Privacy policy

Note: Details in square brackets […] will be added before the public launch.

This policy tells you, in line with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process in "Dein Finanzplaner", for what purpose, for how long, and which rights you have. We keep data to a minimum: the app does not ask for your name and does not use advertising or analytics services.

1. Controller

[First and last name or company name and legal form] [Street and house number, postcode Heilbronn] Email: [email address for data protection requests]

[No data protection officer has been appointed because there is no legal obligation. If there is one: enter name and contact.]

2. What "Dein Finanzplaner" is

A learning and planning app about money. You create an account, play levels with knowledge and event cards and, if you wish, enter your own income and spending. The financial details are voluntary and entered by you; they can be made up, estimated or real, as you prefer.

3. Which data we process and why

3.1 Account and sign-in

  • Data: email address, password (only as an encrypted hash, we never see it in plain text), chosen language, times of registration and sign-in, the invitation code entered at registration.
  • Purpose: creating the account, signing in, confirming your email address, resetting your password, changing your email address, access during the test phase (invitation).
  • Invitations: If you create an invitation in the app, we store the invitation code, the time, its validity and the link to your account. In the settings you only see the status of your invitations (open, redeemed, expired). We do not store in the invitation who registered with it and we do not show it to you; the invited person does not see who invited them. If you delete your account, the code remains without any link to you.
  • Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

3.2 Progress and profile

  • Data: result of the personality quiz ("financial character"), chosen animal, your goals, your answers to choice questions (for example about payment habits, contracts, debt, pensions and investments), living situation (household type), completed stations, points, badges, reminders, favourites, which hints and tours you have already seen.
  • Purpose: making the app playable and saving your progress.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.3 Your financial details

  • Data: income and spending (amounts, own entries, notes, categories), accounts (name and purpose only, please do not enter account numbers or IBANs), contracts and insurance (name, amount, cancellation information, please do not enter contract numbers), savings goals, optimisation ideas and limits.
  • Purpose: showing you your current status, evaluations and hints in the app.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR). The details are voluntary; without them the corresponding parts of the app cannot be used.
  • We do not judge your details, do not pass them on for advertising and make no automated decisions with legal effect (Art. 22 GDPR).

3.4 Emails

We send emails that are necessary for the account: confirming your address, resetting your password, confirming a new email address. There is no advertising newsletter. Sending is done by [email service provider, location and legal basis according to its choice] on our behalf.

3.5 Technical logs

When you visit the pages, our service providers (see section 5) technically record log data: IP address, date and time, page requested, browser and operating system details. They serve secure and stable operation and the prevention of abuse (legitimate interest, Art. 6(1)(f) GDPR). The providers determine the retention period; we do not use the logs for evaluations about individuals.

4. Cookies and local storage

We only use technology that is necessary for the app to work. Under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) no consent is needed for this, and there is no cookie banner. There is no tracking, no analytics and no advertising service.

  • Sign-in session (cookie, up to 400 days): keeps you signed in.
  • Language (cookie `finanzplaner_locale`, 365 days): remembers German or English.
  • Waiting cookie during registration (cookie, 10 minutes): remembers the address whose confirmation is awaited.
  • Local storage in the browser (`localStorage`/`sessionStorage`): which badges you have already seen in your profile, position of the game piece, temporary drafts. You can delete it at any time in your browser settings.

Fonts are hosted on our own servers. No fonts, scripts or images are loaded from Google or other third parties.

5. Recipients and service providers

We pass data only to service providers who support us in operating the app and with whom a data processing agreement (Art. 28 GDPR) exists or is being concluded:

  • Supabase (database and sign-in): the data is stored in a data centre in Frankfurt am Main (region eu-central-1). The provider is Supabase Inc. (USA); [data processing agreement and standard contractual clauses: concluded on …].
  • Vercel (hosting of the website): the provider is Vercel Inc. (USA). Pages are delivered via the provider's global network; the server functions run in Frankfurt [please verify after the next deployment]. [Data processing agreement, standard contractual clauses and participation in the EU-US Data Privacy Framework: please verify and enter.]
  • [Email service provider] (sending system emails): [location, agreement].
  • [Domain provider] (domain `der-finanzplaner.de`): [name].

We do not pass data on to other third parties unless we are legally obliged to.

6. Transfers to third countries

Where service providers based in the USA process data (in particular IP addresses and log data), this is done on the basis of an adequacy decision (EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses (Art. 44 et seq. GDPR) with additional safeguards. You can request a copy of the safeguards from us.

7. Storage period and deletion

  • We store account and game data as long as your account exists.
  • You can delete your account yourself at any time (Settings → Your data → Delete account). Your account and all related data are then deleted immediately and permanently. In technical backups of the database provider, data may remain for up to [period, e.g. 30 days] and is then overwritten.
  • Log data is deleted by the providers according to their periods [enter period].
  • There are no statutory retention obligations for the content of the app.

8. Your rights

You always have the right to

  • access (Art. 15 GDPR): in the settings under "Your data" you can download all stored data, including your email address, as a file.
  • rectification (Art. 16): you change your details directly in the app; email address and password in the settings.
  • erasure (Art. 17): see section 7.
  • restriction of processing (Art. 18).
  • data portability (Art. 20): the download is in a common, machine-readable format (JSON).
  • objection (Art. 21) to processing based on legitimate interests.

Write to us at the email address above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the State Commissioner for Data Protection and Freedom of Information of Baden-Wuerttemberg [please verify address: Lautenschlagerstrasse 20, 70173 Stuttgart].

9. Data security

The connection to the app is encrypted with TLS. In the database each user only sees their own data (row-level access rules). Passwords are only stored as a hash. Still: do not enter data that you do not want to store in an online app, and keep your password secret.

10. Age

The app is aimed at people aged [18] and over.

11. Changes

We adapt this policy when the app or the legal situation changes. The current version is always here.

Last updated: [enter date]