1. Who is responsible
Home Quest is developed and published by codeSTREAM. For the purposes of the EU General Data Protection Regulation (GDPR) and comparable laws, the controller of your personal data is:
codeSTREAMJan Gressmann
Schilfgrund 3
22848 Norderstedt, Germany
info@codestream.de
We are a small independent studio and are not required to appoint a data protection officer. Privacy requests are handled directly by the controller named above.
2. What this policy covers
This policy applies to the Home Quest mobile game for iOS and Android (the "Game"), to the game services we operate for it (accounts, cloud saves, leaderboards), and to this website. It explains what personal data we collect, why, how long we keep it, who we share it with, and what rights you have.
It does not cover the practices of Apple, Google, or other third parties whose own services you use alongside the Game. Their policies are linked in section 5.
3. What data we collect
We keep the data we collect to a minimum. Home Quest can be played without providing your name, email address, or any other contact detail.
3.1 Game account and progress
When you play, the Game creates a player account so that your progress can be saved and restored. This includes:
- A randomly generated player ID that identifies your account.
- Your chosen in-game display name, if you set one.
- Your game state: settlements, buildings, resources, army, story progress, unlocks, settings, and similar gameplay data.
- Timestamps such as when the account was created and last played.
If you sign in with an Apple or Google account to link your progress across devices, we receive an account identifier from that provider. We do not receive your password. Depending on the provider and your choices, we may also receive an email address, which we use only to identify your account and to help you recover it.
3.2 Leaderboards and other players
Home Quest offers leaderboards and realm rankings. If you take part, your display name and score are visible to other players. Please choose a display name that does not reveal personal information you would not want to be public.
3.3 Purchases
Optional in-app purchases are processed entirely by the Apple App Store or Google Play. We do not receive or store your payment card details. To deliver what you bought, restore purchases, and prevent fraud, we receive and store a purchase receipt or token from the store, the product identifier, and the time of purchase.
3.4 Device and technical data
When the Game communicates with our servers, we process technical data that is needed to run the service and keep it secure:
- Device type and model, operating system and version, app version, and language setting.
- Your IP address, which is stored temporarily in server logs.
- Error and crash reports, which may contain the state of the Game at the time of the error but do not contain your name or contact details.
3.5 Support requests
If you contact us by email, we process your email address, the content of your message, and any information you choose to include, such as your player ID or screenshots.
3.6 What we do not collect
- We do not use advertising networks or advertising identifiers (IDFA / GAID).
- We do not track you across other apps or websites.
- We do not collect your location, contacts, photos, or microphone audio.
- We do not build marketing profiles or sell personal data.
4. Why we use it and on what legal basis
Under the GDPR we need a legal basis for each use of personal data. The table below summarizes what we do and why.
| Purpose | Data used | Legal basis |
|---|---|---|
| Running the Game, saving and restoring your progress, syncing across devices | Account and progress data, device data | Performance of a contract (Art. 6(1)(b) GDPR) |
| Delivering and restoring in-app purchases | Purchase receipts, product identifiers, player ID | Performance of a contract (Art. 6(1)(b) GDPR) |
| Leaderboards and realm rankings | Display name, score, player ID | Performance of a contract (Art. 6(1)(b) GDPR) |
| Keeping the service secure and preventing cheating, fraud, and abuse | IP address, device data, account data, purchase data | Legitimate interest (Art. 6(1)(f) GDPR) in operating a safe and fair service |
| Finding and fixing bugs, improving stability | Error and crash reports, device data | Legitimate interest (Art. 6(1)(f) GDPR) in a working product |
| Answering support requests | Email address, message content, player ID | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Sending the newsletter you subscribed to | Email address | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Keeping accounting records | Purchase data | Legal obligation (Art. 6(1)(c) GDPR) under German tax and commercial law |
We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.
5. Who we share it with
We share personal data only with the service providers we need to run the Game, and only to the extent needed. We do not sell personal data.
- Apple and Google. They distribute the Game, process in-app purchases, and, if you use it, provide sign-in. They act as independent controllers for these services. See the Apple Privacy Policy and the Google Privacy Policy.
- Hosting and infrastructure providers. Our game servers and databases run on infrastructure operated by hosting providers under data processing agreements. They may only process data on our instructions.
