This notice covers the Kolonaut app for iPhone, iPad and Android. The website has its own website privacy notice.
In short
Kolonaut needs no account. Your save and your Power Cell balance stay on your device, and the app sends nothing to us while you play. Ads only appear as videos you start yourself. For those videos the app includes Google AdMob. Whether Google may show personalized ads is your choice, the first time you start a video and at any time later.
Controller
Real Movement Analytics GmbH
Kleines Everstal 18d
44388 Dortmund
Germany
Email: hi@punktdev.com
Save and settings
The app stores your save, a backup of the previous save, your settings (for example sound), your Power Cell balance, how many ad videos you watched today and the numbers of your recent purchases in the app storage on your device. We have no access to it. Storing this is necessary so you can keep playing and your colony keeps working during a break. The legal basis is Section 25(2) no. 2 TDDDG. Where personal data is involved, we process it to provide the game under Art. 6(1)(b) GDPR.
The data stays until you delete the app or clear its data in your system settings. Deleting the app also deletes your Power Cells. We cannot restore them because we never receive them. Exported files and existing device backups remain until you delete them yourself.
Device backup
Depending on your system settings, the app storage can be part of your device backup, meaning an iCloud backup or a Google backup. Apple or Google run that backup for you under their own responsibility. We receive no data from it. See the privacy notices of Apple and Google.
Export and import
When you export your save, the app writes a file to the place you choose or hands it to the app you pick in the share sheet. Import only reads the file you select. Your Power Cell balance is not part of the export file.
Ad videos with Google AdMob
For ad videos we use Google AdMob, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The app neither starts the SDK nor requests any ads before you start your first video with a button such as “Watch a video: 10 minutes of turbo for free”. At that point it asks for your consent where required, loads the video and plays it.
Google receives in particular: your IP address (and from it your approximate location), device and app details (model, operating system, language, app version, identifiers of the app and of us as developer), your device’s advertising ID where available and permitted, on Android the App Set ID, how you interact with ads (views, completion, taps), diagnostic and performance data about the SDK and your privacy choices. Google uses this data to deliver, measure and bill ads, to detect fraud and abuse, and to analyse and improve the SDK.
In the EU, the EEA, the UK and Switzerland the app uses Google’s consent form before your first video to ask what Google may do. There, personalized ads and any access to your device that the video itself does not need, such as reading the advertising ID, only happen with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you allow storing and accessing information on your device but not personalization, Google shows non-personalized ads. They are not based on your past behaviour, but Google may use identifiers to limit how often you see the same ad, for reporting and to detect fraud. If you also decline storage on your device, you will usually get no video. We have switched off limited ads in AdMob, for which Google would store data on the device to detect fraud even without consent.
In every case the app has to request the video you start from Google and play it. We base the device access this requires on Section 25(2) no. 2 TDDDG, and the processing of your IP address and device details to deliver the video, bill it and detect fraud on Art. 6(1)(f) GDPR. Our legitimate interest is funding a free game through optional ads.
Outside these regions the app shows no consent form and therefore only requests non-personalized ads.
On iPhone and iPad the app also asks before your first video whether it may track you across apps and websites owned by other companies (App Tracking Transparency). Wherever you are, Google only receives your device’s advertising identifier (IDFA) if you allow this. On Android you can reset or delete the advertising ID in your system settings.
Google also processes this data as an independent controller, for example to bill ads and prevent abuse. Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses also apply. Google decides how long it keeps the data and explains its criteria under How Google retains data. More in How Google uses information from sites or apps that use our services and in Google’s privacy policy.
You can change or withdraw your choice at any time: in Kolonaut under Settings › “Privacy options for ads” (in the EU, the EEA, the UK and Switzerland), and on iPhone and iPad also under Settings › Privacy & Security › Tracking. Withdrawal applies to the future. Ad videos are optional. The game is fully playable without them.
Download, updates and purchases
You get Kolonaut from Apple’s App Store or Google Play. Apple or Google process data under their own responsibility and their own privacy notices. The same applies to purchases: you buy Power Cells through the store, which handles the payment. We never receive card or account details. The store only tells the app which pack you bought and the purchase number. The app uses that to add the cells on your device and to make sure a purchase only counts once (Art. 6(1)(b) GDPR).
In the store’s developer console we can see individual orders, such as order number, date, amount and country, and on Google Play also the email address of your Google account. This information comes from the store. We only use it to answer questions about purchases and refunds and to meet tax obligations (Art. 6(1)(b) and (c) GDPR). We only keep it outside the store console when we need it for a request or for our accounts. Requests are deleted once they are dealt with. Accounting vouchers are kept as long as tax law requires, currently eight years (Section 147(3) AO). Apple and Google decide how long the details stay in the console. The stores give us aggregated statistics, for example about downloads and crashes. We only receive crash reports if you agreed to share them with developers in your system settings. They do not tell us who you are.
Permissions
Kolonaut does not ask for access to your camera, microphone, location, contacts or photos. On iPhone and iPad it asks for permission to track (see above). For ads it needs internet access, and on Android also the advertising ID permission.
Links and contact by email
Links to help and legal pages open in your browser, where that website’s notice applies. If you write to us, we process your email address and message to answer you. The legal basis is Art. 6(1)(b) GDPR for questions about a contract, such as a purchase, and otherwise Art. 6(1)(f) GDPR, based on our interest in answering requests. Whether you write and what you include is up to you, but without a contact address we cannot reply. We only receive a save if you attach it yourself.
Our email runs on Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin), which acts as our processor. Processing in the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the European Commission’s standard contractual clauses also apply. They are part of Microsoft’s Data Protection Addendum, and we will send you a copy on request. We delete messages once they are dealt with and no legal retention period applies.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Write to hi@punktdev.com. We have no access to saves or Power Cells that only exist on your device. You can export or delete your save yourself. For data held by Google, you can also contact Google directly.
Last updated: 24 October 2026