Privacy Policy

2025-11-20

Privacy Policy for the Wichtelrad app

Last updated: 20 November 2025

Protecting your personal data is very important to us. In this privacy policy we inform you, in accordance with the General Data Protection Regulation (GDPR), about the processing of personal data in the Wichtelrad app.

1. Data Controller

Aleksej Kolb
moodwave@kaleidoscope-apps.de

2. Types of data processed

Depending on how you use the app, the following data is processed:

• Data during registration / login (Google & Apple)

  • Email address
  • Name (if provided by the provider)
  • Unique user ID

This data is provided by Google or Apple when you sign in via these providers.

• Usage data within the app

  • Created Secret Santa groups
  • Participant information that you enter manually
  • Settings in the app
  • Time of account creation
  • User ID used to associate your content

• Data for subscription management (RevenueCat)

  • Anonymised user identifier
  • Subscription status
  • Product ID of the subscription
  • History of your in-app purchases (without any personal content)

• Anonymous usage statistics (TelemetryDeck)

  • Randomly generated, cryptographically hashed identifier (no conclusions about your identity are possible)
  • App areas visited and events triggered (e.g. “group created”)
  • Technical context data: app version, operating system version, device type, language, approximate region (country)

TelemetryDeck receives no IP address, no email address, no names and no content of your Secret Santa groups.

• No tracking or advertising data

There is no cross-device tracking, no profiling and no advertising. No advertising identifiers (IDFA) are used.

• Account creation & authentication

Processing of login data in order to give you access to the app.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

• Storage of app data (Supabase)

Supabase serves as the backend to store your content securely.
Legal basis: Art. 6(1)(b) GDPR

• Management of subscriptions (RevenueCat)

To verify, activate and manage your subscription.
Legal basis: Art. 6(1)(b) GDPR

• Anonymous usage statistics (TelemetryDeck)

To improve the app, detect errors and understand which features are used.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app and keeping it free of errors)

• Security & stability of the app

Technically necessary measures, e.g. server logs or error reports.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

4. Storage of your data with Supabase

We use Supabase to store your app data.
Supabase acts as a processor pursuant to Art. 28 GDPR.

Supabase stores:

  • Account data
  • Secret Santa groups
  • Participant data
  • App settings

The servers are located exclusively in regions that comply with the GDPR.

5. Anonymous usage analysis with TelemetryDeck

We use TelemetryDeck (TelemetryDeck GmbH, Bornstraße 12, 20146 Hamburg, Deutschland) to obtain anonymous statistics about the use of the app.

TelemetryDeck is designed with privacy in mind:

  • All signals are cryptographically hashed on the device with a salt before they are sent. It is therefore not possible to draw any conclusions about your identity.
  • No cookies, no advertising identifiers and no IP addresses are stored.
  • Processing and storage take place exclusively on servers in the European Union.
  • TelemetryDeck acts as a processor pursuant to Art. 28 GDPR.

Further information: https://telemetrydeck.com/privacy/

6. Disclosure of data to third parties

Data is only disclosed:

  • to Google or Apple, insofar as this is necessary for the login.
  • to RevenueCat, but exclusively for the management of subscriptions.
  • to Supabase as the technical operator of the database.
  • to TelemetryDeck in the form of anonymised usage signals.
  • where there is a legal obligation to do so (e.g. a court order).

There is no disclosure to advertising partners or tracking providers.

7. Storage period

  • Your data is stored for as long as your user account exists.
  • If you delete your account, all personal data is deleted from Supabase.
  • RevenueCat stores subscription information in anonymised form for billing purposes.
  • Signals stored with TelemetryDeck are anonymous and cannot be attributed to any user account; they are retained in aggregated form.

8. Rights of the data subject

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)

Which data we store about you.

• Right to rectification (Art. 16 GDPR)

Correction of inaccurate or incomplete data.

• Right to erasure (Art. 17 GDPR)

Deletion of your account and of all stored data.

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

Provision of your data in a machine-readable format.

• Right to object (Art. 21 GDPR)

To exercise your rights, please contact us at:
moodwave@kaleidoscope-apps.de

9. Data security

We use technical and organisational measures to protect your data:

  • HTTPS encryption
  • Access control
  • Secured database connections
  • Regular updates and security reviews

10. Changes to this privacy policy

We may amend this privacy policy when new features are introduced or when legal changes require it. The current version is available in the app at any time.

11. Contact

If you have any questions about data protection:
moodwave@kaleidoscope-apps.de