Updated: 8 October 2026
1. Controller
Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany; email: apps@bitbeans.de.
2. Data processed
Progress (clues found, cases and quick puzzles solved, stars, stickers) as well as sound, vibration and language settings are stored only on the device. There is no app account, no sign-in and no camera, microphone or location feature.
Parental gate: a calculation task stands in front of purchase, restore and language selection in the parents’ area. After several wrong answers in a row there is a pause. So that the pause survives a restart of the app, the app stores two counters (failed attempts and pause level) and a point in time locally on the device. These values are not sent over the network and contain neither names nor entries. On iOS they can be part of a device backup; Android does not back up the app data.
Purchase: The full version is a one-time purchase through the App Store or Google Play, available only through the parents' area. To verify purchases, the app signs in to our server, which runs on Cloudflare, with a random identifier created only for this purpose and sends the store's purchase receipt there. We do not receive names, account or payment details. Only the report of a completed purchase is checked with this identifier so that it counts as a real purchase; the identifier is not stored with the report. The purchase is kept when progress is reset and can be brought back on the purchase page with “Restore purchases”.
Languages and narration: Spurenclub can be played in English, German, French, Spanish, Italian and Brazilian Portuguese. The texts of the free cases are included in the app in every language; the cases and puzzles of the full version are downloaded once per language from our server, which runs on Cloudflare, after the purchase has been verified and then stay on this device. The English narration for the free cases is included, and the narration for the full version is downloaded once after the purchase has been verified; the narration for another language is downloaded once from our server, which runs on Cloudflare, when that language is used for the first time (chosen in the parents' area or set as the device language), and again only if the device has deleted the downloaded files. For this download the app uses the same random identifier as for purchase verification; the narration for the full version is only delivered once the purchase has been verified. Downloaded narration stays on this device.
Anonymous usage measurement: So that we can see where a case is too hard or something does not load, the app sends a few summarized reports to our server, which runs on Cloudflare: how long the start took (in rough steps), that the introduction was started and then finished or left early, that the first, second or third case or a quick puzzle was opened or solved, that the help was used, that a case or puzzle was left early, that a locked case was tapped or the parents' area was opened, that the purchase page was opened and a purchase or restore was started, completed or canceled, that the language was changed and that the download of a narration pack was started, completed, canceled or failed, as well as errors when loading the narration or saving. Only fixed event names and fixed codes, the platform, the app version, the language and the rough origin of the installation (store or test) are transmitted. No account, device or advertising identifiers, names of cases or places, progress or entries are transmitted; this means we cannot link the data to a person or a child. Individual reports are deleted after 7 days, daily totals after 120 days at the latest. The legal basis is our legitimate interest in an app that works (Art. 6(1)(f) GDPR); you can object under Art. 21 GDPR by email to apps@bitbeans.de. To prevent abuse, the server limits the number of reports per connection for at most two hours using a non-reversible hash of the IP address; it is not linked to the reports. If a report fails, you will not notice anything.
Feedback and rating: Feedback can only be sent from the parents' area and is meant for adults. We then receive your message, an optional email address, the app version, the platform and the language on our server, which runs on Cloudflare; for handling it, the message is also forwarded to our support by internal email. To prevent abuse, the server limits the number of messages using a non-reversible hash of the IP address; it is not linked to the message. We store the message on our server; there is no fixed retention period. Parents can ask for information and deletion by email to apps@bitbeans.de. Progress, purchase identifier and the anonymous usage measurement are not sent along. After a few solved cases, the app may now and then ask for a store rating, only in the parents' area, never during play and never on the purchase page; the store decides whether its rating sheet is shown, and the app does not receive the rating.
Children and parents: The app is aimed at children aged 7 to 10. We do not knowingly collect personal data from children: there is no account, no advertising, no third-party tracking or analytics SDKs, no chat or share feature; text can only be entered in the feedback form behind the parental gate. Purchase, restore and language selection can only be reached after the parental gate. The anonymous usage measurement contains no identifier and cannot be linked to a child. Parents can send questions and access or deletion requests to apps@bitbeans.de or https://bitbeans.de/daten-loeschen.
The app contains no advertising and no third-party tracking or analytics SDKs; there is no advertising tracking and no usage profile.
Artificial intelligence: The illustrations of Spurenclub were created with AI and the narration voices were produced with speech synthesis; both happened before release. The app does not send any input to AI services and uses no AI at runtime.
3. Purposes and legal bases
We process data to provide the app, verify purchases, deliver online features you actively use, maintain security, resolve errors and answer voluntary requests. Depending on the operation, the legal bases are Article 6(1)(b), (f) or, where expressly requested, (a) GDPR.
4. Recipients and service providers
We use Cloudflare for secure purchase verification, for delivering the full version’s content and the narration voices, and for the anonymous usage measurement; Apple and Google provide store and payment services.
5. International transfers
Some providers may process data outside the EU or EEA. Where no adequacy decision applies, transfers rely on appropriate safeguards, in particular EU Standard Contractual Clauses, or on applicable statutory exceptions.
6. Advertising and tracking
The app contains no third-party advertising. We do not create advertising profiles, sell personal data or use advertising tracking.
7. Retention and security
Local data remains on the device until it is removed in the app or through system settings. Server data is retained only for as long as required for the respective function, security and statutory evidence. Transfers are encrypted.
8. Delete data and account
Local data can be removed in the app or through the device’s system settings. Where an account or cloud data exists, deletion can be requested in the app or by emailing apps@bitbeans.de. Store purchases are managed separately by Apple or Google.
9. Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may also lodge a complaint with a data-protection authority; the LfDI Baden-Württemberg is the authority responsible for our registered office.