§ 1 Scope and Provider

(1) These General Terms and Conditions (hereinafter "GTC") apply to all contracts concluded between Softdot.Studio (hereinafter "Provider"), Buchenweg 5, 85283 Wolnzach, Germany, represented by Maurice Tusche, and its customers (hereinafter "Customer") regarding the products and services offered by the Provider.

(2) The Provider's product portfolio includes in particular, but is not limited to:

• Trading software (plugins for trading support, without broker or trading account provisioning)
• Mobile lifestyle apps
• AI applications (e.g., office applications)
• Computer games (for mobile, web, and PC)
• Custom software on a customer basis

(3) Terms and conditions of the Customer or third parties shall not apply, even if the Provider does not separately object to their validity in individual cases. Even if the Provider refers to a letter that contains terms and conditions of the Customer or a third party or refers to such, this does not constitute agreement with the validity of those terms and conditions.

(4) These GTC apply to both consumers and businesses, unless a differentiation is made in the respective clause.

§ 2 Conclusion of Contract

(1) The presentation and promotion of products on our website, in catalogs, or on distribution platforms does not constitute a binding offer to conclude a contract, but rather an invitation to place an order (invitatio ad offerendum).

(2) By ordering a product or commissioning a service, the Customer submits a binding offer to conclude a contract. The Provider can accept this offer within five working days by:

• a) Sending an order confirmation in text form (email, fax, or letter), whereby the receipt of the order confirmation by the Customer is decisive, or
• b) Delivering the goods or making the digital content available for download, whereby receipt by the Customer is decisive, or
• c) Requesting payment from the Customer.

(3) For orders via distribution platforms such as MQL5, Google Play Store, or Steam, the terms of use of the respective platform operator also apply. In the event of contradictions between these GTC and the conditions of the platform operator, the conditions of the platform operator may take precedence, insofar as this is mandated by the guidelines of the respective platform. The Provider expressly points out that it has no influence on the terms and conditions of the platform operators.

(4) The contract text is stored by the Provider. The current GTC are available for viewing on the Provider's website and will also be made available in text form upon request. By placing an order, the Customer accepts the GTC valid at the time of contract conclusion, which are referred to during the ordering process.

§ 3 Scope of Services and Customer's Obligations to Cooperate

(1) The exact scope of services is derived from the product description or individual offer of the Provider as well as from the supplementary information on the Provider's website.

(2) For standard software products, the functional scope is detailed in the product description. The Provider points out that, according to the state of the art, software cannot be created completely free of errors.

(3) For custom software projects, the Customer is obligated to provide the Provider with all documents and information required for the creation of the custom software in a timely and complete manner. If the Customer does not fulfill its obligations to cooperate or does not do so in a timely manner, the Customer shall bear the resulting costs (e.g., for additional work or delays).

(4) Trading software supports trading decisions and does not provide brokerage services or trading accounts. It is not investment advice and does not guarantee successful trading. Trading in financial markets involves substantial risks, including total loss of invested capital. The general liability provisions in section 7, including their exceptions and limits, apply to damage caused by the software.

(5) The Customer is responsible for ensuring that the hardware and software used by them meets the technical minimum requirements of the product. The applicable minimum requirements are listed in the product description.

(6) The Customer is obligated to take appropriate security measures to protect their IT systems from cyber attacks, data loss, and other security risks. This includes, in particular but not exclusively: the use of current operating systems and security updates, the use of current antivirus software, regular data backups, and an appropriate password policy.

(7) The Customer is obligated to sufficiently test the software and all its functionalities in a secure test environment before productive use. The Provider expressly points out that, according to the state of the art, errors in software products cannot be completely excluded. For damages or losses arising from undiscovered errors in the software, the Provider is only liable within the framework of the limitations of liability set out in § 7 of these GTC. Discovered errors or disruptions should be reported by the Customer immediately using the contact options specified in § 11 paragraph 4.

(8) The Customer shall indemnify the Provider against all claims by third parties arising from unlawful use of the software or from a breach of the Customer's obligations to cooperate.

(9) Insofar as the Provider offers AI applications, the Customer undertakes not to use them for unlawful, abusive, or ethically questionable purposes. This includes, in particular but not exclusively, the creation of illegal content, the dissemination of misinformation, the violation of third parties, personal rights, or the circumvention of security measures. The Provider reserves the right to block access to the AI functions in the event of violations of this obligation and, if necessary, to take legal action.

§ 4 Usage Rights and Intellectual Property

(1) All rights to the software products created by the Provider, in particular copyright, trademark, and patent rights, remain exclusively with the Provider, unless expressly agreed otherwise.

(2) The Provider grants the Customer a simple (non-exclusive), unlimited in time, non-transferable, and non-sublicensable right to use the acquired software. The scope of the right of use is determined by the respective contract and may vary depending on the product category.

(3) For standard software, the Customer is entitled to use the software on the agreed number of devices or for the agreed number of users. Reproduction of the software is only permitted insofar as it is necessary for contractual use.

(4) For custom software, unless otherwise agreed, the Customer receives a simple right of use for the contractually agreed purpose. The transfer of source codes only takes place if this has been expressly agreed.

