Privacy Policy
This privacy policy applies to ARI GG ATO: the website ariggato.com, the web app (the “Hub”), our apps for iOS and Android and all games we publish. It explains which data we process, why, for how long, who receives it and what rights you have.
At a glance
- You can play without an account. In that case, all we know is a random guest ID and your game progress.
- For an account, all we need is your email address. There is no password; you sign in via a link.
- We don't sell data. We only personalize ads if you are 16 or older and have given your consent.
- Payments are handled by a payment service provider. We never see your card details.
- You can delete your account at any time in Settings and download your data as a file.
1. Controller
ReDesign the System OÜ, Pärnu mnt 388b, 11612 Tallinn, Estonia
Registry code 16560505, represented by Stefan Vogel
Privacy contact: privacy@ariggato.com
We have not appointed a data protection officer because we are not legally required to do so. Our team at privacy@ariggato.com answers all privacy questions.
2. Legal bases
We only process data if a legal basis under the General Data Protection Regulation (GDPR) permits it:
- Contract (Art. 6(1)(b) GDPR): everything that is necessary so that you can play, use an account and receive your purchases.
- Legal obligation (Art. 6(1)(c) GDPR): e.g. keeping accounting records, responding to requests from authorities, obligations under the Digital Services Act.
- Legitimate interest (Art. 6(1)(f) GDPR): security, protection against fraud and abuse, troubleshooting, improving our services. In each case, we have weighed things up and concluded that your interests do not override ours. You can object (see “Right to object”).
- Consent (Art. 6(1)(a) GDPR): e.g. for personalized ads, analytics or push notifications. You can withdraw your consent at any time with effect for the future, in Settings under “Privacy settings”.
In addition, storing and accessing information on your device is subject to the rules implementing Art. 5(3) of the ePrivacy Directive (in Germany § 25 TDDDG (German Telecommunications Digital Services Data Protection Act), in Estonia the Electronic Communications Act). We store what is technically necessary without consent. Everything else we store only with your consent (see “Storage on your device”).
3. Website and servers
When you visit ariggato.com or the Hub, our server processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, browser and operating system (user agent) and the previously visited page (referrer). This is necessary to deliver the pages to you and to protect the service against attacks (Art. 6(1)(b) and (f) GDPR). We delete server logs after 7 days, unless we need individual entries for longer to investigate a specific attack.
Hosting: The website and the Hub run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner processes the data as our processor (Art. 28 GDPR).
Domain and email: Our domain and our email mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (processor). When you write to us or we send you emails, they pass through IONOS.
We deliver fonts, images and program code from our own domain. When you visit the website or open the Hub, no data is transferred to font services or other third parties.
4. Playing, guest mode and account
Guest mode. If you play without an account, we create a random guest ID and store the following with it: a randomly generated player name, your game progress, the games you have played (first and last game, number of sessions), achievements, leaderboard scores, GG points, unlocked rewards and your settings (e.g. light/dark, sound). This lets you pick up where you left off (Art. 6(1)(b) GDPR). We automatically delete guest data that has not been used for 12 months.
Account. If you create an account, we also store your email address. We transfer your guest data to your account so that nothing gets lost. With an account, you can play on several devices and restore purchases.
Sign-in via email link. Instead of a password, we send you a sign-in link. It is valid for 20 minutes and can only be used once. We only store a cryptographic hash of the link, not the link itself.
Visibility to others. On leaderboards and in the rankings, other players can see your player name, your rank and your points. So please don't choose a player name that contains your real name. Nobody can see your email address.
Games in the Hub. Games run in an isolated area of the Hub and only exchange game progress, achievements, points and purchases with it. Games by our partner studios never receive email addresses or payment data.
Games on third-party platforms. Some games are currently also available on the external platforms on which they were created. If you open a game via such a link, you leave ariggato.com. The operator of that platform is then responsible for processing your data, in accordance with its own privacy policy:
- claude.ai (Anthropic, PBC, 548 Market St., San Francisco, CA 94104, USA, or Anthropic Ireland, Limited): https://www.anthropic.com/legal/privacy
We do not automatically take over game progress that is saved in your browser there. Once the games run directly on ariggato.com, this route will no longer exist.
