Privacy for our apps

Last updated: 7 November 2026. This notice describes PuttPath and its online features when enabled. Older local test builds may not offer online accounts, real purchases or advertising.

This notice covers PuttPath for iOS and Android, operated by GustaNavi e.U. It does not automatically cover other games or our Food Rallye services. Our website privacy notice separately explains processing when you visit gustanavi.org, including when you open this page in a browser.

Who is responsible and how to contact us

The controller is Lorenzo Chiappani, trading as GustaNavi e.U., Albert-Schöpf Straße 72, 4020 Linz, Austria. For PuttPath support, privacy requests or account deletion, email puttpath@gustanavi.org. For general questions about our games, use game@gustanavi.org.

You can also use our support and account-deletion page.

You do not need to send a password, sign-in token, full payment-card details or an identity document with your request. If needed, we will ask for proportionate information to identify your account and protect it from unauthorised access.

Playing and saving your progress

PuttPath stores campaign progress, completed levels, stars, settings, tutorial progress, your chosen nickname and avatar, and data needed to continue a game on your device. Device backups and restoration depend on your operating system and its settings. Files you export or share may remain outside the app until you delete them.

Online features use a persistent player account and a support identifier. A randomly generated device credential is kept in the operating system's protected credential storage; our server keeps a cryptographic digest rather than the original device credential. The server processes your player identifier, chosen profile information, timezone, hint balance and its credit/debit history to operate the account. Where cloud progress is enabled, it also stores campaign progress and the revisions needed to synchronise devices without overwriting newer progress. A nickname does not need to be your real name. Please do not put contact details or other private information in it.

These functions use data necessary to provide the game and requested services under Article 6(1)(b) GDPR. Security checks, prevention of duplicate rewards and protection against abuse rely on our legitimate interests in a secure and reliable service under Article 6(1)(f), taking account of players' interests and rights.

Daily challenges and public rankings

Online Daily challenges send the challenge date, game commands and results to our server so that it can check moves, maintain a consistent attempt and calculate the result. The public ranking shows the player's chosen display name and game result. It does not display device credentials, a sign-in email address or the private support identifier. Other people may see or copy public ranking entries.

Optional account recovery

Where available, you may link your player account using Sign in with Apple or Google to help recover access. The provider handles its own sign-in process. Our service checks the provider's signed identity information and account identifier to link the correct player account; it does not use this permission to read your Gmail or Google Drive and does not store your Google email address for account matching. Playing does not require a voluntary provider login. The provider's privacy notice also applies to its sign-in service.

Purchases

Hint packs are consumable purchases. Remove Ads is a permanent one-time purchase that removes automatic advertising interruptions; optional videos for a free hint remain available. Apple or Google processes the store payment under its own terms and privacy information. We do not receive your full payment-card details.

To verify and deliver a purchase, restore the Remove Ads entitlement and handle refunds or duplicate submissions, our service processes the store, product and transaction information, its association with your player account, purchase status, timestamps and the delivered hints or entitlement. Purchase evidence is checked with the relevant store. Apple receives a player-account token; Google receives an obfuscated account identifier for the purchase association. Store verification and delivery are necessary for the requested purchase under Article 6(1)(b) GDPR; required accounting records are kept under Article 6(1)(c), and proportionate fraud or dispute records under Article 6(1)(f).

Advertising and free hints

PuttPath uses Google AdMob for optional rewarded videos and automatic advertising between eligible campaign levels. Automatic interruptions are not triggered in the middle of a level. Remove Ads stops these automatic interruptions.

We do not ask for your date of birth. Because age is unknown and children can use the game, ad requests use the configured child/under-age protections, a general-audience content rating and non-personalised treatment. We do not request Apple's tracking permission. We also request limited-ad treatment and restricted data processing. These settings do not mean advertising is data-free.

When ads are enabled and a request is permitted, Google's advertising SDK can process technical information such as the IP address, device/app information, ad requests and interactions, and diagnostic information for delivering ads, measuring their operation and preventing fraud. The exact information depends on the platform and protective settings. Child treatment prevents transmission of the Android advertising identifier and Apple advertising identifier; a pseudonymous reward identifier is a separate item described below. We do not request precise device location for advertising. Programmatic limited ads can use cookies or local storage specifically for detecting invalid traffic and fraud. Ad software and creative content may also be cached on the device. These technical functions do not authorise behavioural profiling. Google Ireland Ltd. provides AdMob under the applicable service terms. Google explains its processing in its privacy policy and advertising information.

For a requested free-hint video, Google receives a pseudonymous player identifier and a reward-request identifier. Google sends a signed reward confirmation to our server. The server checks it and records the reward once. Merely opening a video or receiving an unverified client callback does not establish a hint credit.