(5) The Customer is not entitled to decompile, disassemble, or reverse engineer the software, unless expressly permitted by applicable law. The Customer is also prohibited from removing or modifying the Provider's proprietary notices, ownership information, labels, or trademarks.

(6) In the event of violations of these provisions, the Provider is entitled to revoke the granted rights of use and to assert claims for damages.

§ 5 Prices, Payment Conditions, and Retention of Title

(1) Consumer prices include statutory VAT and other price components. Any additional costs and the total price are disclosed before the contract is concluded. Net prices plus VAT apply exclusively to offers expressly identified as being for business customers.

(2) Payment is made according to the Customer's choice through the payment methods offered during the ordering process. The Provider reserves the right to exclude certain payment methods.

(3) For payments via the payment service provider Paddle or via distribution platforms such as MQL5, Google Play Store, or Steam, the respective payment conditions of the service provider or platform additionally apply.

(4) Unless otherwise agreed, invoices are payable immediately upon receipt without deduction. In case of payment default, the Provider is entitled to charge default interest at the statutory rate.

(5) For business customers, the delivered goods remain the property of the Provider until full payment of all claims from the business relationship (retention of title).

(6) The Customer may set off claims that are undisputed, established by a final judgment or acknowledged by the Provider. Statutory rights of set-off, particularly for counterclaims arising from the same contract, remain unaffected. A right of retention may be exercised where the counterclaim arises from the same contractual relationship.

§ 6 Delivery, Delivery Time, and Transfer of Risk

(1) The delivery of digital products takes place depending on the product and agreement through:

• a) Provision for download from the Provider's server,
• b) Sending a download link via email, or
• c) Provision via one of the distribution channels (MQL5, Google Play Store, Steam, etc.).

(2) Delivery on a physical data carrier by mail or by another way not mentioned in paragraph 1 only takes place in exceptional cases and for a separate fee after prior agreement.

(3) Unless otherwise agreed, the delivery period begins with the conclusion of the contract. For custom software or additional services, the delivery period only begins after the Customer has provided all necessary documents and information and after receipt of an agreed down payment.

(4) For consumers, the risk of accidental loss and accidental deterioration of the sold goods passes to the consumer or a recipient designated by them upon delivery of the goods in the case of a sale by delivery. This applies regardless of whether the shipment is insured or not.

(5) For business customers, the risk of accidental loss and accidental deterioration of the goods passes to the carrier, freight forwarder, or other person or institution designated to carry out the shipment upon delivery of the goods.

(6) For digital products that are made available for download, the risk passes with the provision of the download and information to the Customer about this.

§ 7 Warranty and Liability

(1) The Provider is liable for defects according to the statutory provisions, unless otherwise specified below.

(2) The following periods apply for warranty claims:

• a) Consumers have the statutory rights and limitation periods for defects. Digital products are subject in particular to sections 327 et seq. BGB, including the special rules on continuous supply, update obligations and limitation under section 327j BGB. A blanket period starting on delivery does not replace these rules.
• b) For business customers, the warranty period is only 12 months from delivery or, if acceptance is required, from acceptance.
• c) The shortened warranty period for business customers does not apply to claims for damages by the Customer arising from injury to life, body, or health or from intentional or grossly negligent breaches of duty by the Provider or its vicarious agents, each of which shall become statute-barred according to the statutory provisions.

(3) The Provider is liable without limitation:

• a) in case of intent or gross negligence,
• b) for injury to life, body, or health,
• c) according to the provisions of the Product Liability Act, and
• d) to the extent of a guarantee assumed by the Provider.

(4) In the case of slightly negligent breach of a duty that is essential for achieving the purpose of the contract (cardinal obligation), the Provider's liability is limited in amount to the damage that is foreseeable and typical according to the nature of the business in question.

(5) The Provider is not liable for delays or non-fulfillment of its obligations if these are due to force majeure. Force majeure includes, in particular, natural disasters, war, terrorist attacks, epidemics, pandemics, government measures, cyber attacks, power outages, and similar unforeseeable and unavoidable events.

(6) For AI-supported applications, the Provider assumes no warranty for the completeness, currentness, and correctness of the AI-generated results. The Customer bears sole responsibility for the use of the results.

(7) Otherwise, liability for damage caused by slight negligence is excluded. Rights concerning defects, statutory update obligations and liability under paragraphs 3 and 4 remain unaffected.

(8) Trading software is also subject to the general liability provisions in this section, including unlimited liability under paragraph 3 and liability for essential contractual obligations under paragraph 4. Trading risks and the absence of a success guarantee do not create a blanket exclusion of claims for financial damage.

(9) The above limitations of liability also apply to the personal liability of the Provider's employees, representatives, and organs.

(10) The Provider endeavors to meet the requirements of the EU AI Act and other relevant regulations on AI applications. The classification and categorization of the respective AI components according to applicable regulatory requirements is provided in the product documentation. The Customer is advised that the legal framework for AI applications is continuously evolving and subject to change.

