Last updated: 24 October 2026
This Privacy Policy explains how personal data is processed when you use the mobile game "Too Much Slime" (Android package de.Too_much_slime, iOS bundle com.tooslime.app, together the "App") and our public web pages. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG).
The controller responsible for data processing in the App is:
Julien Saam, Alter Kirner Weg 9, 55608 Bergen, Germany, e-mail: toomuchslimestudios@gmail.com, phone: +49 176 6142921
We have not appointed a data protection officer because we are not legally required to do so. You can reach us for all privacy matters at the e-mail address above.
The App stores your game settings, your local progress, a random local player identifier and small technical flags (for example whether you have seen the tutorial) in the App's private storage on your device. This storage is strictly necessary to provide the game you requested (§ 25 (2) no. 2 TDDDG) and does not require consent. You can delete it at any time via Settings → Delete all game data or by uninstalling the App.
The advertising SDK stores your consent choices and, depending on your choices, advertising identifiers on your device (see section 7).
Age question: on first launch on a phone or tablet the App asks for your year of birth and stores the answer only on your device. It is used solely to decide how ads are requested (see section 7) and is never sent to us. It is kept when you delete your game data and removed when you uninstall the App.
Reminders: if you switch on reminders, the App schedules local notifications on your device (for example when your gem mine is full, your daily login streak is about to break or your weekly league is about to end). They are created on your device from your local game data; no push service is used and no data is sent to us for this. The App only asks for the notification permission when you switch reminders on. You can switch them off at any time in the App settings or in your device settings.
If you choose to create an account, authentication is handled by our processor Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. Depending on the sign-in method, Clerk processes your e-mail address, your name as provided by Google or Apple, a unique user ID, session tokens and technical security data (IP address, device information) needed to prevent abuse.
Purpose and legal basis: providing the account you requested (Art. 6 (1) (b) GDPR) and securing the sign-in process (Art. 6 (1) (f) GDPR — legitimate interest in preventing account takeover and abuse).
Retention: until you delete your account. You can delete your account in the App at any time (Settings → Delete account); the deletion takes effect immediately. Only your pseudonymous account ID (the technical identifier assigned by our sign-in provider — not your name or e-mail address) is kept for up to 24 hours to refuse sessions from devices that were still signed in, then it is removed. Server logs (section 9) may reference this ID for the deletion event.
You must be at least 16 years old to create an account, or have the consent of a parent or guardian.
When you are signed in, we store your game progress on our servers, linked to your user ID, so that you can continue on another device: unlocked and cleared worlds, permanent upgrades, purchased items and skins, in-game currency balances (diamonds, gold and skin shards), records of the diamond packs you bought in the store (section 8), your Town, achievements and weekly challenges, hero mastery, best waves per world, ascension progress, collection unlocks, discovered enemies and synergies, whether you finished the tutorial, and lifetime statistics (for example elite kills). Your detailed run history stays on your device; your best runs appear on the leaderboards (section 6).
So that a currency change is never applied twice when a connection drops, we also store a random identifier for each synchronised currency change. These identifiers contain no game or personal data and are deleted after 180 days at the latest.
Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with you).
Retention: cloud progress that has not been synchronised for 90 days is deleted automatically; otherwise it is kept until you delete your data or your account (Settings → Delete all game data / Delete account).
Player number: your signed-in account gets a permanent player number in the order of its sign-up date as recorded by Clerk (section 4). Accounts that already existed when player numbers were introduced were numbered once in the same order; to number newer accounts, our server regularly reads the user IDs and sign-up dates of accounts created since from Clerk. The first 1,000 players receive the Pioneer Knight skin with their cloud progress. For this we store your player number, your user ID, your sign-up date and when the number was stored. Your player number is shown only to you in the App, unless you are one of the first 1,000 players and switch on “Show Pioneer number” in My Card (it is off by default): other signed-in players then see it as a badge such as “PIONEER #42” on your player card and next to your name on the leaderboards, and it is sent along with the card details of your leaderboard, league and friend-list entries (section 6). You can switch it off again at any time; a hidden card never shows it. We store this choice with your player card; it is reset to off when your game data is deleted. Legal basis: Art. 6 (1) (b) GDPR. Retention: your player number is kept when your game data is deleted (by you or automatically after 90 days), so that the number and the skin stay yours, and is deleted when you delete your account; the number is not handed out again.
