Effective: 18 October 2026 · Applies to the iOS and iPadOS app and its Apple Watch companion app.
BRUNIQO · Alessandro Bruening
Katharina-Bräckeler-Straße 4a
41462 Neuss · Germany
Email: support@bruniqo.de
Website: https://bruniqo.de/
Legal notice: https://bruniqo.de/impressum/
The app is fully playable without a user account and integrates no standalone analytics services; the advertising SDKs do, however, collect performance and interaction data to measure advertising (section 6). Game progress, settings and local technical reports are stored on the device by default. The app shows advertising mediated by Unity LevelPlay; personalised advertising and tracking only take place with your explicit consent (section 6). You only need an account via “Sign in with Apple” if you want to buy or use credits (section 5). The app sends no usage or analytics data to BRUNIQO.
Full iCloud backup is off by default. If you explicitly enable it, the app stores signed game-state snapshots in your private CloudKit database. These include the world state, progress, removed straws, physics and deformation state, needle and tool state, foreground play time, technical world and installation identifiers, timestamps and a small preview.
This processing is used only for backup, restoration and choosing between conflicting offline states. The private database is normally accessible only to you and cannot be inspected through the developer portal. Purchase entitlements and payment details are not included in the snapshots.
Local game data remains until you reset it in the app or delete the app. Cloud snapshots remain until you delete them.
To delete all CloudKit data stored by this app, open Pause & Settings, choose Delete Saved iCloud Data and confirm a second time. This deletes the private CloudKit zone used only by this app; your local game world remains unchanged. Resetting the local world is a separate action and also requires two confirmations.
You can delete your credit account in the app under “Pause & Settings” → “Delete Account and Credit Data”; you confirm the deletion with Apple as well. This deletes the account, all purchase and spending records, sessions and Apple notifications for that account on the server and revokes the sign-in with Apple; unused credits are lost. A deletion marker without purchase data is kept for 30 days so that late notifications cannot restore deleted data. Your local game world is kept.
The only items sold are consumable credit packs via Apple StoreKit. So that your balance survives across devices and cannot be altered on the device, BRUNIQO keeps a credit account on its own server. You sign in with “Sign in with Apple”; the app requests neither your name nor your email address.
The server stores: a keyed hash of your Apple identifier (not the identifier itself), a random account number that is passed to Apple as the account token when you buy, an encrypted Apple sign-in token used only to revoke the sign-in with Apple, and hashes of your sessions (valid for at most 30 days). For your purchases the server stores Apple's transaction and original transaction IDs, the product, the credited credits, timestamps and the environment (production or test), plus your credit spending with item, credit amount and time, and the state of running power-ups. It receives and stores Apple's signed notifications about these transactions, including refunds, so that refunded credits can be deducted again.
BRUNIQO processes no payment details, prices or currencies; payment is handled by Apple alone. Earlier tool purchases are recognised on the device via StoreKit through “Sync Previous Purchases”; they are not sold.
The server is operated by Hetzner Online GmbH in a data centre in Falkenstein, Germany. To prevent abuse and diagnose errors, the web server logs IP addresses and access times; these logs are deleted after 14 days, service logs after at most 30 days.
Since version 1.9 the app shows advertising (banners, occasional full-screen ads and optional rewarded videos). Ads are mediated by Unity LevelPlay (formerly ironSource) by Unity Technologies. Up to version 1.10 they came from ironSource Ads. From version 1.11, these advertising partners also bid for the ad slots through LevelPlay mediation: Unity Ads (Unity Technologies), Liftoff Monetize (formerly Vungle) and Chartboost (LoopMe).
Consent before start (from version 1.11): Before the advertising SDK starts, the app asks you on a screen of its own whether the named advertising partners may use device identifiers, approximate location, ad interactions and performance data for personalised advertising. Both answers carry equal weight. With “Use contextual ads” you keep playing with non-personalised ads, and the app does not ask for tracking permission. Even then, the advertising SDKs process the technical data listed under “Data processed” below to serve and bill ads. With “Allow personalized ads”, a second screen explains App Tracking Transparency; after “Continue”, iOS shows the system dialog in which you allow or refuse tracking. Ads are personalised only if you agreed in the app and allowed tracking in iOS. If either is missing, the app tells the advertising partners that there is no consent; without iOS tracking permission, iOS does not release the advertising identifier (IDFA). Whatever you choose, the app sends an objection to the sale and sharing of personal data (an opt-out signal under US privacy law).
