Orkato privacy policy
Last updated: 3 November 2026
1. Summary
- Orkato needs no account. The provider runs no server: saved games, records, the gallery, and settings stay on your iPhone.
- Game Center, iCloud, and purchases are handled by Apple.
- Without the Full Version, Orkato shows ads from Google. The game requests only non-personalized ads. In the European Economic Area (EEA), the United Kingdom, and Switzerland, it asks for your consent first.
- With the Full Version, the game requests no ads.
- Orkato does not track you across apps and websites owned by other companies.
2. Controller
The controller for the Orkato app and this website is:
Justin Reifenrath, Nußbaumallee 16, 50169 Kerpen, Germany
Email: privacy@jstnd.com
Full details are in the legal notice.
3. Data in the app
3.1 On your iPhone
Orkato stores saved games, runs in progress, records, the gallery, Daily Tower attempts, settings, and your purchase status only in the app’s storage on your iPhone. The provider does not receive this data. If you use device backups (iCloud Backup or a Mac), they include it. When you delete the app, iOS deletes this data.
3.2 iCloud (Daily Tower)
So that only one ranked attempt counts per day, even across devices, Orkato stores a few entries in the iCloud key-value storage of your iCloud account: the day number, the state of the attempt, its start time in UTC, and a random installation token with no link to you or your device. Apple stores and syncs these entries. The provider has no access to them. Without iCloud, they stay on your iPhone only.
3.3 Game Center (optional)
If you are signed in to Game Center, Orkato sends scores, achievements, and Daily Tower results to Apple. Other players see your Game Center name and scores on leaderboards, depending on your Game Center settings. Challenges between friends use your Game Center friends. For this, the app receives from Apple your nickname, your avatar, and Game Center identifiers, as well as other players’ leaderboard entries, and your friends list only with your permission. It uses this information only on the device; the provider does not store it. Game Center is an Apple service, and Apple’s privacy policy applies (Game Center & Privacy).
3.4 Purchases
You buy the Full Version through the App Store. Apple handles the payment; the provider receives no payment details. The app checks Apple’s signed purchase confirmation on the device and stores your purchase status locally. The provider receives only aggregated sales figures from Apple, with no details about you.
3.5 Analytics and crash data through Apple
If you allowed sharing analytics with app developers in iOS Settings, Apple provides the provider with aggregated usage statistics and crash reports. This data does not identify you. Without your permission, there is none. You can change this under Settings › Privacy & Security › Analytics & Improvements › Share With App Developers (App Analytics & Privacy).
3.6 Reminders
Daily Tower reminders are notifications that your iPhone schedules itself. They appear only if you allowed notifications. No data is transferred.
3.7 Sharing clips and images
Clips and images are created on your iPhone. They leave it only if you send them to recipients of your choice through the iOS share sheet.
3.8 Ads (Google AdMob)
When: only without the Full Version. Banners appear only in the gallery and in settings, never during a run. Video ads play only when you start them.
Provider: Ads are delivered by Google through the Google Mobile Ads SDK (AdMob): for users in the EEA and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, otherwise by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is an independent controller for this processing.
What data: To deliver and measure ads and to prevent abuse, Google states that it may process, among other things: your IP address (used to estimate your approximate location), device or app identifiers (an app- or developer-scoped identifier; the advertising identifier only with your permission to track, which the game does not request), advertising data (which ads you saw), interactions with the app (such as app launches and video views), and crash logs and performance data (such as launch time and hangs).
Non-personalized ads only: Orkato requests only non-personalized ads everywhere. They are not based on a profile of your interests but, for example, on your approximate location and the app’s content. Even then, Google uses data and may store or read identifiers on your device to limit how often an ad appears, for aggregated reporting, and to prevent fraud. Where the law requires it, this happens only with your consent. All ads are rated for all ages (rating G). Sensitive data is never used for ads.
Check at launch: Each time the app starts, it asks Google whether consent is required in your region. Google receives your IP address and technical details about the app.
Equivalent protection: Google processes the data under its own privacy policy and terms for advertising services. They provide protection of your data equivalent to that described in this policy.
Consent (EEA, United Kingdom, Switzerland): Before the game requests any ads, it shows you Google’s consent form, no earlier than on the result card in your second session. “Consent” and “Do not consent” are offered equally. Without consent, Google shows only limited ads: no personalization and no identifiers on your device. Google still uses the IP address to deliver them, and local storage only to prevent invalid traffic. You can change or withdraw your choice at any time under Settings › Privacy › Ad privacy choices; withdrawal applies from then on.
US states: For users in US states with their own privacy laws, the game shows Google’s privacy notices with an option to opt out where required; the row Settings › Privacy › Ad privacy choices then appears as well.
