Privacy policy

1. Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, you can reach us at the email address above.

2. The essentials at a glance

• You can play Tamdotti without an account. Your game progress then stays on your device.
• An account is optional and only needed for online features (cloud save, friends, visits, duels, online meadow).
• Our servers are located in the EU (Ireland).
• We use no advertising, no tracking, no analytics or crash-reporting services and we do not sell any data.
• You can optionally buy coin packs for real money. Payment is handled only by Apple or Google – we receive no payment data.
• You can have your account deleted at any time – see Delete account.

3. Playing without an account (data on your device)

If you play without signing in, the app stores your game progress (e.g. your Dottis, room furnishings, garden, inventory, coin balance and settings) exclusively locally in the app storage of your device. This data is not transmitted to us. Reminders such as “Your Dotti is hungry” are – if you allow notifications – scheduled as local notifications directly on your device; no data is sent to us for this. If you use the Tamdotti widget, the game information it needs is likewise only stored locally on the device.

Storing this information on your device is strictly necessary for the app function you have requested (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (b) GDPR). When you uninstall the app, this local data is deleted.

4. App updates (Expo EAS Update)

So that we can deliver bug fixes and small improvements quickly, the app checks at startup whether an update is available and downloads it if necessary. This service is provided by 650 Industries, Inc. (“Expo”), USA. Technically necessary data is transmitted in the process: your IP address, the platform (iOS/Android), the app or runtime version, the update channel and the identifier of the currently installed update. No account data and no game content is transmitted.

The legal basis is our legitimate interest in a secure, error-free and up-to-date app (Art. 6 (1) (f) GDPR).

5. User account & sign-in

You can create an account for online features. Sign-in is handled via the authentication service of our server provider Supabase (see section 8). You have the following options:

• Email and password: We process your email address, your password (stored only as an encrypted hash) and – if provided – a display name. An email may be sent to the address you provide to confirm your registration.
• Sign in with Google: Sign-in takes place with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We receive a user identifier, your email address and, where applicable, your name or profile picture from Google, as provided by Google during sign-in. Google’s privacy notices also apply.
• Sign in with Apple: Sign-in takes place with Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). We receive a user identifier and your email address – on request an anonymous relay address (“Hide My Email”) – and, where applicable, your name if you choose to share it.

To keep you signed in, the app stores a session token on your device. For security purposes, the server logs sign-in events (including time and IP address).

The legal basis is the provision of the online features you have requested (Art. 6 (1) (b) GDPR) and our legitimate interest in the security of our services and in preventing abuse (Art. 6 (1) (f) GDPR). Creating an account is optional; without an account, only the online features are unavailable.

6. Online features & stored data

When you are signed in, we store the following data on our servers in order to provide the online features (Art. 6 (1) (b) GDPR):

What other players see: Your friends and fellow players can see your username, your avatar or your public Dotti info, as well as visits, duel results and trophies they are involved in. You share your friend code yourself so that others can add you as a friend. Your email address is not visible to other players. Please do not choose your full real name as your username.

7. Online meadow (real time)

On the online meadow, several signed-in players can meet with their Dottis at the same time. While you have the meadow open, your user ID, your name tag (username), your Dotti species, your position on the meadow, your current action (e.g. sitting) and any emotes/waves you send are transmitted via a real-time connection to the other players in the same room. This real-time data is not stored permanently and disappears as soon as you leave the meadow. The legal basis is Art. 6 (1) (b) GDPR.

8. Servers & hosting (Supabase)

For sign-in, database, real-time connections and server functions, we use Supabase (Supabase, Inc., USA) as a processor. Our project is hosted in the region eu-west-1 (Ireland, EU); the data is stored there in data centres of Amazon Web Services, which Supabase uses as a sub-processor. When the servers are accessed, log data is processed for technical reasons (e.g. IP address, time, requested function, error messages) to ensure operation and security (Art. 6 (1) (f) GDPR). As Supabase is a US company, access from the USA (e.g. in the course of support and maintenance) cannot be ruled out – see section 14.

9. Notifications

Local reminders (e.g. hunger, thirst, bedtime) are scheduled directly on your device and do not require any data transfer.

Push notifications (e.g. friend requests, duels, daily reward) may be sent to you if you are signed in and have allowed notifications. For this, a device-specific push token is stored in your profile. The notifications are delivered to your device via Expo’s push service (650 Industries, Inc., USA) and from there via the Apple Push Notification service (Apple) or Firebase Cloud Messaging (Google). The push token and the title and text of the notification are transmitted. Quiet hours (bedtime) are respected.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you give via your device’s permission prompt. You can withdraw it at any time in your device’s system settings.

