Privacy – Waffensachkunde Kompakt

Anonymous purchase, learning and review statistics

So that we can see where a purchase fails, whether a review prompt could be shown and whether the app runs fast and reliably, the app reports a few fixed events to our backend operated on Cloudflare: technical purchase steps such as purchase page shown, price loaded, purchase started, cancelled, failed or restored, and whether a review prompt was possible, requested, suppressed or unavailable, and a failed sign-in or account deletion. Once per installation, the app also reports whether the introduction was started, skipped or completed; we delete these counts after at most 120 days. Also, each at most once a day: where the purchase page was opened from (a fixed category such as start page, settings, introduction or a locked topic), whether Buy was tapped there and whether a purchase was made from it, whether a learning round or mock exam was started and roughly at which point one of them was left, the coarse start time until the app can be used (for example “1 to 2 seconds”) and whether the daily reminder is on, was switched or opened the app. With a purchase, the app also sends which purchase page it came from along with the purchase verification; we store this fixed category with the purchase data so that purchases per page cannot be miscounted, and delete it together with them. On the purchase page, the app also counts, at most once a day per page of origin, whether “Check status” was tapped for a waiting purchase, whether the confirmation was shown after a purchase or restore, and whether a restore ended without a purchase found. Each event contains only the event name, fixed categories, platform, app version and app language; no learning content, no answers, no input and no purchase receipts. The event itself contains no sign-in, account or device identifier. If the app already has a sign-in (including an anonymous one), it sends that session’s credential along for authentication; our backend uses it only for short-term rate limiting and to match a purchase report with a purchase the server verified for the same sign-in. Stored with the event is only whether it was signed in, neither identifier nor session; so that a confirmed purchase counts only once, a hashed reference to that purchase is kept with it for at most 8 days. Current app versions also send with every event the coarse origin of the installation (store, test or developer installation) so that test traffic is counted separately; it is determined on the device, without any device or installation identifier. If an event comes from the networks Google publishes for its automated pre-launch tests (Firebase Test Lab), our backend also counts it as test traffic; the IP address is only compared for this and not stored. We delete individual events after seven days. Daily totals of review prompts and of the daily events are deleted after at most 120 days; aggregate daily counters of purchase steps and of purchase and account-deletion errors are kept without a fixed deletion date. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is finding errors and purchase problems and improving the app. Because the events contain no identifier, we cannot link them to a person (Art. 11 GDPR). You can object under Art. 21 GDPR at any time by emailing apps@bitbeans.de. A failed report has no effect on learning or purchases.

1. Controller

Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany; email: apps@bitbeans.de.

2. Data processed

Learning progress, quiz results, settings and started exercises are processed locally or assigned to the signed-in account, depending on the feature.

For purchase verification and restoration, we process product ID, store platform and technical receipt data.

When the optional AI study help or AI exam analysis is used, the question or relevant answers and learning material are sent through our backend to xAI (Grok). Account and payment data is not sent for this purpose. Do not enter personal data in free-text fields.

When you sign in, we process your account’s sign-in ID and email address through Firebase/Google to link learning progress, purchases and account deletion to your account.

Voluntary feedback contains your message, an optional contact email address, category, app version, platform and the screen it was sent from; question suggestions contain the suggested text and, where applicable, the topic. If you are signed in, we link both to your account; we forward feedback to our support team by internal email for handling. Both are deleted when you delete your account.

To select matching catalog texts and to check whether the answer from AI study help is supported by them, we also send the question, catalog excerpts, for questions asked from a quiz also the quiz question with its options, your chosen answer, the solution and explanation, and the generated answer to TypeSafe (api.typesafe.ai); for Plant Protection and Weapons Expertise, a question held back by the word filter may additionally be assessed there together with its quiz context. TypeSafe does not generate text; account, sign-in and payment data are not sent.

3. Purposes and legal bases

We process data to provide the app, verify purchases, deliver online features you actively use, maintain security, resolve errors and answer voluntary requests. Depending on the operation, the legal bases are Article 6(1)(b), (f) or, where expressly requested, (a) GDPR.

4. Recipients and service providers

We use Cloudflare for backend, database, media and security, Firebase/Google for sign-in, and Apple and Google for store services. xAI (Grok, api.x.ai) is used only when the optional AI feature is requested.

5. International transfers

Some providers may process data outside the EU or EEA. Where no adequacy decision applies, transfers rely on appropriate safeguards, in particular EU Standard Contractual Clauses, or on applicable statutory exceptions.

6. Advertising and tracking

The app contains no third-party advertising. We do not create advertising profiles, sell personal data or use advertising tracking.

7. Retention and security

Local data remains on the device until it is removed in the app or through system settings. Server data is retained only for as long as required for the respective function, security and statutory evidence. Transfers are encrypted.

8. Delete data and account

Local data can be removed in the app or through the device’s system settings. Where an account or cloud data exists, deletion can be requested in the app or by emailing apps@bitbeans.de. Store purchases are managed separately by Apple or Google.

9. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may also lodge a complaint with a data-protection authority; the LfDI Baden-Württemberg is the authority responsible for our registered office.