§ 8 Right of Withdrawal

(1) Consumers have a statutory right of withdrawal. Detailed information on this as well as the model withdrawal form can be found in the #Right of Withdrawal, which can be viewed on the Provider's website.

For paid digital content not supplied on a physical medium, the right of withdrawal expires early only if you expressly consented to performance starting before the withdrawal period ends and acknowledged that you lose your right of withdrawal when performance starts, we have actually begun performance, and we have provided a contract confirmation under section 312f BGB on a durable medium, such as email. That confirmation also records your consent and acknowledgement. All requirements must be satisfied (section 356(6) BGB).

For paid services, the right of withdrawal expires early only upon full performance, provided that before performance started you expressly consented to the early start and acknowledged that full performance ends your right of withdrawal. For off-premises contracts, consent must be provided on a durable medium (section 356(5) BGB). Merely starting a service does not extinguish the right of withdrawal.

§ 9 Return and Cancellation

(1) There is generally no contractual right of return beyond the statutory warranty claims and the right of withdrawal for consumers, unless the Provider has expressly promised this.

(2) For certain software products marked accordingly that are purchased directly through the Provider's website, the Provider offers a 30-day right of return. The return must be made within 30 days of purchase by a notification in text form (email or letter) to the Provider. The refund is made via the originally used payment method. For purchases through third-party platforms, additional voluntary return rights are governed by the platform's terms. Statutory withdrawal rights and rights concerning defects remain unaffected in all cases.

(3) For contracts to produce a work, the Customer may terminate at any time before completion under section 648 BGB. The Provider may claim the agreed remuneration but must deduct expenses saved and earnings obtained, or maliciously not obtained, through alternative use of its labour. The rebuttable statutory presumption is five percent of the remuneration attributable to the unperformed part; either party may prove a different amount. Statutory rights of withdrawal and other termination rights remain unaffected.

(4) Cancellation requests must be made in text form (by email or letter).

§ 10 Data Protection

(1) The Provider collects and uses personal data of the Customer exclusively within the framework of the provisions of applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

(2) Functions may transmit data to third parties, such as AI or API providers. The purposes, recipients and legal bases described in the privacy policy and product information, and the requirements for international transfers, apply. Any required consent is obtained separately. Merely using a function does not replace required consent.

(3) Detailed information about the type, scope, and purpose of data processing, about legal bases, storage duration, your data subject rights, and other data protection-relevant information can be found in the #Privacy Policy of the Provider, which can be viewed on the Provider's website and which is part of these GTC.

§ 11 Updates and Support

(1) Legally required updates, including security updates, are provided and notified to consumers. For digital products, the relevant period is determined in particular by section 327f BGB: the supply period for continuous supply, otherwise the period reasonably expected in light of the nature, purpose and circumstances of the contract. Agreed service and update commitments remain binding. New features and further development are owed only where agreed.

(2) After development and sales end, the Provider may offer voluntary fixes and improvements for up to five years. This rule concerns voluntary additional services only; it does not shorten statutory update obligations, rights concerning defects or ongoing service commitments. It does not create a general entitlement to unlimited new features.

(3) Planned product discontinuation is announced at least three months in advance on the website and, where possible, by email. Discontinuation or server shutdown must not curtail statutory rights or agreed ongoing services. Changes to or termination of existing contracts require a valid contractual or statutory basis.

(4) For problems or questions, use the contact form or email support@softdot.studio. Please include the product, version, operating system and a reproducible description of the issue. Statutory claims and agreed support remain binding; no particular response time is promised for voluntary additional assistance.

(5) Additional support and maintenance may be agreed for a separate fee. Statutory remedies for defects, required updates and services already agreed do not require an additional support contract.

(6) The Customer is not entitled to pass on updates or support services to third parties, unless otherwise agreed.

§ 12 Choice of Law and Place of Jurisdiction

(1) For all legal relationships between the Provider and the Customer, the law of the Federal Republic of Germany applies exclusively, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). For consumers, this choice of law only applies insofar as the consumer is not deprived of the protection afforded to them by mandatory provisions of the law of the state in which they have their habitual residence.

(2) If the Customer is a merchant within the meaning of the German Commercial Code, a legal entity under public law, or a special fund under public law, the exclusive place of jurisdiction for all disputes arising from the contractual relationship is the Provider's place of business. However, the Provider is also entitled to sue at the Customer's general place of jurisdiction.

§ 13 Final Provisions

(1) The contract language is German. Translations of these GTC into other languages are for information purposes only. In case of contradictions between the German text and the translation, the German text shall prevail.

(2) New versions of these terms apply to new contracts where validly incorporated. Changes to existing contracts require a valid agreement or another applicable statutory basis. Silence in response to a change notification does not constitute consent.

(3) The Provider is not willing or obligated to participate in dispute resolution proceedings before a consumer arbitration board.

(4) If a provision is invalid or not incorporated, statutory rules, particularly section 306 BGB, govern the remaining contract and replacement of the provision. There is no automatic replacement with an economically similar clause.

