MAX TD
DE · EN

Privacy Policy

Last updated: 7 September 2026

This is a courtesy translation of the German Datenschutzerklärung. Where the two differ, the German version is the legally binding one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Max Anders, Am Bohnenberg 11A, 21376 Salzhausen, Germany
Email: [email protected]

2. Overview of processing

Max TD is a free browser tower defence game. An account is optional and is only needed to synchronise saves across devices. Without an account (as a guest) the game runs entirely locally in your browser; apart from the server logs that arise technically from hosting, no personal data is processed in that case.

3. Hosting and server log files

This site is hosted on Cloudflare Pages (maxtd.io) and Google Firebase Hosting (td-ted-s-defence.web.app). When the page is requested, the respective hosting provider automatically processes technical connection data (including IP address, date and time of access, requested file, browser type) in server log files. This processing serves to provide and secure the service on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and is deleted automatically after a short time.

Providers: Cloudflare, Inc. (USA) and Google Ireland Limited / Google LLC (USA) — transfers to the USA take place on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4. Local game saves (no cookies)

The game runs as a compiled WebAssembly application and stores saves, settings and statistics locally in the browser's virtual file system (comparable to LocalStorage or IndexedDB). This data does not leave your device as long as you do not create an account.

5. Registration and user account (Firebase Authentication)

If you create an account, we process your email address, your chosen password (encrypted) and your display name via Google Firebase Authentication in order to provide sign-in and cross-device synchronisation. The legal basis is performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Provider: Google Ireland Limited / Google LLC (USA); transfers on the basis of EU Standard Contractual Clauses.

6. Cloud synchronisation of saves (Cloud Firestore)

With an account, your progress, settings and statistics are stored encrypted over a secure connection in the Google Cloud Firestore database so that you can continue playing on several devices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

7. Leaderboards

If you take part in a leaderboard, your chosen display name, your chosen avatar symbol and your score / kill statistics are stored publicly visible to other players. Legal basis: consent through active participation (Art. 6(1)(a) GDPR) — you can end your participation at any time by deleting your account.

The home page (maxtd.io) additionally fetches the current top three entries of this (already public) leaderboard directly from the Firestore database before any sign-in, in order to show them as a preview. No cookies are set and no persistent identifier is stored on your device in the process; the legal basis is our legitimate interest in presenting this public feature (Art. 6(1)(f) GDPR).

8. Advertising — Google AdSense / H5 Games Ads

On maxtd.io we show optional reward videos (watch-ad rewards) via Google AdSense / H5 Games Ads. This may involve processing cookies or comparable technologies and your device's advertising ID in order to deliver and, where applicable, personalise ads. Before personalised ads are shown we obtain your consent through a consent banner (Google Funding Choices) (Art. 6(1)(a) GDPR, § 25 TDDDG). You can change or withdraw your choice at any time — the button for that sits directly below this paragraph. Further information: Google's advertising technologies policy and Google "Ads & Data".

Provider: Google Ireland Limited / Google LLC (USA); transfers on the basis of EU Standard Contractual Clauses.

9. US state privacy rights (California and others)

We do not sell your personal information for money. However, showing personalised advertising through Google may count as "sharing" or a "sale" for cross-context behavioural advertising under some US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.

To opt out of that, use the Change privacy settings button in section 8 above, or email us at [email protected] — an email request is honoured regardless of whether the button works in your browser.

Depending on your state of residence you may have the right to know what personal information we hold about you, to access a copy of it, to have it deleted or corrected, to opt out of its sale or sharing and of targeted advertising, and not to be discriminated against for exercising any of these rights. Section 12 below describes how to delete your account and data yourself, immediately and without contacting us.

10. Consent at account creation

When registering you actively confirm by checkbox that you have read and accept this privacy policy and our Terms of Use. To that end we store the time of your agreement and the version of the documents agreed to in your account, in order to be able to demonstrate consent within the meaning of Art. 7(1) GDPR.

11. Minimum age

Creating an account requires a minimum age of 16 under Art. 8 GDPR, or the consent of a parent or guardian for younger users. The game itself can be played without an account (as a guest) at any age, since no processing requiring consent takes place in that case.

12. Retention

We store account data and saves for as long as your account exists. After you delete your account your personal data is deleted, unless statutory retention obligations prevent this. Server log files are erased automatically after a short time.

13. Deleting your account and data

A dedicated page with all the steps is available at Delete account.

You can delete your account yourself, completely, at any time — inside the game, without asking us:

  1. Open Account from the main menu and sign in.
  2. Choose DELETE ACCOUNT at the bottom.
  3. Type DELETE into the confirmation field and confirm.

Deletion happens immediately and cannot be undone. The following are deleted:

Your local progress on the device is kept; you continue as a guest afterwards. To remove that as well, uninstall the app or clear the site data in your browser.

If you no longer have access to your account, an informal email from your registered address to [email protected] is enough. We will then delete the account within 30 days.

14. Your rights as a data subject

Simply email [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.

15. Changes to this privacy policy

We adapt this privacy policy as soon as the data processed or the legal requirements change. The version published on this page applies.