Privacy Policy

The short version

The full details follow: which data comes up, what for, and for how long.

This policy exists in German, English, French, Spanish and Brazilian Portuguese. If the versions differ, the German version applies.

1. Controller

Culpa UG (haftungsbeschränkt), Forsmannstr. 22A, 22303 Hamburg, Germany, represented by the managing directors Marcel Pochert and Sebastian Houshmand
Email: [email protected]

We have not appointed a data protection officer because we are not required to.

2. The app

2.1 The age question at first launch

Before the app creates an account, it asks your age: on iOS 26 and later through Apple’s age range feature (Declared Age Range), otherwise with a year picker. We only use the answer to check your age; the year you pick never leaves your device. Our server stores just one thing, once: whether you are 13 to 17 or 18 and over. If you are under 13, the app creates no account and sends nothing to us. The app keeps your answer on your device, so the question doesn’t simply start over after a reinstall. More in section 7.

Legal basis: Art. 6 (1) (c) GDPR together with the age rules for minors, and Art. 6 (1) (b) GDPR (the game is for ages 13 and up). The note on your device is strictly necessary for that (§ 25 (2) No. 2 TDDDG, the German telecommunications and digital services data protection act).

2.2 Your account

The app creates an anonymous account with our backend provider Supabase. It consists of a random identifier (account ID) and the time it was created; we never ask for a name, email or phone number. To keep you signed in, the app stores a sign-in key (token) in your device’s keychain. For sign-ins, Supabase also logs technical data such as the time, IP address and the device or app identifier of the request (user agent) to protect the account. We also store your device’s time zone, so the new day with fresh Daily Fights starts at the right time for you.

Purpose: to provide the game and link your progress to your account. Legal basis: Art. 6 (1) (b) GDPR (contract for using the game). Storing the token on your device is strictly necessary for the game to work (§ 25 (2) No. 2 TDDDG).

Genuine app check: so nobody can farm Master XP with fake accounts, the app proves to our server with Apple’s App Attest that it is a genuine copy of Punchlings on a real Apple device, when you create a Punchling with a Master. For that we store a key the app creates on your device, with your account. Legal basis: Art. 6 (1) (b) and (f) GDPR (a fair game); the key on your device is strictly necessary (§ 25 (2) No. 2 TDDDG).

2.3 Securing your account with Sign in with Apple

You can choose to secure your account with Sign in with Apple, so you can get your Punchlings back on another device. The app asks Apple for neither your name nor your email address. We only receive Apple’s identifier for you in our app and store it with your account. If that Apple Account already secures another account, the app asks you first and never merges two accounts. When you delete your account, we also tell Apple to revoke the sign-in. Legal basis: Art. 6 (1) (b) GDPR.

2.4 Your Punchlings and game data

With your account we store:

Purpose: to provide the game, compute Fights on the server and find fitting Opponents. Legal basis: Art. 6 (1) (b) GDPR. We only read play days, win rates and progress as totals across all Players, never per person; the legal basis for that is Art. 6 (1) (f) GDPR (our interest in a fair, balanced game). Who is active in a Clan, the server works out automatically from the play days (section 2.13).

Opponents are picked automatically by Level, and the Clan Leader role passes on automatically when the Clan Leader hasn’t played for a while. This has no legal or similarly significant effect on you; there is no automated decision-making within the meaning of Art. 22 GDPR.

2.5 What others see

Punchlings is a game against others. Other Players see your Punchlings as Opponents, in Fights and in Replays: name, Appearance, Level, Stats, Title and Arsenal. Every Punchling also has a public Profile at punchlings.com/<name> with its name, Portrait, Title, Level, Rank, wins and losses and, once it is in the Hall of Fame, since when. Every Profile also shows your Prestige: how many of your Punchlings are in the Hall of Fame. This address is also its Invite link. Replay links (punchlings.com/f/…) show both names, Levels, Portraits, the winner and the date of a Fight, and play the Fight from its Fight record (Appearance, Stats and Arsenal of both sides, without names). Our server draws the Portrait, an image of your Punchling, and stores it publicly at Supabase. Your account ID is never public. So please don’t pick a name that identifies you personally (such as your real name). What others see of Clans is in section 2.13.

If you are under 18, your Punchlings have no Profile at punchlings.com until you switch it on in the app under Settings › “Show my Punchlings on punchlings.com”. Link previews and Replays on the web never show your Punchlings’ names, numbers or Portraits; there they appear as “Masked Punchling”. The Replay still plays the Fight with both Punchlings’ Appearance, Stats and Arsenal.