When you finish a run while signed in, your score, wave and run details are submitted to our leaderboard together with a display name. The display name and scores are visible to all players of the App. When you first sign in on a device, the App asks you to choose a display name. It can suggest a random one (for example “GooeyKnight482”), and if your player card already has a name from another device, it offers that name; it never takes your name from your sign-in provider. You can change the name at any time in the leaderboard screen. We never show your e-mail address or your full name unless you enter it as your display name yourself.
Public entries also contain a pseudonymous player ID (the technical account ID assigned by our sign-in provider) so that the App can mark your own entries. It contains neither your name nor your e-mail address, but anyone who queries our public leaderboard interface can see it next to your entries.
Weekly leagues: when you finish a run in worlds 1–8 while signed in, you are placed in a group of up to 30 players for the current week (Monday to Sunday, UTC). For this we store your display name, the hero you played, your best score, wave and world of the week, your league tier and whether you have claimed the week's reward. The other members of your group can see your display name, hero, best score and wave and, unless you hide your player card (see below), your card's hero (with its skin) and card style. From your league history we also work out your season badges: for each past calendar month (a week counts for the month its Monday falls in), the best league tier you finished a week in. League entries and season badges are deleted together with your other online game data (Delete all game data, account deletion or the automatic deletion after 90 days without synchronisation described in section 5).
Legal basis: Art. 6 (1) (b) GDPR (leaderboards and leagues are part of the game you use) and, for the publication of the display name, Art. 6 (1) (f) GDPR — our legitimate interest in providing a competitive ranking; you can object at any time by choosing a pseudonymous display name or by deleting your entries via Delete all game data.
Please choose a display name that does not reveal more about you than you want other players to see.
Guest players cannot submit scores to the online leaderboard or join leagues.
Display names are compared with a list of blocked words when you save them and when a score is submitted. A blocked name is not published; the App switches to a random name and asks you to choose a new one. No other data is used for this check.
Players with an account can report another player's name in the App. We then store the reporting player's account ID, the board or guild roster and the entry, the reported name and the reported player's account ID, the reason and the optional free-text details. To tell both sides about our decision, we look up their e-mail addresses at our sign-in provider (section 4) when we review the report; the reported player never learns who made the report from us. Reports are deleted automatically six months after they were made, and earlier if the account of the reporting or reported player is deleted. If we remove a name, its blocked form is stored so that it cannot be used again: names blocked only for you are deleted when you delete your account, names blocked for everyone (insulting, hateful or sexual names) are kept without any link to a person.
Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 16 and 17 of the EU Digital Services Act (handling notices and stating reasons) and Art. 6 (1) (f) GDPR (legitimate interest in keeping public names free of illegal and offensive content).
When you are signed in, the App creates a player card for you with a random public card code. The card shows your display name, your guild, a hero and its mastery level (the one you picked, with the skin you picked, or else the hero you play most), the card style you chose (background, frame and a title taken from your earned trophies; rank backgrounds and frames show the league tier you have finished a week in, the town rank you have reached or a place you currently hold on a world's all-time leaderboard; the Founder frame shows that you bought the Founder Pack), how many worlds you have cleared, your best wave, how many slimes and bosses you have defeated, your town rank, your league tier, your season badges (the best league tier you finished in each of up to twelve past months), the trophies you have earned (with up to three you pick for the shelf), how many cheers your town has received and, if you bought the Founder Pack, your founder number (for example “FOUNDER #0042”, section 8) and, if you switched it on, your Pioneer number (for example “PIONEER #42”, section 5). Other signed-in players can open your card from the leaderboards, leagues and guild rosters and visit your town, which shows your buildings but cannot be changed by them. The card code appears next to your public leaderboard and league entries so that the App can link them to your card; it contains neither your account ID nor your name. Your entries on the leaderboards (including Daily Run and Endless) and in your league group also show your card's hero (with its skin), card style and, once you have finished a league week, a small medal with your league tier; if you show your Pioneer number, it comes with these entries too and appears next to your name on the leaderboards.
