Virvel — rotating-rings puzzle for Android com.ringdreie.virvel · published by Eagle AS, Straume · in force from 15 October 2026
Most privacy notices begin at the outside — with the company, the law, the lawyers — and work inwards towards you. This one is laid out like the puzzle it belongs to. The hub is where you are sitting. Each ring outwards is one step further from your hand and one step further from your control, and every ring says who is turning it. There are six. Read them from the middle out, or use the dial below to jump.
Turned entirely by you. Nothing in this ring is visible to anyone else, including us.
Playing Virvel is a sequence of flicks and drags on glass. Those touches are read by the game, used to turn a ring a notch, and discarded. We do not log coordinates, time your hesitations, or keep any record of the order in which you tried things. How you play leaves no trace at all.
One thing is written down, on your device and nowhere else, so that a half-turned dial survives being interrupted:
Android gives every app a storage area of its own, walled off from its neighbours, and that is where the file sits. Eagle AS never sees it. We run no synchronisation service and no off-device backup, so there is no second copy in existence. Removing it takes two routes, both yours: Android Settings → Apps → Virvel → Storage → Clear data, or uninstalling outright. Either way it is gone for good, there being nowhere else it could have gone.
Under the GDPR this is not personal data held by us, for the simple reason that it is not held by us at all. It is a file on your property.
Turned by us, when we publish a build. Everything in this ring is a decision we made and can be checked against the package Google serves you.
One fact carries this entire document, so it goes first: there is no INTERNET permission in the shipped manifest. None is requested, none is declared and none sits unused. Google prints the permission list on the store page before you commit to installing, which makes this the rare claim you can audit without taking anyone's word; switch the handset to flight mode afterwards and the puzzle will not notice. Six of the statements that follow are consequences of that one line.
Virvel is a native Android application rather than a web page in a frame, so no cookie, pixel, tag or beacon is set by it. This document, likewise, plants nothing in your browser. A single external call does occur: both typefaces come from Google Fonts, so your browser contacts Google directly and Google necessarily learns the address that contacted it. The call originates at your end rather than ours, nothing comes back to Eagle AS, and it is listed here only because leaving it unsaid would be a small dishonesty.
Turned by Google and by you, through your device settings. Not ours to turn at all.
Every app on the handset rests on the operating system, and the operating system reports home. Depending on what was ticked during first-time setup, the device forwards diagnostics, usage figures and crash records to Google covering the software running on it — this puzzle included in that sweep. No application asks to be swept up and none can decline on your behalf; strip Virvel of every line we wrote and the behaviour would be unchanged.
We are not a party to it, cannot switch it off on your behalf, and receive nothing from it. Google's privacy notice covers it, your handset's own controls adjust it, and both can be reached without involving this company at any stage. It appears here because Ring 1 read on its own would suggest nothing whatever leaves the phone, and that would be a tidier account than the truth.
Turned by Google, as a controller in its own right. We see only what Google chooses to show a publisher.
Pulling any app off the store leaves a record of that download attached to the Play account that made it. The record is Google's doing and Google's responsibility, created under Google's notice before our code has run even once — opening Virvel is not what causes it, and never opening Virvel will not prevent it. Eagle AS has no window onto that side of the transaction.
The Play Console gives a publisher a dashboard: installs against uninstalls, a country breakdown, which Android releases and handset models are in use, and a rating average. Google builds every one of those figures by pooling many people, and the console offers no panel that narrows down to an individual. There is no lookup in it that would find you, and none we could construct.
A public review carries the display name on your Play profile, your rating, your words and the date, and we may reply underneath in public. This is the only route by which an identifiable person reaches us without writing to us directly, and it is one you open yourself. It lives in Google's review system, so we cannot withdraw it for you — editing or deleting it in the Play Store is the way. Please keep anything private out of a review and put it in an e-mail instead.
Our own ring, and the emptiest one on the dial.
Eagle AS is the controller for Virvel within the meaning of Article 4(7) — the company decides why and how any personal data connected with the game is processed, and the company answers for it. In practice the company's holdings amount to two things, and one of them only exists if you start it.
