Last updated: October 27, 2026
1. Controller
Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany; email: apps@bitbeans.de.
2. Data processed
Cloudlit needs no account and does not ask for a name, a date of birth or a photo. On the device the app stores only the reading profile that parents set up (story language, age group, reading level, syllable help and reading focus), favorite stories, which stories were played recently and the pause of the parental gate. This information does not leave the device, with one exception: for an order in the Story Workshop the app sends the language, age group and reading level to our server (details and retention in the section on the Story Workshop).
The app downloads stories as packages of text, narration and pictures from our server and stores them on the device; after that they play without internet. For the free stories, no identifiers, no profile and no reading data are sent while downloading. When a paid story is downloaded, the app also sends the random identifier of the purchase check (see below) and a session token so that the server can check whether access is unlocked; the profile and reading data are not sent even then. As with any request on the internet, the server technically sees the IP address. The narration of the parental gate is built into the app and needs no network.
To verify purchases, the app signs in to our server with a random identifier created only for this purpose and sends the store's purchase receipt together with platform and product. The identifier is kept in the device's secure storage; it contains no name or email address and is not an advertising or device identifier. We do not receive names, account or payment details.
So that we can find errors and improve the app, it reports a few fixed events without any identifier as anonymous daily counts: starting, skipping and completing the introduction, the first to third story started and played to the end, opening the purchase page and tapping the purchase button per fixed place, a completed purchase, a rough start-time band and whether a rating request was allowed to show. Each report contains only the event name, a fixed stage or fixed reason, platform, app version, app and story language and the origin of the installation (store or test installation). During purchase and restore, fixed purchase events with flow step, fixed error reason and product are added; the app sends these purchase events with the random guest identifier of the purchase check, while the other counts carry no identifier. Names, titles of stories played, favorites, the reading profile and account, device or advertising identifiers are not transmitted, so we cannot link the reports to a person or a child. Individual reports are deleted after 7 days, daily totals after 120 days at the latest. To prevent abuse, the server limits the number of reports per connection using a non-reversible hash of the IP address; it is not linked to the reports.
In the parents' area behind the parental gate, parents can send us feedback. We then receive the message, an optional email address, the app version, the platform and the language on our server; for processing, the message is also forwarded by internal email to our support. Reading profile, favorites, purchase identifier and usage measurement are not sent along. Also only in the parents' area, the app may show the rating dialog of Apple or Google; whatever is entered there is processed by the respective store.
Cloudlit is an app for children. Outside the Story Workshop we do not knowingly collect personal data from children: there is no account, no advertising, no third-party tracking or analytics SDKs, no chat or sharing feature. The purchase page, settings, feedback and links leading out of the app are behind the parental gate; text can only be entered in the feedback form. What is processed in the Story Workshop, also when your child picks the picture cards, is described in its section.
3. Purposes and legal bases
The reading profile, favorites and reading history stay on the device; only for an order in the Story Workshop do the language, age group and reading level go to our server (see the section on the Story Workshop), otherwise we do not process any data for this. We process purchases, restores and the unlocking of stories to perform the contract (Art. 6(1)(b) GDPR). The anonymous purchase verification identifier also serves security and abuse prevention, and the anonymous daily counts help us find errors and improve the app; the legal basis in each case is our legitimate interest in a secure and working app (Art. 6(1)(f) GDPR). You can object under Art. 21 GDPR by email to apps@bitbeans.de. We process feedback to answer your request (Art. 6(1)(b) and (f) GDPR).
4. Recipients and service providers
For our server, which runs the anonymous purchase verification, the anonymous daily counts, feedback and the delivery of the story packages, we use a hosting provider as our processor. Emails to apps@bitbeans.de and our internal emails about feedback and purchases are kept by our email provider, also as our processor. Apple and Google handle purchases, payment, subscription management and ratings as independent providers. We do not use advertising networks, data brokers or third-party analytics services. For the Story Workshop, processors for text creation and speech output are added; what they receive is described in the section on the Story Workshop.
5. International transfers
Our providers for server and email are based in the USA or also process data there. We base transfers to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on appropriate safeguards, in particular the European Commission's standard contractual clauses, or on applicable statutory exceptions. On request to apps@bitbeans.de we will name the individual providers and send you a copy of the safeguards. For the Story Workshop, its section also applies.
6. Advertising and tracking
The app contains no advertising, no third-party tracking or analytics SDKs and no ad tracking. The anonymous daily counts run only through our own backend; the product counts carry no identifier, the purchase events carry the random guest identifier of the purchase check, never an account, device or advertising identifier. We do not create profiles, do not sell personal data and do not share data with advertising networks or data brokers.
7. Retention and security
Local data stays on the device until you delete it in the app or remove the app. Our server keeps the random identifier used for purchase verification; there is currently no automatic deletion period for it. It contains no names, account or device identifiers. After a purchase we store the store's purchase receipt (with order number, product, time and status, plus country and, where the store reports it, price and currency) and the place from which the purchase page was opened for as long as the app needs to unlock and restore the purchase and process refunds, or until deletion is requested. An internal email informs us of every purchase and refund with these purchase details. After a deletion we keep, without any link to your identifier, only the stores' purchase reports, so that purchase limits cannot be bypassed by deleting and starting over, and a deletion note for the deleted identifier. We keep feedback without a fixed period until you ask for it to be deleted. Individual reports of the anonymous daily counts are deleted after 7 days, daily totals after 120 days at the latest. Transmissions are encrypted.
