How Find the Difference processes personal data on the website, in the mobile apps and in related services.
Controller within the meaning of the GDPR: Stefan Tissen, c/o SourceArt, Tuttlingerstrasse 45, 78333 Stockach, Germany.
Email: humanorbot.team@gmail.com. Contact form: https://findthedifference.ai/contact.
This policy applies to the website findthedifference.ai, the Find the Difference apps for iOS and Android and the related services. If the German and the English version differ, the German version prevails.
We process personal data to run the game: to provide accounts, save progress, let you play together in parties, run arena matches, connect friends, host community packs, offer AI features, handle purchases, keep the service safe and answer requests. Advertising is personalized only with your consent. We do not sell personal data.
Our servers run on Google Cloud / Firebase in the United States and on Cloudflare. Section 12 explains these international transfers.
When you open the website or the apps contact our servers, the hosting providers process technical data: IP address, date and time, requested address, browser or app version, operating system and error information. This is necessary to deliver the service and to keep it secure (Art. 6(1)(f) GDPR, legitimate interest in a stable and secure service). Logs are deleted after 30 days at the latest unless they are needed to investigate a specific security incident.
You can play as a guest (anonymous account) or sign in with email and password, Google or Apple. We process an account ID, sign-in method, email address (if provided), the name your sign-in provider shares, the time of sign-in and the username you choose. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).
The data is stored until you delete your account. You can delete it at any time in the app profile or at findthedifference.ai/account-deletion.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We use automated checks, for example for implausibly fast finds, to detect cheating; such signals only lead to a review. Whether an account is restricted is decided by a person (Section 9).
When you create packs, we store your images, audio, titles, descriptions, puzzle data and earlier versions. Published packs are visible to everyone, together with your username as author. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for keeping content and versions, our legitimate interest in keeping published and competitive content working and in being able to restore it (Art. 6(1)(f) GDPR).
When a community pack is well received, we may make it an official pack. Levels of official packs are also played in the arena. There they run as copies without the pack title or author, so nobody can look the level up beforehand. To set the difficulty and the computer opponents, we evaluate the level's play statistics (find times, find rates, ratings) without reference to individual players.
Content you delete is hidden and kept, and after an account deletion it is no longer linked to you (see the Terms of Service). Please only upload images of other people if they have agreed. If content shows you and you want it removed, write to us: we delete it in that case.
When you generate or edit images or songs, your prompts and the images you use (including uploaded photos) are sent to Google (Gemini API and Vertex AI) for processing. The app asks for your agreement before the first use. The results are stored in your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for photos of other people additionally your assurance that you may use them.
To bill credits and prevent abuse we log each generation (time, type, credits, prompt and result). These records are kept as long as needed for billing, abuse prevention and dispute handling.
In the apps you buy through the Apple App Store or Google Play; Apple and Google process the payment as independent controllers under their own privacy policies. On the website, payments are processed by Stripe Payments Europe, Ltd. (Ireland) through RevenueCat; Stripe processes payment data as an independent controller.
RevenueCat, Inc. (USA) manages purchases and subscriptions on our behalf; we receive the product, time, price, store and transaction IDs, never your full payment details. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR). Purchase records are kept for 10 years as required by German tax and commercial law.
Reports about players, packs and levels, block lists, moderation decisions with their reasons and account bans are stored to protect players and to meet our duties as a host of user content (Art. 6(1)(c) and (f) GDPR, Digital Services Act). These records are kept for up to 3 years after the decision.
To protect the service against abuse, the website uses Google reCAPTCHA through Firebase App Check, and the apps use Apple App Attest and Google Play Integrity. These check that requests come from our genuine website or app (Art. 6(1)(f) GDPR; technically necessary under Section 25(2) no. 2 TDDDG).
We receive short notifications about new reports, feedback and unusual activity through the messaging service Telegram (Telegram FZ-LLC, United Arab Emirates). They contain only the kind of event, pseudonymous identifiers such as pack or player IDs and, where relevant, the public title of a pack, never usernames, email addresses, or messages or comments you wrote. The details stay in our own moderation system.
The free version of the apps shows ads from Google AdMob (Google Ireland Limited). In the EEA, the UK and Switzerland you are asked for consent first (Google consent message); personalized ads and the use of advertising identifiers require your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). On iOS we additionally ask for permission under App Tracking Transparency. Without consent you may still see non-personalized ads.
You can change your choice at any time in the app under Profile → Privacy & legal → Ad privacy choices, and on iOS in the system settings.
In the apps you can choose to watch a video ad for a reward, such as energy or another daily chest. So that we can add the reward to your account, we send your account ID and the kind of reward to Google AdMob, and Google confirms to us that the video was watched to the end (Art. 6(1)(b) GDPR).
The website may show ads from Google AdSense (Google Ireland Limited). Google and its partners, as third-party vendors, use cookies and similar technologies to show ads based on your previous visits to this and other websites, to limit how often you see the same ad, to measure ads and to prevent fraud. In the EEA, the UK and Switzerland the website asks for your consent first through a certified consent message from Google; cookies for advertising are only used with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent you may see non-personalized or limited ads.
You can change your choice on the website at any time through the privacy settings link of the consent message. You can turn off personalized ads from Google in My Ad Center (https://myadcenter.google.com). How Google uses information from websites that use its services is explained at https://policies.google.com/technologies/partner-sites. Star Club members see no ads.
The apps send crash reports to Firebase Crashlytics (Google): stack trace, device model, operating system, app version and an installation ID, without your account or name. This helps us fix errors (Art. 6(1)(f) GDPR). Crash reports are deleted after 90 days.
When you use the contact form, the feedback dialog or the cancellation page, we process your email address, your message and the details you enter to answer you or process the cancellation (Art. 6(1)(b) and (f) GDPR). We keep these messages for 3 years after the end of the year in which the matter was settled.
The app and the website store settings, caches and sign-in state on your device (local storage). This is technically necessary for the service you requested (Section 25(2) no. 2 TDDDG).
Transfers to the USA are based on the EU-US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's standard contractual clauses. For the notifications sent via Telegram there is no adequacy decision; we therefore limit them to pseudonymous identifiers.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)). Write to us to exercise them.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds or the processing serves legal claims.
You can lodge a complaint with a supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
Find the Difference is meant for players aged 13 and over. Players under 16 need the consent of a parent or guardian where processing is based on consent, such as personalized advertising.
We update this policy when the service or the law changes. The current version is always available on this page.