The Hall of Fame, in the app and at punchlings.com/hall-of-fame, lists every Punchling in the Hall of Fame and the all-time records (most Tournaments won, highest Level, most challenges fended off, biggest Dojo), each with its place, Level, Rank, Laurels and record, and your Prestige. It shows a Punchling’s name and Portrait only where its Profile is public and its name isn’t hidden; otherwise it shows the Punchling’s public number. The records are updated every hour; a deleted account leaves them at once.

Clips are short videos of a Fight that the app creates on your device. They show both names and your Invite link. We don’t upload them; you decide in the iOS share sheet where they go.

Profiles, Replay links and the Hall of Fame tell search engines not to list them; only people who have the link find them.

Legal basis: Art. 6 (1) (b) GDPR; Opponents, Profiles and Invite links are part of the game.

2.6 Masters and Pupils

You can invite others with your Invite link (your Profile address). When someone new creates their first Punchling, the app asks “Did someone invite you?” and offers matching public names to pick from. If they pick you, they become your Pupil: you see their name, number, Level and the XP they earned you in your Dojo. We never read your contacts and never ask who you sent the link to.

2.7 Report and Block

You can report the name of a Punchling or a Clan and block Punchlings. For a Report we store who reported which Punchling or Clan, its name and when, and how we resolved it; there is no free text. A name is hidden provisionally once three different Players with some play history have reported it, and we are notified with the public number of the Punchling or Clan only. For a Block we store which Punchling you blocked and when; it can also stop someone joining a Clan (section 2.13). Purpose: enforcing the rules and protecting other Players. Legal basis: Art. 6 (1) (b) and (f) GDPR and Art. 6 (1) (c) GDPR together with the Digital Services Act (Art. 16 and 17 DSA). Names we have banned for good stay stored without any link to an account, so they can’t come back.

2.8 Purchases

You buy Punchling Slots, Cosmetics, the founder pack and the premium track of the Season Pass through Apple (in-app purchase). Apple alone handles the payment; we never see payment data, prices or your Apple Account. So we can link the purchase to your account, the app passes your account ID to Apple at checkout. For each purchase we store the transaction numbers, product, environment, time, what it unlocked and any refund; Apple also tells our server about refunds and revocations. Purpose: to unlock, restore and refund purchases, and to keep the records that tax and commercial law require. Legal basis: Art. 6 (1) (b) and (c) GDPR.

If you subscribe to the Club (a subscription that renews automatically), we also store for that purchase when the paid period ends, when Apple’s grace period ends if a renewal could not be charged, whether the subscription renews, and which account it belongs to. Our server asks Apple for its current state when the app reports the purchase and when Apple tells us about a change (such as a renewal, a cancellation or a refund). Purpose: to know whether you are a Club member right now. If you restore your purchases on another account, the subscription moves there (at most once every 30 days). We keep this information like any purchase (section 5). Legal basis: Art. 6 (1) (b) GDPR.

2.9 Notifications (push)

The app never asks at first launch. Only when someone first challenged you does it ask whether you want notifications, and only if you tap “Turn On” does iOS ask for permission. Then we store your device’s push address (token) from Apple, which kinds you want (challenged, Daily Fights full, a Pupil levelled up, your Clan’s boss is down), your quiet hours and when you turned notifications on, plus a log of the notifications sent. A notification contains no names, only the text to show and which Punchling or Fight it opens. At most 2 a day, never in your quiet hours.

You can turn them off in the app or in the iOS settings at any time; we then delete the token. Legal basis: Art. 6 (1) (b) GDPR (notifications are a part of the game that you switched on yourself); storing the token is then strictly necessary for the service you asked for (§ 25 (2) No. 2 TDDDG).

2.10 Sponsor Bonus, Extra Fights and advertising (Google AdMob)

You can choose to watch a short sponsor video in two places: once a day for the Sponsor Bonus (3 stars for the Season Pass, within its daily cap), and, when your Punchling has no Daily Fights left, for an Extra Fight (up to 2 a day for all your Punchlings together; an Extra Fight is gone at the new day). Only when you tap one of these offers does the app start Google’s ad service AdMob; without the tap, no ad code runs. Ads are not personalized for anyone: we don’t use the advertising ID (IDFA), don’t ask for tracking permission (ATT) and switch off personalization for every request. Google still processes your device’s IP address and device and app information and stores data on your device to play the ad, limit how often it is shown, count it and detect fraud.

