Privacy policy
Last updated: October 2026
This privacy policy explains how User Acquisition SL GmbH processes personal data on the website user-acquisition.com and in the mobile games and apps we publish under the brand Vanguard Games on Google Play and the Apple App Store ("our games").
1. Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
User Acquisition SL GmbHHabichtsweg 1
22307 Hamburg, Germany
Email: info@user-acquisition.com
Vanguard Games is a brand of User Acquisition SL GmbH. Further company details are listed in our Impressum. We have not appointed a data protection officer, as we are not legally required to do so; please send any privacy request to the email address above.
2. Website
The website user-acquisition.com is deliberately lean. It uses no cookies, no analytics or tracking tools, no advertising pixels, no social media plugins and no embedded third-party content. Fonts are hosted on our own server.
Hosting and server log files
The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit the site, the server automatically records technical information your browser transmits: IP address, date and time of the request, the page requested, HTTP status code, amount of data transferred, referrer URL, browser type and version, and operating system. This is necessary to deliver the website securely and to detect and defend against attacks (Art. 6(1)(f) GDPR). Log data is not combined with other data and is deleted after a short period in line with the hosting provider's retention settings. We have concluded a data processing agreement with the hosting provider (Art. 28 GDPR).
Contact form and email
If you contact us via the contact form or by email – including for support with one of our games – we process the data you provide (e.g. name, email address, company, topic, your message and any game or device details you include) to handle your request. Form submissions are delivered to us by email via our hosting provider's mail server and are not stored in a database on the website. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We keep your data until your request has been dealt with, unless statutory retention obligations apply.
3. Our games – overview
Our games are free to play. They are financed through advertising and optional in-app purchases. To run, improve and finance them, the following categories of data may be processed, depending on the game and on the choices you make:
| Category | Examples |
|---|---|
| Device identifiers | Advertising ID (Google Advertising ID on Android, IDFA on iOS – only if permitted), app-set ID / IDFV, Firebase installation ID, app instance IDs of our service providers |
| Device and app information | Device model, operating system and version, language, time zone, app version, network type, screen size |
| Network data | IP address, approximate (country / region) location derived from it |
| Usage and gameplay data | Sessions, levels, progress, in-game events, settings, ads viewed or clicked |
| Purchase data | Purchased item, price, currency, country, order or transaction ID (no payment details) |
| Diagnostic data | Crash reports, error logs, performance data |
| Support data | Whatever you send us by email, e.g. name, email address, description of the problem |
We do not ask for your name, email address, phone number, contacts, photos or precise (GPS) location in our games, and we do not sell personal data.
4. Consent and your privacy choices
EEA, UK and Switzerland: when you start one of our games for the first time, a consent dialog (consent management platform, e.g. Google's User Messaging Platform) asks whether you agree to personalized advertising and related processing. Storing information on, or reading information from, your device for purposes that are not strictly necessary requires your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). If you do not consent, you can still play; you will then see non-personalized or limited ads. You can change or withdraw your consent at any time via the privacy settings in the game, with effect for the future.
iOS: on Apple devices we only access the advertising identifier (IDFA) if you allow it in Apple's App Tracking Transparency prompt. You can change this at any time under Settings → Privacy & Security → Tracking. Without permission, ad attribution relies on Apple's privacy-preserving frameworks (SKAdNetwork / AdAttributionKit), which do not identify you.
Android: you can reset or delete your advertising ID at any time in your device settings (typically Settings → Google → Ads, or Settings → Privacy → Ads).
5. Running the game
To provide the game you downloaded, we process device and app information and your game progress and settings. Progress is usually stored locally on your device; if a game offers cloud saves, progress is linked to a pseudonymous identifier (e.g. a Firebase installation or anonymous user ID) and stored with Google Firebase. The legal basis is Art. 6(1)(b) GDPR (performance of the contract of use). Accessing your device for this purpose is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG).
6. In-app purchases
In-app purchases are processed exclusively by Google Play or the Apple App Store under their terms and privacy policies. We do not receive your payment details. We receive the information needed to deliver and verify the purchase (item, price, currency, country, transaction ID) and use it to unlock content, prevent fraud and fulfil our accounting obligations. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention obligations under commercial and tax law). Refunds are handled by the respective store.
