website operation. The website does not set its own analytics or marketing cookies, load external fonts, or use contact or newsletter forms.
3. Local app data and guest mode
The app stores language, audio and display settings, tutorial progress, local saves, cached content, and a randomly generated installation identifier on your device. Guest mode does not automatically create a registered cloud account. You can delete local data through your device settings; unsynchronised progress may be lost.
4. Game account and sign-in
For an account we process email address, internal user ID, display name, profile image or avatar, and sign-in, confirmation, and session information. Depending on platform availability, sign-in may be offered by email, Google, or Apple. We do not receive your external provider password. Our legal basis is Art. 6(1)(b) GDPR, supplemented by Art. 6(1)(f) for account security.
5. Cloud saves and Supabase
Supabase provides account services, database, cloud synchronisation, and server-side functions. Stored data may include progress, missions, rescue and recovery states, resources, buildings, unlocks, equipment, companions, rewards, timestamps, and technical associations. This enables saving, restoring, and cross-device progress under Art. 6(1)(b) GDPR.
6. Profiles, friends, leaderboards, and safety
When you use online features we process display name, avatar, player ID, friend requests and connections, and leaderboard performance. Other players see only profile data intended for that feature, not your sign-in email. Reports and moderation information may be processed to investigate abuse and keep the community safe under Art. 6(1)(f) GDPR. Tailway does not provide open anonymous chat.
7. Purchases
In-app purchases are processed by Google Play or Apple. The store handles payment data under its own responsibility. Tailway does not receive full credit card or bank details. To verify, assign, and restore purchases we process product ID, purchase or transaction ID, purchase token, time, status, and resulting entitlements. Legal bases include contract performance, legal record-keeping, and fraud prevention.
8. Advertising with Google AdMob
The app uses Google AdMob for ads and optional rewarded videos. Processing may include IP address and approximate region, device and app identifiers, advertising ID, ad interactions, and diagnostics. Google UMP manages required consent choices. Age, region, and your choices determine whether ads may be personalised, non-personalised, or restricted. Additional family protections apply to children and users of unknown age; personalised advertising is not intended for them.
9. Operation, content, and diagnostics
The app loads game content and configuration from our servers. Limited account-linked game events, error, security, and verification records may be processed to deliver features, fix problems, assign rewards correctly, and prevent manipulation. We do not use a separate website analytics tool or conduct cross-app analytics for our own marketing.
10. Contact
If you email us, we process your sender address, message, attachments, and information you volunteer to answer your request. Do not send passwords, sign-in codes, or complete payment details. The legal basis is Art. 6(1)(b) or (f) GDPR.
11. Recipients and international transfers
Recipients may include Cloudflare (website), Supabase (accounts, database, and functions), Google (sign-in, ads, Google Play, and email), and Apple (sign-in, App Store, and payments). These services use international infrastructure, so data may be processed outside the EU or EEA. Articles 44 et seq. GDPR, adequacy decisions, and safeguards such as EU Standard Contractual Clauses apply.
12. Retention and deletion
We retain data only as long as required for its purpose or legal duties. Account and cloud data generally remain until account deletion. Necessary purchase, tax, security, and evidence records may be retained with restricted use. Backups are overwritten according to their deletion cycles.
13. Children and families
Tailway is designed to be family-friendly. A store age rating does not replace legally required parental consent. Where a child requires guardian consent, consent-based processing may take place only with that consent. Advertising and online features are restricted according to age and region. Contact us if you believe a child submitted personal data improperly.
14. Your rights
Subject to legal conditions, you have rights to access, correction, deletion, restriction, portability, withdrawal of consent, and objection. You may complain to a data protection authority. The Saxon Data Protection and Transparency Commissioner is one authority responsible for our location. Requests: info@playtailway.com.