Privacy Policy
contents
MIMIC needs an account to pair you with an opponent, and a server to keep the game honest. That is the entire reason any data is stored. There is no advertising, no analytics and no tracking in this app — and no email address is ever collected.
§ 1 /Controller
Oliver Oklitz
Maxstraße 13
45479 Mülheim an der Ruhr
Germany
Email: oliver@oklitz.net
§ 2 /Scope
This policy applies to the MIMIC iOS app and its game server at api.mimikry.oklitz.net. The website you are reading right now is covered separately by the oklitz.net privacy policy.
You can play the tutorial and the offline modes without an account. In that case nothing leaves your device and nothing below applies.
§ 3 /Sign in with Apple
Accounts use Sign in with Apple. The app requests no personal scopes at all — not your name, not your email address, not even Apple's anonymised relay address. Apple confirms your identity, and we store only the pseudonymous user identifier Apple issues for this app.
That identifier cannot be used to contact you, and cannot be used to recognise you in any other app.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract — providing the game).
§ 4 /What Is Stored
Account. The Apple user identifier, the gamer tag you choose, your figure colour and avatar selection, your level and XP, your league standing, and whether you own MIMIC Pro.
Gameplay. Matches, rounds, where a Mimic was hidden, where you tapped, how long you took, how many misses, and the resulting points. The server calculates these itself rather than trusting the app — that is what stops a modified client from inventing results.
Device and notifications. If you allow notifications: your Apple push token, the platform, and your time zone. The time zone exists so that a "your turn" notification does not arrive at three in the morning.
Purchase. If you buy MIMIC Pro, the product identifier and Apple's transaction identifier. The signed receipt is verified and then discarded — it is not stored.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) for the limited abuse-prevention records described in § 9.
§ 5 /What Is Never Collected
Stated plainly, because the list matters more than the assurances.
- No email address and no real name.
- No advertising identifier. The app never shows the App Tracking Transparency prompt, because it has nothing to track you with.
- No location, contacts, photos, camera or microphone access — the app requests none of these permissions.
- No analytics or crash-reporting SDK. MIMIC contains no third-party code of any kind.
Your data is never sold, and never shared for advertising or profiling.
§ 6 /Notifications
Push notifications are opt-in and only ever tell you that it is your turn, or that a season is ending. You can withdraw permission at any time in iOS Settings, and the token is deleted when you delete your account.
§ 7 /In-App Purchase
MIMIC Pro is purely cosmetic and is the only purchase in the app. Payment is handled entirely by Apple — no payment details ever reach our server. The app sends Apple's signed transaction so the server can verify it, and the result is stored as a yes/no flag on your account.
§ 8 /Where Your Data Lives
The game server runs on a virtual server operated by Hetzner Online GmbH in Nuremberg, Germany. All gameplay data stays within the European Union. Connections are encrypted with TLS.
Apple (Sign in with Apple, push notifications, purchases) processes data under its own terms and may do so outside the EU.
§ 9 /Abuse Prevention
Unusual play patterns can be flagged, and those flags are kept for up to one year. Request rate limits use your IP address in transient memory only; IP addresses are not written to the database.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fair game).
§ 10 /Retention & Deletion
You can delete your account yourself, in the app, under Settings → Delete account. No email required.
Deletion happens in two stages. Immediately: your Apple identifier and gamer tag are erased, your push tokens are deleted and all sessions are revoked. From that moment the remaining record can no longer be traced back to you, and your tag becomes available to someone else. After 30 days: the record is deleted outright, taking every match, hide, result and purchase record with it.
The 30-day gap exists so that an opponent's ongoing match and score do not collapse mid-game. Push logs are kept for 30 days and abuse flags for one year, both independently of your account.
Backups. The database is backed up daily, and backups are kept for 14 days. A deleted account therefore still exists inside those backups until they rotate out — editing a backup to remove one record would defeat the purpose of having one. After 14 days at the latest, nothing remains there either.
§ 11 /Children
MIMIC is not directed at children and does not knowingly collect data from them. There is no chat and no free-text messaging between players; the only text another player ever sees is the gamer tag you choose. Please do not use a real name as your tag.
§ 12 /Your Rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Deletion is built into the app; for anything else, write to oliver@oklitz.net.
You also have the right to lodge a complaint with a supervisory authority. The competent authority here is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
§ 13 /Changes
If the app changes in a way that affects this policy, it is updated here and the date at the top changes with it. Substantial changes will be pointed out in the app.