Privacy

Controller and Contact

1.1 This policy explains how we handle personal data when you use LEVVVEL on the web (https://levvvel.com) or in our iOS and Android apps. Personal data means information that can identify you.

1.2 The controller under the General Data Protection Regulation (GDPR) is Bambeo GmbH, Törringstr. 23, 84359 Simbach am Inn, Germany. Email: [email protected]. For privacy requests, you may also write to [email protected] or [email protected].

1.3 Connections to our Service use TLS encryption (https://). We use data processing agreements with our processors where required by law.

Data We Collect Automatically

When you visit our website or use the app, our hosting provider (Cloudflare) processes server log data needed to deliver pages and protect the Service, such as:

• Pages requested
• Date and time of access
• Data volume transferred
• Referring URL
• Browser and operating system
• IP address

We use IP addresses briefly for abuse prevention (for example, rate limiting newsletter sign-ups). Legal basis: Art. 6 (1) point f GDPR (legitimate interest in a secure, stable Service).

Local Storage and Cookies on Your Device

We store some preferences on your device using browser local storage or, in the mobile app, on-device storage (Capacitor Preferences). Third-party advertising and analytics providers may also set cookies as described below.

Depending on how you use the Service, local data may include:

• Theme preference (light/dark) on the website
• Preferred language (in the mobile app)
• Reward-link collection markers (which bonus links you have already claimed)
• Game-code vote markers (so you are not asked to vote twice on the same code)
• Saved articles and offline hub pages (mobile app only; stays on your device)
• Push notification prompt state (mobile app only)

First-party cookie for advertising identity (website only). If you confirm a newsletter or code-alert subscription, we set a cookie named levvvel_hem containing SHA-256 and SHA-1 hashes of your normalized email address (not your plain email). The cookie lasts up to one year, is used so our advertising partner can recognize your browser for ad delivery, and is cleared when you unsubscribe. See Newsletter and Code Alerts below.

You can clear website local storage and cookies through your browser settings. App data can be removed by clearing the app’s storage or uninstalling the app.

Legal basis: Art. 6 (1) point f GDPR for functional preferences; Art. 6 (1) point a GDPR for the levvvel_hem cookie (consent via subscription signup).

Contact by Email

If you contact us by email (for example via the addresses on our Contact page), we process the data you send (typically your email address, name if provided, and message content) to respond. Legal basis: Art. 6 (1) point f GDPR. We delete correspondence when it is no longer needed, unless statutory retention applies.

Newsletter and Code Alerts

If you subscribe via the site footer or a game-code alert form on a specific game page, we collect:

• Email address
• Language/locale of the page you used
• Interest categories you select (free codes, guides, industry statistics)
• For game-code alert forms: the game identifier (slug) for that page so we only email you about that game’s codes
• Time of consent and, after confirmation, time of subscription

Game-code alert signups are stored separately per game. Subscribers on a Shindo Life page only receive Shindo Life code alerts, not alerts for other games.

Subscription uses double opt-in: we send a confirmation email; your address is added only after you click the link.

Legal basis: Art. 6 (1) point a GDPR (consent). Subscription is intended for users who meet the age of digital consent in their country. We do not verify age; if we learn a subscriber is under that age, we delete the subscription. You can withdraw consent at any time via the unsubscribe link in each email or by contacting [email protected]. We delete subscription data after you unsubscribe, unless retention is required by law.

Confirmation, code-alert, and unsubscribe emails are sent through Resend (Resend, Inc., USA). Subscription records are stored in Cloudflare Workers KV on our servers while your subscription is active, or until unconfirmed sign-ups expire (48 hours). Code-alert emails are sent from LEVVVEL (Bambeo GmbH); each message includes an unsubscribe link and identifies Bambeo GmbH as the sender.

