Privacy Policy for the Roliup Android App

Scope: This privacy policy applies to our ad-financed Android app Roliup (io.agnaes.roliup.app) with both of its game modes, 2D and 3D, hereinafter referred to as “APP”. Roliup is free; a one-time in-app purchase “Roliup Deluxe” permanently unlocks all content and ends the display of advertisements (see § 4 paragraph 3 and § 5).

It expressly applies to Android only: the iOS app of the same name, “Roliup”, is ad-free – it is governed by the privacy policy of the iOS app. None of the processing described in § 5 takes place on iOS. Nor does this policy apply to this website: visits to the agnaes.io website are governed by the privacy policy of this website.

Overview of our privacy policies:

  • Website agnaes.io – applies to visits to this website
  • Social media – applies to our profiles on Instagram, TikTok and Reddit
  • Roliup (Android) (this policy) – applies to the ad-financed app
  • Roliup (iOS) – applies to the ad-free app

§ 1 General

We take the protection of your personal data very seriously and handle your personal data as confidential information, in compliance with the statutory data protection regulations and this privacy policy. This privacy policy explains the nature, purpose and scope of the data collection within the use of the APP. We herewith advise you that the transmission of data via the Internet (e.g., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

(1) Responsible party (“controller”)

The responsible party for the data processing within this APP is:

Agnaes Software - Karl Kegel
Dr.-Ing. Karl Kegel
Blasewitzer Straße 41
01307 Dresden, Germany

E-mail: web@agnaes.io
Website: https://agnaes.io
Phone: +49 151 72224722

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.). You can find our legal notice at agnaes.io/impressum.html.

(2) General storage duration of personal data

Unless otherwise specified or made more precise within this privacy policy, the personal data collected by this APP will be stored until you ask us to delete it, revoke your consent to its storage, or the purpose for the data storage lapses. If a statutory obligation to retain data or another legally recognized reason for storing the data exists (e.g., a legitimate interest or a statutory retention period), the personal data concerned will not be deleted before the respective reason for retention ceases to apply.

(3) Legal basis for the storage of personal data

The processing of personal data is only permitted if a valid legal basis for the processing of this data exists. If we process your data, we regularly do so on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG (e.g., if you consent to the display of personalized advertising, see § 5) or on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, which are always weighed against your interests. Where applicable, the relevant legal basis is specified separately in the respective sections of this privacy policy.

(4) Encryption

Data transmissions of the APP (e.g., when loading advertisements, see § 5) take place over encrypted connections (transport encryption). This encryption prevents the transmitted data from being read by unauthorized third parties.

(5) Amendment of this privacy policy

We reserve the right to amend these data protection provisions at any time in compliance with the statutory requirements.

§ 2 Your rights

The GDPR grants data subjects whose personal data we process certain rights, of which we would like to inform you here:

(1) Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. An informal notification by e-mail is sufficient for this; in addition, you can revoke your consent to personalized advertising directly in the APP (see § 5). This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

(2) Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

(3) Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

(4) Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time at the address given in the legal notice.

(5) Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time at the address given in the legal notice. The right to demand restriction of processing applies in the following cases:

  • In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
  • If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the eradication of this data.
  • If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
  • If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

(6) Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

§ 3 Access permissions of the APP

To provide our services, the APP requires the following access permissions:

  • Internet access (“INTERNET” permission): used for loading advertisements (see § 5) and for handling the in-app purchase via Google Play (see § 4 paragraph 3).
  • Network status (“ACCESS_NETWORK_STATE” permission): the APP checks whether an Internet connection is available. Ad slots are only displayed while a connection exists; the same check additionally ensures that an answer from Google Play about the unlock is only treated as definitive when a connection actually exists (see § 4 paragraph 3).
  • Google Play billing (“com.android.vending.BILLING” permission): contributed by the Google Play Billing library and required for the in-app purchase (see § 4 paragraph 3).

The APP does not request any further permissions; in particular, it has no access to location data, contacts, photos/videos, call lists, camera or microphone.

In its 2D mode, Roliup is controlled by tilting the device and reads the accelerometer for this purpose; in the 3D mode the sensor is not read. The sensor data is processed exclusively locally while playing and is neither stored nor transmitted.

Access to the device functions mentioned above is required to ensure the functionality of the APP. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6(1)(f) GDPR. For the advertising, the legal bases described in § 5 apply.

§ 4 Collection of personal data within the use of the APP

(1) General

The APP can be used without a user account and without providing any personal data. We ourselves do not collect, store or transmit any personal data in the course of your use of the APP; the APP contains no analysis or tracking tools of the operator. Personal data is processed exclusively by Google in the course of the display of advertisements (see § 5), by Google Play in the course of the in-app purchase (see paragraph 3), and when you contact us yourself (see paragraph 4).

