Last updated: 12 October 2026
1137Labs UG ("we", "us", "our") takes the protection of your personal data seriously. This policy explains what personal data we process when you play our mobile game Crate Combo (the "app") and when you visit cratecombo.com, why, on what legal basis, how long we keep it, and which rights you have under the EU General Data Protection Regulation (GDPR).
Sections 1–2 and 18–24 apply to both. Part A (sections 3–6) covers the website, Part B (sections 7–17) covers the app.
1137Labs UG (haftungsbeschränkt)
Im Knappengrund 17
63930 Neunkirchen
Germany
legal@1137labs.com
We are not legally required to appoint a data protection officer under Art. 37 GDPR. For all data protection matters, please contact us at legal@1137labs.com.
This website is hosted on Firebase Hosting, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Each time you visit, our hosting provider automatically processes technical access data ("server log files"), specifically:
Purpose: ensuring the technical operation, stability and security of the website, and defending against attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.
Retention: Hosting access logs are retained by Google for a short technical period (typically up to 30 days) and then deleted or fully anonymised.
Recipient / processor: Google Ireland Ltd. / Google LLC, on the basis of a data processing agreement under Art. 28 GDPR. See section 18 for the related third-country transfer.
If you contact us via the email address listed on this site (legal@1137labs.com), we receive the information you choose to send — typically your name, your email address, and the content of your message.
Purpose: to handle and respond to your inquiry.
Legal basis: Art. 6(1)(b) GDPR where your inquiry relates to a (pre-)contractual matter; Art. 6(1)(f) GDPR (legitimate interest in answering general inquiries) otherwise.
Retention: Email correspondence is retained only as long as necessary to resolve the matter and to comply with any applicable statutory retention obligations (e.g. § 257 HGB, § 147 AO — up to 6 or 10 years for tax-relevant correspondence), after which it is deleted.
Our business email is provided by Google Workspace (Google Ireland Ltd. / Google LLC) as a data processor under Art. 28 GDPR.
With your prior consent, we use Google Analytics, a service provided by Google Ireland Ltd. / Google LLC, to understand in aggregated form how visitors interact with this website. Google Analytics processes pages visited, approximate geographic region (country level), device and browser type, session duration, and identifiers stored in your browser (cookies and/or local storage). This data is personal data within the meaning of Art. 4 GDPR but is only used in aggregated form for usage analysis.
We have disabled Google signals and advertising personalisation, and Google Analytics 4 does not store IP addresses. The analytics script is only loaded after you click Accept; before that, no cookies are set and no data is sent to Google.
Purpose: aggregated usage analysis to improve the website.
Legal basis: Art. 6(1)(a) GDPR (your consent), in combination with § 25 Abs. 1 TDDDG (consent for storing/reading information on your terminal device).
Retention: Up to 14 months.
You can withdraw your consent at any time via the reset button on our Cookie Policy page. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We use a strictly necessary local-storage entry to remember your cookie-consent choice, and — only with your consent — analytics identifiers set by Google Analytics. A full list, including names, providers and storage durations, is in our Cookie Policy.
You can play Crate Combo without creating an account. To run the game we use the following providers:
All data is transmitted in encrypted form (TLS). We do not sell your personal data.
When you start the app for the first time, an anonymous game account is created automatically (Firebase Authentication). We store your game progress with it in Google Cloud Firestore, so that progress, coins, items and purchases are kept safe and can be restored.
Legal basis: Art. 6(1)(b) GDPR (providing the game you chose to use) and § 25 Abs. 2 Nr. 2 TDDDG (storage strictly necessary for the service).
Retention: until you delete your account (section 15).
You can link your game account to Google or Apple to use it on several devices. We then receive from the provider your account identifier, your email address (with Apple possibly a private relay address) and, if the provider shares it, your name. Signing in is voluntary.
Legal basis: Art. 6(1)(b) GDPR. Retention: until you sign out and delete your account, or delete your account.
Payments are handled entirely by Apple (App Store) or Google (Google Play); we never receive your payment details. After a purchase we receive the product, a transaction ID and the purchase receipt. Our server sends these to Apple or Google to check that the purchase is genuine and then credits the content to your game account.
Legal basis: Art. 6(1)(b) GDPR (delivering what you bought) and Art. 6(1)(f) GDPR (our legitimate interest in preventing fraud, e.g. the same purchase being credited twice).
Retention: with your game account. When you delete your account, we keep only the record that a transaction was already credited (transaction ID, product, date) so it cannot be credited a second time, for up to 10 years (statutory retention periods, § 147 AO / § 257 HGB), after which it is deleted.
