Privacy Policy for the Brutal app

1. Controller

Huber & Zipse GmbH
Eichenweg 6
75239 Eisingen
Germany

Email: kontakt@huber-zipse.de

2. Using the app without an account

You can use Brutal fully without an account. Your lists, countries, cities and trips then stay on your device only. We do not receive this data. It is deleted when you remove the app.

3. Using the app with an account

An account is optional. It backs up your data and syncs it between your devices. For this we process:

• Account data: name, email address and password. The password is stored only as an irreversible hash.
• App content: your countries and their status (visited, lived, wish), lists, cities, trips with stops, dates, means of transport and notes, and flights if present (date, airline, flight number, departure and arrival airport). This content shows where you were and when.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

4. Technical logs

Each time the app contacts our server, the IP address, time, requested function and status code are logged. This serves secure operation and troubleshooting (Art. 6(1)(f) GDPR). Logs are deleted automatically after five days.

5. Map and app updates

• Apple Maps: the map is displayed using Apple's map service. Your device loads map data from Apple; Apple receives your IP address and the map area shown. Apple's privacy policy applies.
• Expo (650 Industries, Inc., USA): when it starts, the app checks whether a small update is available and downloads it if so. This transmits your IP address, operating system, app version and a random installation ID, never your content. The basis is our legitimate interest in a working app (Art. 6(1)(f) GDPR) and the EU Standard Contractual Clauses.

The app does not access your location, contacts, photos or calendar. It contains no advertising, no advertising identifiers and no analytics or tracking services. We do not sell data or share it with third parties for their own purposes.

6. Where the data is stored

Account data and content are stored on a server operated by Huber & Zipse GmbH in a Hetzner Online GmbH data centre in Germany. Hetzner acts as a processor under Art. 28 GDPR. Encrypted backups are also stored by Hetzner in Germany.

7. Retention and deletion

• You can delete your account in the app at any time: Settings, Delete account. Your account and all its content are then removed immediately from the server and the device.
• Encrypted backups are not edited individually. Daily backups are deleted after 60 days and weekly backups after twelve months; monthly backups are kept longer for disaster recovery. A deleted account is never restored from a backup.
• Technical logs: five days.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to kontakt@huber-zipse.de.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

9. Children

Brutal is not directed at children under 16. Only people aged 16 or over should create an account.

10. Changes

We update this policy when the app or the law changes. The version published at this address applies.