Privacy policy for the Truth or Dare app

App by ExoticProductions for Android (on Google Play under the package name com.ExoticProductions.TruthOrDare) and iOS (App Store). Effective date: 17 October 2026

Summary

Controller

Niklas Dette, Exotic Productions
Wechtern 6, 21732 Krummendeich, Germany
Email: contact@exotic-productions.com

Our contact for privacy matters is Niklas Dette (contact@exotic-productions.com). He is also our privacy officer under the laws of Canada and New Zealand and the person in charge of the protection of personal information under Québec law. We are not required to appoint a data protection officer under the GDPR.

Who the app is for

The app contains questions and dares involving alcohol and sexuality. It is intended exclusively for adults aged 18 and over.

What the app stores on your device

The app stores player names, the gender you can set for individual players so that fitting tasks are chosen, which tasks you have already played, your settings and confirmations, and the content you have unlocked on your device. We never receive player names, gender details or other text you enter in the app, and the app does not send them to anyone. If statistics and tests are switched on, Google only learns the usage events listed below, for example which language and which extras you chose. This data is removed when you uninstall the app or clear its data in your device's settings. If backup is turned on for your device (Android: to your Google account; iPhone: to iCloud or your computer), it may include what the app stores on the device, for example player names and gender details, settings and game progress, and bring it back when you reinstall the app or set up a new device. We have no access to this backup.

Even without consent, the app reads when it was first installed on your device, so that users of earlier versions keep their content for free. It also stores random values that determine which variant of a test you see (see “Tests”). Both stay on the device and are needed for the app to provide its content and offers (Section 25(2) No. 2 TDDDG). Also without consent, the app stores a random identifier for purchases, which it sends to the service RevenueCat (see “Purchases and subscriptions”).

Age check: If your store account is set to the United States, the app asks the store whether an age range is available for you (Google Play Age Signals or Apple's Declared Age Range). Depending on the state, the store provides it to the app or first asks you whether you want to share it with the app. The app evaluates it only on your device to keep minors out, and does not store it. We do not receive your age range, and it is not sent to Google Analytics. To do this, the app reads on your device which country your store account is set to. The legal basis is our legitimate interest in complying with the legal age requirements in the United States and protecting minors (Art. 6(1)(f) GDPR).

The app needs no permissions for location, contacts, camera, microphone or files.

Purchases and subscriptions

In the app you can buy game modes and, depending on the offer, take out a subscription. Purchase, payment, renewal and cancellation are handled entirely by Google Play or Apple's App Store. Google and Apple process your account and payment details as independent controllers; see Google's privacy policy and Apple's privacy policy for details. We never receive your payment details.

The app receives a purchase confirmation from the store with the product, order number and a purchase token. To verify purchases, unlock your content and restore it after a reinstall, we use the service RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA). We do not run our own servers for the app.

The app connects to RevenueCat every time it starts, even if you have not bought anything and regardless of your answer in the consent dialog. On first start it creates a random identifier for this installation, stores it on your device and sends it to RevenueCat. This is how the app learns which offers to show, whether purchases or subscriptions belong to this installation and whether they are still valid. Without this connection, the app cannot detect purchases.

In doing so, RevenueCat receives the random identifier, the device model and manufacturer, operating system version, language, the country of your store account, the app's identifier and version, the time of the connection and, for technical reasons, your IP address. According to RevenueCat, the IP address is only used to determine the country and is not stored. For a purchase, the product, offer variant, purchase token, price, currency and time are added; RevenueCat uses these to look up the status of the purchase with Google Play or the App Store (for example renewal, cancellation or refund of a subscription). RevenueCat does not receive your name, your email address, your payment details, your device's advertising ID, player names or gender details.

We use this data to detect and verify purchases, unlock and restore purchased content, manage subscriptions, handle questions and refunds, and to see in aggregate how many purchases and subscriptions there are. The legal basis is the contract for the purchased content (Art. 6(1)(b) GDPR); as long as you have not bought anything, and for the aggregate figures, it is our legitimate interest in reliably detecting purchases and planning our offers (Art. 6(1)(f) GDPR). You can object to this; please send us an email. The app stores and reads the identifier on your device in order to provide the purchase feature (Section 25(2) no. 2 TDDDG).

RevenueCat processes the data on our behalf under a data processing agreement, on servers in the USA, and uses further service providers in the USA, for example Amazon Web Services for hosting. Transfers to the USA are covered by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR); we will send you a copy on request.

