Privacy Notice for the “Fortune of AIMA” App

Effective as of 16.10.2026

When using the Fortune of AIMA app (hereinafter: “App”), we process personal data (hereinafter: “Data”) and other information about you. Personal data means any information relating to an identified or identifiable natural person. With the following information, we would like to inform you which personal data we process when you use the App and how we handle this Data.

In addition, we inform you about the legal basis for processing your Data and, where processing is necessary to safeguard our legitimate interests, also about our legitimate interests.

You can access this Privacy Notice at any time in the privacy section of the App and at the following address:

https://bluefortune.net/privacy

A. General Information on Data Protection and Data Subject Rights

I. Who is responsible for data processing and whom can I contact if I have questions?

This App is provided by Volutria1 UG (haftungsbeschränkt), c/o Hanyka, Hauptstr. 21 85586 Poing, info@volutria.net (hereinafter: “Provider” or “we”) as the controller within the meaning of the EU General Data Protection Regulation (“GDPR”).

Insofar as we collect, process or use Data and other information, we comply with the applicable statutory provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Within the App, we enable access to and display of the following information and functionalities:

• various games and game histories
• virtual game progress and virtual Activity Points (“AP”)
• virtual stakes, bonuses, inventories and rewards
• MysteryBoxes, boosters, skills and Skill Cards
• predefined in-app avatars
• public profiles and leaderboards
• Category multiplayer lobbies with free-text answers and ratings
• optional internal usage analytics
• banner advertising and voluntary rewarded advertisements (“Rewarded Ads”) via Google AdMob
• push notifications via Firebase Cloud Messaging
• data export and functions for deleting analytics data and user accounts

II. What rights do I have regarding my personal data?

If your personal data is processed, you may have the rights described below as a “data subject” within the meaning of the GDPR. If you wish to exercise rights against us as the “controller,” we recommend that you contact us using the contact details provided above:

• Right of access (Art. 15 GDPR): You may request information about the Data processed, its source, recipients and the purpose of the processing.
• Right to rectification (Art. 16 GDPR): If Data is inaccurate or incomplete, you may request that it be corrected.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your Data, provided that no statutory retention periods or legitimate interests prevent this.
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you may request restriction of processing.
• Right to data portability (Art. 20 GDPR): You may request that Data you have provided to us be made available in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your Data at any time where such processing is based on a legitimate interest.
• Withdrawal of consent (Art. 7 para. 3 GDPR): If you have given us consent to process Data, you may withdraw this consent at any time with effect for the future.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority in the event of violations of applicable data protection law. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, telephone: +49 (0) 981 180093-0; email: poststelle@lda.bayern.de.

III. Data Processing in Connection with the App

Certain Data and information is processed automatically as soon as you use the App. We have listed below exactly which Data and information is processed.

1. Data and information collected when downloading the App

When downloading the App, certain required Data and information is transmitted to the app store you have selected that offers the App (e.g. Google Play or Apple App Store).

In particular, your username, email address, your account customer number, the time of download, payment information and the individual device identifier may be processed. This Data and information is processed exclusively by the respective app store and is outside our responsibility and control.

2. Data and information collected during use

As part of your use of the App, we collect certain Data and information that is required for use of the App. This includes:

This Data and information is transmitted to us or processed by us (1) to provide you with the App and the associated functions; (2) to improve the functions and features of the App; and (3) to prevent and remedy misuse and malfunctions.

The processing of Data is justified because the processing is necessary for the performance of the user agreement between you and us on the basis of our Terms of Use applicable at the relevant time pursuant to Art. 6 para. 1 lit. b GDPR for use of the App. In addition, we have a legitimate interest in ensuring the functionality and error-free operation of the App and in being able to provide a service that is appropriate to the market and users’ interests.

These purposes outweigh any conflicting rights and interests in the non-processing of your personal data within the meaning of Art. 6 para. 1 lit. f GDPR. The above information is also necessary for providing the service pursuant to Section 25 para. 2 no. 2 TDDDG.

3. Who receives my Data?

Apart from the cases explicitly mentioned in this Privacy Notice, your Data will only be disclosed without your express prior consent where this is legally permitted or required.

The following recipients receive your Data for the initiation or performance of the user agreement via the App pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR or on the basis of our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR:

Only those employees or organizational units receive your Data that require it to fulfill our contractual and statutory obligations or to process or pursue our legitimate interests.

If we use a service provider as a processor within the meaning of Art. 28 GDPR, we nevertheless remain responsible for protecting your Data. Where required by law, processors are contractually obligated by means of a data processing agreement to treat your Data confidentially and to process it only in the context of providing the services.

