Privacy Policy – Codex TCG Companion

Effective date: 9 November 2026

Last updated: 2026-11-10

This Privacy Policy describes how Team CodeX GmbH (“we”, “us”) processes information in connection with the Android application Codex TCG Companion (package name com.teamcodex.trainertcg) (the “App”). This policy is provided in English and applies to all App languages (English, German, Spanish, French, Italian, Dutch, Portuguese and Turkish).

1. Controller

Controller for the processing described in this policy:

Controller identity details (address, register court, HRB, contact email, managing director) are taken from the published Team CodeX GmbH Impressum / Datenschutzerklärung hosted on Cloudflare Pages at https://team-codex.pages.dev/impressum.html and https://team-codex.pages.dev/datenschutz.html (canonical targets on www.team-codex.com). Re-verified by read-only fetch on 10 November 2026 (Europe/Berlin). The spelling used throughout this policy is Team CodeX GmbH, matching that Impressum and the previous version of this policy.

2. What the App does

Codex TCG Companion is a free Android utility that provides a live, on-device match board and damage counter for 1v1 tabletop trading-card-game play, plus a private on-device History with win-rate stats. On the board you can track damage and HP and special conditions for Active and Bench slots, energy and tools, and prizes; use a poison/burn checkup helper; flip a coin or roll a die; and undo without limit. Finished matches can be saved to a local-only History that you can export as JSON or text (via your device share sheet) or clear in the App. Match board and History data stay only on your device. The App does not create user accounts, does not sync that data to the cloud, does not operate an App backend for match or History data, does not upload that data to Team CodeX GmbH, and does not use branded third-party game assets or official game APIs.

Optional features:

• A single small TOP banner advertisement via Google AdMob, shown only after Google User Messaging Platform (UMP) consent where required by applicable law. UMP presents a Transparency and Consent Framework (TCF) v2.2 message where required.
• An optional auto-renewing monthly “remove ads” subscription via Google Play Billing at a base price of €0.99 per month, with Google Play localized regional pricing. The subscription only removes the banner. This is a subscription only — there is no one-time purchase to remove ads. All core App features (including the board, History, statistics and export) remain free.

Target audience: 13+; the App is not designed for children.

3. Data we process

3.1 On-device match board and History (local only)

Live board state and History entries you create are stored locally on your device for App functionality. This data is not transmitted to Team CodeX GmbH servers, because the App has no match-data backend and does not sync to the cloud. Exporting History creates a file on your device and opens the system share sheet; it does not upload History to us or to an App server. Clearing History in the App deletes saved matches on the device; files you have already exported or shared stay where you saved them. Deleting the App or clearing App data also removes this local data (subject to your device backup settings).

Legal basis (where GDPR applies): Art. 6(1)(b) GDPR (performance of the service you request) and/or Art. 6(1)(f) GDPR (legitimate interest in providing local App features).

3.2 Advertising – Google AdMob and Google User Messaging Platform (UMP)

If ads are enabled and consent / legitimate-interest signals permit under applicable law, the App shows a single small TOP banner via the Google Mobile Ads SDK (AdMob). Consent is collected where required via the Google User Messaging Platform (UMP), including an IAB Europe Transparency and Consent Framework (TCF) v2.2 message where required.

If you decline consent, or consent is not given, the App may still show the banner as non-personalised (or limited) ads. These are not based on your profile or past behaviour, but Google may still process limited device and request data (for example IP address and advertising identifiers where permitted) for ad delivery, frequency capping, fraud prevention and aggregated reporting. You can change your choice at any time through the privacy / consent option in the App.

Android permissions

The release version of the App (versionCode 46 / versionName 0.1.0) requests only these permissions: INTERNET and ACCESS_NETWORK_STATE (loading ads and Google Play Billing), com.android.vending.BILLING (the optional remove-ads subscription), com.google.android.gms.permission.AD_ID and ACCESS_ADSERVICES_AD_ID / ACCESS_ADSERVICES_ATTRIBUTION / ACCESS_ADSERVICES_TOPICS (advertising identifier and Android Privacy Sandbox APIs used by the Google Mobile Ads SDK, subject to your device settings and consent), and WAKE_LOCK (added by the Google Mobile Ads SDK / Android WorkManager for short background tasks). The merged manifest also declares a signature-protected permission, com.teamcodex.trainertcg.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, which AndroidX uses so dynamically registered broadcast receivers are not exported to other apps; it is not used to collect personal data. The App does not request location, contacts, camera, microphone, storage or foreground-service permissions.

The release binary includes transitive Google Play services libraries used by the ads stack (including location and measurement artifacts). The App does not request a device location permission and does not use those libraries to read GPS or fine/coarse location. Any approximate location processed for advertising is derived by Google from IP address, as described in Google’s AdMob disclosure below. The measurement artifacts are part of the Google Mobile Ads SDK stack; the App does not include a separate first-party analytics or crash-reporting product such as Firebase Analytics or Crashlytics.

