Privacy – Krautbytes

1. Controller

Julian Röckl
Brieger Straße 14
80997 Munich
Germany

Privacy enquiries: contact@krautbytes.de

2. Visiting krautbytes.de

The website is delivered through Firebase Hosting. When it is opened, technically necessary connection data is processed, particularly the IP address, time, requested address, and browser and device information.

Purpose: Secure and reliable delivery of the website and detection of abuse and errors.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the service.
Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the provider of Firebase.
Retention: According to the provider, Firebase Hosting retains IP data for a few months.

This website uses no analytics, advertising or profiling services, externally hosted fonts, or contact form. It sets no analytics or marketing cookies. When you use an email link, your chosen email provider processes the message under its own terms.

3. Skillovo: core principle

Skillovo works locally and does not require registration. Skills, progress, and settings leave your device only when you explicitly use an optional cloud or sharing feature.

Necessary connection and security data is nevertheless processed when the web app is opened and when Firebase interfaces are protected. Skillovo collects no usage analytics and uses no advertising, tracking, or profiling.

4. Local processing in Skillovo

Skill definitions and categories, criteria and steps, notes, levels and targets, practice tasks and repetition counts, activities, and language, display, and notification settings are stored locally.

Purpose: Providing the app, storing learning progress, and displaying personal recommendations and reminders.
Legal basis: Article 6(1)(b) GDPR where processing is necessary for the app features you request.
Retention: Until you delete data in Settings, clear the app data, or remove the app from your device.

Device, browser, or operating-system backups may retain local copies under their own rules. Skillovo cannot access those backups.

In the LLM-assisted workflow, the topic, prompt, and pasted JSON response are processed exclusively on the device. Skillovo does not connect to an AI provider. If you independently transmit content to an external provider, that provider's privacy rules apply.

5. Hosting and technical security

When the web app is opened, Firebase Hosting processes the IP address, time, requested URL, and browser and device information. Depending on the platform, Firebase App Check processes technical integrity attestations and short-lived security tokens.

Services: Firebase Hosting and App Check; depending on the platform, reCAPTCHA Enterprise, Play Integrity and, for appropriately prepared iOS releases, App Attest or DeviceCheck.
Purpose: Delivery, stability, abuse prevention, and protection of Authentication and Firestore from unauthorized clients.
Legal basis: Article 6(1)(f) GDPR. The legitimate interests are secure, reliable operation and protection of user data.
Retention: Hosting IP data is retained for a few months according to the provider. App Check does not retain the attestation material itself; Skillovo security tokens are valid for about one hour.

6. Accounts and sign-in

A durable account is created only when you explicitly connect Google or, where available, Apple to use cloud synchronization. Connecting the account does not enable synchronization. Skillovo may first create an anonymous Firebase session when a share code is created or loaded.

Data: Firebase user ID, sign-in state, provider identifier, where available name, email address and profile image, authentication and session tokens, IP address, and user agent.
Purpose: Secure sign-in, assignment of optional private cloud data, and protection against access by other accounts.
Legal basis: Article 6(1)(b) GDPR to provide the account, synchronization, or sharing feature you explicitly request.
Retention: Until the Skillovo account link is deleted. Firebase states that logged authentication IPs are retained for a few weeks and other deleted Auth data is removed from live and backup systems within up to 180 days.

Google and Apple also process data under their own responsibility when you use the selected sign-in method. Skillovo never receives your Google or Apple password.

7. Historical account entitlement

Accounts that secured a benefit in an earlier release may retain an immutable entitlement in their private account area and a validated copy on their device. New claims are disabled in this release and all Skillovo features are currently free.

Data: Firebase user ID as the assignment, legacy program identifier, entitlement tier, server-side grant time, permanent marker, and a local cached copy.
Purpose: Preservation and restoration of previously granted account benefits and fast offline verification.
Legal basis: Article 6(1)(b) GDPR to preserve the previously granted benefit.
Retention: Until you delete your Skillovo account link. Account deletion removes both the Firestore entitlement and the local cached copy.