The processors commissioned by us receive your Data insofar as they require it to provide the respective service for which we have commissioned them.

Your Data will only be transmitted to government institutions and authorities, or collected for this purpose, where required by mandatory national statutory provisions.

4. Use without a registered user account, creation of a personal user account (registration) and login

The App can be used without a registered user account. During such use, our system creates a random internal user ID and an unregistered user reference in order to assign your game progress, AP, games and rewards to the same use session.

An inactive unregistered user reference and the associated Data will be deleted after 30 days without activity, provided there are no permissible reasons preventing further storage.

If you create a registered user account or log in, we use your login details (username and password) to grant you access to and manage your user account (“required information”). The password is not stored in plain text.

After successful registration, an internal user ID is used by the system to assign your user account.

In addition, you may voluntarily select a display name and one of the avatars provided in the App.

Fortune of AIMA does not require an email address, telephone number, legal name, postal address or social-login account for registration. Because no email address or telephone number is collected for recovery purposes, conventional password recovery by email or SMS is not possible.

We use the required information to authenticate you when logging in, manage your user account and enforce the Terms of Use of the App as well as all associated rights and obligations.

We use voluntary information to display it in accordance with the respective App function and to make it accessible to other users of the App.

This Data processing is justified because the processing is necessary for the performance of the agreement between you as the data subject and us pursuant to Art. 6 para. 1 lit. b GDPR for use of the App, or because we have a legitimate interest in ensuring the functionality and error-free operation of the App, which outweighs your rights and interests in the protection of your personal Data within the meaning of Art. 6 para. 1 lit. f GDPR.

5. General Data Processing When Using the App

Unless we ask you for consent pursuant to Art. 6 para. 1 lit. a GDPR or Section 25 para. 1 TDDDG, usage Data is processed to provide the service. This Data processing is justified because the processing is necessary for the performance of the agreement between you and us pursuant to Art. 6 para. 1 lit. b GDPR for use of the App. In this case, information stored on your device or collected from it is also necessary for providing the service pursuant to Section 25 para. 2 no. 2 TDDDG.

When using the App and its functionalities, we process your Data on the above bases for the following specific purposes:

Permissions

Within the App, you may at your own discretion enter, manage and edit various Data and information, for example in connection with profile management, games, the Category multiplayer mode and data export. In particular, the App requires the following permissions:

• Internet/network access: This is required to store your content on our servers and provide the online functions of the App.
• Local or secure device storage: This is required to store necessary settings, login information and privacy decisions on your device.
• Audio output and haptic feedback: These are used to reproduce the corresponding App effects.
• File and sharing functions: These are required for a data export requested by you.
• Notifications: This permission is required to display push notifications on your device. You can change or disable this permission at any time via your operating system settings.

Fortune of AIMA does not require access to your contacts, camera, microphone, precise GPS location, health, fitness or biometric Data, Bluetooth information, bank account or payment card Data for its own App functions.

Games, Game Progress and Virtual Content

To conduct the games, we process your game progress, AP and virtual transactions, bonuses, inventory, MysteryBoxes, rewards, boosters, skills, as well as game and round information and results.

We use this Data to conduct games, provide progress and virtual content, correctly calculate results and AP, display game histories and leaderboards, and prevent misuse or manipulation.

Game results are generated automatically. The calculations relate exclusively to the course of the game, virtual AP and virtual items. They do not produce legal effects and do not similarly significantly affect you within the meaning of Art. 22 GDPR.

Profiles and Leaderboards

If you use profile, leaderboard or multiplayer functions, other authenticated users may, depending on the function, see your username, optional display name, predefined avatar, public profile, game statistics, leaderboard positions and results.

This visibility is part of the function used by you and is based on Art. 6 para. 1 lit. b GDPR.

Category Multiplayer Mode

If you use the Category multiplayer mode, we process the participant, game, free-text, rating and score Data required for the lobby and the shared game. Participants in the same lobby can see the information required for the shared game.

Free-text answers may contain any content. In particular, do not enter information there that you do not want other users to see.

A lobby expires twelve hours after it is created. The lobby and the associated participant, round, free-text, rating and score Data are automatically deleted no later than approximately 36 hours after creation.

Reports and Moderation

If you believe that a display name, a Category answer, a lobby or other user content made accessible via Fortune of AIMA infringes rights, violates statutory provisions or violates the Terms of Use, you can report the content using the function provided for this purpose or by email to info@volutria.net.

