Responsible for data processing in connection with the app "Chaos – Forbidden Words" is:

Chaos – Forbidden Words is a party game for iOS in which teams take turns describing terms without using certain "forbidden words." The app does not require registration or a user account. There is no server of our own on which game states, profiles, or personal data are stored. The app itself does not collect names, email addresses, phone numbers, contact details, photos, videos, or voice recordings.

One exception: when setting up a match, you can enter your own team names. These names remain exclusively on the device (in memory or in local device settings) and are never transmitted to us or to third parties.

The app does not access the camera, microphone, or GPS. Integrated third-party services (see Google AdMob, Section 5) may process technical data independently of this.

The following data is stored exclusively locally on your device (via the iOS system feature UserDefaults):

• Settings: language, background music, sound effects, vibration
• Game statistics and unlocked achievements (e.g., number of rounds played, categories used)
• Purchase status of the optional in-app purchase "Special Mode" (see Section 10)

This data is stored exclusively locally within the app's storage area, not on our servers, and is not shared with third parties. We do not hold a server-side copy of this data; it can be removed by deleting the app or the corresponding local app data.

Team names you enter, by contrast, are NOT stored permanently via UserDefaults, but are held only in memory for the duration of the running app session: they remain visible as long as you set up a new game within the same app session, but are automatically deleted as soon as you fully close and reopen the app. These names, too, are never transmitted to us or to third parties.

The app reads the system language set on your device in order to automatically suggest a suitable language (e.g., German if the system language is German, otherwise English by default). This does not require access to GPS or precise location determination. Your selected language is stored locally on the device (see Section 3).

In the free / ad-supported version of the app, advertisements are served via the Google AdMob service (Google Mobile Ads SDK), including banner and interstitial ads.

In connection with the use of the Google Mobile Ads SDK, the following data in particular may be processed:

• IP address, from which an approximate location can be derived
• Device identifiers, including advertising identifiers such as the IDFA, where available and permitted (see Section 9)
• Information about the advertisements displayed
• Interaction and usage data, e.g., app launches and interactions with ads
• Crash and diagnostic data
• Performance data (e.g., load times, stability)
• Technical device and operating system information, insofar as processed in connection with ad delivery

This data is processed by Google for ad delivery, ad selection, performance measurement, frequency capping, fraud and abuse prevention, security, and — subject to your consent — for personalizing advertising. Google publishes the current, binding list of data categories it processes in its own data-disclosure documentation for the Mobile Ads SDK.

Where legally required, we obtain your consent before the corresponding data processing takes place, prior to serving personalized advertising. You can choose whether personalized advertising is permitted. Without consent, non-personalized or limited ads are served instead. Technically necessary data processing for ad delivery, security, and fraud prevention continues regardless of your personalization consent.

The app uses the Google User Messaging Platform (UMP) to manage consent and advertising settings — in particular for users in the EEA, Switzerland, and the United Kingdom, where this is legally required. Your choice is stored via this consent mechanism and, where technically and legally necessary, transmitted to the advertising services.

You can change or withdraw your consent to personalized advertising at any time, with effect for the future. The app's settings include an "Ad Settings" menu item, through which the Google UMP form can be reopened at any time. A withdrawal only takes effect for the future and does not affect the lawfulness of processing carried out before that point.

If the app or integrated services intend to use data for tracking within the meaning of Apple's App Tracking Transparency (ATT) policy, the corresponding iOS system permission is obtained beforehand: the app first shows you a short, easy-to-understand explanation of why permission is being requested, followed by the official iOS system dialog, where you can allow or deny tracking. If permission is not granted, the IDFA is not used for tracking requiring authorization. The app remains fully usable even without ATT permission.

The app offers an optional, one-time (non-consumable) in-app purchase ("Special Mode," product ID de.sitar.chaos.specialmodes). This permanently unlocks Duel Mode and Yes/No Mode, and additionally removes advertising (banners and interstitials) after purchase. The purchase is voluntary and is not required for normal use of the app.

Payment is processed exclusively through the Apple App Store. We ourselves do not receive complete payment, credit card, or banking details — these are processed by Apple in accordance with its own privacy policy. In connection with processing the purchase, Apple and the app may process technical purchase and transaction information required to carry out and confirm the purchase, and to re-unlock already purchased content (e.g., after a device change) via "Restore Purchases."