According to Google’s current Google Play data disclosure for the Google Mobile Ads SDK (Legacy), the SDK may automatically collect and share, for advertising, analytics, and fraud-prevention purposes:

• Device and advertising identifiers (including the Android advertising ID and App Set ID)
• Approximate location derived from IP address
• Ad and app interactions (e.g. app launch, taps, video views)
• Diagnostic information (e.g. app launch time, hang rate, energy usage)

Source (Google Developers, checked 9 November 2026; wording unchanged for this update): https://developers.google.com/admob/android/privacy/play-data-disclosure.

Google states that data collected by the SDK is encrypted in transit (TLS). The advertising ID can be reset or deleted in Android settings. Further information:

• https://support.google.com/admob/answer/11402075
• Google Privacy Policy: https://policies.google.com/privacy
• How Google uses information from sites or apps that use Google services: https://policies.google.com/technologies/partner-sites

Legal basis (where GDPR applies): Art. 6(1)(a) GDPR (consent) where consent is required (e.g. personalized ads / non-essential storage); otherwise Art. 6(1)(f) GDPR only where permitted for strictly limited purposes such as fraud prevention / limited ads, subject to UMP / IAB TCF v2.2 signals and applicable law.

No separate first-party analytics SDK (for example Firebase Analytics or Crashlytics) is included in the current App. If one is added later, this policy and the Play Data safety form will be updated before shipping.

3.3 Purchases – Google Play Billing (optional monthly “Remove ads” subscription)

If you subscribe to the optional auto-renewing monthly “remove ads” plan, payment is processed by Google Play Billing. The subscription only removes the banner. There is no one-time / lifetime purchase option. Base price: €0.99 per month, with Google Play localized regional pricing.

Purchase records are handled by Google. We do not receive your full payment card details. The App only receives the entitlement / subscription status needed to hide the banner (for example purchase tokens or subscription status via the Play Billing Library).

Google’s handling of payment data is governed by the Google Privacy Policy and the Google Payments Privacy Notice:

• https://policies.google.com/privacy
• Google Payments Privacy Notice: https://payments.google.com/legaldocument?family=0.privacynotice

Legal basis (where GDPR applies): Art. 6(1)(b) GDPR (contract / requested subscription) and Art. 6(1)(c) where retention is legally required for accounting.

3.4 What we do not do (current App design)

• No Team CodeX user accounts or login
• No App-operated cloud sync or match/History-data backend, and no server upload of board or History data
• No branded official game APIs or branded card/asset downloads from rights holders
• No confirmed separate first-party analytics product (see §3.2)
• Not designed for children; target audience 13+
• No one-time remove-ads purchase — subscription only, and it only removes the banner

4. Sharing

Match board and History data stay on device and are not shared by us. Advertising SDKs share data with Google (and Google’s advertising partners) as described above and in Google’s documentation. Purchase records are handled by Google; the App does not share purchase history onwards. We do not sell personal data.

5. International transfers

Google may process data in the United States and other countries. Where GDPR applies, Google relies on mechanisms such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses as described in Google’s documentation. Hosting of this privacy policy page (when published on Cloudflare Pages) may involve Cloudflare processing as described in the Team CodeX website Datenschutzerklärung.

6. Retention

• Local match board / History: until you delete entries or clear History in the App, clear App data, or uninstall (device backups and files you already exported may retain copies outside our control).
• Ad / consent / SDK data: retained by Google per Google’s policies and your device / consent choices.
• Subscription / entitlement records: purchase records are retained by Google; the App keeps only the entitlement status needed to provide the subscription, and Google may retain records to meet legal accounting obligations.

7. Your rights

Depending on applicable law (including GDPR), you may have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. The App does not create an account, so there is no in-App account-deletion request. You can clear History in the App, or delete local data by clearing App storage or uninstalling. To exercise rights regarding other data we control, contact yasin.yildiz@team-codex.com. For advertising ID / Google account / Play subscription data held by Google, use Google’s account and device controls, or contact Google as described in its privacy policy and Payments Privacy Notice.

You may lodge a complaint with a supervisory authority. For Team CodeX GmbH this includes the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (as stated in the published Team CodeX Datenschutzerklärung).

8. Children

The App is intended for users aged 13 and older and is not designed for children. We do not knowingly direct the App at children under 13.

9. Changes

We may update this Privacy Policy when the App’s data practices change. The effective / last-updated date will be revised. Material changes should be reflected in the Play Store Data safety section before shipping.

10. Contact

Team CodeX GmbH – yasin.yildiz@team-codex.com