Lock&Loot – Privacy Policy

1. Introduction

This Privacy Policy explains how Lock&Loot (“the App”) handles your data. Lock&Loot is a multiplayer base-building game where progress comes from not using your phone: while your screen is off, your base produces resources.

Summary: The App contains no ads, no tracking services, and no analytics SDKs. Playing requires signing in with your Google account; your game state is stored on Google Firebase servers in the EU (Frankfurt). The App never reads which apps you use.

2. Data Controller

For the purposes of the General Data Protection Regulation (GDPR), the data controller is the developer and publisher of Lock&Loot.

Contact: pascalnuescheler@gmail.com

3. What the App Does

Lock&Loot measures how long your device's screen has been off and converts that time into game progress (resources for your base). You can attack other players, trade with them, and write in the in-game chat. Game logic is computed on the server to prevent cheating.

4. Data We Process

a) Account (Firebase Authentication)

Playing requires signing in with your Google account. Your game state is tied to that account, which lets it survive device changes and reinstalls.
In doing so, an identifier for your Google account and your email address are stored with Firebase Authentication. Your email address is not visible to other players — they only see the player name you chose.
We receive no further access to your Google account (no contacts, no emails, no password).

b) Game data (Cloud Firestore)

Your freely chosen player name (it does not have to be your real name and is visible to other players).
Your game state: base, buildings, resources, troops, research.
Battle and trade data: attacks, battle results, transfers between players. Battle reports are deleted automatically after 30 days, transfer records after 31 days.

c) Chat messages

Messages you write in the in-game chat are stored on the server together with your player name and are visible to other players. Please do not share personal information (such as your address or phone number) in chat.

d) Screen state (local, on your device)

Through the Android Usage Access permission, the App reads only screen events: screen on/off, device locked/unlocked, and device restarts, each with a timestamp.
The App does not read which apps you use. Raw screen events stay on your device; only the game progress computed from them (e.g. produced resources) is sent to the server.

e) Technical data

When connecting to Firebase servers, Google processes technically necessary data such as your IP address to establish and secure the connection.

Legal basis: Processing is carried out to provide the game (Art. 6(1)(b) GDPR) and based on our legitimate interest in secure, cheat-free gameplay (Art. 6(1)(f) GDPR).

5. Usage Access Permission

Lock&Loot requires the Android Usage Access permission to detect when the screen was turned off and on again. This is the core mechanic of the game: it is the only way the App can reward you for putting your phone away.

Only screen, lock, and restart events with timestamps are read.
The App does not record which apps you open or how you use your device.
This data is not used for advertising, not sold, and not shared with third parties.

You can revoke the permission at any time in Android system settings. The game will then no longer be able to measure screen-off time, so the core mechanic will stop working.

6. Storage Location and Retention

Your game state is stored with Google Firebase (Cloud Firestore and Firebase Authentication). The server location is Frankfurt, Germany (region europe-west3), within the EU. Google acts as a data processor. More information: Firebase Privacy and Security and Google Privacy Policy.

Game state and account: stored for as long as your account exists.
Battle reports: automatically deleted 30 days after the battle.
Transfer records: automatically deleted 31 days after the transaction.
Local data (settings, screen events, cached game state) lives on your device and can be removed at any time via Android settings (“Clear storage”) or by uninstalling the App.

7. No Ads, No Tracking, No Data Sales

The App contains no advertising SDKs and shows no ads.
There are no analytics or tracking services built in (no Google Analytics, no Crashlytics, or similar).
Your data is never sold and never shared for advertising purposes.
The only recipients of your data are the Google Firebase services listed above, acting as a technical service provider.

8. App Permissions at a Glance

Internet (INTERNET): connection to the game servers (Firebase) for account, game state, battles, and chat.
Usage Access (PACKAGE_USAGE_STATS): detecting screen on/off events for the game mechanic (see Section 5).

9. Data Security

Connections to the servers are encrypted (TLS). Access to game data is protected by server-side security rules, and game-critical calculations happen on the server. No software can guarantee absolute security, but we limit data processing to what the game actually needs.

10. Children's Privacy

Lock&Loot is not intended for children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has provided personal data to us, please contact us using the details below.

12. Policy Updates

We may update this Privacy Policy when the App, legal requirements, or our practices change. The “Last updated” date at the top of this page always reflects the current version.

13. Contact

If you have questions about this Privacy Policy or privacy in Lock&Loot:

Email: pascalnuescheler@gmail.com