blackflip

Privacy Policy

Last updated: September 26, 2026

Blackflip is a puzzle game for the web (blackflip.flaboratorium.org) and for Android. In short:

  • No registration, no e-mail address, no real name needed.
  • No advertising, no analytics or tracking services, no cookies.
  • A random player ID instead of an account. Your data is not sold or used for advertising.
  • Android app only: the in-app purchase of Blackflip Pro runs through Google Play and sends technical diagnostic data to Unity (section 8).
  • Our server is in Germany (IONOS).

1. Who is responsible

Responsible for data processing (controller under the GDPR):

Stefan Christmann
Horster Str. 72
45968 Gladbeck, Germany
E-mail: blackflip@flaboratorium.org

2. Hosting and server logs

The website, the game files and the game's server (API) are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, who processes data on our behalf under a data processing agreement.

Whenever you open the website or the game contacts the server, the server receives technical data: your IP address, date and time, the requested address, the amount of data transferred and the browser or app identification (user agent). This is needed to deliver the game and to keep the server secure (legal basis: Art. 6(1)(f) GDPR). The hosting provider keeps these log files only for a limited time.

3. Data stored on your device

The game stores your progress, settings, puzzle drafts, your random player ID, your device link code and, in the Android app, whether you bought Blackflip Pro in the storage of your browser (IndexedDB) or of the app. This data stays on your device unless described below. No cookies are used. You can delete it at any time by clearing the website data in your browser or by uninstalling the app.

The website registers a service worker only so that it can be installed as an app; it does not store any data.

4. Random player ID and global statistics

On first start, the game creates a random player ID. It is not linked to your name, your e-mail address or any advertising or device identifier.

When you finish a puzzle, the game sends the player ID, the puzzle, the result (solved, failed or gave up), the time you needed, your path and the app version to the server. From this we calculate the global statistics shown in the game (players, solve rate, best time, shortest path). Other players only see these totals, never your player ID (legal basis: Art. 6(1)(b) and (f) GDPR).

5. Online savegame and "Link devices"

So that you can continue on another device at any time, the game also keeps your progress on the server: the status, stars, time and attempts per puzzle, your coins, unlocked levels and game settings, together with your player ID, the app version and the time of the last change.

The savegame belongs to a random 16-character device link code (Settings > Link devices). The server stores this code only as a cryptographic hash. Anyone who knows your code can play with your progress, so only share it with your own devices (legal basis: Art. 6(1)(b) GDPR).

6. Puzzle Creator: community puzzles

When you publish a puzzle, the server stores the puzzle and its solution, the puzzle name, the author name you enter, the optional messages for players, your player ID and the time. The puzzle, its name, the author name and the messages are visible to all players. Please use a nickname and do not enter personal data; the community rules shown before publishing apply (legal basis: Art. 6(1)(b) GDPR). We may correct, hide or delete puzzles that break these rules.

7. Reporting puzzles

If you report a puzzle, the server stores the puzzle, the reason you chose, your player ID, the app version and the time, so that we can review it and to prevent the same report twice (legal basis: Art. 6(1)(f) GDPR, our interest in a safe community).

8. Android app and Google Play

The Android app is distributed through Google Play, operated by Google Ireland Limited. Google processes data about downloads and your device under its own responsibility, see the Google Privacy Policy.

The app contains no advertising or analytics components. It uses the internet (to talk to our server) and the vibration motor (for the optional haptic feedback) and sends the same data to our server as the web version.

Purchase of Blackflip Pro. The app is free; Pro is unlocked with a one-time in-app purchase. The purchase, the payment and refunds are handled entirely by Google Play under Google's responsibility: we receive no payment details, no name and no e-mail address. Whether you bought Pro is asked from Google Play on your device and remembered there; it is not sent to our server (legal basis: Art. 6(1)(b) GDPR, performance of the purchase).

Unity In-App Purchasing. For the purchase the app uses Unity In-App Purchasing by Unity Technologies. It sends technical diagnostic data about the purchase process to Unity, such as errors, the app version and device information (model, operating system). This data is not linked to your player ID and helps keep purchases working reliably (legal basis: Art. 6(1)(f) GDPR). Unity may process it outside the EU, in particular in the USA; details, the safeguards for such transfers and how long Unity keeps the data are in the Unity Privacy Policy. The web version does not contain Unity In-App Purchasing.

9. How long we keep data

Statistics, savegames, community puzzles and reports are kept as long as the game is operated, unless you ask us to delete them earlier. Global statistics may be reset from time to time. Server log files are deleted by the hosting provider after a short period.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77).

Because the game works without an account, we cannot tell which data belongs to you. To exercise your rights, please send us your device link code (Settings > Link devices) by e-mail; we will then find and, if you wish, delete your savegame, results, reports and puzzles.

11. Children

Blackflip is suitable for all ages and needs no personal data. Children should not enter their real name as author name when publishing puzzles.

12. Changes

We update this policy when the game changes. The current version is always available at this address.