← Back

Privacy Policy

Last updated: November 9, 2026

1. The short version

This privacy policy covers the mobile app "Who Larps?" (the "App") and the website wholarps.com.

  • Who Larps? needs no account. Player names, your own prompts, the last game setup and your settings stay on your device only.
  • No ads, no tracking across apps. We measure ourselves, pseudonymously, what gets played (section 3.4) and how the website is visited (section 4) – no names, no prompts, no IP address, no cookies. You can object at any time by email.
  • Data is only processed for "Plus" (subscription): by the Apple App Store (payment) and by Superwall (offer screen, purchase status).

2. Controller

Centaurio UG (haftungsbeschränkt)
Represented by its managing director Valentin Weinert
Dr.-Rohmer-Weg 11
65719 Hofheim am Taunus
Germany
Email: support@wholarps.com

We are not required to appoint a data protection officer (Section 38 BDSG).

3. Data processing in the App

3.1 Game data (on your device)

The App stores the following only in its own storage on your device:

  • the names and chosen characters of the last group
  • prompts you wrote yourself
  • the last game setup (packs, number of rounds)
  • settings (haptics on/off, app language)
  • for the usage stats (section 3.4): a random installation id, the date of the first launch, the last app version used, the number of games started and events not yet sent

The confirmation that everyone playing the "Spicy" pack is at least 18 is not stored; it only lasts until the App is closed.

Player names and your own prompts are never sent to us or anyone else. You can delete player names and your own prompts at any time in the App's settings; deleting the App removes all of it. The data is included in device backups you set up yourself in iOS (iCloud or local backup), for which Apple is your contractual partner.

Legal basis, insofar as we process anything at all: Art. 6(1)(b) GDPR (providing the App).

3.2 Plus: purchase via the Apple App Store

You buy "Plus" (weekly or yearly subscription) through the Apple App Store. Apple handles payment; we receive no payment details and no information about your Apple ID. Apple only provides us with aggregated sales reports and technical transaction data (transaction ID, product, status, expiry date).

Recipient and independent controller: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple's privacy policy: https://www.apple.com/legal/privacy/

Legal basis: Art. 6(1)(b) GDPR (performing the purchase) and Art. 6(1)(c) GDPR in conjunction with Section 147 AO (retention of accounting records).

3.3 Superwall (offer screen and purchase status)

To show the Plus offer screen and to check whether Plus is active, we use the software development kit (SDK) of Superwall.

Provider: Nest 22, Inc. (d/b/a Superwall), 2093 Philadelphia Pike #5307, Claymont, DE 19703, USA

Superwall processes on our behalf:

  • a random, pseudonymous user ID generated by the SDK (we do not send any name, email address, Apple ID or player names)
  • the device identifier "Identifier for Vendor" (IDFV), which Apple only assigns to apps from the same developer
  • technical device and app details: device model, iOS version, app version, language, region, currency, time zone, network type, app install date
  • events around the offer screen (shown, closed, purchase started, purchase completed, restored), why it was shown (e.g. a locked pack), and the purchase status with expiry date and Apple transaction ID
  • the IP address (technically part of every request; Superwall derives an approximate region from it)

Superwall is based in the USA and is not certified under the EU-US Data Privacy Framework. Transfers are therefore based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module 2), which are part of our data processing agreement with Superwall (Art. 28 GDPR). Superwall uses its own sub-processors in the USA (including Amazon Web Services and Cloudflare); current list: https://superwall.com/legal/dpa

Legal basis: Art. 6(1)(b) GDPR (preparing and performing the purchase, unlocking Plus) and Art. 6(1)(f) GDPR (our legitimate interest in working purchase management). Access to the device identifier is strictly necessary under Section 25(2) No. 2 TDDDG to provide the service you requested (buying and using Plus). Superwall's privacy policy: https://superwall.com/privacy

3.4 Usage stats (our own measurement, pseudonymous)

To understand how Who Larps? is played – how many games are finished, which packs and prompts land, where groups stop and how many look at Plus – the App measures this itself, without a third-party analytics service. The analysis is statistical; we want to know how the App is used as a whole, not what any particular person does.

For this, the App sends data to our own server at api.wholarps.com (Cloudflare Workers, Cloudflare as processor as in section 4), which stores it in a database in our Cloudflare account:

  • a random installation id that the App creates on first launch and keeps in its own storage, and a random session id per game night. Both only apply to Who Larps? on this device. We send no advertising id (IDFA), no vendor id (IDFV), no name, no email address and no Apple ID.
  • usage events: App installed, updated and opened; screens viewed; game start and end (number of players, rounds, packs chosen, whether and how many own prompts are in play, duration); per turn the role (REAL or LARP), how many voted LARP, whether proof was shown, which pack the prompt came from and its position there; swapped prompts (likewise pack and position only); quitting a game; the answer to the 18+ question; the number of own prompts; showing, closing and outcome of the Plus offer screen and purchase events (product, price, currency, whether with a free trial; no payment data); tapping "Invite friends" (only whether something was shared, not with whom) and "Rate the app"; whether Plus is active; the App language
  • technical data: app version, iOS version, time, whether it is a test build
  • country, derived by Cloudflare from the IP address. The IP address itself is not stored.

