Privacy policy for the Wobblip app

Last updated: 17 October 2026 · Deutsche Fassung

This policy applies to the game Wobblip for iPhone, also when the app runs in compatibility mode on an iPad. The section “Android only” also applies to the Android version once it is released. Our website has its own privacy notice (in German). This is a translation of the German Datenschutzerklärung.

1. Controller

Ronny Saar · RapidSpark (sole trader)
Saarbrücker Straße 77, 66564 Ottweiler, Germany
E-mail: info@rapidspark.de
Phone: +49 151 11820568

Further details are in our legal notice. For privacy questions, please use the same e-mail address.

2. How Wobblip is built

Wobblip works without a user account and does not need an internet connection to play. The app contains no advertising, no tools for usage analytics or audience measurement, no crash reporting system of its own and no tracking. That is why Wobblip does not ask for permission to track you across apps and websites of other companies. The app does not connect to any server of ours.

Wobblip is made with the Unity game engine. Unity’s online services (for example Analytics, Cloud Diagnostics or advertising) are not enabled. You only need an internet connection to download the app and to buy or restore the full version.

3. Progress and settings on your device

So that Wobblip remembers your progress, the app stores on your device:

• progress: completed levels, stars, best results and the accessories and outfits unlocked for your characters;
• settings: for example volume, language, graphics, vibration, reduced motion, the chosen character and controls, whether microphone, camera and tilt are switched on, whether you have already seen the explanations of the sensors, and whether you have already been shown the offer for the full version at the end of the free part;
• blowing measurements (section 4), the host address you entered last (section 5) and the unlocked full version (section 6).

This data is kept in the app’s protected storage area. We have no access to it, and it is not transferred to us. Storing it is strictly necessary for the game you asked for (Section 25(2) no. 2 of the German TDDDG). To the extent the GDPR applies, the legal basis is Art. 6(1)(b) GDPR.

The data stays until you delete it. In the settings under “Progress”, “Reset progress” resets levels, stars and accessories. When you delete the app, your device removes all of its data. If you have set up device backups, such as an iCloud backup, they may contain this data. You control that in your device settings.

Names you type in the Puff Party stay in memory only until the app is closed. They are neither stored nor transmitted.

4. Microphone, camera and motion sensor

Body controls are optional. Every challenge can also be played by tapping, with buttons or with a controller.

Microphone and camera are switched off at first. Before you switch one of them on for the first time, Wobblip explains what happens. Your device then asks for permission. You can switch both off again at any time in Wobblip’s settings and withdraw the permission in your device settings (iOS: Settings › Wobblip).

Microphone

Wobblip recognises blowing and calling out. To do this, the app continuously analyses the microphone signal on the device, for example its loudness and sound pattern. The sound is only held in a buffer of about two seconds in memory that is constantly overwritten. It is not saved as a recording and not sent.

When Wobblip learns how you blow, the app stores a few values calculated from it, for example the average loudness and the sound character of your blowing. This helps Wobblip recognise you better. These values contain no audio, and your voice cannot be reconstructed from them. They are deleted together with the app.

Camera

Using the front camera, Wobblip checks whether your eyes are open or closed. On iOS the app uses Apple’s Vision framework, on Android Google’s ML Kit face detection with a model built into the app. The detection runs on your device. Each camera image is processed only briefly in memory. It is not displayed, not stored and not sent.

Wobblip does not determine who you are, does not compare faces and does not store biometric features. Only values derived from the image are used, such as how far your eyes are open and how your head is tilted. At the start, Wobblip briefly measures how wide your eyes are open. This value is only used while the camera is running and is not stored.

Motion sensor

While the adventure and the Puff Party are running, Wobblip reads the accelerometer so that you can steer by tilting or shaking. In the Parcours levels the app only does this if you switch on “Tilt” in the settings (default: off). The values are processed in real time only, not stored and not sent. No permission is needed for this. If you do not want to tilt or shake, choose the “Tap” controls.

Legal basis

You decide whether to use body controls. The processing is necessary to provide these controls to you (Art. 6(1)(b) GDPR). Accessing the microphone, camera and motion sensor is strictly necessary for this function you asked for (Section 25(2) no. 2 TDDDG). On iOS, none of it leaves your device. For Android, please read section 8.

5. Wi-Fi Arena: playing on your local network

In the Wi-Fi Arena you play with friends on several devices. One device opens a room. The others join with the host’s local IP address and a six-digit room code, typed in or via QR code. The devices connect directly within your local network (TCP port 47731, private IPv4 addresses only). There is no server on the internet, and we receive none of this data.

The following is exchanged between the players’ devices: the devices’ local IP addresses (technically needed for any connection), the room code, the chosen character with its accessories, your player number, whether your device is ready and its controls have been tested, the chosen type of controls, whether a device has the full version (players without it show as “guest”), the version number of the game protocol, your inputs (such as direction, jump, throw and the detected blowing strength as a number, not the sound) and the game state calculated by the host. Names, sound and camera data are not transferred. The connection within the local network is not encrypted, but it only carries this game data.

The QR code in the lobby contains the host’s IP address, the room code and the version number of the game protocol. If you scan it with the camera app, your device opens Wobblip via a link starting with “wobblip://join”. Only your device processes the link. To make joining again quicker, Wobblip remembers the host address you entered last on your device.

On iOS, your device asks the first time whether Wobblip may access devices on your local network. The legal basis is Art. 6(1)(b) GDPR, as you start the shared game yourself. The only recipients are the devices of the people you play with.

6. Buying the full version

You can download Wobblip for free. You unlock the full version with a one-time in-app purchase. Apple handles the purchase and payment via the App Store under its own responsibility, and Google via Google Play in the Android version. We do not receive your payment details, your name or any details of your Apple Account.