5. Storage on your device
We only store on your device what is technically necessary for the service:
| Name | Purpose | Duration |
|---|---|---|
agg_session (cookie) | keeps you signed in or recognizes your guest access | 180 days or until you sign out |
agg:theme (local storage) | light/dark display | until you change it |
| Game saves (local storage) | game progress on the device, synced with your account | until you delete the data |
| Offline storage (service worker) | lets the Hub start even with a poor connection | until the next version |
| Age information and privacy settings | so we don't have to ask you again every time you start | 12 months |
This storage is strictly necessary for the service you requested to work and does not require consent. Anything beyond that (advertising IDs, analytics) we only use with your consent. You can find the details in our Cookie and Tracking Policy: https://ariggato.com/en/cookies
6. Age check, children and teens
Our games are meant for all age groups. Where it matters (ads, account, purchases), we ask for your year and month of birth in a neutral way when you first start. We only store the resulting age group, not your date of birth.
- Under the age of 16, we don't show personalized ads and don't ask for consent to them. We don't read the device's advertising IDs, and ad partners receive a flag marking the user as a minor.
- Account: from the age of 16. Between 13 and 16 only with parental consent. Under 13, you can only play in guest mode.
- Purchases: under 18 only with parental consent. Under 16, we block purchases in the browser.
Children under 13 in the USA: We do not knowingly collect any personal information from them other than identifiers that we only use to operate the game (saving game progress, security), as permitted by the Children's Online Privacy Protection Act (COPPA). Parents who believe that we hold data about their child can write to privacy@ariggato.com. We will then delete it promptly. More for parents: https://ariggato.com/en/parents
7. Purchases and the Pass
Purchases in the apps. In the apps, you buy through Apple's App Store or Google Play. Apple or Google processes the payment as an independent controller. We only receive a purchase confirmation (product, time, transaction number) so that we can unlock the purchase.
In your account, we store your orders, purchased content, Pass status and inventory (Art. 6(1)(b) GDPR). We keep accounting-relevant data for 7 years because the Estonian Accounting Act requires it (Art. 6(1)(c) GDPR).
8. Ads
Some games are free and financed by ads: banners, interstitial ads between levels and optional rewarded videos (“Watch a video for a reward”). Ads are always clearly recognizable as ads. Where the Pass or a “No ads” purchase is available, it removes interstitial ads.
Without consent (and always for players under 16), everyone only sees non-personalized ads. For this, ad partners process technical data such as your IP address (truncated), device type, operating system, language, approximate region and app version in order to deliver ads, detect fraud and count impressions. The legal basis is our legitimate interest in financing free games (Art. 6(1)(f) GDPR); for this purpose, they only access your device to the extent strictly technically necessary.
With consent (from the age of 16), ad partners may also use your device's advertising ID (Advertising ID or IDFA) and cookies to tailor ads to your interests and to measure ad performance (Art. 6(1)(a) GDPR). On iPhone and iPad, the system also asks you whether the app may track you across other companies' apps (App Tracking Transparency).
Managing consent. We obtain consent through a consent window that uses IAB Europe's “Transparency & Consent Framework” (TCF) standard. There you can see all ad partners and purposes and choose individually. You can change or withdraw your choice at any time in the app under Settings → Privacy settings, as well as in your device settings (iOS: Privacy & Security → Tracking, Android: Settings → Privacy → Ads).
Unity Ads: Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark, and Unity Technologies SF, 30 3rd Street, San Francisco, CA 94103, USA. Unity delivers and measures ads. In doing so, Unity acts as an independent controller: https://unity.com/legal/game-player-and-app-user-privacy-policy
Unity LevelPlay (mediation): Unity Technologies or ironSource Ltd., 121 Menachem Begin Rd., Tel Aviv, Israel. LevelPlay decides which ad network delivers an ad and passes your consent decision on to all networks. An adequacy decision of the European Commission applies to Israel. The connected ad networks and their privacy policies: https://developers.is.com/ironsource-mobile/general/ironsource-mobile-partners/ and in our consent window.
Google AdMob: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google delivers and measures ads. For personalized ads, Google acts as an independent controller; data may be transferred to Google LLC in the USA. How Google uses data from apps: https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy
We publish the file app-ads.txt on ariggato.com. It discloses which ad networks are authorized to sell ads in our apps and protects against ad fraud.
9. Analytics, crash reports and push notifications
We don't use any third-party analytics tools. We only see how often games are played from our own server's data (see “Playing, guest mode and account”), in aggregated form and without looking at you individually.
10. Support, reports and contact
When you write to us, we process your message, your email address and, where necessary, data about your account and your purchases in order to handle your request (Art. 6(1)(b) or (f) GDPR). We delete support requests two years after they are closed, unless we are required to keep them longer.
