Updated: 6 August 2026
1. Controller
Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany; email: apps@bitbeans.de.
2. Data processed
The base game works without a visible account. Progress, downloaded puzzles, settings and active spot-the-difference games are stored mainly on the device.
For purchase verification and restoration, Picparo may create an anonymous Firebase purchase session when needed. This processes the Firebase UID, Firebase ID token, product ID, store platform and technical receipt data. Purchases and restoration work without a visible account, and the store entitlement remains separate from the optional cloud account.
Sign-in with Google or Apple through Firebase Authentication is optional. We process the Firebase UID, email address and name if Google or Apple supplies those details, as well as the sign-in provider and stable provider identities to associate the account.
Only when you are signed in and explicitly use the cloud feature is your progress end-to-end encrypted on the device. Cloudflare/AppCore stores the ciphertext and technical synchronization data such as schema version and ETag. An internal user identifier and timestamps are also processed for account association; the Firebase ID token authenticates the transfer. The recovery key stays on your device unless you manually copy and keep it for recovery; it is not sent to the backend.
For catalogs, puzzle packs and daily puzzles, the app loads manifest and image data. Technical server logs may contain IP address, time, requested resource and status code. For voluntary feedback, only the message and the contact or technical details you choose are processed.
3. Purposes and legal bases
We process data to provide the app, verify purchases, deliver online features you actively use, maintain security, resolve errors and answer voluntary requests. Depending on the operation, the legal bases are Article 6(1)(b), (f) or, where expressly requested, (a) GDPR.
4. Recipients and service providers
We use Cloudflare for content delivery, the backend, encrypted cloud progress, technical logs, security and purchase verification; Firebase/Google for anonymous sessions and optional authentication; and Apple and Google for sign-in and store services. There is no third-party advertising or advertising tracking.
5. International transfers
Some providers may process data outside the EU or EEA. Where no adequacy decision applies, transfers rely on appropriate safeguards, in particular EU Standard Contractual Clauses, or on applicable statutory exceptions.
6. Advertising and tracking
The app contains no third-party advertising. We do not create advertising profiles, sell personal data or use advertising tracking.
7. Retention and security
Local data remains on the device until it is removed in the app or through system settings. Server data is retained only for as long as required for the respective function, security and statutory evidence. Transfers are encrypted.
8. Delete data and account
Local data can be removed in the app or through the device’s system settings. Where an account or cloud data exists, deletion can be requested in the app or by emailing apps@bitbeans.de. Store purchases are managed separately by Apple or Google.
9. Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may also lodge a complaint with a data-protection authority; the LfDI Baden-Württemberg is the authority responsible for our registered office.