Privacy Policy

This Privacy Policy applies to the Dam It! mobile application and website ("Application"), operated by Cornelius Pflüger Digital Solutions ("Service Provider", "we", "us", or "our"), located in Germany.

This policy is designed to comply with:

• EU General Data Protection Regulation (GDPR / DSGVO)
• German Telecommunications-Digital Services Data Protection Act (TDDDG)
• German Digital Services Act (DDG)
• Applicable U.S. privacy laws (CCPA/CPRA, COPPA)
• Google Play User Data & Accessibility API Policies

2. Information We Collect

We collect only the minimum data required to operate the Application (data minimisation principle, Art. 5(1)(c) GDPR).

a) Automatically Collected Technical Data

• IP address (for network communication and security)
• Device type, operating system version
• App version and basic diagnostics (crash logs, performance data)
• General region / country (derived from IP, not stored as precise geolocation)

b) In-App Analytics (Firebase Analytics) - opt-in, off by default

Firebase Analytics is disabled until you explicitly agree to it - a one-time question during setup, separate from anything else in the app. If you opt in, we use it to understand which features are used, in aggregate and anonymised form. Typical events are which onboarding screen was reached and whether a purchase was started or completed. See Section 4(c) for why this needs your consent and how to change your mind later.

• No advertising identifier is collected. The AD_ID permission is removed from the app manifest and ad-personalisation signals are disabled - regardless of your analytics choice
• Events are aggregate and anonymised; they are never used to build an advertising profile or to target ads to you
• No name, email address, or content from your device is included

c) Crash Diagnostics (Firebase Crashlytics) - opt-in, off by default

Firebase Crashlytics is likewise disabled until you explicitly agree to it, via the same one-time question as Firebase Analytics (Section 4(c)). If enabled and the Application crashes, anonymous diagnostic information is sent automatically to Firebase Crashlytics so that we can fix the fault.

• Stack traces, device model, operating system version, and app version
• No name, email address, or content from your device is included

d) Subscription & Purchase Data (handled by RevenueCat / Google Play)

• Subscription status (active / inactive)
• Transaction identifiers issued by Google Play
• Pseudonymous device identifiers required for entitlement validation

We do not receive, store, or process full payment card details. All payment processing is handled exclusively by Google Play Billing.

e) Referral & Promo Attribution

• Google Play Install Referrer: if you reach Google Play through a dam-it.io/promo link, Google passes the referrer string to the Application on first launch. It contains only the promo or referral code - no personal data - and is used solely to apply the correct offer
• Referral records (Cloud Firestore): your referral link contains a random referral code, not your RevenueCat ID. When a referral link is used, we store the referral code, which referred user (by pseudonymous, randomly generated RevenueCat app user ID) came from which referrer, whether a purchase followed, the state of the resulting reward (days earned or held), and a timestamp. This is not your name, email address, or device ID, and it does not directly identify you - though, as a pseudonymous identifier, it remains personal data under GDPR and is handled with the same rights described in Section 8
• How referral data is processed: when a referred user starts a free trial or a paid subscription, RevenueCat sends a notification (webhook) to our Cloud Functions, which run in Google Cloud / Firebase in the EU region europe-west1. These functions record the attribution and reward state in Cloud Firestore and grant the referrer's reward as a promotional entitlement in RevenueCat. The app itself no longer writes referral rewards to the database directly. The webhook notifications are kept in an event log (event ID, type, time) only to avoid processing an event twice. Purpose and legal basis: providing the referral programme you chose to take part in (Art. 6(1)(b) GDPR) and preventing abuse (Art. 6(1)(f) GDPR)
• Promo codes are resolved entirely on-device; no promo-code redemption data is transmitted
• Identifiers: the Application uses a pseudonymous RevenueCat app user ID (for subscriptions and referrals) and Firebase installation IDs (for Remote Config, and for Analytics and Crashlytics if you opt in). None of these is your name or email address
• Remote Config (detection configuration): to deliver updates to the view identifiers the Application uses to recognise short-video screens, the Application fetches a configuration from Firebase Remote Config. This request includes the Firebase installation ID and your IP address and takes place regardless of your analytics choice. Purpose and legal basis: delivering the detection configuration, our legitimate interest in keeping the core function working after app updates by other providers (Art. 6(1)(f) GDPR). Aggregated detection-health counters (whether detection worked, no screen content) are sent only if you have agreed to analytics
• App Check / Play Integrity: used to confirm that requests to our database come from a genuine, unmodified install of Dam It!, as anti-abuse protection for referral rewards. It does not identify you personally

f) Website Hosting Data

The dam-it.io website is hosted by Hostinger International Ltd. (Cyprus / Lithuania). When you visit the website, Hostinger's servers automatically log standard web access data (IP address, browser type, pages visited, timestamps). This constitutes a separate processing activity under Hostinger's own privacy policy, available at https://www.hostinger.com/privacy-policy.

g) Contact Form

If you use the form at dam-it.io/contact, we receive your email address, your message and, if you enter it, your name, by email through our host Hostinger. We use them only to answer you (GDPR Art. 6(1)(b) where your request relates to a contract, otherwise Art. 6(1)(f), our legitimate interest in answering enquiries). To limit abuse, a hash of your IP address is kept on the server for a short time. We delete your message when your request is settled, unless statutory retention duties apply.