Which region applies is taken from your App Store country, not from your location: the app sends it to our server, which decides with your age group whether ads may run, and doesn’t store it. Google confirms a completed video directly to our server, with a one-time code from us; we never send your account ID or a Punchling’s ID to Google. We store the code, when it was issued, for an Extra Fight which Punchling it is for, Google’s transaction number from the confirmation, and the bonus or Extra Fight it paid for. If you tap “Report this ad”, we receive Google’s number for that ad and the reason you picked, and use it to block the advertiser or category. Under Settings › “Show sponsor offers” you can hide both offers.

Google processes the data for the ads under its own responsibility, as a separate controller; Google’s privacy policy applies (policies.google.com/privacy). In the EU and EEA that is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Legal basis: for adults in the EU, EEA, UK and Switzerland your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can change or withdraw at any time in the app under Settings › “Ad privacy options”; elsewhere Art. 6 (1) (b) GDPR (you asked for the bonus or the Extra Fight) and § 25 (2) No. 2 TDDDG.

2.11 Usage statistics with TelemetryDeck

We want to know whether people come back and where they get stuck. For this the app sends short usage signals to TelemetryDeck, such as “session started”, “opened: Arena” or “created first Punchling”. Every signal contains the app version, iOS version, device model and screen size, language, region and time zone, whether it is a test or App Store build, and simple usage figures such as the number and length of sessions and the first day of use. To count returning Players, the app computes a one-way hash on your device from the identifier iOS gives our app on this device (identifierForVendor) and sends only that hash, plus a random identifier for each session. We never send account IDs, Punchling names, Fight IDs, email addresses or device identifiers. What may be sent is fixed in the code; nothing you type is ever included. TelemetryDeck only starts after the age question, and never if you are under 13.

You can switch this off in the app under Settings › “Share anonymous usage data”. From then on the app records no new signals, and from the next launch on TelemetryDeck doesn’t start at all. The same switch covers crash reports (section 2.12).

Legal basis: Art. 6 (1) (f) GDPR (our interest in improving the game). You can also object at any time (see section 6).

2.12 Crash reports with Sentry

If the app crashes or hangs, an error report goes to Sentry: the error message, the technical trace (stack trace), app version, device model, iOS version and network calls without parameters; for errors in loading the Shop’s prices, also your App Store country. If a sponsor video can’t be shown, the app reports that the same way, with only the reason and Google’s error code as the error message. Before sending, the app removes user, IP and request data and redacts IDs, email addresses, IP addresses and tokens in the text. To compute the crash rate, Sentry creates a random installation identifier on your device that is not linked to your account. Errors on our servers are reported the same way, without request data.

You can switch crash reports off with the same switch as usage statistics (section 2.11). Legal basis: Art. 6 (1) (f) GDPR (our interest in a stable app).

2.13 Clans and the boss of the week

From a Level, or after a few days, as the app tells you, you can found a Clan or join one. A Clan is a group of Players; you are in at most one, with all your Punchlings. It has a name its founder picks, an emblem made from ready-made presets and a Clan Leader. There is no chat, no description and no other text. Every week each Clan takes on the same boss: once a day, one of your Punchlings can have a Boss Fight. Our server computes it like any Fight, and its damage counts for your Clan. The only rewards are Titles.

For this we store:

How much Health a week’s boss has depends on how many members played in the 7 days before. If none of the Clan Leader’s Punchlings has fought for a while, the role passes to the member who has been in the Clan longest and has played recently. The server works out both from the play days (section 2.4).

What others see: in the app, anyone can find a Clan through the search or its link and sees its name, number, emblem, how many members it has and whether anyone can join. The members of your Clan see each member as their highest-Level Punchling (name, number, Level), since when they have been in it and who leads it, and on the boss board who dealt how much damage this week. The Clan Leader sees each request to join the same way, as the requesting Player’s highest-Level Punchling. Nobody ever sees your account ID.

Every Clan has a Clan page at punchlings.com/c/<name> with its name, emblem, number of members, whether anyone can join, and how many bosses the Clan has toppled. It never shows members or their Punchlings. Link previews don’t show the Clan’s name, and the page tells search engines not to list it. A hidden name has no Clan page. Replay links of Boss Fights show your Punchling like any Replay (section 2.5), and the boss.

If a Block stands between you and a member of a Clan, no matter who blocked whom, you can’t join that Clan; the app doesn’t say why. If you have notifications on, one tells you when your Clan’s boss is down (section 2.9).