8. Delete data and account
You delete downloaded stories in the parents' area with “Delete downloaded stories”; when you remove the app, the reading profile, favorites and downloaded stories are deleted from the device. On iOS, the technical purchase verification identifier may remain in the device keychain; the app discards it after a reinstall. You can ask for the data of a purchase to be deleted by email to apps@bitbeans.de or at https://bitbeans.de/daten-loeschen; it is identified by the order number from the purchase confirmation from Apple or Google. To delete feedback, the email address you gave or the approximate time is enough. We cannot link an identifier without a purchase to a person. You manage and cancel the subscription itself with Apple or Google.
9. Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may also lodge a complaint with a data-protection authority; the LfDI Baden-Württemberg is the authority responsible for our registered office.
10. Story Workshop
In the Story Workshop, parents can have a story of their own created for their child. The text and the narration are created automatically from your selection. Every order starts behind the parental gate, and the app releases each new story to your child only after you have viewed and released it in the parents' area.
What data we process
Your selection: picture cards, if you wish character names from a fixed list of suggestions, language, age (3 to 10 years), reading level and length. There is no free-text field; you cannot enter a name of your own, such as your child's.
The random, pseudonymous identifier of this app installation (the same as for the purchase check), your entitlement from a purchase (with a hash of the store transaction) to count your allowance, as well as the identifier, status and timestamps of the order.
The created story (title, text and audio file).
For the free trial story, the IP address when the request arrives. To prevent abuse, we store only a hash of your network formed with a secret key, never the address itself.
In the workshop we do not ask for an email address or location and do not process any voice recordings or typed text from your child. If your child picks the picture cards, we only send that selection.
Anonymous daily counts of the workshop
The app reports fixed workshop events without any identifier as anonymous daily counts to our own backend: opened, story ordered and finished, failure or block with a fixed reason. A card choice, a name, a text or your allowance is never reported. We delete individual reports after 7 days and daily totals after 120 days at the latest. The legal basis is our legitimate interest in finding errors and improving the app (Art. 6(1)(f) GDPR).
Purposes and legal bases
Creating, checking, narrating and providing the ordered story, and checking and counting the allowance: performance of the contract (Art. 6(1)(b) GDPR). Using the workshop is voluntary; without this information we cannot create a story.
Where the card choice and the age group are information about your child, we process them to create the story you ordered for your child; the legal basis for this is our and your legitimate interest (Art. 6(1)(f) GDPR). Your child's interests do not override it, because we collect no name, no picture and no free text from the child and use the information only for this story.
Protection against abuse and disproportionate costs and handling reports: legitimate interest (Art. 6(1)(f) GDPR).
The workshop is meant for parents: you are the contracting party, and an order is placed by an adult behind the parental gate. We do not base the workshop on your child's consent and do not build profiles of your child. Our server checks every text automatically against fixed rules; this check makes no decision about you or your child and does not replace your own judgement.
Recipients and transfers to third countries
For the workshop we use processors (Art. 28 GDPR) in three categories: for server and storage (we store the story files in the EU), for text creation and for speech output. The text creation provider receives the description of the chosen cards, the chosen character names, language, age, reading level and length and, for checking, the title and text of the story; the speech output provider receives the text of the story and the language. Neither receives the identifier of your installation or your IP address.
These providers are based in the USA or also process data there. We base transfers to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. On request to apps@bitbeans.de we will name the individual providers and send you a copy of the safeguards. If a new category of recipients or another third country is added, we update this privacy policy beforehand.
Retention
Server copy of a finished story: 30 days after completion, so that the app can download it. You keep the copy on your device until you delete it.
Failed orders: we delete the content when the order fails, and the entry without content after 7 days.
Counters: the network hash until the end of the following month, the monthly allowance of a purchase for the current and the twelve previous calendar months (it belongs to the purchase and remains for that long even after "Delete all workshop data"), the use of the one-time trial until you choose "Delete all workshop data", other counters without an identifier 35 days.
At the providers: according to its own information, the text creation provider deletes inputs and outputs within 30 days, or after up to 2 years if a breach of its usage rules is suspected. At the speech output provider we delete every narration right after it is created; according to its own information, it removes backup copies within 30 days. If the deletion fails in an exceptional case, the narration stays there until we delete it. According to its own information, it keeps logs for troubleshooting and abuse detection without a fixed period.
Deletion
If you delete a story in the app, it can no longer be retrieved immediately; we remove its files immediately, at the latest in the next hourly run. "Delete all workshop data" in the parents' area deletes the workshop stories on this device and, on our server, all workshop stories and orders of this installation as well as its random identifier with the related server data, usually within a few hours. While a purchase is active, "Delete all workshop data" is not available so that the purchase can be restored; you can then delete single stories as described above, and we delete the server copy of every story after 30 days in any case. You can send us any further deletion request at any time through the feedback or to apps@bitbeans.de.
If you report a story with "Report a story", your message reaches us through the feedback in the parents' area and contains the identifier of the story. With it we find the order on our server while it is stored, check the story and improve the checking rules. The legal basis is our legitimate interest in safe content for children (Art. 6(1)(f) GDPR).
In case of abuse or repeated justified reports, we can block the workshop for an installation; it then creates no new stories, while stories already created and purchases are not affected. For this we store a fixed reason (abuse, repeated reports or other) and the time with the random identifier until we lift the block or the identifier is deleted. We log every block with reason and time and every lifting with time, without names. These entries keep the identifier as long as it exists; after the identifier is deleted, they remain without it. The legal basis is our legitimate interest in safe content for children and in preventing abuse (Art. 6(1)(f) GDPR).