3. Legal Basis for Processing (GDPR Art. 6)

All personal data we process is based on one of the following legal grounds:

• Art. 6(1)(a) GDPR - Consent: Activation of the Accessibility Service; Firebase Analytics and Firebase Crashlytics in the mobile app, which are off by default and only activate once you agree via the in-app opt-in described in Section 4(c); any other optional data collection you explicitly agree to
• Art. 6(1)(b) GDPR - Performance of a Contract: Processing necessary to provide the app functionality, manage your subscription (e.g., verifying entitlements via RevenueCat), and apply referral or promotional offers you have chosen to redeem
• Art. 6(1)(c) GDPR - Legal Obligation: Retention of transaction data as required under German commercial and tax law (§ 257 HGB, § 147 AO)
• Art. 6(1)(f) GDPR - Legitimate Interests: Security monitoring, referral-reward abuse prevention (App Check / Play Integrity), fraud prevention, and server log analysis. Our legitimate interest is the secure and stable operation of the Application. These interests are not overridden by your interests or fundamental rights given the minimal nature of data processed.

4. Cookies & Tracking Technologies

We use no advertising cookies, no tracking pixels, and no cross-site or cross-app tracking. Analytics on the website and analytics in the mobile app are two separate systems, described below.

a) Website (dam-it.io) - Umami Cloud

• Umami Cloud is a privacy-focused, cookie-less analytics service used to measure traffic on this website only
• It sets no cookies and stores or reads no information on your device beyond what is strictly necessary to deliver the page
• No personal data, persistent device identifiers, or cross-site activity is collected; all event triggers are aggregated and anonymised
• Because no non-essential information is stored on or read from your device, no consent banner is required under § 25(2) TDDDG

b) Website Fonts

• All web fonts are self-hosted on dam-it.io - your browser never contacts Google Fonts or any other font provider
• No IP address or request data is transmitted to a third party for the purpose of displaying fonts

c) Mobile Application - Firebase Analytics & Crashlytics (opt-in, off by default)

Firebase Analytics and Firebase Crashlytics start switched off. During setup, the app asks a single, one-time, plainly worded question - "Help us build a better dam?" - with two equally weighted buttons and no box pre-ticked. Nothing is collected before you answer, and declining has no effect on any other feature. You can change your answer at any time in the app's Settings, just as easily as you gave it.

• Firebase Analytics is not cookie-based; if enabled, it uses an app-instance identifier generated on your device
• The advertising ID is not collected - the AD_ID permission is removed from the app manifest and ad-personalisation signals are disabled, whether or not you opt in
• Events are aggregate and anonymised and are never used for advertising, ad profiling, or behavioural targeting
• No analytics cookies and no cross-app trackers (e.g., IDFA or AAID) are used in the Application

This is a different situation from the cookie-less website analytics described in 4(a): Firebase Analytics and Crashlytics store and read a persistent identifier on your device and send data to a third party (Google), which requires your prior consent under § 25 TDDDG and Art. 6(1)(a) GDPR - regardless of how anonymised or aggregated the resulting data is. That is why the app asks first, rather than assuming permission.

No consent management banner (Cookie-Banner) is displayed on the dam-it.io website, as no non-essential cookies are set there and no non-essential information is stored on or read from your terminal equipment when browsing it (§ 25(2) TDDDG). Any technically necessary session or preference data used by the web server is covered by the legitimate interest basis (Art. 6(1)(f) GDPR) and the TDDDG exemption for essential storage operations. The mobile Application is a separate case, handled by its own in-app opt-in described above.

5. Third-Party Service Providers

We engage the following processors / independent controllers. Each operates under its own data protection documentation:

Google Play Services & Google LLC
Role: App distribution, billing infrastructure, device integrity checks
Privacy Policy: https://policies.google.com/privacy

RevenueCat, Inc.
Role: Subscription entitlement management and receipt validation
Data processed: pseudonymous device ID, subscription status, transaction receipts
Privacy Policy: https://www.revenuecat.com/privacy

Hostinger International Ltd.
Role: Web hosting for dam-it.io
Data processed: server access logs (IP address, browser data)
Privacy Policy: https://www.hostinger.com/privacy-policy

Google Ireland Ltd. / Google LLC (Firebase)
Role: App analytics (Firebase Analytics), crash diagnostics (Crashlytics), referral processing and storage (Cloud Functions and Cloud Firestore, region europe-west1), detection configuration (Remote Config), and integrity verification (App Check / Play Integrity)
Data processed: anonymised event counts, crash diagnostics (stack trace, device model, OS and app version), pseudonymous subscription identifier and referral code, Firebase installation ID, IP address (Remote Config)
Privacy Policy: https://firebase.google.com/support/privacy and https://policies.google.com/privacy