We process the information collected in this context in order to review reports, implement necessary measures and, where applicable, process complaints against a decision. Final moderation decisions are not made exclusively by automated means.

Processing is carried out pursuant to Art. 6 para. 1 lit. b GDPR insofar as it is necessary to enforce the Terms of Use and perform the user relationship, pursuant to Art. 6 para. 1 lit. c GDPR insofar as statutory obligations exist, and otherwise pursuant to Art. 6 para. 1 lit. f GDPR.

Optional Internal Usage Analytics

Fortune of AIMA offers optional internal usage analytics. This remains disabled unless you actively enable it.

If analytics is enabled, pseudonymous usage events, App areas and game types used, changes to virtual AP, results and timestamps may be processed. We use this information to understand use of the App and improve Fortune of AIMA.

Processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. Insofar as information is stored on or read from your device for this purpose, this is carried out pursuant to Section 25 para. 1 TDDDG.

Advertising and Rewarded Ads

Fortune of AIMA uses Google AdMob to display banner advertising and voluntary Rewarded Ads, as well as the Google User Messaging Platform (“UMP”) to display and manage privacy decisions for advertising.

Depending on your location, your decisions and the operating system settings, personalized advertising, non-personalized advertising, restricted advertising (“Limited Ads”) or no advertising may be displayed.

Personalized advertising, cross-app tracking and non-essential advertising measurement are only used where the required consent has been given. On iOS, authorization under App Tracking Transparency (“ATT”) may additionally be required.

Before beginning to use the App, users select a broad age group. The selection is stored exclusively locally on your device. Users under the age of 16 cannot use Fortune of AIMA.

For users aged 16 or 17, Fortune of AIMA requests non-personalized advertising for all banner and Rewarded Ads.

Rewarded Ads are voluntary. After successful completion of such an advertisement, Fortune of AIMA may grant a virtual reward.

Push Notifications

Fortune of AIMA may send you push notifications insofar as you have permitted their receipt on your device. For the technical provision of push notifications, we use Firebase Cloud Messaging (“FCM”), a service provided by Google.

As part of FCM, in particular a Firebase Installation ID or an FCM registration token is assigned to an App installation, and technically required App and device information is processed. The FCM registration token is used to address push notifications to a specific App installation. On Apple devices, FCM messages are technically delivered via the Apple Push Notification Service (“APNs”). Google also states that information regarding the delivery of and interaction with notifications may be processed as part of FCM.

Insofar as push notifications serve to provide an App function used or activated by you, processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. Insofar as we send push notifications on the basis of your consent, processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR. You can disable the receipt of push notifications at any time via your operating system settings.

Insofar as technically required information is stored on or read from your device for the push function activated by you, this is carried out on the basis of Section 25 para. 2 no. 2 TDDDG.

Data Export and Deletion

Registered users can request a structured export of their own information stored in the App via the App.

The export file is temporarily created on your device and is only passed on to the app, service or person selected by you via the sharing menu.

You can delete existing internal analytics Data without deleting your user account. You can delete a registered user account using the function provided for this purpose in the App or at https://bluefortune.net/delete

External Discord Link

Fortune of AIMA may display a link to Discord. Merely displaying the link does not transmit any Data to Discord. If you select the link, further processing is carried out in accordance with the privacy policies of Discord and the system used by your device.

6. Services and Service Providers Integrated for Use of the App

6.1. Hosting with Hetzner and Creation of Log Files

For hosting the App and storing personal Data, we use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a technical hosting service provider.

When using the App, technically necessary connection and log Data is transmitted to our servers operated by Hetzner. In particular, the following Data may be processed:

• IP address
• date and time of access
• operating system used
• App version or technical device information
• technically required request and log Data

Hetzner processes this Data on our behalf. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Hetzner.

The processing is necessary to technically provide the App and ensure secure, stable and functional operation. The legal basis for processing in connection with hosting is Art. 6 para. 1 lit. b GDPR insofar as the processing is necessary to provide the App and perform the user relationship.

Insofar as Data is processed to ensure IT security, analyze errors, detect misuse and optimize technical stability, processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable and error-free provision of the App.

Insofar as information on the end device is accessed or such information is processed where technically necessary, this is carried out on the basis of Section 25 para. 2 no. 2 TDDDG.

6.2. Google AdMob and Google User Messaging Platform

Fortune of AIMA uses Google AdMob to display banner advertising and voluntary Rewarded Ads, as well as the Google User Messaging Platform (“UMP”) to display and manage privacy decisions for advertising.

