For the mobile app Scary Maze on Android and iOS · Last updated: 3 October 2026
In short
We do not ask for your name, your email address or any account. What you make in the app — your photo, your recorded scream, the videos of a reaction — stays on your device. We never receive it.
The app shows advertising from Google AdMob and, to improve the game, sends usage statistics and crash reports to Google Firebase. In the European Economic Area, the United Kingdom and Switzerland you are asked first, nothing is sent before you answer, and you can change your answer at any time in the app's settings.
The optional Prank pack is bought through Google Play or the App Store. We receive no payment details.
The controller for the processing described here, within the meaning of Article 4(7) GDPR, is:
Rillich GmbH
Nobelring 56
04420 Markranstädt
Germany
Email: info@scarymaze.app
If you have any question about this policy or about your data, that email address reaches us directly.
This reflects app version 8.4 on Android and 1.4 on iOS. Older versions are covered in section 13.
| Android | iOS | |
|---|---|---|
| Advertising | Google AdMob — none after buying the Prank pack | Google AdMob — none after buying the Prank pack |
| Usage statistics | Google Analytics for Firebase, after consent where required | Google Analytics for Firebase, after consent where required |
| Crash reports | Firebase Crashlytics, after consent where required | Firebase Crashlytics, after consent where required |
| User accounts or sign-in | None | None |
| In-app purchases | Prank pack, through Google Play | Prank pack, through the App Store |
| Advertising identifier | Used with your consent | Only if you allow tracking |
| App Tracking Transparency prompt | — | Shown once, after the consent dialog; not to buyers of the pack |
| Camera | Only for your own photo and the reaction video, if you allow it — stays on the device | Only for your own photo and the reaction video, if you allow it — stays on the device |
| Microphone | Only for your own scream and the sound of the reaction video, if you allow it — stays on the device | Only for your own scream and the sound of the reaction video, if you allow it — stays on the device |
| Photos | System photo picker, no access to the library; a video is saved to the gallery only when you tap Save (Android 7–9 ask for storage access for that) | System photo picker, no access to the library; adding a video to Photos only when you tap Save |
| Contacts, location permission | Never requested | Never requested |
| Data sent to us, the developer | Pseudonymous usage statistics and crash reports, through Firebase | Pseudonymous usage statistics and crash reports, through Firebase |
We never learn your name or contact details. The statistics and crash reports we see are tied to a random identifier that Firebase creates for the installation, not to you, and we cannot tell who plays this game.
The app keeps the following using the operating system's own storage (SharedPreferences and
app files on Android, NSUserDefaults and app files on iOS):
None of this is transmitted to us, and we have no access to it. Deleting the app deletes it. Your device's own backup (Google or iCloud, under your account) may include the settings and your prank; reaction videos are excluded from backups.
When you set up a prank, you can take a photo with the camera or pick one, and record your own scream with the microphone. The photo picker hands the app only the photo you choose. Photo and recording are stored only in the app's own storage on your device and used only for the scare.
If you switch it on — on the first-launch screen or under Set up a prank → Film the reaction — and allow the camera, the front camera films during the levels in which a scare can come. The microphone is used for the sound only if you allow it too. The app keeps about three seconds before the scare and five seconds after it; everything else is deleted as soon as the recording ends, and a recording without a scare is deleted entirely. While the camera records, iOS and Android 12 or later show their camera indicator, and on iOS the app also shows a red REC in the corner. Nothing is filmed while filming is switched off, and the app never asks for these permissions during a level.
The video is shown first to the person who was filmed, on the Got you! screen, with a button to delete it. Kept videos are stored only in the app's own storage, excluded from backups, and only the 20 most recent are kept. We have no server for them and never receive them.
A video leaves the device only when you tap Share — through the system's share sheet, to the app and the people you choose, whose own privacy policies then apply — or Save, which puts a copy in your photos or gallery. Before the first share, the app reminds you to share a video only if the person in it agrees.
If you film someone else, respecting their rights is your responsibility; in particular, share a video of a person only with their consent. You can withdraw the camera and microphone permissions at any time in your device's settings.
The usage statistics (section 6) only record that a level was filmed, whether a video has sound, and whether it was shared, saved or deleted — never an image, a video or a sound.
