Privacy Policy

Who is responsible

The apps are published by Tobias Tønnessen, an independent developer based in Oslo, Norway ("I", "me"). I am the data controller for the personal data described here. For any privacy question or request, write totobiasht93@gmail.com.

This policy covers every app I publish under my own name on the Apple App Store and Google Play ("the apps"). It does not cover apps I have built for clients; those are published by the client and have their own policies. Not every app uses every feature described below. An app only collects the data needed for the features it actually has, and the privacy details on its store listing show what applies to that app.

What is collected

Account information

If an app lets you create an account, I store the details needed to sign you in: your email address, or the identifier and basic profile details (such as name and email) shared by Apple or Google when you use their sign-in. Passwords are handled by the authentication provider and are never visible to me.

Content you create

Anything you add in an app, such as entries, settings, lists or uploaded images, is stored so it can be shown to you and synced between your devices. I do not look at this content except when needed to fix a problem you have reported or when the law requires it.

Usage data and crash reports

The apps may collect information about how they are used (screens opened, features used, session length) and technical diagnostics when something goes wrong (crash logs, device model, operating system version, app version, language and approximate region derived from your IP address). This data is tied to a pseudonymous app-instance identifier, not to your name.

Advertising data

Apps that show ads use Google AdMob. The ads are non-personalised: they are not based on your interests, your behaviour or a profile of you. To deliver ads, limit how often the same ad is shown, measure results and prevent fraud, AdMob processes your IP address (which also gives an approximate region), device and app information, and which ads were shown and tapped.

In apps made for children, every ad request is marked as child-directed and limited to content rated for a general audience. For those requests Google turns off personalisation and does not use the device's advertising identifier.

Purchases

In-app purchases and subscriptions are processed by Apple or Google. I never receive your card number or billing details. I only receive confirmation of what was bought, when, and whether a subscription is active, so the app can unlock what you paid for.

Permissions

Some features need a device permission such as camera, photos, notifications or Bluetooth. An app asks only when the feature needs it, uses the access only for that feature, and keeps working without it where possible. You can withdraw a permission at any time in your device settings.

Messages you send me

If you email me for support, I keep the conversation for as long as needed to help you and to follow up.

Why it is used, and the legal basis

• To provide the app: signing you in, storing and syncing your content, and unlocking purchases. Legal basis: performance of the contract with you (GDPR art. 6(1)(b)).
• To keep the apps working and make them better: crash reports and usage statistics. Legal basis: my legitimate interest in a stable, useful product (art. 6(1)(f)), or your consent where the law requires it.
• To show ads: non-personalised ads pay for apps that are free to use. Legal basis: my legitimate interest in funding the apps (art. 6(1)(f)), or your consent where the law requires it for storing or reading information on your device.
• To meet legal obligations: for example bookkeeping rules for sales (art. 6(1)(c)).

I do not sell your personal data, and I do not use it for automated decisions that have legal or similar effects on you.

Who receives data

I use a small number of service providers that process data on my behalf or as independent controllers. Depending on the app, these may include:

• Google Firebase (authentication, database and file storage, analytics, crash reporting). SeePrivacy and Security in Firebase.
• Google AdMob (advertising). Seehow Google uses information from apps that use its services.
• Apple App Store and Google Play (payments and subscriptions)

The providers that apply to a specific app are reflected in that app's privacy details on its store listing. Beyond these providers, data is only disclosed if the law requires it.

Transfers outside the EEA

Some providers process data in the United States or other countries outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

How long data is kept

• Account information and your content: until you delete your account, or the content itself.
• Usage data and crash reports: up to 14 months, then deleted or aggregated so it no longer identifies anyone.
• Purchase records: as long as bookkeeping law requires, normally five years.
• Support emails: up to two years after the conversation ends.

Deleting your account and data

Apps with accounts let you delete your account from inside the app, under settings. You can also emailtobiasht93@gmail.com from the address tied to the account and name the app. Your account and the content linked to it are deleted within 30 days, except records I am legally required to keep. Data stored only on your device is removed when you uninstall the app.

Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent you have given. Email me and I will respond within 30 days. You can also control data collection yourself:

• iOS: Settings → Privacy & Security, and the app's own permission settings.
• Android: Settings → Privacy → Ads to reset or delete your advertising ID, and the app's permission settings.

If you believe your data is handled unlawfully, you can complain to the Norwegian Data Protection Authority,Datatilsynet, or to the authority in your own country.

Children

Some of the apps are made for children. Those apps have no accounts, no chat, no social features and no in-app purchases, and they never ask for a name, email address, photos, contacts or location. Progress and settings are saved only on the device. Ads in those apps are child-directed and non-personalised, as described underAdvertising data.

Those apps may use Google Analytics for Firebase to count things like how many games are played and where the app crashes, so I can fix problems and improve the app. In apps for children, collection of the advertising identifier is switched off, the statistics are never used for advertising or to build a profile, and they are tied only to a random app-instance identifier that is reset when the app is reinstalled.

Apps with accounts are not intended for children under 13, and I do not knowingly collect personal data from them. If you are a parent or guardian and believe your child has given me personal data, contact me attobiasht93@gmail.com and I will delete it.

Security

Data is encrypted in transit, stored with established cloud providers, and access is limited to me. No system is perfectly secure, but if a breach affecting your data occurs I will notify you and the authorities as the law requires.

This website

This website does not use cookies, analytics or tracking. The hosting provider may keep standard server logs, including IP addresses, for a short period for security and operations.

Changes to this policy

When the policy changes, the new version is published on this page with a new date. If a change significantly affects how your data is used, you will be told in the app before it takes effect.