Privacy Policy – Weed Empire

Last updated: October 20, 2026 · Deutsche Fassung (the German version is authoritative) · Imprint · Terms of use

1. Controller

Luke Jahn und David Jahn
Am Teich 6
Cunnersdorf
Email: weedempire23@gmail.com

2. In short

3. Data on your device

Your save, profile (name, avatar, optionally a profile photo) and settings are stored only locally on your device. The save is stored encrypted so it cannot be edited by hand. Profile photos never leave your device. Reminders (e.g. “storage full”) are local device notifications and do not go through a server. The request to rate the game is handled by Google Play; we don't learn whether or how you rate it.

Android: the app allows Android backup. If it is enabled in your device settings, Google backs up the app data to your Google account; Google's privacy policy applies. PC (Steam): your save may also be backed up via Steam Cloud; Valve's privacy policy applies.

Legal basis for storing data on your device: Section 25(2) no. 2 TDDDG (strictly necessary for the game you use) and Art. 6(1)(b) GDPR.

4. Account and online features (optional)

Only when you create an account or sign in is data sent to our server:

Purpose: sign-in, backing up and syncing your save between your devices and showing the leaderboard. Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).

Sign in with Google (Android): Google confirms to the game with a sign-in token that you use a certain Google account. We only store the account number (“sub”). Google's privacy policy also applies. Sign in with Steam (PC): our server has a sign-in ticket checked by Valve and only stores your SteamID. Valve's privacy policy also applies.

5. Server time and anti-cheat

So that changing your device clock doesn't earn offline income, the game asks our server for the current time at start-up and occasionally during play – even without the online features turned on. No game data is sent and nothing is stored. If the game detects tampering, this is only noted in the save on your device, and that save no longer takes part in the leaderboard. The server automatically hides unrealistically fast progress from the leaderboard. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fair game and leaderboard).

6. Error reports

If a technical error occurs, the game sends an anonymous error report to our server: the error message, the place in the program code, the game version, device type (Android/PC/browser) and browser/WebView version and operating system (user agent). No account ID, player name or save is included. Identical errors are only counted; reports are deleted after 30 days. Turn it off under Settings → Data → Send error reports. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a bug-free game).

7. Feedback and reports

You can send us a message via Feedback in the game. We store your text, the type (bug/idea/other), game version, device type and user agent – and your player name if you are signed in. Please don't include personal data. Feedback is deleted after 180 days at the latest. Legal basis: Art. 6(1)(b) and (f) GDPR.

You can report players in the leaderboard, e.g. for an offensive name. We store the reported account, the reason, the time and your account ID – or, without an account, a hash of your IP address (so nobody reports twice). If a player is reported several times, they are hidden from the leaderboard until reviewed. Resolved reports are deleted after 90 days. Player names with offensive words are rejected when the account is created. Legal basis: Art. 6(1)(f) GDPR (protecting players from offensive content).

8. Copy protection (Android)

When you sign in in the Android app, the game uses the Google Play Integrity API to ask Google whether the app comes from Google Play and is unmodified. Google processes information about the app, device and purchase for this; we only receive the result (e.g. “from Google Play, purchased”) and only keep anonymous counts. Google's privacy policy also applies. Legal basis: Art. 6(1)(f) GDPR (protection against unauthorized copies).

9. Achievements on Google Play Games and Steam

Android: If you are signed in to Google Play Games on your device, the game reports unlocked achievements to Google Play Games so they appear in your Play Games profile. Google manages the sign-in and the profile; we receive no data from it. PC: The Steam version reports achievements to Steam (Valve). Google's and Valve's privacy policies apply. Legal basis: Art. 6(1)(b) GDPR.

10. Server logs and abuse protection

Our host technically processes your IP address with every request (see 11). To prevent abuse (e.g. creating accounts en masse or guessing link codes), the server stores a hash of IP address and action with a counter; this entry is deleted after one day at the latest. Requests to the server are logged briefly for troubleshooting (a few days at most at Cloudflare); this may include the IP address. Legal basis: Art. 6(1)(f) GDPR (security and stability of the service).

11. Hosting

The server runs on Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as a processor (Cloudflare Workers and D1 database). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

12. Security

All connections between the game and the server are encrypted via HTTPS (TLS). Passwords are only stored as a salted PBKDF2 hash and device secrets only as a SHA-256 hash – nobody, including us, can read your password. Saves are encrypted and protected against tampering on your device and in the cloud. Only we as the operators have access to the database.

13. Retention and deletion

Online data is kept until you delete it. Settings → Online → Delete online data removes your cloud save, leaderboard entry and account from the server completely; turning off the leaderboard also removes your entry. So that a player name is never given out twice or again after a ban, only an irreversible hash of the name is kept afterwards (legitimate interest, Art. 6(1)(f) GDPR). Link codes expire after 15 minutes. You delete the data on your device by uninstalling the app or clearing its data.

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). As we don't know any names or email addresses, we can only identify you by your player name or account ID – the easiest way is to delete your data directly in the game or on the delete account page. For anything else, an email to the address above is enough. You can also lodge a complaint with a data protection authority, in particular in the EU country where you live.

You are not obliged to give us any data: the game works without an account; only the online features are then unavailable. There is no automated decision-making within the meaning of Art. 22 GDPR – automatically hiding entries in the leaderboard only affects what is displayed and is reviewed by us.

15. Children

The game is intended for adults (18+) and is not directed at children. We do not knowingly collect data from children.

16. Changes

If the game's features change, we will update this policy. The version published here applies.