Technical ad delivery, security and fraud prevention are based on our legitimate interests in funding and protecting the service, Article 6(1)(f) GDPR, subject to applicable protections for children and requirements for device storage/access. Where consent is required for a particular processing activity, its legal basis is Article 6(1)(a), and that activity requires a valid consent before it begins. A consent dialogue is not proof of age or parental authorisation. Under-age treatment may suppress the consent dialogue; we do not treat the absence of a dialogue as consent. You can find available privacy choices in the app's legal/privacy area.

Support, sharing and service providers

If you email us, we process your sender address, message and attachments to respond. Support relating to your use or purchases is handled under Article 6(1)(b) GDPR; other enquiries under our legitimate interest in responding to correspondence, Article 6(1)(f). Please include only what is necessary. Normal games-support correspondence is deleted no later than 12 months after the case is closed. Necessary purchase records or a specific unresolved dispute may require separate retention; this does not justify keeping the entire support history indefinitely.

Email is handled through our existing Google Workspace service, with a Cloud Data Processing Addendum. Google's contracting-entity information identifies Google Cloud EMEA Limited, Ireland, for Workspace customers with an Austrian billing address. Our player service is hosted with Hostinger International Ltd., Cyprus, on a server in Frankfurt, Germany, under Hostinger's data processing terms. Google AdMob is a separate advertising service, generally acting as an independent controller except where particular processing terms apply; the Workspace agreement is not the agreement for AdMob.

If you choose to share a game result, PuttPath prepares the content for the operating system's sharing interface. You choose the receiving app or person. Their processing is governed by their own privacy information.

Storage and deletion

Account data is kept while needed to operate your account. A valid server-account deletion request immediately blocks account access and removes the account from active use; the scheduled deletion process removes the account data on its next hourly run. Minimal deletion markers and device-credential digests are retained for 30 days to prevent deleted accounts from reappearing during restoration.

Expired account-link challenges and advertising test probes are removed one day after expiry. Unconfirmed reward requests are removed eight days after expiry to allow delayed reward confirmation. A separate, minimal production-purchase archive excludes the player identifier, nickname, device credentials, provider identifiers and Daily data. It contains the store, transaction digest, product, quantity or entitlement, status, booking/refund timestamps and retention date. The configured retention period ends on 1 January of the eighth year following the purchase or refund year. Necessary accounting evidence is retained to meet legal record-keeping obligations; a specifically documented unresolved claim can require longer retention. The archive is separate from the deleted player account. Cryptographic transaction digests are not automatically anonymous, and records no longer necessary for their purpose are subject to deletion or restriction under the applicable rules.

Our own daily encrypted database backups are rotated after 14 days. Separate hosting-provider weekly backups have their own rotation and are not all encrypted at rest. Restores must respect the deletion record so that deleted accounts are not made active again. Technical logs are limited and rotated; credentials, complete receipts and reward callback queries are not intended for diagnostic logs. We do not promise a fixed number of days for logs that are currently rotated by size.

International processing

The player server's Frankfurt location does not mean that every provider processes all information only in the EU. Google, Apple and their authorised service providers may process information in other countries, including the United States. Google describes reliance on applicable adequacy decisions, including the EU-US and Swiss-US Data Privacy Frameworks and the UK extension for its certified US entities, and standard contractual clauses where an adequacy mechanism does not apply. Its business-service contracts also provide applicable transfer safeguards. See Google's transfer framework information, the Cloud Data Processing Addendum and advertising data protection terms. Hostinger's Data Processing Addendum addresses authorised subprocessors and transfers, including standard contractual clauses for applicable restricted transfers. You can contact us for information about the safeguards relevant to your data. The stores and sign-in providers also explain their own international processing in Apple's and Google's privacy notices.

Children and parental requests

PuttPath can be used by children. We do not ask players to publish their real name or contact information. A parent or guardian can contact puttpath@gustanavi.org about a child's data, request information or ask for deletion. We may need appropriate verification to protect the child and the account. Advertising or sign-in settings do not replace any legally required parental authorisation.

Additional regional information

Our settings do not request personalised advertising or cross-context behavioural targeting, and we do not provide player contact details to advertisers. Restricted-data-processing and child-protection settings apply to the advertising requests described above. Where US state privacy laws apply, you may request access, correction or deletion and exercise applicable opt-out or appeal rights by contacting puttpath@gustanavi.org. We do not discriminate against you for exercising applicable privacy rights. Parents may request review or deletion of a child's information and ask that further collection stop, subject to the verification needed to protect the child.

Your rights

Subject to the applicable legal conditions, you can request access, correction, deletion, restriction and portability of your personal data. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Where processing is based on consent, you can withdraw it for the future without affecting the lawfulness of earlier processing.

We cannot remotely read or delete data held only on your device. You can also complain to a competent supervisory authority, including the Austrian Data Protection Authority, the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner, as applicable. We update this notice when relevant functions or processing change; changing the notice does not replace consent where consent is required.