Privacy Policy for PopcornMan

1. Controller

The German version is authoritative; this is a translation for convenience. This website itself is covered by the general privacy policy.

2. In short

PopcornMan is an endless runner for iPhone. You play without an account. The game uses online services for three things: the daily leaderboard, ads and the “Remove Ads” purchase.

3. What data is processed

3.1 On your device only

Progress, kernels, unlocked skins, items and gadgets, settings and your profile as long as you are not in the top 3: a profile picture you choose is cropped and stored on the device. At first only a checksum goes to the server (a fingerprint of the file from which the picture cannot be recovered). Notifications (reminders of the daily level) are scheduled by the device itself; there are no server push notifications. Your consent to a public profile (3.3), the result of the age check (3.7) and the list of players you blocked (3.3) also stay on the device.

3.2 Leaderboard and game statistics (our server)

• The random player ID
• For every run that goes on the leaderboard: score, distance in metres, the date of the daily level and a technical random number of the level (seed)
• Your social handle (platform and name, e.g. Instagram or TikTok), which also serves as your display name – only if you agreed to a public profile (3.3). It is then sent with every run but shown only when you are in the top 3 and have passed the check. Without that agreement your run goes on the leaderboard without a name, as “Popcorn Rookie”
• Your profile picture, only once you reach the top 3. Only then does the server ask for the picture (JPEG, 256 × 256 pixels, at most 200 KB). Approved pictures are kept in public storage so the leaderboard can show them. This, too, only with your agreement to a public profile
• With every leaderboard entry the server sends a short code. It is derived from the player ID but does not reveal it, and only lets your device recognise a blocked player even after a name change
• Reports you send about an entry: which entry, from which player ID, and a one-way hash of your IP address (we do not store the IP address itself for this). This lets us count reports from different networks so the report button cannot be abused
• Game statistics: events such as session start (with app version and game language), start and end of a run (score, distance, duration, cause of the game over), boss fights, continues, opened chests, purchases with in-game currency, ads shown and the “Remove Ads” purchase. We use them to balance the game and find bugs, not for advertising

Not processed: precise location, contacts, calendar, your photo library (you pick a single picture through the system picker; the app gets no access to your other photos), email address, phone number, payment details.

3.3 Checking names and profile pictures (top 3 only)

To keep the public leaderboard free of offensive content, we check names, social handles and profile pictures automatically, and only for entries that make the top 3. There is no manual moderation.

We ask first: Before you save a social handle or profile picture for the first time, the game explains that both are shown publicly and checked beforehand by the services below, and asks for your agreement. Without it, handle and picture do not leave the device. You can withdraw at any time under “Profile” → “Edit profile” → “Remove”.

• OpenAI (OpenAI Ireland Ltd., Dublin; OpenAI, L.L.C., USA): name, handle and profile picture are checked through the moderation API for insulting, sexual or otherwise offensive content. Only the content itself is sent, no player ID
• Serper (serper.dev): for a social handle, we search the public web for the account to tell whether it is an adult account. Only the search query with platform and handle is sent

We keep the result (approved or rejected, with a reason) for 30 days so the same name is not checked again. Rejected content is not shown and rejected pictures are not stored; you can enter another name or picture right away in the app. If three players from different networks report the same entry, its handle and picture are hidden automatically.

Report and block: Reporting an entry also blocks the player on your own device: their name, handle and picture are no longer shown there, even offline. The list of blocked players stays on your device; you can unblock players one by one in the leaderboard, or all at once under “Profile”.

3.4 Corn price for the daily level

The daily level depends, among other things, on the corn futures price. Your device fetches it directly from Yahoo Finance (query1.finance.yahoo.com). Like any server, Yahoo sees your IP address; no game data is sent.

3.5 Advertising

PopcornMan shows video ads (optional, e.g. to continue) and ads before a new run. They are served through Unity LevelPlay (Unity Technologies and its subsidiary ironSource) and Google AdMob (Google Ireland Limited, Dublin; Google LLC, USA). When an ad is requested, these services collect data themselves, in particular IP address, device type, operating system, language, the device’s advertising ID, ad events (shown, tapped, watched to the end) and diagnostics of their libraries.

