Privacy policy

1. Overview

This policy explains which personal data we process when you use Bloomtime (“the app”), for which purposes, on which legal basis, and to whom it may be disclosed.

2. Controller

The controller for this data processing is the operator named in the legal notice. For questions about data protection you can reach us at the email address given there.

3. What data we process, and on what legal basis

• Account and profile data (email, name/display name, password hash, parent/child role): to provide the user account — Art. 6 (1) (b) GDPR (performance of a contract).
• Content you create (categories, activities, time entries, achievements): to deliver the core function of the app — Art. 6 (1) (b) GDPR.
• Payment data for the Premium plan (subscription status, Stripe customer identifier; card details are processed exclusively by Stripe and never stored by us): to perform the contract — Art. 6 (1) (b) GDPR.
• Sign-in with Google (optional): only if you use this function — Art. 6 (1) (a)/(b) GDPR.
• Technical data and server logs (IP address, browser, timestamp) to ensure operation and security — Art. 6 (1) (f) GDPR (legitimate interest).

4. Recipients and processors

To provide the app we use carefully selected service providers, with whom data processing agreements are in place where required:

• Stripe (payment processing) — Stripe Payments Europe, Ltd. / Stripe, Inc. (USA).
• Google (optional “Sign in with Google”) — Google Ireland Ltd. / Google LLC (USA).
• Hosting by Hetzner Online GmbH, Gunzenhausen (servers located in Germany), to provide the app.

Transfers to third countries: Stripe and Google may process data in the USA. Such transfers are safeguarded by appropriate measures, in particular EU standard contractual clauses and the EU–US Data Privacy Framework.

5. Retention period

We store personal data only for as long as it is needed for the purposes described. Account and usage data are stored until you delete your account; after deletion they are removed or anonymised, unless statutory retention obligations apply (for example commercial or tax law requirements for payment records).

6. Your rights

You have the right at any time to:

• access the personal data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR) — available directly in the app via account deletion
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR) and to withdraw consent with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority.

7. Cookies and consent

We use strictly necessary cookies and local storage for authentication (login session), language settings and to remember your cookie decision. These are required for operation and do not need consent (§ 25 (2) TDDDG).

Beyond that, we only use analytics cookies (Google Analytics, see section 8; Matomo, see section 9) after your explicit consent via our cookie banner. You can change or withdraw your decision at any time with effect for the future, using the “Cookie settings” link in the page footer.

During payment (Stripe) or the optional Google sign-in, those providers may set their own cookies.

8. Google Analytics

If you have consented via our cookie banner (Art. 6 (1) (a) GDPR), we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and similar technologies to analyse how our website is used. By default, Google Analytics 4 does not store the IP address and truncates it before processing.

Without your consent, tracking stays switched off (Google Consent Mode v2, default “denied”); no analytics cookies are set and no personal identifiers are transmitted to Google. Where data is transferred to the USA, Google relies on the EU–U.S. Data Privacy Framework and standard contractual clauses. Further information is available in Google’s privacy policy. You can withdraw your consent at any time via “Cookie settings” in the page footer.

9. Matomo (self-hosted web analytics)

For reach measurement we additionally use Matomo, an open-source web analytics package. We run Matomo ourselves, on our own servers in Germany (hosting: Hetzner Online GmbH, see section 4) — no analytics data is transferred to third parties or to third countries.

Without your consent, measurement is cookie-free and anonymised: no cookies are set, your IP address is truncated by the last two octets before storage (e.g. 192.168.xxx.xxx), and no cross-device recognition takes place. Your browser’s “Do Not Track” setting is respected. The legal basis is our legitimate interest in statistical analysis and in improving our service (Art. 6 (1) (f) GDPR).

Only if you consent via our cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) does Matomo set cookies (including _pk_id and _pk_ses) in order to record returning visits more precisely; the storage period is at most 13 months. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the page footer.

10. Children’s privacy

Bloomtime is a family-friendly application. For use by children under the age of 16, the consent or authorisation of a parent or legal guardian is required under Art. 8 GDPR; child accounts are created and managed through a parent account. We process only the data required for use, we do not carry out profiling for advertising purposes, and we do not pass children’s data to third parties for advertising purposes.