App privacy policy

Controller: EES Engineering, Florian Eppinger, [address to be added], email florian.eppinger@ees-engineering.de.

What data we process:

(a) Account — your email address (stored encrypted), your account name for signing in, a password hash (never the password itself), an account ID and a login token on your device. If you request a code for a new password, we store a check value of the code for 15 minutes and send you the code by email (sent via STRATO).

(b) Player name — the name under which you appear in the game. It is public: other players see it in the leaderboards next to your scores. We do not show other players any further information about you.

(c) Game progress — it is stored on your device and, if you are signed in, also on our server (backup and playing on several devices). It contains your dragons, items, materials, counters (e.g. dragons caught, monsters defeated, metres walked), settings and the map positions of your mines, depleted deposits and search spots. With every upload we store the device model it came from.

(d) Catches, checks and leaderboards — the app reports every caught dragon with number, species, level and time of capture; the server decides whether it is exotic. The server checks every uploaded game save for values that grow faster than is possible through play, records anomalies and calculates the leaderboards (world and country) from this.

(d2) Log of game actions — the app records changes to your money and to valuable items (gems, potions, carbuncles, whetstones, colossus essences) and what caused them (e.g. purchase, sale, loot, reward for an ad video, daily reward), each with a timestamp and a random ID of your device. The log is sent to our server together with your game progress. The server itself records sign-ins, uploaded game saves, reported catches, daily rewards, name choices and consents. Purpose: help if something has been lost, and detecting manipulation (the server checks whether the log and the game progress match). Only the operator can view the log. It contains no location data.

(e) Location — GPS positioning is processed on your device to build the map around you. We do not transmit your coordinates. We only receive: the country you are currently playing in (two-letter code, for the country leaderboard); the map positions in your game progress according to (c); and, for dragon care, route segments without coordinates — for each section of at most ten minutes the time, duration, distance, speed, a one-kilometre grid square and whether you were on foot or driving. The app does not send the start and end of a game session.

(f) Service — when you sign in and for the forge, epic dragons and Bigs, the app sends requests with your account ID to our server (coll.planisdracoria.com); the time and the ID are stored there so that the same state applies to all players. The web server logs requests with the IP address (operation, security, troubleshooting).

(g) Map — the map tiles come from our own tile service; no third-party services (Google, OpenStreetMap servers) are queried.

(h) Age — on first start, the app asks for the month and year of your birth. Both are only evaluated on your device and are not stored; the calculation uses the last day of the month. The app only keeps your age group there, the day of the query and, derived from this, the day from which you are of age (for those under 13: the day from which Planis Dracoria may be used). We only receive whether you agreed to the version for adults or the one for 13- to 17-year-olds. Purpose: Planis Dracoria is only for ages 13 and up, and consent and advertising depend on age.

Purposes and legal bases: providing the game, the account, the online game progress, the leaderboards and dragon care (Art. 6(1)(b) GDPR); checking game saves and the log for manipulation, help with problems, fair leaderboards, security and troubleshooting (Art. 6(1)(f) GDPR — our legitimate interest is a fair game and a secure service); advertising only with your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app at any time. For users under 16, consent is only effective with the approval of their parents or legal guardians (Art. 8 GDPR); Planis Dracoria requires their consent until the user comes of age.

Where the data is stored: on our rented server at STRATO in Germany, which processes it on our behalf (Art. 28 GDPR). To protect against overload attacks (DDoS), data traffic between the app and our server may run through the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; also on our behalf under Art. 28 GDPR). Cloudflare processes your IP address, device and connection data and the transmitted content only to forward them and to fend off attacks; your game data continues to be stored only on our server. In the process, data may be transferred to the USA (EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses). Privacy notice: https://www.cloudflare.com/privacypolicy/ Other players only see your player name and your leaderboard scores; we do not pass anything on to third parties — except Cloudflare as described, and the advertising and Google's consent dialog if you consent to advertising.

Advertising for ages 18 and over (only with consent): Planis Dracoria can show optional ad videos via AppLovin MAX (AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA). AppLovin receives your device's advertising ID, the IP address, device data (model, operating system, language) and usage data of the ad; the data may be transferred to the USA (standard contractual clauses / Data Privacy Framework). If you tick the box for advertising, Planis Dracoria shows the consent dialog of the Google User Messaging Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) according to the European TCF standard before the game starts; there you decide on purposes such as personalised advertising and on the individual advertising partners. Google receives the IP address and device data for this. Your choice is stored on the device and respected by AppLovin; you can change it at any time in the account menu. Privacy notices: https://www.applovin.com/privacy/ and https://policies.google.com/privacy

Advertising for 13- to 17-year-olds (only with consent): Planis Dracoria shows optional ad videos via Google AdMob (Google Ireland Limited, address as above) — never via AppLovin. Planis Dracoria identifies you to Google as a minor (under the age of consent, teenager): Google then shows no personalised advertising and only ads rated as suitable for teenagers. Google receives the IP address, device data and the advertising ID in order to deliver and measure ads and to detect abuse; the data may be transferred to the USA (Data Privacy Framework). There is no Google consent dialog for you.

You can also turn off personalised advertising in the Android settings (reset or delete the advertising ID).

Storage period: account, player name, game progress, catches, check and leaderboard values, country and the daily totals of distance travelled until your account is deleted; individual route segments 30 days; the log of game actions (d2) 180 days; login tokens expire after one year without use; check values of password codes 15 minutes; web server logs with IP address at most 14 days; nightly backups 14 days. If you delete your account, we delete all the data mentioned; it disappears from the backups after 14 days at the latest. The states of forges and anchors contain no email, only the ID. Age group, the day of the age query, the age cut-off dates and your consent are stored only on your device until you delete the app; in the service we record, per account, the version, the ticked boxes and the time of your consent until the account is deleted.

Your rights: access, rectification, erasure, restriction, data portability, objection (in particular to processing based on legitimate interest) and withdrawal of consent given — by email to the address above. You have the right to lodge a complaint with a data protection supervisory authority. You withdraw your consent to advertising in the account menu under “Consent and ads”.

Children and young people: Planis Dracoria is only for ages 13 and up. Anyone who, on first start, enters a birth month according to which they are younger than 13 can only use the app on this device once they are 13 according to that entry. 13- to 17-year-olds see a separate version of this consent, need the consent of their parents or legal guardians and only receive non-personalised advertising via Google AdMob.

As of: 1 October 2026 — draft under review.