Privacy Policy

Trollvakt asks you to register nothing, keeps no profile of you, posts no scores to any server, carries no advertising, measures nothing and runs no mailing list. Underneath all of those absences lies one that makes them checkable instead of merely stated: the published package declares no internet permission. Android will not open a connection for an application that has not asked for one, so the question of what this game transmits has a mechanical answer rather than a reassuring one.

Your defences, your stars and your furthest wave are written into the storage area Android sets aside for this app alone. They stay on the handset. Nowhere does a copy of them exist in our hands, which means there is nothing of yours here to guard, mislay, sell or be compelled to produce.

Eleven posts are nailed up below, and the war table above lists them. Together they answer what the General Data Protection Regulation requires a notice like this to answer; the eleventh says where to take a disagreement.

In Article 4(7) the word "controller" belongs to whoever decides a processing operation's purpose and the manner of carrying it out. Attached to this page the title brings a single genuine duty: that these posts were written honestly, and that somebody answers for any of them which proves otherwise.

There is no data protection officer here. Article 37 makes the appointment compulsory for a public authority, for an undertaking whose core activity is systematic monitoring at scale, and for one handling special categories at scale. A company selling timber measurement, with a game on the side that transmits nothing, is none of the three.

A campaign has to be remembered between sittings or it would be no campaign. The complete list:

• Maps cleared, and the star rating earned on each, so the map screen can show where the line held.
• The furthest wave reached on maps not yet cleared.
• A game in progress — tower positions, upgrade levels, coin in hand, the wave counter — so leaving mid-defence does not forfeit it.
• Settings: sound, speed preference, whether the range circles are shown, reduced motion.

Then read the list for what it lacks. No name is asked. No address of any kind is stored. The Android advertising identifier is never read. No set of device characteristics is gathered into anything that could serve as a fingerprint. And no installation number is generated, which is the quiet omission that matters: without one, nothing distinguishes your copy of Trollvakt from the next person's, to us or to anybody. Android then walls that storage off, so no other app on the handset can read it either.

Remove the game and the list is removed with it. To wipe it and keep the game, the settings screen offers a reset, and Android offers the same from its own application settings under "clear data".

A notice of this kind usually sets a lawful ground against each item it gathers. This one sets none against anything, and an argument is owed rather than a silence.

A ground under Article 6 exists to answer a question — what entitles you to hold this? — and the question needs a holder. Here there is none. The items in post III rest on equipment belonging to you, outside our reach, and they identify nobody: strip out the identifiers and what is left is a record of how one telephone fared in a mountain pass. The Regulation governs a controller's processing of personal data; on neither limb is there anything here for it to govern.

That argument lives or dies with its premise. Give a later build a login, an advertisement, a measurement library or a shop and the premise fails, at which point this page has to be rewritten in the same release, with a ground stated for every new item. The comment block closing this file sets out how, in some detail, for whoever comes to it next.

No cookie notice appears for a related reason. The ePrivacy rules reach the act of placing something on, or taking something from, a person's equipment where that is not strictly needed to provide the service they asked for — the usual vehicles being an embedded browser, a measuring pixel, or an identifier dropped by an outside component. This game carries no such vehicle, and no line out of the handset by which one could report back, so the Norwegian implementation has no subject matter here.

The rest of this document leans on that first refusal. Where there is no route out, a sentence about where data ends up is no longer something you are asked to believe about our intentions — it becomes a fact about the package, open to anyone who cares to look inside it.

Should a prompt appear for something not in that right-hand column, refuse it and tell us the version number at vakt@scan-wood.digital. Either we have let this page fall out of date, or what reached your handset is not the package we published — and we would want to establish which before anybody else runs into it.

Everything above concerns the game once it is running. How it got onto the handset is another matter entirely, transacted beforehand and between you and Google. Into Google's own record of your account go the installation, every subsequent update and whatever rating you post, under the terms Google sets for its services. That relationship excludes us: we neither observe it nor have any say in what it preserves.