When you leave or the Clan Leader removes you, your membership ends; you keep your Titles. When the Clan Leader leaves, the member who has been in the Clan longest leads it. When the last member leaves, we delete the Clan; its name stays blocked for 12 months, without any link to an account. Legal basis: Art. 6 (1) (b) GDPR; Clans are part of the game.

2.14 What doesn’t exist

No tracking across other companies’ apps and websites, no personalized advertising, no advertising ID (IDFA), no location, no access to contacts, photos, camera or microphone, no clipboard reading, no fingerprinting, no chat, and no selling of data.

3. This website

3.1 Hosting at Cloudflare

punchlings.com runs on Cloudflare (Cloudflare Pages). For every request Cloudflare processes technically necessary data: IP address, time, requested address, browser identifier (user agent) and preferred language. We use the language only to show you the page in your language; we don’t store it, and we keep no request logs of this website ourselves. Purpose: delivering the site and protecting it from attacks. Legal basis: Art. 6 (1) (f) GDPR.

From this request data Cloudflare compiles counts for us. They are totals only, such as how many requests and visitors there were on a day, from which countries, and how often Profiles, Replay links or the press page were opened altogether. We don’t see single requests, IP addresses or browser identifiers, and we don’t look at how often a particular Profile or Replay link was opened. No script runs in your browser for this, and no cookie is set. Purpose: understanding which parts of the website are used. Legal basis: Art. 6 (1) (f) GDPR.

3.2 No cookies, no tracking

This website sets no cookies and uses no advertising services; its only analytics are the counts from section 3.1, with no script in your browser. The only script is our own Replay player on Replay pages: it plays the Fight in your browser and stores nothing on your device. Fonts, images and the Replay player’s art and sounds come from our own server, with one exception: your browser loads Punchling Portraits directly from Supabase, which then receives your IP address and browser identifier.

3.3 Profiles, Replay links and the Hall of Fame

Profiles, Replay links, the Hall of Fame and Clan pages show only the public game data from sections 2.5 and 2.13. We read it through an interface that returns no account IDs or other personal data. A reported and hidden name does not appear.

4. Recipients and processors

We only pass data to service providers that process it on our behalf and under our instructions (Art. 28 GDPR):

Apple (Apple Distribution International Ltd., Ireland) runs the App Store, in-app purchases, Sign in with Apple, App Attest, the age range feature and the notification service. Apple is responsible for that itself; Apple’s privacy policy applies (apple.com/legal/privacy). Google is responsible itself for the ads (section 2.10).

If data is transferred to a country outside the EU, this happens on the basis of an adequacy decision of the European Commission (for certified companies the EU-US Data Privacy Framework, under which Sentry, Cloudflare and Google are certified) or the EU Standard Contractual Clauses (Art. 45, 46 GDPR), which are part of our data processing agreement with Supabase. For Players in Brazil the EU–Brazil adequacy decisions apply, and for transfers on to the USA the Brazilian standard contractual clauses.

5. How long we keep data

Deleting your account: in the app under Settings › Account. It happens right away: your account, all Punchlings and their Portraits, Profiles and game data from section 2 are deleted. If you secured your account with Apple, you confirm with Sign in with Apple once more, and we revoke the sign-in at Apple.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7 (3)). Write to the address in section 1. Because your account is anonymous, we need proof that it is yours: the account ID shown in the app under Settings › Account.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. For usage statistics and crash reports, the switch in Settings is enough.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example where you live or the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (the Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, [email protected], datenschutz-hamburg.de.

7. Children and teenagers

Punchlings is for ages 13 and up. It is not made for children, and we don’t knowingly collect personal data from anyone under 13. If the age question at first launch (section 2.1) shows that you are under 13, the app creates no account and sends nothing to us. If we learn that a Player is under 13 anyway, we delete the account. Parents who think their child under 13 plays Punchlings can write to us.

If you are 13 to 17, some things work differently for you:

For parents: you can limit screen time and purchases with Apple’s Screen Time and Family Sharing (“Ask to Buy”). You can ask us for access to or deletion of your child’s data at any time; the account ID under Settings › Account helps us find it.

8. Do you have to provide data?

Without the age question, an anonymous account and game data the game cannot work. Usage statistics, crash reports, Sign in with Apple, notifications, Clans, the Sponsor Bonus and Extra Fights are not needed to play.

9. Changes

If the data the game uses changes, we update this policy. We announce important changes in the app before they apply.

Last updated: November 3, 2026