The contractual partner for our German AdMob publisher account is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Depending on the respective service and processing operation, Google LLC in the United States, other Google group companies, subcontractors and advertising technology partners named through Google’s privacy interface may also process Data.

Depending on the device, location, privacy decision and advertising mode, in particular the IP address, an approximate region derived from it, device, App and operating system information, permitted advertising or App identifiers, App and advertising interactions, as well as diagnostic and security Data may be processed.

Personalized advertising, cross-app tracking, access to advertising identifiers and other non-essential access to or storage of information on your device is carried out only with the required consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG.

Insofar as processing is not subject to a consent requirement and is necessary for the secure and economical provision of advertising as well as fraud prevention, it may be based on Art. 6 para. 1 lit. f GDPR.

For Rewarded Ads, our backend receives limited transaction and confirmation Data after successful completion in order to assign the virtual reward and prevent duplicate or abusive granting.

The technically necessary local storage of your current privacy decision is carried out pursuant to Section 25 para. 2 no. 2 TDDDG.

Fortune of AIMA does not use any additional external analytics provider.

6.3. Firebase Cloud Messaging

For the technical provision of push notifications, we use Firebase Cloud Messaging (“FCM”), a service provided by Google. With regard to personal Data that they transmit to Firebase, Firebase customers are generally controllers within the meaning of the GDPR; Google generally processes such Data as a processor for Firebase services.

As part of FCM, in particular Firebase Installation IDs, FCM registration tokens as well as technically required App and device information may be processed. The registration token identifies a specific App installation and is required for the delivery of messages.

Firebase Cloud Messaging is operated on Google’s global infrastructure. Processing may therefore also take place outside the European Economic Area. For international Data transfers, the statutory transfer mechanisms provided by Google for this purpose apply, in particular adequacy decisions and standard contractual clauses.

VI. How Long Is My Data Stored?

Your Data is used only for the purpose for which you provided it to us or for whose processing you gave us your consent, and is stored until that specific purpose has been fulfilled. After the purpose has been fully completed, or as soon as you request that we erase your Data, your Data will only be stored for as long as necessary due to statutory limitation periods or retention periods.

At the latest after all such periods have expired, the Data will be erased unless you have expressly consented to further or different use. You may also exercise rights during retention periods, such as restriction of your Data. See Section A. II. above.

An inactive unregistered user reference and the associated Data will be deleted after 30 days without activity, provided there are no permissible reasons preventing further storage.

Category lobbies expire twelve hours after creation. The associated participant, round, free-text, rating and score Data are automatically deleted no later than approximately 36 hours after creation.

Information processed by Google and participating advertising partners is stored in accordance with the retention rules of the respective provider.

The locally stored age group remains stored until it is corrected, the App Data is deleted or a new selection is required. A selection of “16 to 17” is requested again after no more than twelve months.

Firebase Installation IDs and FCM registration tokens are processed for as long as this is necessary to provide push notifications. Registration tokens may be renewed by Firebase or become invalid. Insofar as corresponding tokens are stored on our servers, they are retained only for as long as they are required for the push function.

Unless otherwise stated, we store your personal Data for the duration of the user or contractual relationship via the App plus a period that is reasonable under data protection law, during which we retain backup copies after deletion, unless such Data is required for a longer period for criminal prosecution in the event of misuse or to secure, assert or enforce legal claims.

Specific information in this Privacy Notice or legal requirements regarding the retention and erasure of personal Data remain unaffected.

VII. Is Personal Data Transferred to a Third Country?

The Fortune of AIMA backend, database, logs and backup copies are hosted on Hetzner infrastructure in Germany. Through this hosting infrastructure, we do not transfer the backend and database Data stored there to a third country outside the European Economic Area.

International Data processing may take place in connection with Google AdMob, UMP, Rewarded Ads, Firebase Cloud Messaging and advertising technology partners involved in an advertising request. Personal Data may in particular be processed by Google LLC, other Google group companies, subcontractors or advertising partners outside the European Economic Area, particularly in the United States.

Depending on the recipient and processing operation, transfers may be based on an adequacy decision, a valid certification under the EU-US Data Privacy Framework, standard contractual clauses approved by the European Commission or another legally recognized transfer mechanism.

B. Miscellaneous

Due to the further development of our App or our other offerings, as well as changed statutory or regulatory requirements, it may become necessary to amend this Privacy Notice. You can access the current version of the Privacy Notice in the App at any time.

FORTUNE OF AIMA · Volutria1 UG (haftungsbeschränkt)