Privacy Policy
Version privacy-1.0 · as of [DATE]
1. Who is responsible
[First name Last name], [address], Germany, e-mail [privacy@…] (we). We are not required to appoint a data protection officer.
2. Overview
| What | Data | Legal basis (GDPR) | Kept until |
|---|---|---|---|
| Account (guest or Google) | User ID, for Google: name, e-mail, profile picture | Art. 6 (1) b, contract | Account deletion |
| Goals and game | Profile (name, age/birthday, job, hobbies, about me, goal types and areas), goals, steps, sessions, flowers, characters, energy, account type | Art. 6 (1) b | Account deletion |
| Use of AI (goal and step ideas) | See section 5 | Art. 6 (1) b, a feature you ask for | Not kept by us; the provider deletes it within 30 days |
| Reminders and push | Device push token, time zone, reminder times | Art. 6 (1) b; the OS asks for permission | Account deletion or token change |
| Usage limits and security | AI request counter per day, server logs (IP address, time, request) | Art. 6 (1) f, protection against abuse | Counter: overwritten daily; logs: [14] days |
| Premium | Purchase status from Apple / Google (no payment data) | Art. 6 (1) b, and c for tax records | Statutory retention (up to 10 years for invoices) |
Settings such as language and sound are stored only on your device; this is strictly necessary for the App (§ 25 (2) TDDDG). We use no analytics, advertising or tracking tools.
3. Account and storage (Firebase)
When you start the App, a guest account is created with Firebase Authentication. If you link a Google account, we receive your name, e-mail address and profile picture from Google. Your App data is stored in Google Cloud Firestore.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor (Art. 28 GDPR). Data location: [europe-west… / to be checked]. Google may also process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses apply in addition.
4. Our server
Our backend runs at [hosting provider, address, location] as our processor. It receives your requests from the App, reads and writes your data in Firestore and, when you ask for ideas, contacts the AI provider.
5. Use of artificial intelligence (AI)
In short: Your fairy's goal and step ideas are suggested by AI. When you ask for ideas, your answers, profile and goals are sent to OpenAI Ireland Limited. Neither we nor OpenAI use your data to train AI.
What happens. When you ask the App for goal or step ideas, our server sends a request to an AI model and shows you the result. This happens on the suggestions page of the intro story (after its questions) and when you tap for AI ideas while creating a goal or step.
What is sent:
- your profile: name, age or birthday, job, hobbies, "about me", chosen goal types and life areas;
- for goal ideas: your existing goals (title, description, status);
- for step ideas: the goal, its existing steps and your session history for it;
- the text you type into the request, today's date and game details (account type, character levels).
Your account ID, and your e-mail address if you linked a Google account, are sent with goal-idea requests.
Recipient: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland, as our processor. Data is also processed by OpenAI, L.L.C. in the USA; the transfer is based on [the EU-U.S. Data Privacy Framework / standard contractual clauses: check OpenAI's current DPA]. OpenAI does not use API data to train its models and deletes it after at most 30 days (abuse monitoring).
No AI training on your data. We do not use your data to train, fine-tune or improve AI models, and we do not allow our AI provider to do so: we only use its paid business API, where your inputs and the suggestions are not used for model training. We do not sell or share your data for AI training with anyone.
Sensitive data. Please do not enter information about your health or other special categories of data (Art. 9 GDPR) in "about me", the intro answers or a request: whatever you write there is sent with the request.
No automated decisions. Suggestions are only proposals; they have no legal or similar effect on you (Art. 22 GDPR does not apply).
Your choice. The intro questions are optional, and anything you leave out is not sent. You can always write goals and steps yourself instead of asking for ideas; all other features work without AI.
Guests can request a limited number of suggestions per day. To enforce this, we store a daily counter linked to your user ID.
6. Push notifications
For reminders we use Firebase Cloud Messaging (Google Ireland Limited, processor). Your device's push token and your time zone are stored. You can switch notifications off at any time in your device settings.
7. Purchases
Premium is bought through Apple or Google. They process your payment as independent controllers under their own privacy policies. We only receive whether and what you bought.
8. Recipients
We share your data only with the processors named above, bound by data processing agreements, and with authorities where we are legally obliged to. We do not sell your data.
9. How long we keep data
We delete your data when you delete your account, unless the law requires us to keep it (e.g. tax records). Backups are overwritten within [30] days. Guest accounts that have not been used for [24] months are deleted.
10. Your rights
You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent at any time (Art. 7 (3)).
Right to object (Art. 21): where we process data based on legitimate interests (section 2), you can object at any time for reasons arising from your particular situation.
Write to [privacy@…]. You can delete your account yourself in the App under Profile → Delete account.
You have the right to complain to a supervisory authority, e.g. the one for our place of business: [Landesbeauftragte(r) für Datenschutz, name, address, website].
11. Age
The App is only for people aged 16 and over. If we learn that a user is younger, we delete their account and data.
12. Changes
We update this policy when the App or the law changes. The current version is always available in the App. We tell you about important changes (e.g. a new AI provider) in the App before they apply.