• Consent in the EEA, the UK and Switzerland: before the first ad, the game asks through Google’s consent platform (User Messaging Platform, Google Ireland Limited) which purposes and ad partners you allow. Your choice is stored on the device as an IAB TCF string and passed to the ad services. You can change it at any time in the game under “Profile” → “Privacy”
• Advertising ID (IDFA) only with your permission: on first launch iOS asks whether PopcornMan may “track your activity across other companies’ apps and websites”. Only if you allow it do the ad services receive the IDFA and may show personalised ads. Otherwise they only see an ID that is the same for all apps of this developer on your device (IDFV) and show non-personalised ads. You can change your choice at any time under Settings → Privacy & Security → Tracking
• The ad services are controllers for their own processing; their privacy policies apply: Unity, Google
• Where data reaches the USA, Unity and Google rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses

With the “Remove Ads” purchase the game shows no more ads: the ads before a run are gone, and bonuses such as continuing or doubling your kernels come without a video.

3.6 Purchases

The “Remove Ads” purchase runs entirely through the App Store; we receive no payment details and no name. Apple is a separate controller for the purchase and payment. On our server, the game statistics only note that the purchase happened.

3.7 Age check

Public profiles are available from age 13. Before you create a public profile, the game asks for your age range through Apple’s “Declared Age Range” interface on iOS 26. iOS shows its own sheet; you or your parents decide whether to share the range. The game never learns a date of birth, only a range such as “13 to 15” or “18 and over”. If the check is not available or you decline, you confirm yourself that you are at least 13. The result stays on the device and is not sent to us. Under 13, the game stores no public profile and opens no links to social networks.

3.8 Links to social profiles

When you tap an underlined name in the leaderboard, the game asks whether you want to open the profile on that platform (Instagram, TikTok, YouTube, Twitch or X). Only after you confirm does iOS open the page in the browser or the platform’s app. Like any page visit, the platform receives your IP address, among other things; it is responsible for everything after that, and its privacy policy applies. We pass on no data from the game.

4. Where the data is stored

The leaderboard, profile pictures, reports and game statistics are stored with Supabase (Supabase Inc.) in region eu-central-1 (Frankfurt am Main, Germany). Supabase processes the data on our behalf (Art. 28 GDPR). Like any server, Supabase logs requests briefly, including the IP address, to detect faults and abuse. We do not sell data.

5. Legal bases

• Leaderboard, checks of top-3 entries, reports and purchases: Art. 6 (1)(b) GDPR (providing the game you use) and Art. 6(1)(f) GDPR (legitimate interest in a leaderboard without offensive content)
• Social handle, display name and profile picture, including their check by OpenAI and Serper: Art. 6(1)(a) GDPR (your consent in the game; optional and revocable at any time by removing the profile)
• Game statistics: Art. 6(1)(f) GDPR (legitimate interest in a bug-free, fairly balanced game)
• Personalised ads, and storing or reading information on the device for advertising: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent in the consent dialog or the iOS prompt). Non-personalised ads: Art. 6(1)(f) GDPR (funding the free game)

6. How long data is kept

Our server deletes automatically every night:

• Daily leaderboard entries: 90 days after the day
• All-time leaderboard entries: after 12 months without a new run
• Game statistics: after 13 months
• Profile pictures: once no entry points to them, at the latest 12 months after your last run
• Check results for names and pictures: after 30 days
• Reports: after 12 months

The ad services keep data according to their own periods; see their privacy policies (section 3.5).

7. Deleting and changing

Change or remove your name, social handle and profile picture in the game under “Profile”; the next run uses the new state. If you delete the app, your entries stay on the server until the periods in section 6 run out.

Delete everything right away: in the game under “Profile” → “Delete my data”. Our server then deletes everything under your player ID: leaderboard entries, name, social handle, profile picture, reports and game statistics. On the device, name, handle and picture are removed and the game gets a new player ID that is not linked to the old one. Progress, kernels and purchases stay.

If you have already deleted the game, email us at hi@turbobarn.com. Since there are no accounts, please tell us how we can recognise your entries: your display name or social handle and roughly on which days you played.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR), in particular to processing based on legitimate interests. You can withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority. Ours is:

9. Children and teenagers

PopcornMan is not directed at children. Only players aged 16 or over should enter a social handle or profile picture for the public leaderboard; younger players only with their parents’ permission. Under 13, the game allows no public profile and no links to social networks (3.7).

10. Changes

If what the game processes changes, we update this policy before, not after. The date at the top shows the current version.