Retention: RevenueCat keeps the data for as long as we use the service for the app, so that your purchases stay unlocked. On request we delete your data at RevenueCat earlier; please send us the identifier shown in the app's settings. Order and sales records that we must keep for accounting are not affected.

For purchases and for the country check on first start (see “Countries without a prompt”), the app uses Google's library for purchases through Google Play (Play Billing Library). Each time it connects to the Play Store, the library sends technical information to Google, such as whether a request succeeded and whether there were connection problems, and, for technical reasons, your IP address. According to Google, it uses this information to improve the library and to help with errors. This happens regardless of your consent, including on first start, and we cannot switch it off, because purchases through Google Play are only possible with this library. The legal basis is our legitimate interest in offering purchases through Google Play (Art. 6(1)(f) GDPR). Google itself is responsible for any further processing (policies.google.com/privacy).

Google and Apple also provide us with order and sales data, for example order number, product, price, country and time. On Google Play we can also find an order by your email address, for instance if you write to us about a refund. We use this data to process purchases, handle questions and refunds, and for our accounting.

The legal basis is the contract for the purchased content (Art. 6(1)(b) GDPR) and, for accounting, our statutory retention obligations (Art. 6(1)(c) GDPR). We keep accounting records for as long as tax and commercial law require, usually 8 to 10 years.

Your consent

Except in the countries listed under “Countries without a prompt”, the app asks for your consent to two purposes when you first start it, which you can choose separately:

Data is only sent to Google for a purpose once you agree to it; before that, the app sends nothing for it. If you decline, the app works exactly the same, and everything you have bought stays unlocked. Crash reports (see “Firebase Crashlytics”) and the connection to RevenueCat for purchases (see “Purchases and subscriptions”) do not depend on your consent.

When the app starts, it keeps track, in your device's working memory, of what happens until it is clear whether it may send data. If it may, because you agreed or statistics are switched on, it sends these events. Otherwise it deletes them and keeps track of nothing further. None of this is stored permanently.

You can change your decision at any time in the app's settings. Withdrawing consent applies from then on. If you withdraw consent to statistics and tests, the app also deletes the statistics data on your device and resets its app instance ID. Data already sent is deleted after the periods given below, or for ad measurement according to Google's own periods.

The legal basis is your consent (Art. 6(1)(a) GDPR) and, for storing and reading information on your device, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Countries without a prompt

In the USA, India, Australia, New Zealand, Japan and Taiwan, the app does not ask first. There, statistics and tests (Google Analytics for Firebase, as described below) run from the start, and you can switch them off at any time in the app's settings under “Statistics and tests”; the app then works exactly the same. There is no ad measurement there; the app does not collect an advertising ID. The legal basis is our legitimate interest in improving the app based on how it is used and in testing texts and offers (Art. 6(1)(f) GDPR).

The app determines which country applies from the country of your Google Play account and checks it against the country of your mobile network and SIM card. If one of them shows a country where the app asks, or if the country cannot be determined on first start, it asks. The app evaluates this information only on your device; it only stores whether it needs to ask and does not send the countries to anyone. For the query of your Google Play account, what is said about Google's library for purchases under “Purchases and subscriptions” also applies.

Google Analytics for Firebase

Google Analytics for Firebase shows us how the app is used, for example which game modes are popular, where rounds are abandoned and how often offers are bought. This tells us what to improve. It processes:

We do not collect names, email addresses or precise location data. Your device's advertising ID is only used if you have agreed to ad measurement (see below).

Retention: Google Analytics automatically deletes data that can be linked to an individual installation 14 months after you last used the app. We need it for that long to see how things develop over a whole year, for example how long subscriptions last. Aggregated statistics with no link to individual installations may be kept longer.

Industry benchmarks: Google may include the data, aggregated and with no link to individual users or to our app, in comparisons between apps. In return, we can see how our app compares with similar apps.

Tests

We try out different variants, for example what the one-off purchases cost or what the request for a review looks like. Which variant you see is decided by a random value that the app generates and stores on your device, a separate one for each test. If statistics and tests are switched on, we send the variant to Google Analytics to compare the variants. If you buy something, RevenueCat also learns with the purchase which variant you bought in (see “Purchases and subscriptions”).