What the Play Console shows us on this side is already aggregated by Google: install counts, country totals, crash clusters, an average rating. No line of it is a person and no line is a handset. Nothing of the account reaches us — not the address it was opened with, not a stored card, not the roster of handsets it has signed into. Whatever say Google gives you over its own records is exercised inside that account, which is why a request of that sort has to be addressed there rather than here.

One warning about the listing: a review is public from the moment it is posted, under whatever display name the account carries, and it stays legible to every later visitor the listing receives.

Handing processing to somebody else presupposes processing. Behind Trollvakt no firm hosts anything, measures anything, receives a crash report, places an advertisement, sends a mailing or takes a payment, because none of those things happen at all. Article 13(1)(e) asks for the categories of recipient to be set out; set out, the count is nil.

Transfer abroad follows from the same fact. Every instrument in this area — an adequacy decision, the standard clauses, one of the Article 49 escape routes — exists to authorise data in motion. Nothing here is in motion. The record of your defence on the glacier map was written on your telephone and never left it.

Written here so it reads as the edge of our responsibility rather than a hole in it: what post VI describes takes place on equipment Google owns, under an agreement Google holds with you, and it is complete before this software has been run even once.

Duration. Ask how long and the answer is a question back: how long do you want it? The campaign record has no expiry we impose, because imposing one would require us to be holding it. Reset it from the settings screen or uninstall the game and it is over within the second, with no copy filed elsewhere, no nightly duplicate, and nothing on a machine of ours that could outlive the gesture.

Age. Trollvakt carries a general-audience rating. Four things normally make a parent read further: adverts pointed at the child, a purchase reachable by one careless tap, messages from strangers, and whatever other players have uploaded. None of the four was built into this game. The trolls are the only hostile thing in it. Article 8 fixes the age below which a child's consent to an online service needs a parent behind it; that provision simply has nothing to operate on, since this game requests consent from no player, young or old. Norway puts that line at 13. It is written down here purely so that the figure is already on the page the day somebody adds advertising and the question acquires teeth.

You hold all of them, undiminished. The variable is the place of exercise, and for this game that place is nearly always the handset in your hand rather than our postbox. A formal request route that could only ever end in us writing "there is nothing here" would pad the post and assist no one, so the ledger below states what would actually come of each.

All of this is free of charge, free of forms, and free of the usual demand that you prove who you are. With no file on this side, a passport would have nothing to be compared against; requesting one would collect from you precisely what the rest of the page says is never collected.

A company seated in Norway falls under the General Data Protection Regulation through personopplysningsloven, the statute that carries it into Norwegian law. The authority that supervises the result is Datatilsynet: write to Postboks 458 Sentrum, 0105 Oslo, or begin at datatilsynet.no.

Oslo need not be where you write. Article 77 opens three doors: the authority of the country where you usually live, the one where you work, and the one covering the place you believe the problem arose. Pick the one that is least trouble for you. No wording here can shut any of those doors, and wording that tried would be ineffective in law.

As practical advice only, and not as a condition: a letter here is usually answered the following morning, while a supervisory authority has procedures and a queue. That is a reason to try us, not an obligation to, and there is nothing irregular about a complaint sitting with Datatilsynet while the correspondence with us carries on.

One address takes all of it: vakt@scan-wood.digital. Use it for a right you intend to exercise, for a line on this page you suspect is wrong, for a permission prompt post V did not foresee, or simply to ask how some part of it works. Norwegian and English both reach a reader.

Du kan trygt skrive på norsk — samme adresse, og svaret kommer på norsk.

The seal under the heading carries the version, and it moves whenever a word below it does. On timing we hold to one rule without exception. A revision carrying actual consequence — some category of information newly kept, an outside party admitted, data sent across a border, a further purpose adopted — goes out in the same release as the behaviour responsible for it. It does not follow two weeks later, once the change is already installed on handsets. Reading that one line therefore settles the only question worth asking, which is whether this text governs the build you are holding. Superseded versions are kept, and asking will bring you one.