Umami Software, Inc.
Role: Privacy-focused usage analytics for the dam-it.io website
Data processed: Anonymized usage statistics, page views, and custom event triggers such as clicks on download buttons, how far a page was scrolled, which page sections and calls to action came into view, and which FAQ answers were opened (no personal identifiers or cookies used, nothing stored on your device)
Privacy Policy: https://umami.is/privacy

6. International Data Transfers

Some of our service providers (Google, RevenueCat, Hostinger) are based in or process data in the United States or other countries outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure an adequate level of protection through one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission (Decision 2021/914)
• EU–U.S. Data Privacy Framework (where applicable and the recipient is certified)
• Adequacy decisions issued by the European Commission

You may request a copy of the applicable transfer mechanism by contacting us at the address in Section 14.

7. Data Retention

• Subscription & transaction data: retained for the duration of the active subscription plus the statutory retention period under German tax law (10 years, § 147 AO)
• Technical logs: retained for a maximum of 90 days for debugging and security purposes, then deleted or anonymised
• Crash reports (Firebase Crashlytics): retained for 90 days (Google's default retention period), then deleted
• App analytics (Firebase Analytics): retained in aggregate form for the shortest period offered by Google, currently 14 months
• Website analytics (Umami): statistically aggregated usage data stored without personal identifiers and kept for product optimisation purposes
• Referral records (Cloud Firestore): kept until the corresponding reward has been granted and for a further 12 months for abuse and chargeback prevention, then deleted. Reward-state records without held days or a running reward are deleted after 12 months without activity
• Referral codes: a referral code that has not been used for 24 months is deleted
• Webhook event log (Cloud Firestore): deleted after 30 days
• In-app deletion: in the Application, Settings > Delete my data deletes your referral attribution, referral code and reward records on our server and resets the data on your device. Subscription and purchase records stay with Google Play and RevenueCat; to have these deleted, email us (see below). Data already sent to Firebase Analytics or Crashlytics is not recalled; it is deleted after the retention periods above
• Accessibility Service data: not retained - all processing is transient and on-device only

You may request deletion of your personal data at any time (see Section 8).

8. Your Rights (EU / EEA Users - GDPR)

Under the GDPR, you have the following rights, exercisable free of charge by contacting us:

• Right of access (Art. 15 GDPR) - obtain confirmation and a copy of data we hold about you
• Right to rectification (Art. 16 GDPR) - correct inaccurate data
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) - including to processing based on legitimate interests
• Right to withdraw consent at any time without affecting prior processing (Art. 7(3) GDPR)

No user account - how to identify your data: Because Dam It! has no user account, we cannot look you up. To exercise a deletion request covering referral records, email contact@dam-it.io with the referral link or code you used, and we will delete the associated record.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart: https://www.baden-wuerttemberg.datenschutz.de.

9. Your Rights (California Residents - CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know what personal information is collected, used, shared, or sold
• Right to request deletion of personal information
• Right to correct inaccurate personal information
• Right to opt-out of the sale or sharing of personal information
• Right to non-discrimination for exercising these rights

We do not sell or share personal information as defined under the CCPA/CPRA. To exercise any of these rights, contact us at contact@dam-it.io. We will respond within 45 days as required by law.

10. Children's Privacy (COPPA & GDPR)

The Application is not intended for children under the age of 13 (or under 16 where applicable under GDPR Art. 8). We do not knowingly collect personal data from children.

In compliance with the U.S. Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506), we do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent.

If you believe we have inadvertently collected personal data from a child, please contact us immediately at contact@dam-it.io and we will delete the data promptly.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encrypted data transmission (TLS/HTTPS)
• Access controls limiting data access to authorised personnel only
• Data minimisation - we collect only what is necessary

No system can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Art. 33 GDPR.

12. No Sale or Advertising Use of Data

We explicitly confirm:

• We do not sell personal data to any third party
• We do not use personal data for advertising, profiling, or behavioural tracking
• We do not track users across unrelated apps or services
• Data collected via the Accessibility Service is never used for any purpose beyond on-device gesture blocking

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Application, legal requirements, or our data practices. Material changes will be communicated within the Application and/or on this website with an updated "Last Updated" date. Continued use of the Application after the effective date of changes constitutes acknowledgement of the updated policy.

14. Contact & Data Controller

Data Controller (Verantwortlicher i.S.d. DSGVO):
Cornelius Pflüger Digital Solutions
Inhaber: Cornelius Pflüger
Germany
Email: contact@dam-it.io

For the full legal notice (Impressum) including postal address, please see the Legal Notice page.

15. German Legal Note

The required Legal Notice (Impressum) pursuant to § 5 DDG and § 18 Abs. 2 MStV is provided at dam-it.io/legal-notice and is reachable from every page of this website via the footer link within one click.