Cheers: a visiting player can cheer your town once per day, which pays both of you in-game gold. We store who cheered whom, on which day and how much gold was paid. When you next open your town, the App shows you how many visitors cheered and the display names of up to three of them. Collected cheers are deleted 8 days after they were given, uncollected ones after 90 days at the latest.
You can hide your card and town at any time (Settings → Public player card). A hidden card cannot be opened, your town can then not be visited or cheered, and the card code, hero, card style, league medal and Pioneer number are removed from your board entries (and the card code and league medal from your guild's member list); your leaderboard and league entries themselves stay visible as described above.
If you found or join a guild, we store your membership (guild, role and date joined), what your runs and finished town jobs added to the guild's weekly goals (for example slimes defeated, waves survived or gold earned) and which guild rewards you have claimed. Guild names are put together from fixed word lists; guilds have no free-text fields or chat. All members of your guild can see your display name, your role and your points for the current week and, unless you have hidden your card, open it and see a small medal with your league tier next to your name once you have finished a league week. The list of open guilds shows each guild's name, banner (cloth, shield and emblem), level, member count and the display name of its leader to all signed-in players.
If you join a guild through a member's invite link, we store that you were recruited, by whom, into which guild and in which week, so that the guild receives its recruit bonus (at most a few recruits per guild and week) and the inviting player's Recruiter trophy counts you. This record is deleted when you or the inviting player delete your game data or account.
Retention: weekly guild goals, contributions and claimed rewards are deleted after three weeks. Your membership ends when you leave the guild, when the leader removes you, or when you delete your game data or account; in the last two cases your contributions are erased as well. When the last member leaves, the guild is deleted.
Your player card, cheers and guild data are deleted together with your other online game data (Delete all game data, account deletion or the automatic deletion after 90 days without synchronisation described in section 5). Guest players have no player card, cannot open other players' cards or visit towns and cannot join guilds.
Legal basis: Art. 6 (1) (b) GDPR (player cards, town visits and guilds are part of the game you use) and, for showing your card to other players, Art. 6 (1) (f) GDPR — our legitimate interest in letting players see and compare each other's progress; you can object at any time by hiding your card in the settings.
Signed-in players can add other players as friends using their card code, an invite link or a player card. We store who added whom and when. Your friends see your display name, your card's hero and card style (with your Pioneer number if you show it), your league tier (once you have finished a league week), how many worlds you have cleared and your best wave in each world (for example to show who to beat on the world cards); players you have added you back are marked as mutual friends, and a player who adds you appears in your list of players who added you. Hiding your card removes you from other players' friend lists and prevents new friend requests and invites; you can remove a friend at any time.
Invite links contain your card code and, if you share them from your guild, the guild code. When someone opens your invite link in a browser, the invite page shows your display name (and, for a guild invite, the guild's name and banner) and links to the app store; on Android, the link to Google Play carries the invite as an install referrer. After installation, the App reads this install referrer once through Google Play on your device and keeps only the invite code it contains; it is sent to us only when you accept the invite while signed in.
If you accept an invite as a new player, we store who invited you and when, whether you have reached the goal world and whether each side has collected the reward. The inviting player sees your display name (unless your card is hidden) and whether you have reached the goal. To stop rewards from being collected several times with the same account, we keep two technical flags (that this account has accepted an invite and that it has counted as a guild recruit) even if you delete your game data; they contain no other information and are deleted no later than one day after you delete your account. Legal basis for these flags: Art. 6 (1) (f) GDPR — our legitimate interest in preventing abuse of rewards.
Retention: friends, invites and the rewards collected for them are deleted together with your other online game data (see above). If the inviting player deletes their data, your own invite reward stays available to you. Legal basis: Art. 6 (1) (b) GDPR (friends and invites are part of the game you use).
The App shows banner ads and optional rewarded video ads delivered by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA, UK and Switzerland) and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google acts as an independent controller for the processing described in its own privacy policy.