Player names and prompts you wrote are never sent – for your own prompts we only learn that it was one of yours. We only analyse the data in aggregate (counts, shares, trends).

Objection: There is no dialog at launch; we rely on our legitimate interest. You can object at any time (Art. 21 GDPR) with an informal email to support@wholarps.com. Deleting the App removes the id from your device; a reinstall gets a new id that cannot be linked to the old one.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the game (content, game flow, offer) and planning its operation. We only process pseudonymous data, use no third-party analytics service and store no IP addresses.

3.5 What we don't do

  • No account, no login
  • No ads, no third-party analytics, no crash reporting, no tracking across apps or websites
  • No access to camera, microphone, photos, contacts or location
  • No push notifications
  • No transfer of player names or your own prompts

4. Website wholarps.com

When you visit the website, our hosting provider processes technically necessary data (IP address, time, page requested, browser and operating system, referrer) in server log files to deliver and secure the website. Logs are deleted automatically after a short time. The website uses no cookies and no third-party analytics or advertising services.

Hosting: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as processor (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely).

Visit statistics (our own measurement, no cookies). To understand how many people visit the website, where they come from and whether they go on to the App Store, the website measures this itself, without a third-party analytics service. When you open and leave a page, your browser sends the following to our own server at wholarps.com (Cloudflare Workers, Cloudflare as processor as above), which stores it in a database in our Cloudflare account:

  • a random visit ID that exists only in the memory of the open browser tab. Nothing is stored on or read from your device (no cookies, no local storage); reloading or opening a new tab starts a new visit that is not linked to the previous one.
  • events: the page opened; on leaving, how long it was open and which sections of the home page were visible; clicks on the App Store button and on links to other websites (their domain only)
  • origin: the domain of the page you came from (not the exact address) and campaign details from the link you opened (e.g. utm_source, ref)
  • coarse device details derived from the browser identifier (user agent) that is sent anyway: device type (phone, tablet, computer), browser and operating system, without versions. The browser identifier itself is not stored.
  • country, which Cloudflare derives from the IP address. We use the network operator's number (ASN) only to recognise requests from data centres as automated; it is not stored. The IP address is not stored for visit statistics; to prevent abuse, the server only briefly counts in memory how many reports come from one address.

Requests from search engine crawlers and from browsers that send the "Global Privacy Control" signal are not stored. We only evaluate the data in aggregate (counts, shares, trends). You can object at any time (Art. 21 GDPR), for example by turning on Global Privacy Control in your browser, or informally by email to support@wholarps.com.

Legal basis for visit statistics: Art. 6(1)(f) GDPR. Our legitimate interest is measuring the reach of the website and our campaigns and improving the website; for this we only process pseudonymous data, use no third-party analytics service and store no IP addresses.

5. Contacting us by email

If you email us, we process your email address and the content of your message to answer you. "Send feedback" in the App opens your mail app with a pre-filled subject and a line with app version, operating system and device model; you see all of it before sending and can change or delete it. We delete the data once your request is resolved, unless legal retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (answering requests).

6. Retention

  • Game data and settings: on your device until you delete them in the App or delete the App
  • Superwall: for the duration of our contract with Superwall; deletion by Superwall on request
  • Usage stats (section 3.4) and website visit statistics (section 4): 13 months from each event, then deleted automatically
  • Accounting records (aggregated reports from Apple): 10 years (Section 147 AO)
  • Email requests: until resolved, then at most 3 years for possible claims (Section 195 BGB)
  • Website server logs: deleted automatically after a short time

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on Art. 6(1)(f) GDPR (Art. 21), and to withdraw consent with effect for the future (Art. 7(3)).

Because your game data only exists on your device, we can neither see it nor delete it for you; you do that yourself in the App's settings or by deleting the App. For the pseudonymous data stored by Superwall, we enforce your rights with Superwall on request. You object to the usage stats by email (section 3.4). Since we cannot link the random installation id to a person, we cannot look up individual installations (Art. 11 GDPR).

To exercise your rights, just email support@wholarps.com. We reply within one month.

You may also lodge a complaint with a data protection supervisory authority. Ours is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
https://datenschutz.hessen.de

8. Children

The App does not knowingly collect personal data from children. Player names stay on the device. The "Spicy" pack is only meant for groups in which everyone is at least 18 and can only be played after confirming that.

9. Changes

We update this privacy policy when the App, our service providers or the law change. The current version is at https://wholarps.com/privacy. The date of the last update is at the top.