1. Controller

Responsible for data processing on this website and in our apps within the meaning of the General Data Protection Regulation (GDPR) is:

2. Person Responsible for Data Protection

For questions regarding data protection, please contact directly:

3. Collection and Processing of Personal Data

3.1 Visit to Our Website

When visiting our website, we automatically collect technical information that is necessary for the display of the website. This includes:

• IP address, which may be processed in full during transmission and in ordinary access logs
• Date and time of the request
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser, operating system, and its interface
• Language and version of the browser software

The processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

3.2 Contact

When you contact us via contact form, email, or telephone, we process the data you provide for processing your request. This includes:

• Name
• Email address
• Telephone number (if specified)
• Content of your message and attachments you choose to upload

The processing is carried out pursuant to Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures or for the fulfillment of a contract, or pursuant to Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the effective processing of requests addressed to us.

If you have agreed to “Marketing”, the contact form also sends which advertisement, campaign or page brought you to us (section 4.5). This information is shown with your request so that we can see which advertising leads to requests and orders. Without this consent your request contains no such information.

3.3 Product Use

When using our products, different data is processed depending on the product. Details on the scope of data processing can be found in the respective product documentation. In particular, when using AI applications, content may be transmitted to external services such as Claude AI for processing.

3.4 Use of Our Apps

Some of our products are apps for mobile devices. Which data is processed depends on the respective app and on the functions you use.

Data that an app stores on your device is not processed on our systems. It reaches us or third parties only insofar as you use a function that transmits data. Backups to a cloud storage of your choice are handled by the respective provider (for example Google or Apple) in accordance with their privacy terms, as is the payment for purchases within the app. If you contact us from within an app, section 3.2 applies; for error reports that you send us from an app, section 3.6; for optional usage statistics, section 3.7; for the verification of purchases by our server, section 3.8; and for the optional measurement of advertising success, section 3.9.

Independently of this, app data stored on your device may be captured by the automatic backup function of your operating system and restored when you set up a new device. Whether and to what extent this happens depends on the settings of your device and of your operating system account; the provider of the operating system is responsible for this processing.

Advertising may be displayed in the free version of individual apps; section 3.5 applies to this.

3.5 Advertising in Our Apps (Google AdMob)

In the free version of individual apps, we display advertising. For this we use Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. No advertising is displayed in the paid version; the advertising module is not started there, so no advertising data is collected.

Data processed. According to Google, the advertising module used (Google Mobile Ads SDK) collects and transmits to Google: your IP address, from which the approximate location can be derived; device and account identifiers, namely the advertising ID of your device and, on Android, the App Set ID as well as, where applicable, further identifiers relating to accounts signed in on the device; your interactions with the app and the advertisements, such as app launches, taps, and ad views; and diagnostic data on the performance of the app and the module, such as launch time, hang rate, and energy usage. According to Google, the transmission is encrypted using TLS. The purposes are advertising, analytics, and fraud prevention, specifically the delivery of the advertisements, limiting how often they are shown, reach and billing measurement, the detection of fraud and abuse, and, where consent has been given, the personalisation of the advertisements.

iOS. In the iOS version, the app does not ask for permission to track across apps. The advertising module therefore does not receive the advertising identifier (IDFA) of your device, and iOS itself blocks connections that Google declares as tracking. According to Google, the module may use other device identifiers bound to the app or the provider there, such as the identifier for vendors (IDFV). It also measures the success of app advertising through Apple's SKAdNetwork, which does not transmit any identifier of your device.

Role of Google. For this processing, Google is not our processor but an independent controller. Details on this in section 5.3.

Control data on your device. To limit how often advertisements are shown, the app stores control data on your device. For the storage period, see section 7.5.

Legal basis. The storage of information on your terminal equipment and the access to it (in particular to the advertising ID) take place on the basis of your consent pursuant to Section 25 (1) TDDDG; the subsequent processing of the data is based on Art. 6 para. 1 lit. a GDPR. We obtain your consent through the Google consent window, which the app displays before an advertisement is requested for the first time.

Your decision and its consequences. Before every ad request, the app asks the Google consent module whether the request is permitted, and requests no advertisement without that clearance. If you consent, you receive personalised advertisements. If you do not consent, or consent only in part, either no advertisements or non-personalised or limited advertisements are delivered. Non-personalised and limited advertisements do not build an advertising profile about you, but may still access device identifiers in order to limit how often they are shown, to measure reach and billing, and to detect abuse.

Withdrawal. You can change or withdraw your decision at any time with effect for the future. In the ad-supported version, the app provides the entry "Advertising privacy" under Settings → About for this purpose; it appears as soon as and for as long as Google provides such a withdrawal window for your region. Independently of this, you can reset or delete the advertising ID of your device in your system settings and object to personalised advertising there. Your right of withdrawal under Art. 7 para. 3 GDPR remains unaffected; you can also contact us at any time using the contact details given under point 1 or 2.

Transfer to third countries. Google may also process the data collected in this context outside the EU and the EEA. Section 6 applies to this.

3.6 Error Reports from Our Apps

Via "Report a problem" (in the app under Settings → About) you can report a problem with an app to us directly. The report is transmitted in encrypted form to our server at softdot.studio, which turns it into an e-mail to our support; no e-mail program on your device is needed. No confirmation e-mail is sent to you.

