Privacy policy
Last updated: 26 September 2026. This policy covers the website seacliff.app. Each app has its own privacy policy, linked inside the app and on its store listing.
App-specific privacy policies: Peekafish, Minesweeper Royale.
1. Controller
CBDNOL GmbH
Nestroystraße 29
4053 Ansfelden
Österreich
Email: info@eckmair.com
2. This website
seacliff.app consists of static HTML pages. There is no contact form, no comments and no ad networks. Audience and advertising measurement runs only with your consent — see the section “Cookies, consent and analytics” for how it works. Beyond that, the only third-party service the pages embed is the Google Fonts font service (see the “Fonts” section). Without your consent we set no cookies; only your cookie decision itself is stored.
3. Fonts (Google Fonts)
To display the typefaces Instrument Serif and Manrope consistently, the pages embed Google Fonts. When you open a page, your browser loads the font files directly from Google servers (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google thereby learns that the page was requested from your IP address. According to Google, no cookies are set and the requests are not linked to a Google account. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent, legible presentation). Where data is transferred to the USA, this relies on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified. Details: fonts.google.com/faq#privacy and policies.google.com/privacy.
4. Server log files
When you load a page, our host processes technically necessary access data (IP address, timestamp, file requested, volume transferred, referrer, browser type). This is required to deliver the page and relies on Art. 6(1)(f) GDPR. The data is not combined with other sources.
Hosting: GoDaddy.com, LLC, servers located in USA.
Transfer to a third country: Because the servers are located in USA, the access data described above is transferred there. The legal basis is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework where the provider is certified, otherwise Standard Contractual Clauses under Art. 46(2)(c) GDPR. This concerns technical access data of this website only. Whatever you enter in our apps is processed separately on servers in Frankfurt am Main (see “Data in our apps”).
5. Cookies, consent and analytics
Strictly necessary storage (no consent needed, § 165(3) Austrian TKG 2021): your cookie decision in your browser's localStorage (“cv_consent”: version, analytics yes/no, marketing yes/no, timestamp; 12 months, then we ask again). All other cookies are set only with your consent.
Consent (Consent Mode v2): on your first visit a notice at the bottom of the screen asks whether we may measure audience (“Analytics”) and advertising results (“Marketing”). Without your consent no measurement or advertising service is loaded and no such cookie is set; Google services receive the “denied” signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) via Google Consent Mode v2. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). The notice is shown to visitors from the EU, the EEA, the United Kingdom and Switzerland (detected from the page language and the browser's timezone and language); outside these countries the services load without a prior prompt and you can switch them off at any time via “Cookie settings” in the footer. You can withdraw or change your consent at any time with effect for the future via “Cookie settings” in the footer of every page; on withdrawal we delete the cookies the services set. As long as we have not set up any of the following services, nothing is loaded even with consent.
Google Analytics 4 (Analytics): Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. With your consent the cookies “_ga” and “_ga_<ID>” (up to 2 years) are set and page views (page, referrer) and approximate location and device data are processed. GA4 truncates IP addresses by default before storage and never stores full IP addresses. Event data is retained by Google for 14 months. A transfer to Google LLC (USA) is possible; Google is certified under the EU-US Data Privacy Framework and EU standard contractual clauses apply in addition. Processing by Google is governed by a data processing agreement; no advertising features (Google Signals) are enabled.
Google Ads conversion measurement (Marketing): Google Ireland Ltd. With your consent the Google Ads tag records whether a visit after a click on one of our ads led to a specific action, such as opening an app page or clicking a store link (cookies “_gcl_au”, “_gcl_aw”, 90 days; click id “gclid”). We only see figures per campaign, never persons. Enhanced conversions are used only with marketing consent.
Meta Pixel and TikTok Pixel (Marketing, only if activated): if we run campaigns on these platforms and you allowed “Marketing”, we load the Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4; cookie “_fbp”, 90 days) or the TikTok Pixel (TikTok Technology Ltd., Dublin; cookie “_ttp”, 13 months) to measure the ads (page view, app page opened). Both providers are joint controllers with us for the collection; details and your rights towards them are in their privacy notices. If no pixel is activated, nothing is loaded even with consent.
Retention: “cv_consent” 12 months; Google Analytics cookies up to 2 years, event data 14 months; Google Ads cookies 90 days; Meta 90 days; TikTok 13 months. On withdrawal via “Cookie settings” the services' cookies are deleted.
6. Contact by email
If you write to us we process your details to handle the enquiry (Art. 6(1)(b) or (f) GDPR) and delete the correspondence once it is no longer needed.
7. Data in our apps
The apps store profile and usage data on the device. For AI features the necessary input is sent to servers in the EU (Frankfurt am Main) and on to the AI provider; it is not stored there and not used for AI model training. Purchases run through the respective app store; we receive no payment data.
8. Your rights
You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority.
9. Changes
We update this policy when the website changes. The current version is always available at this address.