To deliver ads, the AdMob SDK processes your IP address, device and app information (device model, operating system, app version, language), advertising identifiers (Google Advertising ID on Android, IDFA on iOS — only if you have allowed tracking), coarse location derived from the IP address and information about how you interact with ads.
If you are in the European Economic Area, the United Kingdom or Switzerland, the App shows a consent dialog (Google's certified consent management platform, IAB TCF 2.2) before any ad is requested. Storing or reading identifiers on your device and personalised advertising are based exclusively on your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). If you decline, no advertising identifiers are used; depending on your choices you may still see non-personalised (contextual) ads, for which Google processes your IP address and coarse location on the basis of Art. 6 (1) (f) GDPR (legitimate interest in financing the free game).
You can withdraw or change your consent at any time with effect for the future under Settings → Ad privacy options. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Ads are limited to a maximum content rating suitable for general audiences (PG).
If, according to the age question (section 3), you could be younger than 16, the App tells Google's consent platform and the AdMob SDK that you are under the age of consent. Google then does not show the consent dialog and only non-personalised ads are requested, regardless of earlier choices.
Where no consent dialog is legally required, ads are served on the basis of our legitimate interest in financing the free game (Art. 6 (1) (f) GDPR or the corresponding local law). You can opt out of personalised ads in your device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy & Security → Tracking / Apple Advertising).
On iOS the system asks for your permission before the App may access the advertising identifier (IDFA). If you do not allow tracking, ads are delivered without the IDFA.
With the optional Founder Pack or Ad-free purchase (section 8) banner ads are removed. Rewarded video ads are only ever shown when you actively choose to watch one.
To monitor whether ads are being delivered correctly, the App reports to our server whether a banner slot was filled or failed, together with the platform, the ad unit, an error code and Google's error message (for example “No fill.”). This report contains no user or device identifier.
How Google uses data from apps that use its services
The App offers optional purchases: the Founder Pack (a one-time purchase that removes banner ads and unlocks the Champion Knight skin, the Founder card frame and a founder number), Ad-free (a one-time purchase that only removes banner ads) and diamond packs (in-game currency; the starter pack can be bought once per account). Payment is processed exclusively by Apple (App Store) or Google (Google Play) under their own terms and privacy policies; we do not receive your payment details.
To validate purchases and restore them on your devices we use our processor RevenueCat, Inc., 633 Taraval St. Suite 101, San Francisco, CA 94116, USA. RevenueCat receives an app user ID, the purchase receipt/token, the product identifier, price and currency, the platform and the app version. If you play as a guest, the app user ID is a random anonymous ID. While you are signed in, the App uses a random purchase ID that our server assigns to your account instead, so that your purchases follow your account to every device. The purchase ID contains neither your account ID, your card code, your name nor your e-mail address, but we can link it to your account.
Diamond packs can only be bought while signed in. Our server asks RevenueCat which purchases belong to your purchase ID and adds each newly bought diamond pack once to the diamond balance of your cloud game progress (section 5). For this we store, linked to your account, a record of each diamond pack purchase: the store, the store's transaction ID, the product, the quantity, the number of diamonds credited, the purchase time and when it was credited.
Founder Pack: while you are signed in (also after you sign in following a purchase as a guest), our server asks RevenueCat in the same way whether a Founder Pack purchase belongs to your purchase ID and gives it the next founder number. Numbers are handed out once, in purchase order, and are never reused; earlier purchases of the former supporter package were numbered first, in the order of their purchase dates. For this we store a founder record: the founder number, the store, the store's transaction ID, the purchase time and, once the purchase is linked to your account, your account and when it was linked. A purchase made before the numbering started that is not linked to an account yet (for example a guest's) is kept with its number but without an account until it is claimed. Your founder number is shown on your player card, and the Founder frame (if you choose it) with your card style, to other players as described in section 6; a hidden card shows neither.
Legal basis: Art. 6 (1) (b) GDPR (performance of the purchase contract) and Art. 6 (1) (c) GDPR (statutory retention obligations for accounting records, up to 10 years).