Data processed. With a report, the app transmits your description of the problem and (only if you provide them) your e-mail address and up to three screenshots that you select; these are reduced in size beforehand, and location information and other image metadata are removed in the process. Added automatically are technical details about the app (version, all app settings, purchase status "Free" or "Premium", number of stored moments and reminders) and about the device (manufacturer, model, operating system version, screen size, language setting), a technical event log of the app (debug log) and measurements of the rendering performance. Not transmitted are the contents of your moments, the name of your device and device identifiers, your Google account (only whether a connection exists) and access codes. On receipt, our server also processes your IP address; see section 7.6.

Debug log. The app records technical events on your device, such as app starts, error messages and frame-rate measurements. The log is limited to 2 MB, older entries are overwritten, and it is excluded from the automatic device backup. Already when writing, the app removes e-mail addresses, access tokens and the values that database error messages would otherwise contain (such as the name of a moment); when sending, it checks the log once more. It leaves your device only with an error report that you send yourself.

Preview and sending later. Under "What is sent along?" you can use "View report" to display the technical details before sending. If there is no connection when you send, the app stores the report on your device and sends it at the next start or when you return to the app; a report that cannot be delivered for 14 days is discarded.

Legal basis. We process the report on the basis of our legitimate interest in fixing reported errors and handling your request (Art. 6 para. 1 lit. f GDPR) and, insofar as it concerns a service we owe you under a contract (such as a purchased premium feature), for the performance of that contract (Art. 6 para. 1 lit. b GDPR). Reading the technical details on your device is strictly necessary to provide the service you have explicitly requested, namely the transmission of your report (Section 25 (2) no. 2 TDDDG).

Voluntary nature. Whether you send a report is entirely your decision. Providing your e-mail address and attaching screenshots are voluntary; without an e-mail address, however, we cannot reply to you or let you know when the error has been fixed.

3.7 Optional Usage Statistics in Meaningful to Me

In the Android and the iOS version of Meaningful to Me you can choose to share basic usage statistics. Sharing is off until you switch it on during setup or under Settings ("Usage data for basic statistics"). It applies to the respective device only. We use the statistics to understand which designs and functions are used and to develop the app accordingly.

Data processed. The app transmits to our server at softdot.studio the current inventory of the installation, namely the number of your non-private moments and how many of them have their own background picture or their own texts, together with the selected design, whether you use the free or the premium version, and the platform. It also transmits that a moment was created, changed or deleted, or that a setting for design, detail view, notifications or reduced motion was changed, in each case with these details only. Titles, texts, dates, categories, pictures and videos of your moments are not transmitted with these statistics (for optional text analysis see below); moments marked as private are left out entirely. For assignment and later deletion, our server generates a random identifier of the installation that is not linked to your name, your e-mail address or a Google account.

Google Analytics for Firebase. The same statistical events are sent to Google Analytics for Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which analyses them on our behalf. According to Google, the module used for this also automatically records an identifier of the app installation (app instance ID), the app version, device model, operating system version and language, the country derived from the IP address, the start and duration of use, and purchases in the app that are processed via Google Play or the App Store (product, price and currency). As user ID, Google receives a further random identifier issued by our server, which serves solely to have your data deleted at Google. The advertising ID and the Android ID of your device, on iOS the advertising identifier (IDFA) and the identifier for vendors (IDFV), are not collected, Google signals and the collection of granular location and device data are switched off, and the consent types for advertising purposes (storage, user data, personalisation) remain denied unless you separately consent to the measurement of advertising success (section 3.9); personalisation remains denied even then. On iOS, the app starts the module only after you have switched sharing on on this device.

Legal basis. The processing takes place only with your consent (Art. 6 para. 1 lit. a GDPR); the storage of information on your device and the access to it that this requires are based on Section 25 (1) TDDDG. Without your consent, collection remains switched off, and the app works without restriction.

Withdrawal and deletion. You can switch sharing off at any time under Settings. The app then stops collection immediately, resets the analytics data on your device and instructs our server to delete. The server deletes the statistics of the installation and submits a request to Google to delete the data associated with your user ID. If Google accepts the request, we record it as accepted; Google carries out the deletion itself according to its procedure. If your device is offline, the app keeps the deletion order and sends it later. Via "Copy deletion receipt" you can save a receipt with which we can delete your data even after the installation has been lost.