Changing your decision: Under “Pause & Settings” you can switch “Personalized ads” off or back on at any time; the app passes the change on to the advertising partners immediately. You change the iOS tracking permission under Settings → Privacy & Security → Tracking; the app reads it again whenever it returns to the foreground. Up to version 1.10 the app explained advertising on a single information screen, led straight to the iOS system dialog with “Continue” and personalised ads only when tracking was allowed.
Data processed: To deliver, cap and bill ads and to prevent fraud, Unity LevelPlay and the integrated advertising partners process device and usage data, in particular device model, operating-system version, language setting, approximate location derived from the IP address, a vendor-scoped device or installation identifier, and information about ads shown and tapped. The advertising identifier (IDFA) and linking with other companies' data for advertising (tracking) are used only with your consent. The tracking domains declared in the app's privacy manifest belong to Unity mediation.
Unity Technologies, Liftoff and Chartboost (LoopMe) each process this data as independent controllers or under their own terms and may process it outside the EU, in particular in the USA. More information: Unity https://unity.com/legal/privacy-policy · Liftoff https://liftoff.ai/privacy-policy/ · Chartboost (LoopMe) https://legal.loopme.com/privacy-center.
Rewarded videos and ad-free right: Rewarded videos are available only when you are signed in and only when you tap for one. From version 1.11 the app requests a one-time random reward ID from our server, which the server assigns to your credit account; Unity LevelPlay receives only this ID for the video, not your Apple identifier and not your account number. When the advertising SDK starts, the app also passes a random installation ID that is not linked to your Apple identifier. After the video, Unity notifies our server directly with a signed server-to-server message, and the server adds the credits exactly once. For this the server stores the reward ID, account number, installation ID, action, number of credits, status, event ID and timestamps. Up to version 1.10 the app passed your random account number as the reward user ID instead. If you obtain the ad-free right with credits, the server stores it as part of your credit account so that it applies on all your devices. These records belong to the credit account and are deleted with it (section 4). Legal basis: Article 6(1)(b) GDPR.
Performance and MetricKit reports are stored locally and retained in limited quantities. Nothing is sent to BRUNIQO automatically. If you explicitly use the system share sheet, you choose the recipient and destination. The report removes the local free-space value before sharing.
The Watch app exchanges only limited game slices and confirmed removal operations with the paired iPhone. It shows no ads, uses no tracking and sends no data to a BRUNIQO server.
Game Center: If you are signed in to Game Center on your device, the app signs in to Game Center at launch and submits your scores (for example removed straws and challenge results) to Apple's Game Center leaderboards. Other players can see them under your Game Center name, depending on your Game Center settings. Apple processes this data as an independent controller. Legal basis: Article 6(1)(b) GDPR. You can sign out of Game Center at any time under Settings → Game Center.
Apple services are used for the App Store, StoreKit, Sign in with Apple, Game Center and the optional iCloud/CloudKit backup. Apple processes data under its own privacy terms and may process it outside the European Union according to its infrastructure. The credit account is hosted on a server of Hetzner Online GmbH in Germany. For advertising, data is transmitted as described in section 6 to Unity Technologies and, from version 1.11, also to Liftoff and Chartboost (LoopMe). No app data is disclosed to data brokers or analytics providers.
Processing required to provide the app and features you explicitly enable is based on performance of the contract or action at your request (Article 6(1)(b) GDPR). Secure local diagnostics serve the legitimate interest of stable app operation (Article 6(1)(f) GDPR); reports do not leave the device unless you explicitly share them. The credit account serves to fulfil your purchases (Article 6(1)(b) GDPR); server logs and refund processing rely on the legitimate interest in secure, abuse-free operation (Article 6(1)(f) GDPR). Personalised advertising, access to the advertising identifier and tracking are based on your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with future effect under “Pause & Settings” (“Personalized ads”). Serving non-personalised ads to finance the free app is based on our legitimate interest (Article 6(1)(f) GDPR).
You may have rights including access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a data-protection supervisory authority such as the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. Send requests to support@bruniqo.de.
We update this policy if the app's data flows or functionality change materially. The version published on this page is authoritative.