Privacy

Sandbar · Last updated: September 2026

Controller

Xavier Joseph Haas
Barer Straße 45
80799 Munich
Germany
Email: contact@xavierhaas.com

Storage on your device

Without an account, Sandbar stores your islands, shells, purchases, settings and statistics only in your device’s storage. This data is not sent to us. You can remove it at any time in Settings under “Delete all data”; it is also removed when you delete the app.

Account and backup of your islands (optional)

If you sign in under Settings → Account, we process your email address, a random account ID and your game progress (islands, shells, unlocked worlds and statistics). Settings and the running timer stay on the device. The purpose is to back up your islands and keep them in sync across your devices. The legal basis is the performance of the contract for using the app (Art. 6(1)(b) GDPR).

In the iOS app you can also sign in with Apple instead of a code. Apple then gives us an identifier and your email address; if you choose “Hide My Email”, it is a forwarding address from Apple. We don’t ask for your name. Apple’s privacy policy applies to the sign-in itself.

You can also sign in with Google. The sign-in happens on Google’s own page (Google Ireland Limited, Ireland). Google then gives us an identifier, your email address, your name and your profile picture. The app uses only the identifier and the email address; the sign-in service (Supabase, see below) keeps what Google sends with your account until you delete it. Google’s privacy policy applies to the sign-in itself (policies.google.com/privacy).

The account and the backup are stored by Supabase (Supabase Inc., USA) on servers in the EU (Frankfurt am Main). To sign in, we send you a code by email; this is delivered by Resend (Resend, Inc., USA). Both process the data on our behalf (Art. 28 GDPR). Where data reaches the USA, the transfer is safeguarded by the EU Standard Contractual Clauses. Technically necessary log data (such as the IP address and time of a sign-in) is also processed and deleted after a short time.

You can delete your account at any time in the app under Settings → Account → “Delete account”. Your email address and your backed-up islands are then deleted immediately and for good. Everything on your device stays as it is.

Purchases in the iOS app

Purchases (Sandbar Plus, worlds, decor packs) are handled by Apple through the App Store, and Apple’s privacy policy applies to them. So that the app knows what you own, it uses the RevenueCat service (RevenueCat, Inc., USA). This processes a random user ID and your purchase history (which product, when it was bought, how long it is valid). If you are signed in, this ID is your account ID, so your purchases apply on all your devices. Your email address, name or Apple ID are not passed on to RevenueCat. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). RevenueCat also processes data in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses.

Notifications

If you allow it, the app reminds you with a notification when a focus session ends. Your device schedules these notifications itself; no data is transferred.

Fonts and third-party content

All fonts and images ship with the app. Nothing is loaded from other servers.

Web version

The web version is hosted by Vercel Inc. When you open it, the server processes technically necessary data such as your IP address, the time and the file requested, in order to deliver the page and protect it from misuse (Art. 6(1)(f) GDPR).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object. You can also lodge a complaint with a data protection supervisory authority. Simply write to us at the address above.