The game is financed by advertising. We use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on Android and iOS. The app shows a banner in the menu, an occasional full-screen ad between levels, and an optional rewarded video that you can choose to watch to save your own prank. Buying the Prank pack removes all advertising: the advertising SDK is then not started at all.
To select and deliver an ad, and to measure it, Google may process:
We do not receive any of this data ourselves. We see only aggregate reporting in the AdMob console: how many ads were shown, and what they earned.
Storing and reading information on your device for advertising purposes, and the processing of your data for personalised advertising, take place solely on the basis of your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG (formerly TTDSG). You give that consent in the dialog shown when you first start the app, and on iOS additionally in Apple's tracking prompt. You may withdraw it at any time with effect for the future; see section 7.
If you do not consent, the app still shows ads, but Google serves them without personalisation and, where you refused storage on your device, as limited ads without reading or storing identifiers on your device. These ads rest on our legitimate interest in financing a free game (Article 6(1)(f) GDPR).
We limit the advertising served in this app to a maximum content rating of T (teen). Advertising rated for mature audiences is excluded.
To find out where players get stuck, what fails and which parts of the game are used, the app uses Google Analytics for Firebase and Firebase Crashlytics, services of Google Ireland Limited. Google processes this data on our behalf under the Firebase data processing terms.
In the European Economic Area, the United Kingdom and Switzerland, Firebase is not even started until you agree in the consent dialog. What happens in the app before your answer waits on the device; if you decline, it is discarded and nothing is sent. Crash reports held back are deleted when you withdraw your consent. Where the law does not require consent, the dialog does not appear and the statistics are collected from the first start.
We collect no name, email address, photo, recording, video, contact or precise location, and assign no user ID.
Your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Google Analytics keeps event data for at most 14 months, and Crashlytics keeps crash reports for 90 days. For our own analysis we copy the statistics into a database in our Firebase project at Google (BigQuery) and delete those copies after at most 14 months as well.
Consent is obtained through Google's User Messaging Platform, a consent management platform certified by Google and built on the IAB Transparency & Consent Framework. The same answer covers advertising and the usage statistics.
You can review or withdraw your choice at any time: open Settings in the app and choose the privacy options entry. The same dialog appears again, and your new answer takes effect immediately. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
Independently of this, you can reset or delete your advertising identifier, or withdraw tracking, in your device settings:
The Prank pack is a one-time purchase that unlocks your own pranks and removes the advertising. It is bought and paid for entirely through Google Play or Apple's App Store, under their terms and privacy policies. We receive no payment or card details, and no name or email address — only the store's confirmation that the pack is owned, which the app keeps on the device. With your consent the usage statistics record the purchase, with product and price.
Google's own privacy documents:
We do not sell data, and we pass nothing to anyone else.
Google and Apple may process data outside the European Economic Area, in particular in the United States. They rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses as the basis for those transfers. Details are set out in their privacy policies.
Usage statistics are kept for at most 14 months and crash reports for 90 days (section 6). Everything held on your device remains until you delete it in the app, clear the app's data or uninstall it. Retention periods for advertising data processed by Google are governed by Google's own policies.
Under the GDPR you have the right to access your data (Art. 15), to have it rectified (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20), and to object to processing (Art. 21). Where processing rests on consent, you may withdraw that consent at any time (Art. 7(3)).
The statistics and crash reports are tied only to a random installation identifier that we cannot link to you, so we are generally unable to find your data from a request (Art. 11 GDPR). Withdrawing your consent in the app's settings stops all further collection, and uninstalling the app discards the identifier. For advertising data processed by Google, please address your request to Google using the links in section 9.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us, by virtue of our registered office in Saxony, is:
Die Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 5, 01067 Dresden, Germany
datenschutz.sachsen.de
You may equally complain to the supervisory authority of the EU member state where you live or work.
Updating the app brings it to the state this policy describes.
This app contains sudden frightening images and loud sound, and is not directed at children. It is not a child-directed service within the meaning of Article 8 GDPR or the US Children's Online Privacy Protection Act, and we do not knowingly process data from children. Advertising served in the app is limited to a maximum content rating of T (teen), as described in section 5.
We update this policy when the app changes. The date at the top always shows the current version. If a change materially affects how your data is processed, we will ask for your consent again where the law requires it.
Questions about this policy, or about your data: info@scarymaze.app