8. Optional cloud synchronization

Synchronization is off by default. Once enabled, Skillovo processes skills including your text, notes, criteria, steps, levels, targets, practice and time information, activities, and technical synchronization metadata.

Purpose: Private backup, restoration, and cross-device synchronization.
Legal basis: Article 6(1)(b) GDPR to provide the cloud backup you request.
Location: Cloud Firestore at the permanently selected European multi-region location eur3.
Retention: Until you use “Delete Skillovo account and cloud data”. Disabling synchronization only stops further syncing and does not delete an existing cloud copy.

Instructions and an external request route are available under Delete your account and cloud data .

After your explicit action, Skillovo creates a random twelve-character share code. Anyone who knows the code can load the shared skill definition while it is valid. Public listing is technically blocked.

The skill name, description, categories, levels, criteria, reusable practice definitions, and creation and expiry times are shared. Progress, notes, activities, targets, account data, creator identity, and internal source IDs are not shared.

Purpose: Time-limited sharing of a reusable skill definition with people you choose.
Legal basis: Article 6(1)(b) GDPR to perform the sharing feature you request.
Retention: Access ends automatically after 30 days. Expired documents are no longer delivered and are deleted during operational cleanup no later than 90 days after expiry.

10. Local notifications

Reminders are off by default. Once enabled, only the device processes the chosen weekday, time, and reminder interval. Skillovo uses no push or Firebase messaging.

The legal basis is Article 6(1)(a) GDPR based on your voluntary activation and operating-system permission. You can withdraw consent at any time by disabling reminders. The settings remain until they are disabled, the app data is cleared, or the app is uninstalled.

11. Recipients and international transfers

Google Ireland Limited generally provides Firebase as a processor. Google LLC and published subprocessors may participate in technical service delivery.

Firestore content is stored at the eur3 location in Europe.
According to the provider, Firebase Authentication is operated exclusively from data centers in the United States.
Firebase Hosting and App Check use global infrastructure.

Where data is processed outside the European Economic Area, Google relies as applicable on adequacy decisions, including the EU-US Data Privacy Framework, and the European Commission's Standard Contractual Clauses. Firebase transfers data over HTTPS and also encrypts, among other services, Firestore, Authentication, and App Check data at rest.

12. Provision of data and automated decision-making

Local skill data is required for the core features you request. Accounts, synchronization, sharing, and notifications are voluntary. Without the associated data, the local core remains available and only the optional feature is unavailable.

Skillovo makes no solely automated decisions with legal or similarly significant effects and creates no profile for advertising or scoring.

13. Your privacy rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, and, where applicable, objection. You may withdraw consent at any time with effect for the future.

To exercise your rights, email contact@krautbytes.de. We may request reasonable proof of identity to securely match your request.

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority. The authority particularly responsible for the controller is the Bavarian State Office for Data Protection Supervision :

Promenade 18
91522 Ansbach
Germany

14. Changes and further information

This notice is updated when features, providers, or the legal situation change. The current date appears above. We provide appropriate notice of material changes.

15. Calm Warden: apps and browser extensions

Calm Warden notice: 18 October 2026

Local protection and device permissions

Calm Warden stores rules, selected website domains, schedules, daily limits, focus sessions, temporary exceptions, the reasons and optional situations you enter, confirmed activity, usage counters, language and display settings on your device. The browser extension checks relevant website requests and measures usage needed to apply your chosen rules. It does not read the content, messages, form entries or passwords of visited websites, and does not upload your complete browsing history. Browser website access is used to identify and redirect the domains you choose. Withdrawing permission can stop the corresponding protection. Apple Screen Time selections and Android app selections remain device-local. The legal basis is Article 6(1)(b) GDPR for the features you request.

