Privacy Policy

1. Privacy at a Glance

The following notes give an overview of what happens to your personal data when you use our mobile app "Quible – Quiz & Geo" (hereinafter "Quible" or "the app") or visit our website playquible.com. Personal data is any data that can be used to identify you personally.

The essentials:

Quible needs no user account. Your progress (XP, level, streak, path progress, collected facts) is stored only on your device. We do not operate a server that receives this data.
We use the analytics service PostHog (EU hosting, pseudonymous, no advertising ID, no account needed) to see which games are played and where something gets stuck. You can object to the analytics at any time (section 3.6).
The free version shows ads (Google AdMob). Personalized ads are shown only with your consent, which you can change at any time.
For the "Quible Plus" subscription we use the Apple App Store (payment) and the Superwall service (displaying the offer screen, checking subscription status).

2. Controller

The controller responsible for data processing is:

Centaurio UG (haftungsbeschränkt)
Represented by the Managing Director Valentin Weinert
Dr.-Rohmer-Weg 11
65719 Hofheim am Taunus
Germany
Email: support@playquible.com

We are not required to appoint a data protection officer (§ 38 BDSG).

3. Data Processing in the App

3.1 Progress and Settings (local on your device)

While you play, Quible stores the following data exclusively in the app's storage area on your device:

Game progress: XP, level, streak, unlocked chapters and lessons, opened chests, collected facts, results of played rounds, Daily results
Settings: reminder on/off, streak freeze on/off, your advertising consent choice (see 3.5)

This data is not transmitted to us. It is included in the device backups you configure yourself in iOS (iCloud Backup or local backup); Apple is your contracting partner for those. Deleting the app removes all local data; there is no separate delete function inside the app.

Legal basis, insofar as any processing by us takes place at all: Art. 6(1)(b) GDPR (provision of the app).

3.2 Notifications (Reminders)

Quible can remind you of your daily round (in the evening at 7 p.m. and 1, 3 and 7 days after your last round). These notifications are scheduled locally on your device. There is no push server; no device tokens are transmitted to us or to third parties. The app asks for the iOS permission only after your first completed round; you can switch reminders off at any time in the app settings or the iOS settings.

Legal basis: your consent via the iOS permission dialog (Art. 6(1)(a) GDPR).

3.3 Quible Plus: Subscription via the Apple App Store

You purchase the "Quible Plus" subscription through the Apple App Store. Apple processes the payment; we receive no payment data (no card or bank details) and no information about your Apple ID. Apple provides us only with aggregated sales reports and technical transaction data (transaction identifier, product, subscription status, expiry date) that do not allow us to identify you.

Recipient and independent controller: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple's privacy policy: https://www.apple.com/legal/privacy/

Legal basis: Art. 6(1)(b) GDPR (performance of the subscription) and Art. 6(1)(c) GDPR in conjunction with § 147 AO (German tax law retention of accounting records).

3.4 Superwall (Offer Screen and Subscription Status)

To display the Quible Plus offer screen and to check whether a valid subscription exists, we use the software development kit (SDK) of the Superwall service.

Provider: Nest 22, Inc. (d/b/a Superwall), 2093 Philadelphia Pike #5307, Claymont, DE 19703, USA

Superwall processes on our behalf:

a randomly generated, pseudonymous user identifier created by the SDK (we transmit no name, email address or Apple ID)
the "Identifier for Vendor" (IDFV), a device identifier Apple assigns only to apps from the same developer
technical device and app information: device model, iOS version, app version, language, region, currency, time zone, font size, network type, app installation date
events around the offer screen (display, close, purchase started, purchase completed, restore) as well as the subscription status with expiry date and the Apple transaction identifier
the IP address (technically with every request; Superwall derives the approximate region from it)

Superwall is based in the USA and, according to our review, is not certified under the EU-US Data Privacy Framework. Transfers are therefore based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module 2), which form part of the data processing agreement (Art. 28 GDPR) concluded with Superwall. Superwall uses its own sub-processors located in the USA (including Amazon Web Services and Cloudflare); the current list is available at https://superwall.com/legal/dpa.

Legal basis: Art. 6(1)(b) GDPR (initiation and performance of the subscription, unlocking paid features) and Art. 6(1)(f) GDPR (our legitimate interest in functioning subscription management). Access to the device identifier is necessary under § 25(2) no. 2 TDDDG (German telecommunications privacy act) to provide the service you expressly request (purchase and use of Quible Plus on this device). Superwall's privacy policy: https://superwall.com/privacy

With Quible Plus the app shows no ads; the processing described in section 3.5 then does not take place at all.

In the free version, Quible shows ads: a full-screen ad after the end of a round (at the earliest after the second round) and voluntary "rewarded ads" that you start yourself (e.g. for an extra life, double XP or a free clue). For this we use Google AdMob.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Consent (EU, EEA, United Kingdom, Switzerland): On first launch, the app asks for your consent via the Google User Messaging Platform (UMP) in accordance with the IAB Europe Transparency and Consent Framework (TCF). You can consent, decline or manage options. Your choice is stored locally on the device (TCF string). Without consent, Google serves only "Limited Ads", which are delivered without advertising identifiers and without profiling. You can change your consent at any time under Settings → Quible Plus → "Privacy settings".

App Tracking Transparency (ATT): After the consent dialog, iOS asks whether Quible may track your activity across apps of other companies. Only with your permission does Google receive your device's advertising identifier (IDFA). You can change this decision at any time under iOS Settings → Privacy & Security → Tracking.

Data processed (depending on your consent):

advertising identifier (IDFA) – only with ATT permission
device identifiers and technical information (device model, iOS version, language, app version, screen size)
IP address and the approximate location derived from it (country/region)
interactions with ads (impression, click, completed viewing of a rewarded ad), ad usage and performance data
diagnostic data of the ads SDK (errors, load times)
your consent decision (TCF string)

We have configured AdMob to serve only ads with content rating "G" (suitable for all audiences).

For serving and personalizing ads, Google acts as an independent controller; the "Google Ads Controller-Controller Data Protection Terms" apply. How Google uses data from apps that use Google services is described at https://policies.google.com/technologies/partner-sites. The list of ad technology providers that may receive data via AdMob is available at https://support.google.com/admob/answer/9012903. Google LLC is certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov); where data is transferred to the USA, the transfer relies on that certification and, in addition, on EU Standard Contractual Clauses.

Legal bases: personalized advertising and storing or reading identifiers on your device on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); limited, non-personalized ads on the basis of our legitimate interest in financing the free app (Art. 6(1)(f) GDPR). Google's privacy policy: https://policies.google.com/privacy

3.6 Usage Analytics: PostHog

To understand which games are played, where players abandon a round and whether new features land, we use the analytics service PostHog. The analysis is statistical: we want to know how Quible is used as a whole, not what a particular person does.

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog's EU Cloud: the data is stored and processed on servers in Frankfurt am Main, Germany (Amazon Web Services, region eu-central-1).

Data processed:

a randomly generated, pseudonymous installation identifier that the PostHog SDK creates on installation and keeps in the app's storage area. It is valid only for Quible on this device. We transmit no advertising identifier (IDFA), no vendor identifier (IDFV), no name, no email address and no Apple ID; there is no "identify" call linking the identifier to a person.
usage events: app opened/backgrounded, switching between the app's sections, rounds started and finished (game, result right/wrong, score, duration, lives), learning-path progress (lesson, chapter, chests, collected facts), Daily and Duel (result only, never the guest player's name), level and streak, display and closing of the Quible Plus offer screen and purchase events (product, price, currency; no payment data), whether and why ads were shown, changes to settings (language, reminder, data export) and the state of the advertising consent and the ATT prompt as yes/no values
technical information: device model, iOS version, app version, language, time zone, screen size, network type (Wi-Fi/cellular), timestamps
IP address: technically with every transmission. PostHog derives the approximate region (country, region, city) from it; the IP address itself is not stored, because we have enabled PostHog's "discard IP addresses" setting.

What PostHog does not do: no screen or session recording (session replay), no surveys, no tracking across other apps or websites, no merging with the data held by Superwall or Google. The identifier is not passed on to Google, Superwall or Apple.

Objection: There is no consent dialog at launch; we base the processing on our legitimate interest. You can object to the analytics at any time (Art. 21 GDPR): an email to support@playquible.com is sufficient. So that we can find your installation, please tell us the pseudonymous installation identifier from the data export (Settings → "Export my data", field analytics.installationId). We then delete the events stored under that identifier at PostHog; deleting the app creates a new, unlinkable identifier on reinstallation.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in improving the app, finding errors and planning the free service economically. For this we process only pseudonymous data, store no IP addresses and host in the EU.

PostHog processes the data on our behalf (Art. 28 GDPR); PostHog's data processing agreement (https://posthog.com/dpa) forms part of the contract. Because PostHog, Inc. is based in the USA, the company may access the data stored in the EU for operations and support; this access is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module 2), which are part of the data processing agreement. PostHog's privacy policy: https://posthog.com/privacy

3.7 What We Do Not Do

No user account, no login, no collection of name, email address or phone number in the app
No access to iOS location services (the approximate region results only from the IP address in ad, Superwall and analytics requests)
No access to camera, microphone, photos or contacts
No attribution or crash-reporting SDKs, no session recording
No user-generated content, no chat or community features; the "Duel" is played on one device and transmits no data
No artificial intelligence and no profiling at runtime; all quiz content is bundled with the app

4. Data Collection on the Website playquible.com

4.1 Hosting

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, your data is processed on Vercel's servers; personal data may be transferred to the USA. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Vercel's privacy policy: https://vercel.com/legal/privacy-policy

4.2 Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser transmits: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, IP address. This data is not merged with other data sources and is automatically deleted after a short time.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and security of the website).

The website uses no cookies for analytics or advertising.

5. Contacting Us

If you contact us by email, we store your details (email address, content of the request) to process the request and for follow-up questions. We do not pass this data on without your consent. The data is deleted once the request has been fully dealt with and no statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual requests) or Art. 6(1)(f) GDPR (legitimate interest in answering requests).

6. International Data Transfers

Because we use services from providers in the USA, data may be transferred to countries outside the European Economic Area (EEA). We ensure an adequate level of protection through:

the EU-US Data Privacy Framework (DPF) for certified providers (Google LLC); you can check the status at https://www.dataprivacyframework.gov
EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with providers that are not certified (Nest 22, Inc./Superwall; Vercel Inc.; PostHog, Inc. – with PostHog the data itself stays in the EU, the clauses cover access by the US company)
data minimization: we transmit no name, email address or Apple ID to any of these providers

You can request a copy of the Standard Contractual Clauses at support@playquible.com.

7. Data Security

All data transmissions of the app and the website are encrypted via TLS.
Your progress is stored in the app's protected storage area, which iOS encrypts with Data Protection.
We store no user data on our own servers; there is therefore no central data store that could be compromised.
We have concluded data processing agreements under Art. 28 GDPR with all processors.

8. Retention Periods

Progress and settings: on your device until you delete the app
Superwall (subscription status, pseudonymous user identifier, events): for the duration of our contract with Superwall; deletion by Superwall on request
Google AdMob: according to Google's retention periods (https://policies.google.com/technologies/retention)
PostHog (usage events, pseudonymous installation identifier): 12 months from the respective event; earlier deletion on request
Accounting records for subscriptions (aggregated reports from Apple): 10 years (§ 147 AO)
Support requests: until fully dealt with, then at most 3 years (§ 195 BGB) where claims are possible
Website server logs: automatic deletion by the host after a short time

9. Your Rights

Under the GDPR you have the following rights:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
withdrawal of consent with effect for the future (Art. 7(3) GDPR), in particular via "Privacy settings" in the app, the iOS tracking switch and the iOS notification settings
objection to usage analytics at any time by email, stating the installation identifier from the data export (section 3.6)

Please note: because your progress exists only on your device, we can neither view it nor export or delete it for you. You do both yourself: "Settings" → "Export my data" gives you every piece of data the app stores as a JSON file (access and data portability); deleting the app from your device irreversibly deletes all of that data. The export file also contains your pseudonymous PostHog installation identifier (analytics.installationId); with it we delete, on request, every usage event of your installation held by PostHog. For the pseudonymous data held by Superwall and Google, we enforce your rights with those providers on request; for this we may need the device identifier (IDFV); we will explain on request where you can find it.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
https://datenschutz.hessen.de

To exercise your rights, an email to support@playquible.com is sufficient. We respond within one month.

10. Children and Young People

Quible is a quiz for all ages; the content is family-friendly and ads are served only with content rating "G". We do not knowingly collect personal data from children in the app. Personalized advertising requires consent; under Art. 8 GDPR, persons under 16 may give it only with the approval of a parent or guardian and should choose "Do not consent" in the consent dialog. Parents who find that their child has consented without such approval can withdraw the consent in the app under "Privacy settings" or contact us at support@playquible.com.

11. Changes to This Privacy Policy

We update this privacy policy when the app, our service providers or the legal situation change. The current version is always available at https://playquible.com/privacy and in the app under Settings → Legal. The date of the last update is shown at the top.

12. Contact

For questions about privacy:

Email: support@playquible.com
Postal address: Centaurio UG (haftungsbeschränkt), Dr.-Rohmer-Weg 11, 65719 Hofheim am Taunus, Germany