- Email and newsletter services. Support email is handled by our email provider. The optional newsletter on this website is delivered through Mailchimp (Intuit Inc.). See the Intuit Privacy Statement.
- Authorities. We may disclose data if required by law, a court order, or to protect our rights or the safety of players.
- Business transfer. If codeSTREAM or the Game were sold or merged, player data would be transferred to the new owner under the same commitments made in this policy.
6. International transfers
We are based in Germany and aim to keep player data within the European Economic Area. Some providers listed above, in particular Apple, Google, and Mailchimp, may process data in the United States or other countries. Where that happens, transfers are protected by an adequacy decision of the European Commission, such as the EU‑US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and progress data | For as long as your account exists. After you request deletion, the account and its data are removed within 30 days. |
| Leaderboard entries | Removed together with the account. |
| Purchase records | Kept for the retention periods required by German tax and commercial law, currently up to ten years, in a form that no longer allows the game account to be identified where possible. |
| Server logs with IP addresses | Deleted or anonymized after no more than 30 days, unless needed longer to investigate a specific security incident. |
| Error and crash reports | Up to 12 months. |
| Support emails | Up to 24 months after the request is resolved, so that we can refer back to earlier conversations. |
| Newsletter subscription | Until you unsubscribe. |
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of inaccurate data.
- Erasure of your data, subject to legal retention obligations.
- Restriction of processing in certain circumstances.
- Data portability, meaning a copy of the data you provided in a machine-readable format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time where processing is based on consent, without affecting processing that took place before the withdrawal.
To exercise any of these rights, email info@codestream.de. Please include your player ID, which you can find in the Game's profile settings, so that we can locate your account. We will respond within one month. We may ask for additional information to confirm that the request comes from the account holder.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (datenschutzzentrum.de). You may also contact the authority in your own EU member state.
If you live in California or another jurisdiction with its own privacy law, you have comparable rights to know, delete, and correct your data and to opt out of the sale or sharing of personal information. We do not sell or share personal information for advertising and we do not discriminate against you for exercising your rights. Use the same contact address above.
9. Deleting your account
You can delete your Home Quest account directly in the Game:
- Open your profile page and tap Settings.
- Tap Account Settings.
- Tap Delete Account and confirm.
The account and all associated progress are deleted within 30 days. Deleted accounts cannot be recovered. A step-by-step guide with screenshots is available at Delete your Home Quest account. If you no longer have access to the Game, you can also request deletion by email.
Purchase records that we must keep under tax law are retained separately from the deleted account, as described in section 7.
10. Security
We protect your data with technical and organizational measures that are appropriate to the risk. Communication between the Game and our servers is encrypted using TLS. Access to game servers and databases is restricted to what is needed to operate the service, and purchase verification is performed server-side. No system is perfectly secure, so we cannot guarantee absolute security, but we will inform you and the competent authority of a data breach where the law requires it.
11. This website
This website (homequest.app and the Home Quest pages on codestream.de) is a static site. It does not use cookies for tracking and does not use analytics services.
Server logs
Our web server records technical access data such as your IP address, the page requested, the time of the request, the referring page, and your browser type. We use these logs only to keep the site running and secure. They are deleted or anonymized after no more than 30 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Web fonts
The site loads its typefaces from Google Fonts. When a page loads, your browser connects to Google's servers to fetch the font files, which transmits your IP address to Google. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a consistent presentation of the site. See the Google Privacy Policy.
Newsletter
You can subscribe to our newsletter by entering your email address. The subscription is managed through Mailchimp and uses double opt-in, meaning we send a confirmation email and only add you once you confirm. Every newsletter contains an unsubscribe link. Legal basis: consent (Art. 6(1)(a) GDPR).
External links
The site links to the Apple App Store, Google Play, and social networks. Those sites have their own privacy practices over which we have no control.
12. Changes to this policy
We may update this policy when the Game changes or when the law requires it. The effective date at the top of the page shows when it was last revised. If a change materially affects how we use your data, we will let you know in the Game or on this page before it takes effect. Earlier versions are available on request.
13. Contact
For any question about this policy or about your data, contact:
codeSTREAM · Jan GressmannSchilfgrund 3, 22848 Norderstedt, Germany
info@codestream.de