MAX TD

Privacy Policy

Last updated: 18 October 2026

This is a courtesy translation of the German Datenschutzerklärung. Where the two differ, the German version is the legally binding one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Max Anders, Am Bohnenberg 11A, 21376 Salzhausen, Germany
Email: [email protected]

2. Overview of processing

Max TD is a free tower defence game in the browser and as an app for iOS and Android; this privacy policy covers all three. An account is optional. It is needed to synchronise saves across devices, to take part in leaderboards and to send feedback; with an account we also record gameplay statistics (section 9). Without an account (as a guest) the game runs entirely locally on your device; apart from the server logs that arise technically from hosting and — in the browser only — the advertising described in section 10, no personal data is processed in that case; the game only counts anonymously how many rounds are played per day and game mode (section 9).

3. Hosting and server log files

This site is hosted on Cloudflare Pages (maxtd.io) and Google Firebase Hosting (td-ted-s-defence.web.app). When the page is requested, the respective hosting provider automatically processes technical connection data (including IP address, date and time of access, requested file, browser type) in server log files. This processing serves to provide and secure the service on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and is deleted automatically after a short time.

Providers: Cloudflare, Inc. (USA) and Google Ireland Limited / Google LLC (USA) — transfers to the USA take place on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4. Local game saves (no cookies)

The game stores saves, settings and statistics locally — in the browser in the virtual file system of the WebAssembly application (comparable to LocalStorage or IndexedDB), in the apps in the device's app storage. This data does not leave your device as long as you do not create an account.

5. Registration and user account (Firebase Authentication)

If you create an account, we process your email address, your chosen password (encrypted) and your display name via Google Firebase Authentication in order to provide sign-in and cross-device synchronisation. The legal basis is performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Provider: Google Ireland Limited / Google LLC (USA); transfers on the basis of EU Standard Contractual Clauses.

6. Cloud synchronisation of saves (Cloud Firestore)

With an account, your progress, settings and statistics are stored encrypted over a secure connection in the Google Cloud Firestore database so that you can continue playing on several devices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

7. Leaderboards

If you take part in a leaderboard, your chosen display name, your chosen avatar symbol and your score / kill statistics are stored publicly visible to other players. Legal basis: consent through active participation (Art. 6(1)(a) GDPR) — you can end your participation at any time by deleting your account.

The home page (maxtd.io) additionally fetches the current top three entries of this (already public) leaderboard directly from the Firestore database before any sign-in, in order to show them as a preview. No cookies are set and no persistent identifier is stored on your device in the process; the legal basis is our legitimate interest in presenting this public feature (Art. 6(1)(f) GDPR).

8. In-game feedback

When signed in you can send us a message through the feedback form in the game (at most one per day). We store the chosen topic, the title and your text together with your user ID, your display name, the game's version number, the platform (browser, iOS or Android) and the time, in the Google Cloud Firestore database. Only we can read these messages. We use them solely to read and process your message and to fix reported bugs; they are not passed on to third parties.

The legal basis is handling your request (Art. 6(1)(b) GDPR) and, for the version number and platform, our legitimate interest in being able to trace a reported bug (Art. 6(1)(f) GDPR). Provider and data transfer as in section 6.

9. Gameplay statistics

With an account, the game additionally transmits individual gameplay events — such as the end or abandonment of a round — with details such as stage, game mode, duration and values reached. These events are stored together with your user ID and your display name in the Google Cloud Firestore database and can only be viewed by us. We use them to understand how the game is played and to improve difficulty and fix bugs. They are neither passed on to third parties nor used for advertising or to track you across other apps or websites. No gameplay events relating to you are transmitted when you play without signing in (as a guest). At the end of a round lasting at least one minute, the game merely increases an anonymous daily counter for the game mode by one. No user or device ID, name or save data is transmitted; only the number of rounds per day and game mode is stored. This does not allow any conclusions about you. The IP address that technically arises during transmission is not stored with the counter.

The legal basis is our legitimate interest in improving the game (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR); an informal email to [email protected] is enough, and we will then delete the gameplay events stored for your account. Provider and data transfer as in section 6.

10. Advertising — Google AdSense / H5 Games Ads

On maxtd.io we show optional reward videos (watch-ad rewards) via Google AdSense / H5 Games Ads. This may involve processing cookies or comparable technologies and your device's advertising ID in order to deliver and, where applicable, personalise ads. Before personalised ads are shown we obtain your consent through a consent banner (Google Funding Choices) (Art. 6(1)(a) GDPR, § 25 TDDDG). You can change or withdraw your choice at any time — the button for that sits directly below this paragraph. Further information: Google's advertising technologies policy and Google "Ads & Data".

Provider: Google Ireland Limited / Google LLC (USA); transfers on the basis of EU Standard Contractual Clauses.

11. US state privacy rights (California and others)

We do not sell your personal information for money. However, showing personalised advertising through Google may count as "sharing" or a "sale" for cross-context behavioural advertising under some US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.

To opt out of that, use the Change privacy settings button in section 10 above, or email us at [email protected] — an email request is honoured regardless of whether the button works in your browser.

Depending on your state of residence you may have the right to know what personal information we hold about you, to access a copy of it, to have it deleted or corrected, to opt out of its sale or sharing and of targeted advertising, and not to be discriminated against for exercising any of these rights. Section 15 below describes how to delete your account and data yourself, immediately and without contacting us.

12. Consent at account creation

When registering you actively confirm by checkbox that you have read and accept this privacy policy and our Terms of Use. To that end we store the time of your agreement and the version of the documents agreed to in your account, in order to be able to demonstrate consent within the meaning of Art. 7(1) GDPR.

Newsletter (optional). Below it there is a second checkbox, not pre-ticked. If you tick it, you agree that we may occasionally email you news about Max TD (new versions, content, promotions) at the address you registered with. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) German Unfair Competition Act). We store "newsletter yes/no" and the time of your consent in your account. Creating an account does not depend on it. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter or by email to [email protected]. After unsubscribing you will not receive any further newsletters; the entry is deleted at the latest when you delete your account (section 15).

13. Minimum age

Creating an account requires a minimum age of 16 under Art. 8 GDPR, or the consent of a parent or guardian for younger users. The game itself can be played without an account (as a guest) at any age, since no processing requiring consent takes place in that case.

14. Retention

We store account data, saves, feedback messages (section 8) and gameplay events (section 9) for as long as your account exists and delete them when you delete your account (section 15), unless statutory retention obligations prevent this. Server log files are erased automatically after a short time.

15. Deleting your account and data

A dedicated page with all the steps is available at Delete account.

You can delete your account yourself, completely, at any time — inside the game, without asking us:

  1. Open Account from the main menu and sign in.
  2. Tap DELETE in the top right corner.
  3. Type DELETE into the confirmation field and confirm.

Deletion happens immediately and cannot be undone. The following are deleted:

Your local progress on the device is kept; you continue as a guest afterwards. To remove that as well, uninstall the app or clear the site data in your browser.

If you no longer have access to your account, an informal email from your registered address to [email protected] is enough. We will then delete the account within 30 days.

16. Your rights as a data subject

Simply email [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.

17. Changes to this privacy policy

We adapt this privacy policy as soon as the data processed or the legal requirements change. The version published on this page applies.