Extended usage data (text analysis). Only if you additionally switch on “Extended usage data” does the app send the titles and the texts you wrote for your non-private moments (designation and the texts for past, future and loss) to our server at softdot.studio, existing and future ones. We analyse them to improve the app's categories, wording and design. The texts are sent as you wrote them and may therefore include information about other people or particularly sensitive information, such as on health. Moments marked as private, event dates, categories, pictures and videos are not sent as additional content fields. Technical identifiers and the modification timestamp support updates and deletion. Information you write into the texts remains included. The texts do not go to Google, are not published and are used neither for advertising nor for training AI models on raw text. Our server stores them encrypted under a random identifier, separately from usage statistics and without linking them to a user account. Texts from the same installation remain technically grouped. This separation does not make them anonymous: their content may itself identify you or other people. Only the operator can read the texts, and every read access is logged. When receiving requests, the server also processes the IP address to prevent abuse; IP-based limiting operates temporarily in memory. Regular IIS access logging is disabled for this analysis service to prevent a link between an IP address and a text document path through those logs. The legal basis is your explicit consent (Art. 6(1)(a) GDPR and, where your texts contain special categories of personal data, Art. 9(2)(a) GDPR). Your consent does not replace any required permission to share personal information about other people. If you switch the option off, our server deletes all texts of this installation; if you delete a moment or mark it as private, its text is deleted as well. If your device is offline, the app sends the deletion request once it is connected again. The app remains fully usable without this consent.

Transfer to third countries. Google may also process data outside the EU and the EEA; section 6 applies. The contents of optional text analysis are processed exclusively on our own server and are not forwarded to Google.

3.8 Verification of Purchases in Meaningful to Me

In the Android version, Google Play unlocks the premium version of Meaningful to Me: as soon as Google Play reports a successful purchase or restoration, premium is active. The same applies to Apple's App Store in the iOS version; the paragraph "App Store (iOS)" below describes what is different there. Our server then checks the purchase in the background with Google Play (Google Play Developer API) for validity and revocation, at the purchase, at a restoration and afterwards at intervals of at most once a week. If our server cannot be reached or answers too slowly, the purchase and the unlocking work all the same. Premium ends only if Google documents a revocation of the purchase, for example a refund with which Google Play withdraws the entitlement, or if Google documents that the purchase token does not belong to a valid purchase and a second check at least one day later shows the same. The payment itself is handled by Google Play; we do not receive your payment data.

Background check. For this, the app sends the purchase token issued by Google Play and the product to our server, without any identifier of your installation. With it, the server asks Google Play for the state of the purchase and returns only the result to the app: valid, still pending, revoked, invalid or currently not verifiable. For this check our server stores neither the request nor the purchase token. To detect revocations, it also regularly retrieves Google Play's list of purchases revoked in the last 30 days and keeps from it, per purchase, an irreversibly derived key of the purchase token with the time, source and reason of the revocation, without the order number. On your device, the result of the last check remains with its date and an irreversibly derived key of the purchase token, so that the app does not ask again at every start.

Booking of purchases. If you start a purchase of the premium version or of a thank-you for further development in the app, the app first receives a random, one-time purchase reference from our server, which Google Play assigns to the purchase, and transmits the purchase token after the purchase. With it, our server confirms the purchase with Google Play and stores the product, the store, the order number, time, quantity, the amount confirmed by Google with its currency, the status and any refunds. As long as Google has not yet confirmed the amount, it remains open and is added later. The purchase token is kept encrypted until it has been verified and is deleted afterwards. We do not process your name, e-mail address, Google account or means of payment for this; the purchase reference is not linked to your installation or your usage statistics unless you have consented to the measurement of advertising success (section 3.9). We do not use the data for advertising, and for measuring advertising success only with this separate consent and only if it still stands when Google confirms the amount.

App Store (iOS). In the iOS version, Apple's App Store unlocks premium, at once and even if our server cannot be reached. For the background check, the app sends, instead of a purchase token, the transaction number issued by the App Store and the product to our server, without any identifier of your installation. With it, the server retrieves the transaction signed by Apple from Apple (App Store Server API), verifies its signature and, as above, returns only the result to the app. Premium ends only if Apple documents a revocation, for example a refund, or if the signed transaction belongs to another product and a second check at least one day later shows the same; if Apple does not answer or does not know the transaction, nothing changes. For the booking, the App Store assigns the purchase reference to the purchase as an account token (appAccountToken); our server stores the transaction number instead of the order number and the amount signed by Apple with its currency, otherwise the same details as above. It books purchases in Apple's test environment (TestFlight, app review) as test purchases. We do not receive your Apple Account, name, e-mail address or means of payment; the payment is handled by Apple.

Legal basis. The verification and the booking serve the performance of the purchase contract (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in reliably confirming purchases, detecting revocations and misuse and correctly assigning refunds (Art. 6 para. 1 lit. f GDPR). If our server cannot be reached, the app submits the purchase token for the booking later and repeats the background check; the purchase and the unlocking do not depend on it.

3.9 Optional Measurement of Advertising Success in Meaningful to Me

In the Android version of Meaningful to Me you can separately consent to us measuring whether our advertising for the app leads to purchases ("measuring advertising success"). This consent is off until you switch it on during setup or under Settings. It requires the usage statistics of section 3.7 to be shared, applies to the respective device only and is independent of the advertising consent in Google's consent dialogue (section 3.5). The iOS version does not offer the measurement of advertising success.

