Nomel Labs

Privacy policy

This website sets no cookies, loads nothing from third-party servers and uses no analytics or tracking services. Our apps Fictionly and Ball Bandits show no ads and track no one. Whatever data does arise is described here.

Controller

Nomel Labs
Owner: Naomi Zuschke
Gartenfeldweg 7
65510 Hünstetten
Germany

Email: support@nomellabs.com

No data protection officer has been appointed, as the conditions of section 38 of the German Federal Data Protection Act (BDSG) are not met.

Principles

The pages embed no content from third-party servers. We serve the fonts from our own server, and no cookies are set. For animation, a script of our own runs from our server. It uses only what the page itself sees while it is shown (window size, scroll position, where you point or tap), and only inside your browser, to draw the animations. It does not access any information stored on your device, stores nothing there and sends nothing to us or to anyone else. There is no profiling and no automated decision-making. Consent under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required. If “reduce motion” is switched on in your system, the site shows no animation.

Visiting the website

The website is run on the Cloudflare Pages platform of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When a page is requested, Cloudflare processes the technically necessary connection data: IP address, date and time, the address requested, the referring page, and details of the browser and operating system.

This data is needed to deliver the page and to protect the service against attacks. We do not analyse it and do not combine it with other data.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Contact form

On the support page you can send us a message. Only your email address is required, so that we can reply. Name and topic are optional.

Your details are not stored in a database. On our server they are turned straight into an email and delivered to our mailbox through the sending service Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Your IP address is neither included in the message nor passed to Resend.

Sending is set to the Ireland region (eu-west-1). Delivery is therefore processed within the European Union.

We use your details solely to deal with your request. The message is deleted once the matter is settled and no statutory retention periods prevent this.

Legal basis: Article 6(1)(b) GDPR where your request concerns entering into or performing a contract, otherwise Article 6(1)(f) GDPR, our legitimate interest being to answer enquiries.

Contact by email

Email sent to our addresses is forwarded through Cloudflare Email Routing and stored in a mailbox hosted by Google. The same applies as for the contact form: we use the details only to deal with your request and delete them once that is done.

The app Fictionly

Fictionly is an Android app for reading e-books (EPUB, PDF, MOBI, AZW3). It shows no ads, uses no analytics or tracking services, has no account of its own and sends no data to any server of ours on its own. Only what you expressly send us as feedback from the app reaches us. The following sections describe what the app processes on the device and in which cases data leaves the device. They match our data safety information on Google Play.

What stays on the device

The app keeps its data only in its own protected storage on the device: copies of the books you add and their covers, the details read from the files (such as title, author and tags), reading positions, highlights, bookmarks, notes, collections, ratings, the reading log and the settings. We have no access to any of it. Files on the device are only ever read, never changed, moved or deleted. Uninstalling the app removes this data from the device.

While you read, the app loads no content from the internet. Pictures or stylesheets that a book points to on other servers are not fetched.

App lock: whoever sets up the lock for private books chooses a four-digit code. It is stored on the device only as a salted hash and never transmitted, not even by sync. Unlocking with a fingerprint or face uses Android's biometric feature; the app receives no biometric data, only whether the check succeeded.

Backup file and export: a backup of the library or an export as a spreadsheet is saved wherever you choose in Android's save dialog, or handed to an app of your choice through Android's share menu. We receive nothing of it.

Android backup: if you have turned on backing up your device to your Google account in the Android settings, Android may include the app's data in it. Google and Android control this backup, not us. The app excludes the app lock code, the sync state and the purchase status from it.

Permissions

Sync with Google Drive

Sync is optional and part of Fictionly Plus. It only takes place once you sign in to the app with a Google account and allow the app access. The app then has access only to the files it creates itself in your Google Drive (the “drive.file” permission), not to your other files.

In a folder called “Fictionly” in your Google Drive, the app stores a file with your library (titles and details of the books, reading positions, highlights, notes, collections, ratings and reading log) and, depending on your settings, copies of the books and their covers. To show your account and storage in the app, it also reads the name, email address, profile picture and storage usage of your Google account. These details stay on the device.

The data goes directly from the device to Google. We run no server for it and have no access to your Google Drive. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google's terms of service and privacy policy for your account apply. You can stop sync at any time by signing out in the app, deleting the “Fictionly” folder in Google Drive and removing the app's access under “Third-party apps & services” in your Google account.

Legal basis: Article 6(1)(b) GDPR, providing the feature you chose.

Buying Fictionly Plus

Fictionly Plus is offered as a one-time in-app purchase through Google Play. Google handles the payment and the payment details; we receive no payment information. The app asks Google Play on the device whether the purchase exists and unlocks the features accordingly. For accounting, taxes and refunds, Google provides us with order details such as the order number, date, product, price and country.

Google's purchase library built into the app (Google Play Billing Library) sends Google technical information about its use, such as whether calls succeed or fail and whether there are connection problems. Google uses this information to improve the library and fix errors. We have no access to it.

Legal basis: Article 6(1)(b) GDPR for the purchase, Article 6(1)(c) GDPR for statutory retention obligations and Article 6(1)(f) GDPR for the technical information of the purchase library. Our legitimate interest is a purchase that works reliably.

Feedback from the app

Under “Send feedback” you can send us a message from the app. Nothing is transmitted until you tap “Send”, and only what is in the form: the kind you picked (problem, idea or other), your message, optionally your email address for a reply, and the device details shown in the form (app version, manufacturer and model of the device, Android version). If you open the form from an error message, it also names the kind of error (for example “Adding a book, damaged”), never a file name or a book title.