Keeping a message on file until it has been dealt with rests on Article 6(1)(f): a company has an evident interest in being able to answer its own post. Nothing else requires a basis, because nothing else happens — no campaigns, no segmenting, no machine judgements of the sort Article 22 contemplates, and nothing passed or sold on to a third party under any arrangement.
We engage nobody to handle personal data on our behalf — no hosting provider, no backend, no support desk, no contractor — so there is no Article 28 processor agreement to list. Nothing of yours is sent outside the EEA by us, which means no standard contractual clauses, adequacy decision or Chapter V derogation is being relied upon. Where Google moves data it collected in Rings 2 and 3, Google answers for those transfers under its own safeguards.
Such a schedule exists to say, category by category, what is stored and what causes it to be erased. Ours would have exactly one line in it — letters, kept while a conversation is live, destroyed once it is done — and padding the remainder out would mean fabricating entries for things nobody here has. So there is no table, and that sentence is the schedule.
We have not appointed one, and are not obliged to. The three triggers in Article 37 are being a public body, monitoring people systematically on a large scale, and handling special categories of data on a large scale. A single-person company shipping a puzzle that cannot reach a network falls outside all three by a wide margin. Correspondence sent to the plate below lands with the one human in the organisation.
Turned by nobody in this document. It holds whatever it holds, and we are inside it.
The Regulation reaches Norway by way of the EEA Agreement and takes domestic shape as personopplysningsloven (LOV-2018-06-15-38). Eight distinct entitlements flow from it to you, and no wording on any website can shorten that list. They are set out below as notches on a dial, each paired with the result it would in fact deliver against this company — after four rings, mostly an empty envelope.
Those same eight bite properly when directed at Google, whose hands Rings 2 and 3 end in; the levers are inside your Google account's privacy settings, or Google's own published channel for subject requests. There is no charge, no prescribed wording and no form to download, and a month is the outside limit for a reply. The Regulation does build in two let-outs and it is fair to flag them: where we cannot tell from a request whose data is at issue, we are entitled to put a question back before acting, and where the same demand arrives over and over, or is plainly disproportionate, we are entitled to decline rather than repeat ourselves.
Norwegian law fixes 13 as the age from which a young person can agree for themselves to an information society service — personopplysningsloven § 5. The figure makes no difference to this document. Agreement is a device for authorising processing, and Rings 0 and 1 between them leave no processing standing that would need authorising, from a thirteen-year-old or from anybody. Virvel is not aimed at the young, nor entered into any children's programme on the store; it is merely the kind of object a child can sit with for an hour, with nobody the wiser afterwards. Should a letter arrive that plainly came from a child, it is destroyed instead of filed or replied to.
Going to a regulator is your right and requires no permission from us, nor any attempt to settle it here first; dial@eagle.makeup is open if you would prefer to, but it is an option and not a precondition. Datatilsynet supervises this in Norway, at Postboks 458 Sentrum, 0105 Oslo and datatilsynet.no. Live somewhere else in the EEA and your own national regulator will take the identical complaint; a court case belongs where you are resident. And a genuine suggestion: nothing in Ring 1 asks to be trusted. Each assertion there can be put against the artefact on the store, so the useful instruction to a regulator is read the manifest, not ask the publisher.
Eagle AS
Controller · Article 4(7)
Geitevikja 24B, 5353 Straume, Norway. Director and signatory: Nils Ingemund Hoff. Data enquiries: dial@eagle.makeup. General enquiries: post@eagle.makeup.
Henvendelser på norsk er like velkomne som på engelsk.
Eagle AS is a Norwegian aksjeselskap; its registration particulars are held in the Brønnøysund Register Centre and may be looked up there against the company name and registered address given above. The developer named on the Google Play listing is the same company. No data protection officer has been appointed, for the reasons given in Ring 4.
Six rings, and ours is the emptiest of them — which is exactly what the arrangement was meant to expose, instead of leaving it to be inferred from a clause somewhere in the middle. Any release that alters a ring gets this document revised first and published second, carrying a fresh date beneath the heading. So far nothing has needed revising, and 1.0 stands alone.