Data processed. If you switch measurement on, our server stores a record of your consent with the time, the version of the consent and the app instance ID from section 3.7. If you then start a purchase of the premium version or of a thank-you, our server assigns the purchase reference (section 3.8) to your installation. Once Google has confirmed the purchase as paid together with its amount, and your consent still stands at that time, it transmits to Google Analytics for Firebase a purchase event with the amount confirmed by Google and its currency, the time of the purchase, an identifier derived from the order that does not allow Google to infer the order number, and the app instance ID and user ID from section 3.7. If a purchase is refunded before it has been reported, it is not reported; if a reported purchase is refunded, the server reports the refund with its amount. Only paid purchases that you started after giving your consent are reported, no test purchases, no free and no restored purchases. Google does not receive the order number, the purchase token, your name, e-mail address or means of payment from us.

In the app. As long as measurement is switched on, the app also grants Google Analytics for Firebase the consent types for storage for advertising purposes and for user data for advertising purposes. This allows the usage statistics of section 3.7, in particular the purchases mentioned there, to be used for measuring advertising success as well. The advertising ID of your device is still not collected, and the consent type for personalised advertising remains denied.

Purpose and limits. We use the events solely to measure whether our own advertising for the app leads to purchases. They are marked as non-personalised; we use them neither for personalised advertising nor for remarketing or to build audiences, and the contents of your moments are never part of them. Google Analytics for Firebase processes the events on our behalf, as described in section 3.7.

Legal basis. Advertising success is measured only with your separate consent (Art. 6 para. 1 lit. a GDPR); reading the app instance ID on your device, which this requires, is based on Section 25 (1) TDDDG. Without this consent, no measurement of advertising success takes place; the app, the usage statistics and purchases work without restriction.

Withdrawal and deletion. You can withdraw your consent at any time under Settings; the withdrawal takes effect immediately. The app then denies the consent types for advertising purposes again, and our server deletes the stored app instance ID and all purchase events not yet transmitted and removes the assignment of purchases whose amount has not yet been confirmed to your installation; it no longer reports refunds afterwards. Events already transmitted remain with Google until the retention period expires (section 7.8). If you switch off the usage statistics altogether, the measurement of advertising success ends as well: our server then also deletes the record of your consent and the assignment of reported purchases to your installation, and the deletion request to Google under section 3.7 also covers the reported purchase events, because they are stored under your user ID.

Transfer to third countries. Our server sends the purchase events to the European collection endpoint of Google Analytics. Google may nevertheless also process data outside the EU and the EEA; section 6 applies.

3.10 Customer reviews on this website

We reproduce customer reviews from MQL5 and Trustpilot on this website. These include publicly available reviews and reviews of commissioned work that are only visible when logged into our MQL5 account. We process the review text in its original language, the star rating, the publication date where available, the name of the reviewed product or service and a source link. On request, we display a clearly labelled translation, also stored on our own server. For personal names, we show the first name and the initial of the surname; publicly used nicknames remain unchanged. The information comes from reviews on the platforms named above.

We use this information to give prospective customers a traceable insight into experiences with our services and products. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the transparent presentation of customer opinions. We store the selected reviews on our own server and review their continued use when changes occur or their authors contact us.

Displaying the reviews does not transmit any data to MQL5 or Trustpilot when you visit our website. We do not embed widgets, images or scripts from these platforms for this purpose. Only when you follow a source link do you open the respective provider’s website, where its privacy policy applies.

As the author of a review, you may object to the processing of your personal data on grounds relating to your particular situation under Article 21 GDPR. Please contact us using the details in section 1 and identify the review concerned. We will assess your objection and remove the reproduction where the legal conditions are met. Publication on the original platform is independent of this.

3.11 Newsletter

For our newsletter we process your email address, chosen topics (trading, lifestyle, artificial intelligence or gaming), language, signup and confirmation times, and the version of your consent. A subscription becomes active only after you confirm the personal link in an email (double opt-in). Unconfirmed signups receive no newsletters. To prevent abuse, we limit attempts and use Google reCAPTCHA for new signups after separate consent (section 4.6). The signup IP address is processed temporarily for rate limiting; we do not copy it into active subscriptions or consent evidence.

Sending news on your chosen topics is based on consent under Article 6(1)(a) GDPR. The confirmation request, technical abuse prevention and necessary evidence are based on Article 6(1)(f) GDPR, our interest in preventing unauthorised signups and demonstrating valid consent. Newsletter consent does not include consent to website analytics or advertising.

We manage subscriptions on our server and send through our mail server at hosting provider Host Europe GmbH. Mail is delivered to your email provider. Google receives the data described in section 4.6 when you separately allow CAPTCHA verification. Newsletter addresses are not shared with advertising platforms.

Unconfirmed signups are stored for no more than seven days from the first signup; resending does not extend this period. Active subscriptions last until you unsubscribe. We then remove delivery data and retain necessary consent evidence separately, solely as evidence, for no more than three years after withdrawal. This includes address, topics, language, consent version and signup, confirmation and withdrawal times. Daily cleanup enforces these periods. Confirmation and management links are personal access keys and should not be shared.

You may withdraw consent with future effect or change topics using the personal link in a newsletter email. No CAPTCHA or Google consent is required. If you do not have the link, contact support@softdot.studio; we verify your authority before changing the subscription. Withdrawal does not affect the lawfulness of earlier sending.