The app downloads game settings (for example level rewards or prices) from Firebase Remote Config. For this, Google processes a Firebase installation ID, the app version, the device language and the country derived from your IP address. We use this to change the game without an update and to compare variants of the game.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating and improving the game) and § 25 Abs. 2 Nr. 2 TDDDG. Assigning you to a test variant based on analytics data only happens with your consent to analytics (section 14).
If the app crashes or a technical error occurs, Firebase Crashlytics sends a report: the error and where it happened in the code, device model, operating system and app version, a random installation identifier, the current level and the last technical log messages of the app. The report does not contain your user ID, name or email address.
Purpose: finding and fixing errors so the game runs reliably. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable app) and § 25 Abs. 2 Nr. 2 TDDDG. You can object at any time (section 19). Retention: 90 days.
Crate Combo is free and financed by advertising: short ads between levels and optional ads you can watch for a reward. Ads are delivered through Unity LevelPlay, which selects an ad from Unity Ads, ironSource Ads or Google AdMob. The ad networks process: your device's advertising ID (IDFA on iOS, Advertising ID on Android), IP address, device and app information (model, operating system, language, app version) and how you interact with ads (views, clicks, rewards).
Your choice: When you first start the app, a consent window (Google's consent tool, based on the IAB Transparency & Consent Framework) asks whether ads may be personalised and lists all partners. On iOS, Apple additionally asks whether the app may "track" you; your advertising ID (IDFA) is only accessed if you allow it.
You can change your choice at any time in the app under Settings → Privacy Settings. On iOS you can also change tracking permission in the device settings; on Android you can reset or delete your Advertising ID in the device settings.
The ad networks process data partly as independent controllers. Details are in their privacy policies: Unity (Unity Ads, LevelPlay, ironSource Ads), Google AdMob. Retention of the consent choice: on your device until you change it or delete the app.
A "Remove Ads" purchase switches off the ads shown between levels.
If you choose "Allow" when the app asks, we use Google Analytics for Firebase to understand how the game is played, for example which levels are too hard, and to evaluate changes. Processed: game events (e.g. level started, won or lost, items used, purchases, ad views), a random app-instance ID, device model, operating system, app version, language and approximate location (country/region, derived from the IP address). Analytics data is not linked to your name or email address. Google signals and data sharing for Google's own advertising purposes are switched off.
Legal basis: Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG (your consent). Without consent, no analytics data is collected. Retention: 14 months.
You can withdraw your consent at any time under Settings → Privacy Settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
You can delete your account at any time in the app under Settings → Delete Account. This permanently deletes your game account, cloud save and sign-in link (for Sign in with Apple, we also revoke the app's access with Apple). The only exception is the purchase record described in section 10. Crash reports and analytics data are not linked to your account and are deleted automatically after the periods stated above.
You can also email legal@1137labs.com. Please include your player ID (shown at the bottom of the Settings screen in the app) or, if you can no longer use the app, which sign-in (Google or Apple, with the email address) you used. We will delete your account and confirm it. Deleting the app alone does not delete your account. Step-by-step instructions: Delete your account.
Crate Combo is not directed at children under 13. If you are under 16, you may only consent to analytics or personalised ads with the permission of a parent or guardian (Art. 8 GDPR). If you believe a child has given us personal data without such permission, contact us and we will delete it.
The app stores on your device: your game save, your privacy choices (analytics and ad consent) and identifiers of the services above (Firebase installation ID, ad network identifiers). The storage needed to run the game is based on § 25 Abs. 2 Nr. 2 TDDDG; everything used for analytics or personalised ads only with your consent (§ 25 Abs. 1 TDDDG).
Google (website hosting, Firebase, AdMob) and Unity (LevelPlay, Unity Ads) may process data in the United States; ironSource may process data in Israel. Google LLC and Unity Technologies are certified under the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, C(2023) 4745), so transfers take place on the basis of Art. 45 GDPR. For Israel, an adequacy decision of the European Commission applies (Art. 45 GDPR). Where these do not cover a transfer, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) are used. You can request a copy of these safeguards at legal@1137labs.com.
You have the following rights regarding the personal data we process about you:
To exercise any of these rights, contact us at legal@1137labs.com.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the supervisory authority of the federal state in which our registered office is located: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). You may alternatively contact the supervisory authority of your habitual residence or place of work. A list of all German supervisory authorities is available at bfdi.bund.de.
You are not legally or contractually obliged to provide us with personal data. However, the app cannot save your progress or deliver purchases without the data described in sections 8 and 10, and we cannot respond to email inquiries without an email address.
We do not use automated decision-making within the meaning of Art. 22 GDPR. If you consent to personalised ads, the ad networks create interest-based profiles to select ads (section 13); this has no legal or similarly significant effect on you.
We may update this policy when our services, technical infrastructure or legal requirements change. The current version is always available on this page.
Questions? Reach us at legal@1137labs.com.