Retention: diamond purchase records are deleted together with your other online game data (Delete all game data, account deletion or the automatic deletion after 90 days without synchronisation described in section 5). Your founder record is kept when your game data is deleted (by you or automatically), so that your number stays yours, and is deleted when you delete your account; the number is not handed out again. Your purchase ID is kept as long as your account exists, so that diamond packs you have bought are credited once more to your new game data after a deletion of your game data; it is deleted when you delete your account. RevenueCat and the app stores keep their own records of your purchases under their own retention rules; once your account is deleted, we can no longer link the purchase ID they hold to you.
Our game server and the public web pages are hosted by our processor Replit, Inc., 767 Bryant St. #203, San Francisco, CA 94107, USA. To deliver a request, the hosting infrastructure necessarily processes your IP address. Our own server log records each request's method, path (without query parameters), response status, processing time and time stamp, but not your IP address. Individual events, such as an account deletion or an operation that failed, are logged with your pseudonymous account ID. Sign-in requests are passed through our server to Clerk together with your IP address (section 4). We use these logs solely to operate the service securely, to detect abuse and to fix errors.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable operation of the service). Logs are kept for a short period and then deleted or anonymised, unless a specific incident requires longer retention.
If the App runs into a programming error (for example a crash, a screen that fails to load or a save that cannot be read), it sends an error report to our game server. A report contains the error message and the program locations involved (stack trace), the type of error and the part of the App where it was caught, the screen you were on, the app version and build number, the platform (Android or iOS), the operating-system version, how often the error occurred and when. Before sending, the App removes e-mail addresses, account and player IDs, tokens and web-address parameters from the error text; our server removes them again on arrival.
Error reports are sent without your sign-in token and contain no account ID, display name, e-mail address, advertising ID or game progress, so we cannot link them to you or your account. Our server uses your IP address only briefly in memory to limit the number of reports (protection against abuse); it is not stored with the report. Identical errors are combined: we keep a count per day, app version and platform together with the most recent example. Reports that cannot be sent right away (for example while you are offline or right after a crash) are kept in the App's storage on your device for up to 7 days and sent on a later start. Only release versions of the App send reports, not development builds.
We use error reports solely to find and fix errors in the App, not for analytics, advertising or profiling, and we do not pass them on to anyone except our hosting provider Replit. They are deleted automatically after 30 days. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a stable and error-free App).
If you contact us by e-mail, we process the data you send us (e-mail address, content of the message, if applicable your display name or user ID) to handle your request. Legal basis: Art. 6 (1) (b) GDPR if the request relates to a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We delete support correspondence once the matter is closed, unless statutory retention obligations apply.
We share personal data only with the service providers named in this policy (Clerk, Google, RevenueCat, Replit), with Apple and Google as operators of the app stores, and with authorities where we are legally obliged to do so. Processors are bound by data processing agreements under Art. 28 GDPR.
Some of these providers process data in the United States. Transfers are based on the EU-U.S. Data Privacy Framework for certified providers (adequacy decision under Art. 45 GDPR) and otherwise on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) including supplementary measures.
Data Privacy Framework participant list
Under the GDPR you have the following rights with regard to your personal data:
Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time for reasons arising from your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. A list of the German supervisory authorities is available at the link below.
To exercise your rights, contact us at toomuchslimestudios@gmail.com.
German data protection supervisory authorities
The App is not directed at children under 13, and an account may only be created by persons aged 16 or older or with the consent of a parent or guardian. We do not knowingly collect personal data from children. Ads are requested without child-directed treatment but with a general-audience content rating; players who, according to the age question, could be younger than 16 only receive non-personalised ads (section 7). If you believe a child has provided us with personal data, please contact us and we will delete it.
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The automatic name filter (section 6) only rejects a display name and has no other effect; reports are always decided by a person. All connections between the App and our servers are encrypted (TLS). Access to our database is limited to what is needed to operate the game.
We update this policy when the App or the legal requirements change. The current version is always available in the App (Settings → Privacy Policy) and on our website. If a change affects processing that relies on your consent, we will ask for your consent again.