The message is transmitted encrypted to our server and handled there exactly like a message from the contact form: it is not stored in a database but turned straight into an email and delivered to our mailbox through the sending service Resend (Ireland region). Your IP address is neither included in the message nor passed to Resend. Details about Cloudflare, Resend and the mailbox are in the sections “Visiting the website”, “Contact form” and “Contact by email”.

We use the details only to deal with your request, to reply to you and to fix problems in the app, and delete them once that is done and no statutory retention periods prevent this. If sending fails, you can send the message by email instead.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is handling feedback and improving the app.

Ratings and links

The app may show Google Play's rating window at a suitable moment. It is provided entirely by Google Play; we only see the review you publish in the store. Links to our website and to the store page open in your browser or in Google Play; their privacy policies apply there, and for our website this policy.

Deletion

You remove all data on the device by uninstalling the app or clearing its data in the Android settings. You delete the data in Google Drive yourself by removing the “Fictionly” folder. To have feedback you sent us deleted, an informal email to support@nomellabs.com is enough.

The app Ball Bandits

Ball Bandits is an Android game in which balls with weapons fight each other, online against other players. When few players are online, computer-controlled opponents also take part. The game shows no ads, uses no third-party analytics or tracking services and no advertising ID. The following sections describe what data arises. They match our data safety information on Google Play.

Guest account and progress

The first time you start it, the app automatically creates a guest account on our game server. The account is identified by a value the app calculates from the Android ID, an identifier that Android assigns separately to each app on each device. The Android ID itself never leaves the device and cannot be recovered from the calculated value. This keeps your progress when you reinstall the app. No sign-in, email address or password is needed. The account gets a random player tag (for example #K7QM2XA).

The server stores your progress (balls and their levels, trophies, chests, coins, gems, missions, achievements and game statistics), the player name you chose, the device's time zone for the daily reset and, for each match, when it started and ended and how it went. The server calculates rewards itself so that nobody can cheat with a modified app. We delete the details of individual matches after 30 days, or after 90 days if cheating is suspected.

During a battle, the server passes on to your opponent: your player name, your profile ball, your trophies, your day streak, your deck with the levels of its balls, and your inputs in the battle (choice of ball, aiming, special abilities). Please don't use your real name as your player name.

The server is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Helsinki (Finland). When a connection is established, it processes your IP address as technically necessary. To protect against abuse, such as accounts being created in bulk, it counts requests per IP address; for this it stores the address only as a check value (hash) and deletes these counters after two days at the latest. The connection is encrypted. A data processing agreement under Article 28 GDPR is in place with Hetzner.

Legal basis: Article 6(1)(b) GDPR, providing the online game. For protection against cheating and abuse, Article 6(1)(f) GDPR; our legitimate interest is a fair and secure game.

Game statistics

To improve and balance the game, we analyse on our own server what arises during play anyway: sign-ins and app starts with the app version, matches (balls chosen, result, duration, trophies), chests opened, balls upgraded, purchases in the game and changes to coins and gems. The entries are linked only to the identifier of your guest account, not to your IP address, an advertising ID or details about the device. We delete them after 30 days; after that we keep only daily totals that cannot be linked to any person. Nothing is passed on to third parties.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is a fair, well-balanced game. You can object at any time in the app under “Settings” → “Privacy” → “Game statistics on the server”.

Only if you agree does the app also send data that arises on the device alone: which screens you open, the steps of the introduction, the quality of the connection in online battles (share of waiting frames, ping) and technical error messages. This data is handled the same way and deleted after 30 days. The app asks once; until then the setting “Usage data from the app” is off.

Legal basis: Article 6(1)(a) GDPR, your consent. You can withdraw it at any time in the settings with effect for the future.

Suspensions

Anyone who breaks the game rules, for example by cheating with a modified app or choosing an offensive name, can be suspended by us for a set time or permanently. For this we store the account, the identifiers of the devices belonging to it (see “Guest account and progress”), the reason and the end of the suspension. A suspension is kept for as long as it applies, even if the account is deleted. When a suspended player opens the app, it shows the reason and the time remaining. Every access by our team to an account is logged.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is a fair game and protection against abuse.

Permissions

App updates

When it starts, the app asks Google Play on the device whether a newer version is available and then lets you know. This check is provided by Google Play; Google's privacy policy applies.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is that everyone plays with a current, error-free version.

Deletion

In the app, “Delete account” under “Profile” deletes your guest account on our server together with your progress and game statistics, and resets the app on the device. Uninstalling the app alone does not delete the guest account: it is kept so that you can continue playing after reinstalling. We automatically delete guest accounts that nobody has signed in to for 24 months. We're happy to answer questions about this by email at support@nomellabs.com; please include your player tag.

Transfers to the United States

Cloudflare and Plus Five Five (Resend) are companies based in the United States. Email sending is set to the Ireland region, so that processing takes place within the EU; access from the United States cannot be ruled out entirely, however. Google Ireland Limited, which provides Google Drive and Google Play to users in the EU, belongs to Google LLC, based in the United States; there too, data may be transferred to the United States.

The transfer is therefore based on standard contractual clauses under Article 46(2)(c) GDPR or, where the provider in question is certified under the EU-US Data Privacy Framework, on the European Commission's adequacy decision under Article 45 GDPR. Data processing agreements under Article 28 GDPR are in place with Cloudflare and with Resend; in each case they are part of their terms of service.

Your rights

You have the following rights with regard to us:

An informal email to support@nomellabs.com is enough.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority at any time. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany

Changes

If anything about the site or our apps changes that matters for data protection, we update this policy. The version published here applies.

Last updated: 20 October 2026

This translation is provided for convenience. The German version is the legally binding one: Datenschutzerklärung.