Advertising identity (website only). If you have a confirmed newsletter or code-alert subscription and browse our website, we may pass cryptographically hashed versions of your email address to Freestar, our advertising partner, so that Freestar and its vendors can recognize your browser for ad delivery without receiving your plain email. This applies only while your subscription remains active. We normalize your address (for example, lowercasing and Gmail-specific rules) and hash it with SHA-256 and SHA-1 on our side before transmission; Freestar does not receive your email in plain text through this feature. Hashes are stored in the first-party cookie levvvel_hem (see above) and passed to Freestar; Freestar may also store them in browser session storage (for example, under the key fs.ident) for the current browsing session. Freestar may share these hashes with its advertising vendors (for example, Prebid User ID modules and bidders) under Freestar’s privacy policy. Technical details are in Freestar’s Hashed Email Passthrough documentation.

Legal basis for this use: Art. 6 (1) point a GDPR (consent, as described when you subscribe). You can withdraw consent by unsubscribing from the newsletter or code alerts; after unsubscribe we stop passing your hash to Freestar and clear the levvvel_hem cookie.

Notifications (Mobile App)

Server push (iOS)

If you enable push notifications in the LEVVVEL iOS app, we store:

• A device push token (provided by Apple)
• Platform (iOS)
• Language/locale
• Notification topics you receive
• For game-code pages: the game identifier(s) you opted into on that page, so push alerts match the game you were viewing

Server push alerts are currently delivered on iOS only via Apple Push Notification service (APNs). If you register on Android, we may store your token for future use, but we do not currently send server push messages to Android devices.

Legal basis: Art. 6 (1) point a GDPR (consent via your device permission). Push notifications are intended for users who meet the age of digital consent in their country. You can disable notifications in your device settings at any time.

Local reminders (on your device)

The app can schedule local reminders (for example, daily Coin Master spin reminders or weekly code roundups). These run entirely on your device through your operating system’s local notification APIs. We do not receive the content of those reminders on our servers, and you can turn them off in the app or device settings.

Legal basis: Art. 6 (1) point a GDPR (consent via your device permission).

Game-Code Community Votes

On game-code pages you may vote whether a code still works. Votes are stored as aggregated counts in Cloudflare Workers KV on our servers. We do not require an account; a local marker on your device prevents duplicate votes from the same browser.

Legal basis: Art. 6 (1) point f GDPR (legitimate interest in maintaining useful, community-checked code lists).

Embedded Content

Some articles embed YouTube videos using YouTube’s privacy-enhanced mode (youtube-nocookie.com). When you play a video, YouTube may process data under its own privacy policy. We do not control that processing.

Consent Management (Website)

On the website we use a consent management platform operated through Freestar (Sourcepoint) to collect and record your choices about cookies and similar technologies where required by law. You can change your preferences at any time via the Privacy Preferences link in the site footer. Analytics and advertising tags on the website load only according to those choices (or where consent is not required).

Legal basis: Art. 6 (1) point a GDPR (consent), or Art. 6 (1) point f GDPR (legitimate interest in compliant ad and analytics delivery) where applicable.

Online Marketing

Freestar

We work with Publisher First, Inc. dba Freestar, 20715 N. Pima Rd., Suite 108, Scottsdale, AZ 85255, United States (hereafter “Freestar”) to provide advertising and publisher technology on this website. Freestar’s privacy policy applies to its processing.

Freestar sets cookies and similar technologies for ad delivery, measurement, fraud prevention, and consent management. Its ad stack may involve partners such as Google, Amazon Ads, Prebid bidders, Confiant, and Blockthrough. Where you have a confirmed newsletter or code-alert subscription, we may also provide Freestar with hashed versions of your email address as described in Newsletter and Code Alerts above. Legal basis for HEM passthrough: Art. 6 (1) point a GDPR (consent via subscription signup). You can opt out by unsubscribing from email alerts or, for other ad processing, via Privacy Preferences in the site footer.

To the extent required by law, we obtain your consent to ad-related processing through the consent platform described above. You can withdraw consent at any time with effect for the future via Privacy Preferences.

Google advertising (via Freestar)

Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 ESW5, Ireland (“Google”) may serve or measure ads on this website through Freestar’s ad stack, including demand associated with Google AdSense. Google may use cookies or similar technologies and process data such as your IP address, device identifiers, and ad interaction data. Data may be transferred to Google LLC in the USA. For more information, see Google’s privacy policy and Google’s ad settings. You can also manage preferences through Privacy Preferences or your browser settings.