No tracking: The game shows no App Tracking Transparency prompt and does not request the advertising identifier (IDFA). Without your permission in that prompt, Google’s SDK does not receive the IDFA either (Google, IDFA message, https://developers.google.com/admob/ios/privacy/idfa, abgerufen 5.10.2026).
More: in the app under Settings › Privacy › Why am I seeing ads?, at Google under How Google uses data in its advertising services, in Google’s privacy policy, and at How Google uses information from sites or apps that use its services.
Report an ad: Settings › Privacy › Report an ad opens a prepared email to the provider. It contains only the name of the ad network and the identifier of the last ad shown. You decide whether to send it (see 5).
3.9 Test versions
For test versions through TestFlight, the information in the test invitation also applies. For the questionnaires about the test, the privacy notice in each questionnaire applies.
4. This website
The website runs on a rented server from Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. The server is located in a data center in Frankfurt am Main, Germany. When you visit, it processes your IP address and your browser’s request to send you the page. It keeps no log of visits. Only when a technical error occurs does it write an entry to an error log: the date and time, the request (for example the page requested and the referring page), and the error message. Your IP address is masked in it beforehand. This serves to deliver the website and keep it secure. The entries are deleted after 7 days at the latest. A data processing agreement is in place with Hostinger (an annex to Hostinger’s terms of service). The website sets no cookies, uses no analytics tools, and loads no content, fonts, or scripts from other servers.
5. Contacting by email or phone
If you write to the provider (support or “Report an ad”), the provider processes your email address, your name if given, and the content to reply. The mailbox is hosted by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates (Geneva), Switzerland. Emails are deleted once the request is resolved, unless a legal retention duty applies. If you call or leave a voicemail, the provider processes your phone number, if it is transmitted, and your message to call you back. The voicemail is hosted by the mobile carrier of the phone number. Messages are deleted once the request is resolved.
6. Legal bases
- Game features you use (storage on the device, iCloud, Game Center): Art. 6(1)(b) GDPR.
- Purchases: Art. 6(1)(b) GDPR.
- Ads: your consent (Art. 6(1)(a) GDPR; for access to your device, Section 25(1) of the German TDDDG) where required; otherwise the legitimate interest in funding the free version (Art. 6(1)(f) GDPR).
- Analytics and crash data through Apple: your permission in iOS Settings and the legitimate interest in an app without errors (Art. 6(1)(a) and (f) GDPR).
- Delivering the website and the error log: legitimate interest in secure and working operation (Art. 6(1)(f) GDPR).
- Emails and calls: Art. 6(1)(b) and (f) GDPR.
You are not required to provide any data. Without Game Center there are no leaderboards, without iCloud no Daily Tower sync between devices, and without consent only limited ads; you can still play. There is no automated individual decision-making, including profiling (Art. 22 GDPR).
7. Recipients and transfers to third countries
Recipients are Apple (Game Center, iCloud, App Store, analytics), Google (ads), Hostinger as the website host, Proton for the mailbox, and the mobile carrier of the phone number for the voicemail. Apple and Google also process data in the United States. Google participates in the EU-US Data Privacy Framework, so the European Commission’s adequacy decision applies. Apple transfers data from the EEA under standard contractual clauses. Proton is based in Switzerland, for which the European Commission has issued an adequacy decision. The website runs on the server in Frankfurt; for any transfer outside the EEA, the agreement with Hostinger provides for EU standard contractual clauses.
8. Retention and deletion
- Data on your iPhone: until you delete the app.
- iCloud key-value entries: in your iCloud account until you delete them through Apple’s iCloud storage management.
- Game Center, App Store, and analytics: under Apple’s rules.
- Ad data: under Google’s rules.
- Website error log (without IP addresses): at most 7 days; there is no log of visits.
- Emails and voicemails: until the request is resolved, unless a legal retention duty applies.
9. Children
Orkato is not directed at children and does not ask for age. Ads are limited to content rated for all ages (rating G) and are never personalized.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). To exercise them, write to privacy@jstnd.com.
Right to object (Art. 21 GDPR): Where processing is based on legitimate interests (Art. 6(1)(f)), such as delivering the website and its error log, you can object at any time on grounds relating to your particular situation.
You can withdraw consent at any time with effect for the future (Art. 7(3)); for ads, directly in the app. You can lodge a complaint with a data protection supervisory authority (Art. 77), for example in your country or with the authority responsible for the provider, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
Apart from emails and voicemails, the provider holds hardly any data about you, because the app works without a server. For data held by Apple or Google, you can also contact those companies directly.
11. Changes
If the app or the website changes, this policy will be updated. The version on this page, with the date above, applies.