10. No tracking, no ads

Tamdotti contains no advertising, no advertising IDs, no analytics or tracking services, no third-party crash reporting and no AI services to which your data would be sent. We do not create user profiles for advertising purposes and we do not sell any data. The app does not access your camera, microphone, contacts, photos or location.

11. App stores

Tamdotti is offered via the Apple App Store and Google Play. When you download the app, Apple or Google process data (e.g. account, device, time of download) under their own responsibility. We have no influence on this; the privacy notices of the respective store apply.

In-app purchases (coin packs)

In Tamdotti you can optionally buy coin packs for real money. The purchase is handled exclusively by Apple’s App Store or Google Play. The respective store is the contracting party for the purchase, payment, invoice, VAT, withdrawal and refunds. We receive no payment data (e.g. card or bank details), no name and no billing address.

To credit purchased coins to your game account securely and exactly once, we process: your pseudonymous game account ID, which is passed to the store with the purchase (so that a purchase can only be credited to the purchasing account), the store’s transaction ID or order number and purchase token, the product, the time of purchase, the platform, whether it was a test or real purchase, and any refund status the store reports to us. For verification we send the transaction ID or purchase token to Apple (App Store Server API) or Google (Google Play Developer API).

Purposes and legal bases: verifying the purchase, crediting the coins and handling refunds (Art. 6 (1) (b) GDPR) and preventing double credits and abuse (Art. 6 (1) (f) GDPR). We keep purchase records as long as your account exists; they are deleted together with your account unless statutory retention obligations apply.

Purchased coins are not needed to play – everything can also be reached by playing. Parents can restrict purchases or require approval in the store settings (Apple: “Ask to Buy”/Screen Time, Google Play: Family Link or purchase authentication). The odds of which Dotti hatches from a surprise egg are shown in the app right at the egg purchase.

12. This website

The website tamdotti.de is provided via GitHub Pages (GitHub, Inc., USA). When you visit it, technically necessary data such as your IP address, date and time, the page accessed and browser information are processed in order to deliver the page and protect it against abuse (Art. 6 (1) (f) GDPR). The website sets no cookies, uses no analytics tools and does not load any external fonts or third-party content.

13. Contact by email

If you write to us by email, we process your email address, your name (if provided) and the content of your message in order to deal with your request (Art. 6 (1) (b) or (f) GDPR). We delete the messages once your request has been dealt with, unless statutory retention obligations prevent this.

14. Recipients & transfers to third countries

Your data is only received by the service providers named above, to the extent necessary for the respective purpose: Supabase (servers, database, sign-in), Expo (app updates, push delivery), Apple and Google (sign-in or push delivery, if used by you) and GitHub (website hosting). We conclude agreements pursuant to Art. 28 GDPR with our processors.

Some of these providers are based in the USA. Where personal data is transferred to the USA in this context, this is done on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), provided the recipient is certified under it, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

15. Storage period & deletion

• Local game data stays on your device until you uninstall the app.
• Account and game data on the server is stored for as long as your account exists. If you have your account deleted, we delete this data completely – within one month of your request at the latest. How to do this is described under Delete account.
• Real-time data of the online meadow is not stored.
• Technical logs (servers, update service, website hosting) are deleted automatically by the respective providers after a short time.
• Email enquiries are deleted once they have been dealt with, unless statutory retention obligations apply.

16. Children & young people

Tamdotti is intended for all age groups and can be played without an account and without providing any personal data. An account is required for the online features. Children under 16 should only create an account with the consent of their parents or legal guardians. We recommend that parents accompany their children when using the online features and choose a username that does not contain a real name. There are no free-text messages between players; interactions are limited to predefined actions and emojis. If we learn that an account was created without the required consent, we will delete it upon notice from the parents.

17. Your rights

Under the GDPR, you have the right to:

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw any consent given, with effect for the future (Art. 7 (3) GDPR).

To do so, simply contact info@vidofood.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

18. Data security

Transmission between the app, the website and the servers is encrypted (TLS/HTTPS). In the database, access rules ensure that each player can only access their own data and the information shared with friends. Passwords are only stored as a hash.

19. Changes to this privacy policy

If the app or the legal requirements change, we will update this privacy policy. The version published here applies.

Last updated: 12 October 2026 (translation of the German version of the same date)