Legal basis: Art. 6 (1) point a GDPR (consent, where required) and Art. 6 (1) point f GDPR (legitimate interest in funding the Service through advertising).

Wargaming

We participate in the Wargaming Group Limited affiliate program (105 Agion Omologiton Avenue, Nicosia, 1080, Cyprus; hereafter “Wargaming”). Some articles include partner links to World of Tanks and World of Warships.

When you click a partner link, Wargaming may process referral data and set cookies on their website. We do not receive your Wargaming account details.

Legal basis: Art. 6 (1) point f GDPR (legitimate interest in measuring affiliate referrals and receiving commission). Further information on Wargaming’s use of data can be found in their privacy policy. You can limit cookie storage through your browser settings; blocking third-party cookies may affect referral attribution but does not stop you from browsing LEVVVEL.

Other affiliate partners

Some articles include links to other third-party products or services under affiliate programs. For example, we participate in the Star Stable affiliate program (links via Impact). When you click those links, the partner may process referral data and set cookies on their site. We do not receive your account details from those partners. Each partner’s privacy policy applies on their site.

Legal basis: Art. 6 (1) point f GDPR (legitimate interest in measuring affiliate referrals and receiving commission).

Web Analysis Services

Google Analytics

This website uses Google Analytics 4 (GA4), a web analysis service operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 ESW5, Ireland (“Google”). Google Analytics uses cookies and similar technologies to analyze how users use the site. Data generated about your use of this website may be transmitted to Google servers, including Google LLC in the USA.

We load Google Analytics on the website only (not in the native app), and only after you consent through our consent management platform where consent is required. We use Google Consent Mode with analytics storage denied by default until consent is granted. We also maintain a legacy Universal Analytics property with IP anonymization for transitional reporting; Universal Analytics has been discontinued by Google and is being phased out.

On our behalf, Google uses this information to evaluate website use, compile reports, and provide related services. You may refuse analytics cookies via Privacy Preferences or your browser settings. You can also use Google’s browser add-on where available.

Further information: Google Analytics privacy and Google’s privacy policy.

Legal basis: Art. 6 (1) point a GDPR (consent, where required).

Service Providers

We use the following processors to operate the Service:

• Cloudflare — hosting, CDN, Workers, and KV data storage (subscriptions, push tokens, vote counts, rate limits)
• Resend — transactional and newsletter email delivery
• Freestar — website advertising, consent management, and publisher technology
• Google — website analytics and advertising (via Freestar)
• Apple — push notification delivery (iOS)

We have data processing agreements in place where required. Provider privacy policies apply to their own processing.

International Data Transfers

Some processors listed above are located outside the European Economic Area (EEA), particularly in the United States (for example, Cloudflare, Resend, Freestar, and Google). Where personal data is transferred to countries without an EU adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and supplementary measures where required. You may request more information about transfers and safeguards by contacting [email protected].

Children

Our Service covers video games and is not directed at children under 16. We do not knowingly collect personal data from children under 16 for consent-based features (newsletter, code alerts, or push notifications) without parental consent, and we do not offer verified parental-consent flows.

If you are a parent or guardian and believe your child under 16 subscribed or enabled push notifications, contact [email protected] and we will delete the relevant data. Visiting the Service may still involve limited technical processing (for example, server logs) as described above.

In EU member states that allow a lower age of digital consent (down to 13), that national age applies instead of 16 for consent-based features in that country.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

Your Rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, to withdraw consent, and to object to processing based on legitimate interests (including direct marketing). You may lodge a complaint with a supervisory authority. For Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), www.lda.bayern.de.

To exercise your rights, email [email protected] with enough detail for us to identify your request.

Right to object: If we process your data on legitimate interests, you may object at any time for reasons arising from your situation. If you object to direct marketing, we will stop processing for that purpose.

Retention

We keep personal data only as long as needed for the purposes above or as required by law (for example, tax or commercial retention). Newsletter and push-token data are deleted when no longer needed; unconfirmed newsletter sign-ups expire after 48 hours; the levvvel_hem cookie is cleared on unsubscribe; server logs are retained according to Cloudflare’s standard periods.

Changes

We may update this policy. The date at the top of this page shows when it was last revised. Material changes will be noted on the Service where appropriate.