Späti Tycoon TokyoOne shift in the konbini

Privacy Policy

Last updated: 13 September 2026

Short and complete: the app has no accounts, no sign-in, no advertising and no tracking, and it plays in airplane mode exactly as it does online. Your savegame stays on your device. Exactly two things leave the app: the purchase check — at launch, when buying and when restoring, the app asks Apple or Google Play through the service provider RevenueCat whether the full version is unlocked, using a random anonymous ID instead of your name — and a report you send yourself using “Report a problem”. Nothing else.

Controller

Martin Langhammer
contact@c-arena.com

What the app processes

• Your savegame — money, stock, day, achievements, settings. It is stored only in the app's own storage on your device and is never transmitted anywhere. Delete the app and it is gone.
• Purchase check through RevenueCat — a random, anonymous app ID that the purchase SDK creates on first launch, plus the purchase receipt and purchase history of the full version. It runs automatically at launch, when buying and when restoring. Details under “The in-app purchase”.
• A report at the press of a button — only if you send something yourself using “Report a problem”. The next section describes exactly what that looks like.
• Nothing else. No name, no email address, no location, no contacts, no photos, no advertising ID, no automatic crash reports to us.

Accordingly, the App Store privacy section lists three items: Purchases (purchase history, from the purchase check), Diagnostics (other diagnostic data) and User Content (other user content, both from a report). None of it is linked to your identity and none of it is used for tracking.

Report a problem

The game has a “Report a problem” button. Apart from the purchase check it is the only way data leaves the app. It happens only if you tap the button, write something and tap send. Before that, the game shows you in full what will go out. Nothing is ever sent automatically and nothing is ever sent in the background. The report goes to https://spaeti.c-arena.com/melden.

What a report contains — the complete list:

• art — bug, idea or other.
• text — the free text you write yourself, 2000 characters at most.
• fassung and build — the app's version and build number.
• markt and sprache — the market you have set (e.g. de, at, it) and the language.
• plattform and huelle — a short note on the operating system and whether the game runs in the app shell or in a browser.
• bildschirm — the screen size in points, e.g. 390x844.
• tag, kasse, sterne — day, till balance and rating, that is your savegame in short form.
• fehler — up to 5 script error messages that occurred most recently in the game: the text of the error message, 500 characters each at most.

What a report explicitly does not contain: no name, no email address, no phone number, no device ID, no advertising ID, no location, no contacts, no photos, no purchase receipt. There is deliberately no field for contact details. Which also means: we cannot reply to a report.

Do not write anything personal into the free text. Whatever you type there arrives with us exactly as you typed it — so please no names, addresses or other personal data.

Your IP address is not stored — neither in the record nor in an access log, because this domain still keeps no access log. So that nobody can flood the endpoint, the IP is hashed in memory only, against a random value that is rolled again every hour. After that the value cannot be traced back to anyone.

Who receives the report: only the controller named above. There is no processor for the contents, no sharing with third parties and no evaluation for advertising purposes. The server is hosted by Hetzner Online GmbH in Germany.

How long: 90 days. After that the report is deleted automatically, by a daily job on the server.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in fixing bugs. You trigger the sending yourself.

Note down the report number if you may want it deleted later. After sending, the game shows you a number in the form M-1A2B3C4D. That number is the only way to find your report again, because nothing else is attached to it that would let us match it to you. Without it we can neither hand out a report nor delete a specific one — that is not reluctance, it is technically impossible. With the number both work; just write to the address above.

The in-app purchase

Payment for the one-time full version purchase is handled by Apple (on Android by Google Play). Payment and receipt run through your Apple or Google account; we receive no payment data, no name, no email address and no postal address. What Apple and Google process is described in their own privacy policies: apple.com/legal/privacy, policies.google.com/privacy.

Purchase check through RevenueCat. The app checks whether the purchase exists using the purchase SDK of RevenueCat, Inc. (USA), which acts on our behalf (processor under Art. 28 GDPR). For this the app connects to RevenueCat at launch, when buying and when restoring. Without a connection the game still plays; the last known purchase state stays on the device.

What goes to RevenueCat:

• a random, anonymous app ID that the SDK creates on first launch. We assign no ID of our own, and nothing links it to your name, your email address or your Apple or Google account;
• the purchase receipt and purchase history of the full version: product, time, price and currency, store country, Apple or Google transaction ID;
• technical details needed for the request: platform, operating system and app version, language or region; and, as with any connection, the IP address.

What for: to verify the purchase, unlock the full version and restore a purchase on a new device, and so that we can see an overview of purchases and revenue in RevenueCat (per anonymous ID, without names). No advertising, no tracking across other apps.

Legal basis: Art. 6(1)(b) GDPR (performing the purchase and unlocking) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and a purchase overview). Third country: RevenueCat processes the data in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses in RevenueCat's data processing agreement. How long: for as long as we use RevenueCat for the app; after that RevenueCat deletes the data under its data processing agreement. More from RevenueCat: revenuecat.com/privacy.

This website

• No cookies, no scripts, no third-party embeds — fonts come from your operating system, not from the network.
• No access logs: the web server keeps no access log for this site. The same goes for the report endpoint /melden. Your IP address is necessarily processed for the moment it takes to deliver the page (Art. 6(1)(f) GDPR), but it is not stored.
• The connection is encrypted with HTTPS.

Children

The app is aimed at a general audience. Nothing is processed about children beyond what applies to everyone: the anonymous purchase check above, and a report if they send one themselves. What a report contains is decided solely by the person sending it — hence the note above about keeping personal details out of the free text.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, objection and data portability, as well as the right to lodge a complaint with a supervisory authority. Because neither the purchase check nor a report carries a name or an email address, we can only match data to you using something you give us: for a report its number M-…, for the purchase the transaction ID from your Apple or Google purchase receipt. Ask anyway if you are unsure — the address is above.

Changes

If something changes in the app that is described here, we change this page and update the date at the top.