Optional accounts, synchronisation and Pro access

Local rules work without an account. If you use an account, Firebase Authentication processes your email address, Firebase user ID, authentication/session information and technical connection data. Your account password is transmitted securely to Firebase for authentication; it is not a password collected from other websites. If you enable synchronisation, Cloud Firestore stores portable website rules, confirmed focus and exception events, any reasons or situation labels you enter, device identifiers, daily usage contributions and technical synchronisation metadata under your account. Native app-selection tokens are not synchronised. A voluntary situation label is your own input, not a GPS reading.

Account-based Pro status and any complimentary grant are linked to the Firebase user ID. This can include the access tier, source, expiry and grant/revocation audit records. The same Calm Warden account is required on each device; matching store email addresses alone do not link accounts. Purchases and web checkout are disabled in this release. No payment-card details are collected by Calm Warden. The legal basis for requested account, sync and access features is Article 6(1)(b) GDPR. Security and abuse prevention rely on Article 6(1)(f), with the legitimate interest of protecting accounts and the service. Calm Warden does not sell user data, use it for personalised advertising or transfer it for creditworthiness or lending decisions.

Providers, storage locations and transfers

Google Ireland Limited provides Firebase Authentication, Cloud Firestore and Cloud Functions as cloud services. Calm Warden's database and backend are configured in Frankfurt (europe-west3). Authentication, technical service data, support operations and provider infrastructure can involve processing outside this region, including in the United States. A German database location does not mean that all processing remains in Germany. The provider's applicable data-processing terms, adequacy decisions and Standard Contractual Clauses govern international transfers as applicable.

RevenueCat, Inc. is used for associated subscription-customer data where it exists. As part of account erasure, the backend sends your Firebase user ID to RevenueCat to request removal of any associated customer record. It does not query the provider to create a new customer during this check. RevenueCat's data-processing addendum includes safeguards for international transfers. This release does not initiate a new purchase or web checkout.

Retention and account deletion

Your account data stays in the active cloud account until deletion. Signing out or turning sync off does not delete it. In the extension settings, request account deletion and authenticate again if prompted. You can also request deletion at contact@krautbytes.de from your account email address; we may need to verify ownership. Never email your password.

The deletion process blocks cloud access, recursively removes account data from the active database and deletes the Firebase Authentication account. A bounded background job then requests removal of any RevenueCat customer. Failed steps are retried; persistent failures require operator intervention. Completed technical operation/deletion receipts are retained for seven days, billing cases marked for review for 30 days, and minimal deletion safeguards for 30 days after provider acceptance. Incomplete deletion requests are not removed merely because of age. These are technical service records, not statutory invoice-retention periods. A deletion receipt confirms acceptance of the provider request, not immediate physical erasure of every provider backup.

Local protection data on other devices is not remotely wiped. Remove it in the app or extension, clear local data or uninstall as appropriate; device and operating-system backups follow their own settings. Firebase states that deleted Authentication data is removed from live and backup systems within up to 180 days and logged authentication IP addresses are retained for a few weeks. Technical cloud logs and legally required security/audit records follow the configured provider retention. Account deletion does not cancel a pre-existing store subscription; cancellation remains with the original store.

Support and your rights

Contact support@krautbytes.de for product help or contact@krautbytes.de for privacy requests. We process your email and the information you choose to send to handle the request and retain correspondence as needed to resolve it, document the outcome and meet applicable legal obligations. The legal basis is Article 6(1)(b) for service support, Article 6(1)(c) for legal duties and, where necessary, Article 6(1)(f) for defending legitimate claims. Do not send payment-card data, passwords or unnecessary browsing history. The rights and complaint routes in sections 13 and 14 also apply to Calm Warden.

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide and secure the user-facing protection, account and synchronisation features described here.

Firebase Privacy · Google Cloud Data Processing Addendum · RevenueCat Privacy · RevenueCat Data Processing Addendum · Calm Warden support

Privacy notice