After the purchase, the app receives a signed purchase confirmation from the store, containing among other things the product, transaction number and purchase date. The app checks it on the device and stores the unlock there, with the store, transaction number and time. This information is not transferred to us. “Restore purchases” asks the store for your purchases again, for example on a new device. The legal basis is Art. 6(1)(b) GDPR.

Apple and Google provide us with aggregated sales and payment reports, for example the number of purchases per country and period. We cannot identify individual buyers from them. Please request refunds directly from Apple or Google.

7. App Store, Google Play and crash reports

When you download, buy or update Wobblip, the store operator processes data such as your account details, device data and purchases under its own responsibility. For people in the EU this is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, for the App Store (Apple Privacy Policy) and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Google Play (Google Privacy Policy). These companies may also process data outside the EU, for example in the USA. We have no influence on this.

If you allow your device to share analytics with app developers (iOS: Settings › Privacy & Security › Analytics & Improvements › “Share With App Developers”), Apple provides us with crash reports and aggregated usage statistics in App Store Connect. On Android, Google does the same in the Play Console if you have allowed sharing usage and diagnostics data. The reports contain technical information such as the device model, operating system and app version and the state of the program at the time of the crash. According to Apple, they do not contain information that directly identifies you, such as your name or Apple Account.

We only use these reports to find and fix bugs. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is an app that runs reliably. Apple and Google keep the reports according to their own retention periods. We only make our own copies in individual cases to investigate a bug and delete them once it is fixed.

If you review Wobblip in a store, we see your review with the name shown there and can reply publicly (Art. 6(1)(f) GDPR, legitimate interest: responding to feedback).

8. Android only: eye detection with Google ML Kit

The Android version has not been released yet. This section applies only from its release and describes how it will work. It does not apply to the iPhone version. Before then, we will check it again against the finished app.

On Android, Wobblip detects closed eyes with ML Kit face detection, a software component from Google. The detection model is built into the app and works on the device. According to Google, ML Kit does not send camera images or detection results to Google.

When eye detection is used, however, ML Kit transmits technical metrics to Google: information about the device (such as manufacturer, model, Android version and available hardware accelerators), about the app (package name and version), a per-installation identifier that, according to Google, is not intended to uniquely identify you or your device, performance metrics such as processing time, settings of the feature such as image format and resolution, the size of input and output, the feature version, the event type and error codes. For technical reasons, Google also receives your device’s IP address. ML Kit may also contact Google servers for bug fixes, updated models and hardware acceleration information. According to Google, the transfer is encrypted (HTTPS).

According to Google, it uses this data to measure the performance and use of ML Kit, to fix bugs, to maintain and improve ML Kit and to detect misuse, and does not pass it on to third parties. The recipient is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the European Commission’s adequacy decision of 10 July 2023 applies to the transfer to the USA (Art. 45 GDPR). Google decides how long it keeps the data. More information: Google’s data disclosure for ML Kit and the Google Privacy Policy.

The legal basis is your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, Section 25(1) TDDDG). The Android version will ask for your consent before you switch on camera controls for the first time. You will then be able to withdraw your consent at any time with effect for the future by switching off camera controls in Wobblip’s settings. Without consent, you play with the “Eyes shut” button. Everything else stays the same.

9. Contacting us by e-mail

If you write to us, for example via the help page, we process your e-mail address, your name if you provide it, and the content of your message, including any technical details you give us. We only use this data to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns the app or your purchase, otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).

We use Google Workspace for our mailbox. Google processes the e-mails on our behalf (Art. 28 GDPR). Our contractual partner is a Google company based in Dublin, Ireland. Data may also be processed by Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We delete your message once your request has been dealt with, unless statutory retention obligations apply.

10. Recipients and third countries at a glance

• Apple and Google as operators of the app stores, under their own responsibility (sections 6 and 7);
• Google as our processor for e-mails (section 9);
• Android only: Google LLC for ML Kit metrics (section 8);
• the devices of the people you play with in the local network (section 5).

We do not sell any data and do not pass it on to anyone else. On iOS, the app itself does not transfer any data to countries outside the EU. Data may reach the USA when Google processes e-mails or when ML Kit sends metrics on Android. In addition, Apple and Google may process data in third countries as part of their store services.

11. Retention

• Data on your device: until you delete it or remove the app.
• Wi-Fi Arena: only during the connection. The host address you entered last remains until your next entry or until you delete the app.
• Names in the Puff Party: in memory only until the app is closed.
• Unlocked full version: on the device until you delete the app. It can be restored via the store at any time.
• E-mails: until your request has been dealt with, longer only where statutory retention obligations apply.
• Crash reports: at Apple and Google according to their retention periods, our own copies until the bug is fixed.

12. Your rights

Subject to the legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just write to us at info@rapidspark.de.

We do not hold the data on your device. You delete it yourself in the app or by removing the app. For data that Apple or Google process under their own responsibility, please contact these companies directly.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany, www.datenschutz.saarland.de.

13. Further information

You are under no statutory or contractual obligation to provide us with data. Without sensors and without the Wi-Fi Arena, you play by tapping, with buttons or a controller, alone or together on one device. To buy the full version, you need an account with the respective store.

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

14. Children

Wobblip is made for a general audience and is not specifically designed for children. You can find the age rating in the respective store. The app does not ask for anyone’s age, does not create an account and, on iOS, does not send any data to us. Parents can restrict in-app purchases via Screen Time (iOS) or the purchase settings of Google Play and withdraw access to microphone and camera in the device settings. On Android, children under 16 should only switch on camera controls with their parents’ consent, because ML Kit then sends metrics to Google (section 8).

15. Changes

We update this policy when Wobblip or the law changes. The version published here applies. The date at the top shows when it was last updated.