We handle reports of illegal content and complaints about moderation decisions in accordance with the Digital Services Act (Art. 6(1)(c) GDPR). We do not pass on the name and email address of the person who made a report to the person reported.
11. Our social media presence
We have profiles on Instagram, TikTok, YouTube, X, Facebook, LinkedIn, Twitch, Discord and Bluesky. When you visit our pages there, the operators process your data in accordance with their own privacy policies. For our Facebook and Instagram pages, we are joint controllers with Meta Platforms Ireland Limited for the page insights (Art. 26 GDPR); the essence of the arrangement: https://www.facebook.com/legal/terms/page_controller_addendum. It is best to exercise your rights directly with the respective operator, but we are happy to help: privacy@ariggato.com. We only receive aggregated statistics from the networks and the messages you send us.
12. Artificial intelligence
We use AI tools to develop games, graphics and texts. We do not enter any personal data of our players into these tools. If you talk to an AI character in a game, we will tell you beforehand.
13. Recipients and transfers to third countries
Your data is only received by the service providers named in this policy, and only to the extent they need it for their task. Processors are contractually bound by our instructions (Art. 28 GDPR). Authorities only receive data if we are legally required to provide it.
Some service providers are based in the USA or process data there. For the USA, the European Commission determined on 10 July 2023 that companies certified under the EU-US Data Privacy Framework provide an adequate level of data protection (Art. 45 GDPR). Where a service provider is not certified, we have concluded the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and assess additional safeguards. You can obtain a copy of these safeguards from privacy@ariggato.com. For the United Kingdom, Switzerland and Israel, adequacy decisions of the European Commission apply.
14. How long we store data
| Data | Duration |
|---|---|
| Server logs | 7 days |
| Sign-in links | valid for 20 minutes, then deleted |
| Sessions | 180 days or until you sign out |
| Guest data | up to 12 months after last use |
| Account and game progress | until you delete the account |
| Deleted accounts in backups | at most 30 additional days |
| Orders and invoice data | 7 years (statutory accounting obligation) |
| Support requests | 2 years after closure |
| Reports and moderation decisions | 12 months after closure |
| Consents and withdrawals of consent (proof) | 3 years |
15. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of any consent you have given (Art. 7(3)). You can do much of this directly in the app: under Settings, you'll find “Download my data” and “Delete account”. For everything else, an email to privacy@ariggato.com is enough. We reply within one month. To protect your data, we may ask you to confirm your request via your account's sign-in link.
16. Right to object
You can object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interest (Art. 21(1) GDPR). We will then no longer process the data for that purpose, unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defense of legal claims. You can object at any time, without giving reasons, to advertising based on your data (Art. 21(2) GDPR). To do so, write to privacy@ariggato.com or use the Privacy settings in the app.
17. Complaint to a supervisory authority
You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee.
18. Automated decisions
We do not make any decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Automated filters may temporarily hide content; decisions on account suspensions are always made by a human.
19. Do you have to provide data?
To play in guest mode, we don't need any information from you. For an account, we need your email address; otherwise we can't send you a sign-in link. Consent is voluntary; without it, all games work exactly the same, just without personalized ads.
20. Security
We transfer all data in encrypted form (HTTPS/TLS), store sign-in links and sessions only as hashes, technically separate games from the Hub, restrict access to data to a small number of people and back up the database daily in encrypted form.
21. Additional information for California and other US states
If you live in a US state with its own privacy law (e.g. California, Colorado, Connecticut, Virginia, Utah, Texas), the following also applies: We collect the categories of personal information listed in this policy (identifiers such as email address, guest ID and IP address; purchase data; usage data in our games; approximate region; advertising IDs if you consent) for the purposes stated. We do not sell personal information for money. If ad partners use advertising IDs for personalized advertising, this may count as “sharing” under California law. You can opt out via the “Do Not Sell or Share My Personal Information” link in the app and on ariggato.com; we also treat a Global Privacy Control (GPC) signal from your browser as an opt-out. You have the right to access, delete and correct your data and to opt out, without being discriminated against for doing so. Requests: privacy@ariggato.com. We do not sell or share the data of anyone under 16.
22. United Kingdom and Switzerland
For users in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply, with the same rights; you can lodge complaints with the Information Commissioner's Office (ico.org.uk). For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies; the competent authority is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
23. Changes
When we introduce new features or laws change, we update this policy. We announce significant changes in the app before they take effect. The current version is always available at https://ariggato.com/en/privacy.
Last updated: 26 September 2026