7. Advertising
Our games show ads, for example banners, interstitials and optional rewarded videos. Ads are delivered via the mediation platform AppLovin MAX (AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA), which selects an ad from several advertising networks in real time. For this, the mediation platform and the participating networks process device identifiers (including the advertising ID if permitted), device and app information, IP address and approximate location, and information on ads shown and interactions. With your consent, this data can be used for personalized advertising, frequency capping, ad measurement and fraud prevention; without consent, only non-personalized or limited ads are shown, as far as the respective network supports this.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent) for personalized advertising and access to the advertising ID; Art. 6(1)(f) GDPR (legitimate interest in financing our free games, and in preventing fraud) for non-personalized ad delivery.
Depending on the game, the following networks may take part in the mediation. Each processes data under its own privacy policy:
- AppLovin – legal.applovin.com/privacy
- Google AdMob / Google Ad Manager (Google Ireland Limited) – How Google uses information from apps that use its services
- Unity Ads and ironSource (Unity Technologies) – Unity game player and app user privacy policy
- Meta Audience Network (Meta Platforms Ireland Limited) – Meta privacy policy
8. Analytics and crash reports
Google Analytics for Firebase
With your consent, we use Google Analytics for Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA) to understand how our games are used – for example how many players reach a level, how long sessions last and where players stop playing. It processes the Firebase installation ID, app instance ID, device and app information, approximate location derived from the IP address and in-game events. We do not use it to identify individual players. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Privacy information: firebase.google.com/support/privacy.
Firebase Crashlytics
To find and fix errors, we use Firebase Crashlytics (also Google). If the game crashes, Crashlytics transmits a crash report containing the stack trace, a Crashlytics installation UUID, the Firebase installation ID and device and app details such as operating system version and device model. According to Google, crash data is retained for 90 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, error-free games).
9. Install attribution
To understand which of our advertising campaigns lead to installs and how well they perform, we use a mobile measurement partner (MMP). It matches an install to the ad that led to it and measures the performance of our campaigns; it does not let us identify you personally. It processes device identifiers (advertising ID only with your consent or, on iOS, ATT permission), IP address, device and app information, install and in-app events (e.g. purchases) and campaign information. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG where consent is required; otherwise Art. 6(1)(f) GDPR (legitimate interest in measuring our marketing efficiently). On iOS without ATT permission, attribution uses Apple's SKAdNetwork / AdAttributionKit.
AppsFlyer – AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel, and AppsFlyer Inc., USA. Privacy policy: appsflyer.com/legal/services-privacy-policy.
Adjust – Adjust GmbH, Berlin, Germany. Privacy policy: adjust.com/terms/privacy-policy.
10. Recipients and transfers outside the EU
Personal data is shared only with the service providers named in this policy, with the app stores, and where we are legally obliged to (e.g. with tax authorities). Where providers act on our behalf, we have concluded data processing agreements with them (Art. 28 GDPR); advertising networks largely act as independent controllers.
Some providers are located in, or transfer data to, countries outside the EU/EEA, in particular the USA and Israel. For the USA, transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified under it (adequacy decision of the European Commission of 10 July 2023), and otherwise on the EU Standard Contractual Clauses. Israel is covered by an adequacy decision of the European Commission.
11. Retention
We keep personal data only as long as it is needed for the purpose for which it was collected. Analytics data is kept according to the retention period set in our analytics configuration (at most 14 months), crash data for 90 days, and support enquiries until they are resolved. Purchase and accounting records are kept for the periods required by commercial and tax law (up to ten years). Data processed by advertising networks and the measurement partner is retained according to their own policies.
12. Children
Our games are intended for a general audience and are not directed at children under 16. We do not knowingly collect personal data from children for personalized advertising. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Deleting your data
Our games do not require an account. Most data is linked only to pseudonymous device identifiers. You can:
- Request deletion by emailing info@user-acquisition.com with the subject "Data deletion request", the game name and your platform. If the game shows a player or support ID in its settings, please include it so we can find your data. We will delete the data we hold about you, and request deletion from our service providers where possible, within 30 days, unless statutory retention obligations apply (e.g. purchase records).
- Withdraw consent in the game's privacy settings.
- Reset or delete your advertising ID (Android) or deny tracking (iOS) in your device settings.
- Uninstall the game to delete all locally stored game data from your device.
14. Your rights
Under the GDPR you have the right to access your personal data (Art. 15), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with effect for the future; the lawfulness of processing before the withdrawal remains unaffected.
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Personalized advertising involves profiling by the advertising networks, which only takes place with your consent.
To exercise your rights, contact us at the address in section 1.
15. Changes
We update this privacy policy when our website, our games or the legal situation change. The current version is always available at user-acquisition.com/privacy-policy/.