(2) Locally stored game data and Android Auto Backup

Game progress, settings and replay recordings are stored exclusively locally in the protected storage area of the APP on your device and are not transmitted to us. Video exports of game runs that you trigger yourself (in both game modes) are placed in the gallery of your device (folder “Movies/roliup”). Sharing achievement images and videos takes place exclusively via the Android share dialog with apps chosen by you and is entirely in your hands.

Android may back up the local app data via the operating system feature “Auto Backup” to the storage linked to your Google account (Google Drive). This is a feature of the Android operating system (provider: Google) that you can deactivate in the Android settings; we have no access to these backups.

(3) Distribution via Google Play; the “Roliup Deluxe” in-app purchase

The APP is distributed via the Google Play Store. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you download or update the APP, Google processes data relating to your Google account and your device as an independent controller in accordance with the Google privacy policy: https://policies.google.com/privacy. We have no influence on this processing.

The Roliup app is free and contains exactly one in-app purchase: the one-time, permanent “Roliup Deluxe” unlock (no subscription, no consumables). Purchase, payment and restoring the unlock on new devices are handled entirely by Google Play (Google Play Billing); in the course of this, Google processes data relating to your Google account and your device as an independent controller. From Google, the APP receives the purchase data for this one product (including the purchase token, order number, purchase time and purchase state); it sends the purchase token back to Google once in order to acknowledge the purchase (otherwise Google refunds it automatically). None of this data is transmitted to us.

When the APP talks to Google Play: The APP queries the purchase status with Google Play on every start and every return to the foreground – including when you have not bought anything. The result of that query is solely the information WHETHER the unlock is present for your Google account; that answer is stored locally on your device so the unlock remains available without an Internet connection. Conversely, this means: if a query made while an Internet connection exists shows that the unlock is not (or no longer) present – after a refund, for instance – it is removed locally as well. No personal data is stored in the process. After the purchase, no advertisements are displayed anymore (see § 5). In no case do we receive access to your payment data.

(4) Request by e-mail or telephone

If you contact us (e.g., by e-mail or telephone), your request, including all resulting personal data (e.g., name, request) will be stored and processed by us for the purpose of processing your request. These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of your consent (Art. 6(1)(a) GDPR) and/or on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR). The data sent by you to us via contact requests remain with us until you request us to delete them, revoke your consent to the storage or the purpose for the data storage lapses (e.g., after completion of your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected. We do not pass these data on without your consent.

§ 5 Advertising (Google AdMob)

The APP is financed by advertising and uses Google AdMob, a service for the integration of advertisements in mobile apps. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Advertisements are displayed in the free scope only: once the “Roliup Deluxe” unlock has been purchased, they are permanently removed (see § 4 paragraph 3).

With the assistance of Google AdMob, we are in a position to display ads by third parties within the APP (banner ads). If you have given your consent, the contents of the ads are based on your interests, which Google determines based on your past user patterns. Otherwise, non-personalized ads are displayed; in this case, only contextual information is taken into account for the selection (e.g., your approximate location derived from the IP address and the content of the APP).

For recognition purposes, Google AdMob uses in particular the advertising ID of your device and comparable recognition technologies. As a result, it is possible to analyze information such as the display of and the interaction with ads. The usage information recorded by Google AdMob (in particular the advertising ID, your IP address, device information such as device type, operating system version and language setting, as well as information about the delivery of advertising formats) may be transferred to a Google server in the United States, where the information is stored. Google may share this information with its contracting partners.

Whether consent is required is decided by the Google User Messaging Platform based on your location (e.g., in the European Economic Area and the United Kingdom). If it is required, the APP shows a consent dialog from Google when it is started for the first time. In it, you decide whether you consent to the use of Google AdMob with personalized advertising. With your consent, Google AdMob may in particular store and read information on your device (e.g., the advertising ID) and show you personalized ads. The dialog shows which purposes are covered in detail. The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time. You can change your selection at any time via the privacy options within the APP. Without consent (or after revocation), only non-personalized ads are displayed. Google AdMob follows your selection in the consent dialog. How Google delivers ads without consent, and which data Google processes in doing so, is determined by Google. Google describes the details here: https://policies.google.com/technologies/partner-sites. The legal basis for displaying non-personalized ads is our legitimate interest in financing the free APP through advertising (Art. 6(1)(f) GDPR).

You can also deactivate personalized advertising in the settings of your Google account at https://adssettings.google.com and reset or delete the advertising ID of your device in the Android settings (depending on the device, e.g., under “Privacy” or “Google” – “Ads”). You can also play the APP entirely without an internet connection. Without an internet connection, the APP loads no ads and transmits no data to Google AdMob.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://business.safety.google/adscontrollerterms/sccs/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5780.

For more information on data protection at Google, please refer to the Google privacy policy: https://policies.google.com/privacy.

§ 6 Hosting of this page

This privacy policy is provided as a page of the agnaes.io website. The processing that occurs when this page is accessed (e.g., server log files) is governed by the privacy policy of the website.

As of: October 2026