The app does not require a user account — there is no login, no public profiles, no public chat, no private messaging, and no uploading or sharing of content with other players over the internet. The game's "multiplayer" character (Team 1 / Team 2) takes place exclusively locally on the same device (pass-and-play), not via an online connection.

We do not sell our users' personal data. Processing/disclosure takes place exclusively in connection with the services described above:

• Google (AdMob, User Messaging Platform)
• Apple (App Store, iOS, in-app purchases)

Beyond this, we do not disclose personal data to third parties unless we are legally required to do so or it is otherwise legally permissible and necessary.

Google and Apple are internationally operating companies. In connection with the use of their services, personal data may be processed outside Germany and the European Economic Area (EEA), in particular in the USA. Where such a transfer to a third country takes place, it is based on the applicable legal transfer mechanisms, for example an adequacy decision of the European Commission or appropriate safeguards under Art. 46 GDPR (e.g., standard contractual clauses). Further information on this is provided by Google and Apple in their respective privacy notices (see Section 21).

Additional requirements under Section 25 TDDDG (Telecommunications-Digital-Services-Data- Protection Act, successor to the former TTDSG) apply to the storage of information on your terminal equipment (your device) or access to information already stored there. Where such storage or access is not strictly necessary, it takes place only with your prior consent.

The processing of personal data is based on the following legal grounds, depending on the purpose of processing:

• Where consent is required for the processing of personal data or access to information on your device, processing is carried out on the basis of Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. This applies in particular to personalized advertising and tracking subject to consent requirements.
• Processing in connection with the purchase and provision of the in-app purchase (Special Mode) is carried out, insofar as personal data is processed, on the basis of Art. 6(1)(b) GDPR (performance of a contract).
• Where data is processed to ensure security, prevent abuse and fraud, or to provide app functions that are technically necessary, and no consent is required, processing may be based on Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in providing the app securely, stably, and economically.
• Where we are legally obligated to process data, we rely on Art. 6(1)(c) GDPR.

Locally stored game states, statistics, achievements, and settings remain on your device until you delete them or uninstall the app — there is no server-side copy held by us. Team names are excepted from this: as described in Section 3, they are held only in memory for the duration of the running app session and are automatically deleted at the latest when the app is fully closed and reopened. Since we do not hold our own copy of this data, we also cannot remotely delete it "on request"; deleting/uninstalling the app is sufficient. For data processed by Google and Apple as part of their respective services, their own retention periods apply.

Chaos – Forbidden Words is aimed at a general audience and is not specifically directed at children. There are no user accounts, public profiles, chats, or ways to publicly share your own content. When using advertising services, we take into account the applicable legal requirements for the protection of minors. Where consent is required and cannot be validly given by the minor under applicable law, the consent of the parent or legal guardian is required. Parents/legal guardians should additionally configure their device's privacy, advertising, screen time, and purchase settings appropriately for the child's age; the "Parents' Guide" within the app provides an additional overview.

The app does not need access to the camera, microphone, photos, contacts, or precise location determination for the game itself and does not request the corresponding permissions. Integrated third parties such as Google may independently determine an approximate location derived from the IP address, without the app itself having GPS access.

Under the GDPR, you have, among others, the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Since data stored locally on your device is neither visible to us nor remotely deletable by us, corresponding requests regarding this data can practically only be carried out by you yourself on the device (e.g., by deleting the app). For all other matters, you can contact us at any time using the contact details in Section 23.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

We rely on data minimization: there are deliberately no user accounts and no server-side storage of game states. Integrated third-party services (Google AdMob, Google UMP, Apple) employ their own technical and organizational security measures.

The privacy notices of the integrated third-party providers apply in addition:

• Google Privacy Policy: https://policies.google.com/privacy
• Apple Privacy Policy: https://www.apple.com/legal/privacy/

The "App Privacy" details (privacy nutrition labels) stored in App Store Connect should be consistent in substance with this policy.

We reserve the right to update this privacy policy whenever the app's features, integrated third-party services, technical processes, or legal requirements change. The current version is available within the app under "Settings → Privacy Policy."

If you have questions about privacy, you can contact us at any time at: