Privacy

Privacy Policy

This privacy policy applies to the BoatPass Android app and the website boatpass.de. Last updated: July 2026.

Controller

Marius Gehler

Blissestraße 56 · 10713 Berlin
[email protected]

Website

Hosting

This website is hosted by Netlify Inc. (2325 3rd Street, Suite 215, San Francisco, CA 94107, USA). When accessing the website, technically necessary data (IP address, access time, browser) are stored in Netlify server logs.

Delivery is fronted by a content delivery network operated by Cloudflare Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Cloudflare processes technically necessary connection data (including the IP address) to deliver the website securely and to protect it against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)

Website Analytics

This website uses Plausible Analytics – a privacy-friendly tool without cookies and without collecting personal data. No consent banner is required.

plausible.io/data-policy →

Contact form

The contact form is processed via Formspree (Formspree Inc., USA). Submitted data (name, email address, message) is used solely to respond to your inquiry and deleted afterwards. Data is not shared with third parties.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / responding to inquiries)

Android App

Principle: Local Data Storage

BoatPass stores learning progress, settings, and purchase status exclusively on your device. In addition, Google services are used for analytics and stability improvements as described below.

· Learning progress (answered questions, error rates, streaks) – stored locally, never leaves your device.

· Settings (language, notification times, daily goal) – stored locally, never leaves your device.

· Purchase status (which catalogues have been purchased) – stored locally, never leaves your device.

· Exam history (results of past simulated exams) – stored locally, never leaves your device.

Firebase Analytics (Google LLC)

We use Firebase Analytics by Google LLC to understand and improve app usage. Data collected includes: screens and features accessed, device type, OS version, language setting, app version, installation source, session duration, and the anonymous advertising ID (Android Advertising ID).

Google LLC acts as a data processor under Art. 28 GDPR. IP addresses are anonymised before storage. Data transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR). More info: firebase.google.com/support/privacy

Retention: Event data stored for 2 months by default.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in app quality).

Opt-out: App → More → Privacy → Disable Analytics.

Firebase Crashlytics (Google LLC)

We use Firebase Crashlytics to detect and fix app crashes. On a crash, the following data is automatically transmitted: stack trace, error message, device state (memory, OS, app version), and an anonymised installation ID. No personal user data or learning content is transmitted.

Retention: 90 days.

Legal basis: Art. 6(1)(f) GDPR (technical stability).

Firebase Remote Config (Google LLC)

We use Firebase Remote Config to adjust app configuration (e.g. feature flags) without requiring an app update. No personal data is transmitted – only an anonymous installation ID for configuration delivery.

Legal basis: Art. 6(1)(f) GDPR.

Google Play Billing

In-app purchases are processed via Google Play Billing. Google's privacy policy applies (policies.google.com/privacy). We receive no payment data; Google only informs us whether a valid purchase exists.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Notifications

If you enable study reminders, local notifications are scheduled on your device. No push messages are sent via external servers. You can revoke the notification permission at any time in your device settings.

General

Data Sharing

Data is shared only with the services described above: Google services (Firebase Analytics, Crashlytics, Remote Config, Google Play Billing), Netlify and Cloudflare for website operation, and Formspree for the contact form. No further sharing with third parties takes place.

Data Deletion

All locally stored app data is deleted when you uninstall the app. You can manually reset your learning progress at any time via More → Reset Progress. Since Firebase Analytics processes aggregated and anonymised data, individual identification and deletion of specific records is technically not possible. For other deletion requests: [email protected]

Your Rights (GDPR)

Under GDPR you have the right to:

✓ Access to stored data (Art. 15)

✓ Rectification of inaccurate data (Art. 16)

✓ Erasure of your data (Art. 17)

✓ Restriction of processing (Art. 18)

✓ Data portability (Art. 20)

✓ Object to processing (Art. 21)

✓ Lodge a complaint with a supervisory authority (Art. 77)

Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstr. 219, 10969 Berlin, Germany.

For all requests: [email protected]