Privacy Policy

1. Controller (Art. 4 No. 7 GDPR)

The controller responsible for data processing within the meaning of the GDPR is:

• Name: Jens Kübler
• Address: Max-Beckmann-Straße 39, 76227 Karlsruhe, Germany
• Email: support@dolphincrusher.com

A data protection officer has not been appointed (none required by law).

1a. Legal Bases for Processing

Where we process personal data, processing is based on the following legal bases:

• Art. 6 (1) lit. a GDPR – consent (e.g. optional beekeeper profile, location access, voice notes, Firebase Analytics)
• Art. 6 (1) lit. b GDPR – performance of a contract (provision of App functions, premium purchases)
• Art. 6 (1) lit. c GDPR – legal obligation (e.g. retention duties under commercial / tax law)
• Art. 6 (1) lit. f GDPR – legitimate interest (e.g. stability, security, Crashlytics for bug fixing)

2. What Data Is Collected?

📱 Required App data

Data required for the basic functions of the App:

👤 Optional personal data

You may optionally provide for your beekeeper profile:

• Name / apiary name
• Email address
• Phone number
• Address / location

📸 Media

• Photos: Beehive images (optional, stored locally)
• Voice notes: Audio recordings (optional, stored locally)

📊 Automatically collected data

3. Data NOT Collected

4. Permissions

5. Data Storage

Locally on your device

• Room database: All beehive data
• DataStore: App settings
• Android Keystore: Encrypted sensitive data

No cloud (basic version)

6. Third-Party Providers

Firebase (Google)

• Crashlytics: Automatic error reports
• Analytics: Anonymous usage statistics
• Privacy: firebase.google.com/support/privacy

OpenAI API (optional)

• Purpose: AI-based beekeeping assistance (premium)
• Active: Only on explicit use
• Privacy: openai.com/privacy

7. Your Rights (GDPR)

You have the right to:

• Access (Art. 15 GDPR): What data is stored about you
• Rectification (Art. 16 GDPR): Correction of incorrect data
• Erasure (Art. 17 GDPR): Complete deletion of all data
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): Export in a structured, machine-readable format
• Objection (Art. 21 GDPR): Against processing based on legitimate interests
• Withdrawal of consent (Art. 7 (3) GDPR): With effect for the future

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular the authority of your habitual residence. The supervisory authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de

8. Protection of Children and Minors

This App is not intended for children under 13 years of age. No targeted data is collected from children.

9. Data Security

• ✅ Encrypted data transmission (HTTPS/TLS)
• ✅ Encrypted storage (Android Keystore)
• ✅ No cloud storage (local data)
• ✅ Regular security updates

10. Google OAuth Authentication

This App uses Google OAuth 2.0 for user authentication. When signing in with Google, the following data is processed:

📊 Google OAuth Scopes Requested

The App requests the following permissions from Google:

• https://www.googleapis.com/auth/userinfo.email – Access to your Google Account email address
• https://www.googleapis.com/auth/userinfo.profile – Access to your Google Profile (name, picture)
• openid – OpenID Connect for secure authentication

🔄 Data Transfer to Supabase

For storing authentication data, Supabase (Supabase Inc., 548 Market St, San Francisco, CA 94104, USA) is used as a data processor:

• Purpose: JWT token management and user authentication
• Legal Basis: Art. 6 (1) lit. b GDPR (Contract performance)
• Safeguards: EU Standard Contractual Clauses (Art. 46 GDPR)
• Privacy Policy: supabase.com/privacy

💾 Storage and Deletion

• Storage Period: Until account deletion or App uninstallation
• Deletion: Automatically upon logout or manual account deletion in the App
• Withdrawal: You can withdraw consent at any time by:
  • Logging out in the App (Settings → Account → Logout)
  • Revoking Google permission at myaccount.google.com/permissions

🇺🇸 Third Country Transfer

Google is a US company. Data transfer to the US is based on an adequacy decision by the EU Commission (EU-US Data Privacy Framework, July 2023).

• Google Privacy Policy: policies.google.com/privacy
• Google Terms: policies.google.com/terms

11. Changes

This Privacy Policy may be updated. You will be notified of material changes within the App.

12. Changelog

13. Language

This Privacy Policy was drafted in German. The English version is a courtesy translation. In the event of any discrepancy between the German and English versions, the German version shall prevail.