Firebase Crashlytics

If the app crashes or an unexpected error occurs, Crashlytics sends a report so we can find and fix the bug. This happens without consent; you can switch it off at any time in the app's settings under “Send crash reports”, and the app then works exactly the same. On the very first start, Crashlytics only sends once you have answered the consent prompt or, in countries without a prompt, once the country has been determined; a crash before that is reported afterwards. A report contains:

For this, Crashlytics fetches its settings from Google once and registers the Firebase installation ID. The legal basis is our legitimate interest in an app that runs without crashes (Art. 6(1)(f) GDPR); storing reports and identifiers on your device for this purpose is strictly necessary for stable operation (Section 25(2) No. 2 TDDDG). If you switch crash reports off, the app sends no more of them and deletes reports that have not yet been sent. Statistics and crash reports share the Firebase installation ID; it disappears from your device when you uninstall the app or clear its data.

Retention: Google keeps crash reports and the associated identifiers for 90 days and then deletes them.

Our Firebase project is linked to our Google Play developer account. Google may therefore also evaluate and display crash reports in the Google Play Console, which we use to publish the app; the Google Play terms apply to this.

Ad measurement (Google Ads, Android only)

We run ads for the app, for example in Google Play search. To see which ads bring people who actually play the app, and to steer our campaigns accordingly, the app sends certain events to Google Ads via Firebase once you agree to ad measurement, for example the first time the app is opened and that five tasks have been played. This involves:

We do not show ads in the app. We do not use the data for personalised advertising and do not build remarketing audiences from it; personalisation is therefore always declined in Google's consent mode. Without your consent, the app does not collect the advertising ID and sends nothing to Google Ads. You can reset or delete the advertising ID in your device's settings.

Independently of the app, Google Play itself attributes installs and purchases that result from one of our ads; we only see aggregated figures.

For ad measurement, Google is an independent controller (Google Ads Controller-Controller Data Protection Terms) and keeps the data according to its own retention periods. The legal basis for the transfer is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

There is no ad measurement on iOS: the app does not use the advertising ID (IDFA) there and does not track you across other companies' apps and websites.

Without your consent to ad measurement, neither we nor others collect data through the app about your activities over time and across other companies' apps and websites; otherwise Google and RevenueCat process data only on our behalf. The app does not respond separately to “Do Not Track” signals because it does not engage in such tracking without consent.

Google as service provider and transfers to the USA

Google Analytics for Firebase and Firebase Crashlytics are provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google processes the data for them on our behalf under its data processing terms.

In this context and for ad measurement, data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, Google has agreed to standard contractual clauses (Art. 46 GDPR).

There are no recipients other than Google, RevenueCat (see “Purchases and subscriptions”), Apple for purchases on iOS, and our hosting provider STRATO for emails (see “Contact by email”). We do not sell data.

Google Play, App Store and ratings

The app is installed and updated through Google Play or the App Store. Google and Apple process data there as independent controllers (see the privacy policies linked above).

The app may ask you for a rating through the rating feature of Google Play or the App Store, or take you to its store page. Your rating goes straight to the store. We see it as it appears in the store, plus, depending on the store, device model, app version, language or country, and we can reply to it publicly.

Security

All transfers to Google and RevenueCat are encrypted via HTTPS. We process data in Germany, our service providers also in the USA; we provide further details on our safeguards on request.

Contact by email

If you write to us, we process your email address and your message in order to reply (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for questions about a purchase). Our mailbox is on our server at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which acts as our processor for this. We delete the message once your request has been dealt with, unless statutory retention obligations require otherwise.

Your right to object

We process crash reports and, in the countries without a prompt, statistics and tests on the basis of our legitimate interest. You can object to this at any time (Art. 21 GDPR), most easily in the app's settings: switch off “Send crash reports” or “Statistics and tests”, and the app sends nothing more for this. You can also object, on grounds relating to your particular situation, to processing by RevenueCat and by Google's library for purchases, the age check and the processing of your emails; just send us an email.

Deletion and your rights

Because the app works without an account, we don't know who you are and generally cannot link the data held by Google to you (Art. 11 GDPR). The quickest way: switch off what you don't want in the app's settings, or uninstall the app. No further data is then sent to Google, and data already sent to Google is deleted automatically after the periods above. The connection to RevenueCat only ends when you uninstall the app; how to have your data deleted there is explained under “Purchases and subscriptions”. We can find order data for a purchase by its order number or, on Google Play, by your email address.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just send us an email. Your right to object is set out in the section above.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

Changes

If the app changes in a way that means different data is processed, we will update this policy beforehand. The version published here always applies. If we change it, the new date is shown at the top and the changed version applies from its publication here; the app always links to this page.