4. Cookies and Similar Technologies

We use cookies on our website. Cookies are small text files that are stored on your terminal device and that store certain settings and data for exchange with our system via your browser.

4.1 Functional Cookies

These cookies are necessary for the operation of the website and cannot be deactivated in our systems. The processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in an optimized website offering.

4.2 Consent and Cookie Settings

On your first visit, the website asks you in its own notice which purposes you agree to: preferences (section 4.3), statistics (section 4.4), marketing (section 4.5) and form protection (section 4.6). None of these services is loaded before you decide. “Accept all” and “Necessary only” carry equal weight; under “Choose” you decide on each purpose separately. The necessary functions (section 4.1) are always active.

We store your decision in a cookie on your device: the purposes you chose, the time, the version of the notice and a random identifier. It is valid for twelve months; after that, or when the notice changes, we ask you again. So that we can prove your consent, our server stores the same details together with the page and the language on which you decided. We do not store your IP address or any other characteristics of your device for this.

Under “Cookie settings” at the bottom of every page you can change your choice at any time and withdraw consents with effect for the future. After a withdrawal the website no longer loads the service concerned, sends it no more events and deletes its cookies and the information stored for it on your device as far as it can read them; scripts of Google reCAPTCHA and LinkedIn that have already been loaded end when you leave the page. The cookie with your decision is strictly necessary for your choice to apply (Section 25 (2) no. 2 TDDDG). We keep the proof because we are obliged to (Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR). All other purposes are based on your consent (Section 25 (1) TDDDG, Art. 6 para. 1 lit. a GDPR).

4.3 Preferences

The home page remembers which of its chapters you have seen and shows them to you complete when you return instead of telling them again. During a visit it keeps this list in the session storage of your browser, which is cleared when you close the tab; this is strictly necessary for the navigation (Section 25 (2) no. 2 TDDDG). If you agree to “Preferences”, it keeps the list in the local storage of your browser until no new chapter has been added for 30 days (Section 25 (1) TDDDG); if you withdraw, it is deleted there. The list contains only the names of the chapters and never leaves your device.

4.4 Statistics (Google Analytics)

If you agree to “Statistics”, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf. Only then does the website load the script from Google. Google Analytics stores a random identifier in cookies on your device, by which it recognises returning visits and page views that belong together. With every report it receives the address called, the page you came from, details of your browser, operating system, screen size and language, and the time.

According to Google, Google Analytics 4 neither logs nor stores your IP address: Google only derives your approximate location from it (country, region and city) and then discards it; for visits from the EU this happens on servers in the EU. The other data may also be processed on Google servers in the USA (section 6). Google Signals and the use of the data for personalised advertising remain switched off unless you also agree to “Marketing”.

If your browser blocks the script of Google, the website sends the measurements to our server, which forwards them to Google Analytics through the Measurement Protocol. The random identifier is then kept in the local storage of your browser. In this way Google receives neither your IP address nor details of your browser and device; it derives the approximate location from the address of our server.

Beyond the page views we measure how the website is used: which chapters and worlds of the home page you view and for how long, how you get there (scrolling, menu, map of the worlds, tour or “Next”), whether you follow an animation to its end or scroll on, whether you play the small game in the world of games, which parts of the products page and of the legal texts you read and which links and buttons you choose. In the contact and newsletter forms we record your steps, such as the start, the chosen request and product or the topics, the number of attachments, missing required fields, sending with its result or the field at which you stop. What you type, your name and your email address do not reach Google. From this we derive whether a visit shows particular interest, for example with two worlds viewed or a minute on the site; we count a sent request and a newsletter signup as a conversion. We evaluate these data to improve the website.

The processing takes place only with your consent (Section 25 (1) TDDDG, Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time with effect for the future under “Cookie settings”; after that the website sends nothing more to Google Analytics and deletes its cookies.

4.5 Marketing (Google Ads, Meta, Microsoft Advertising and LinkedIn)

If you agree to “Marketing”, the website loads the tags of the advertising platforms named below, as far as we use an advertising account with them. They measure whether visits and requests result from our advertisements and may add your device to audiences for later advertisements (remarketing) or build similar audiences from them. For this they store cookies with identifiers on your device and receive the addresses visited, your IP address, details of your browser and device and these events: page views, your interest in a world of the home page, an area of the products page or a product (from four seconds of viewing or with a click to the store), a visit with particular interest (section 4.4), the start and the sending of a request, the newsletter signup and clicks on our email address. They do not receive what you enter in forms; for a project request the next paragraph applies. Without this consent none of these platforms receives data from this website.

If you send a project request, the platforms additionally receive hashed values (SHA-256) with which they can assign the request to a user account you have with them (enhanced matching): Google and Meta of your email address and your first and last name, Microsoft and LinkedIn of your email address only. The platforms compute the same hash from the details of their users and compare; they do not receive your address or your name themselves. Until the confirmation page appears, the hashed values are kept in the session storage of your browser tab. The platforms do not receive your message or your attachments.

Our server also reports the same events directly to the interfaces of Meta, Microsoft and LinkedIn (Conversions API), so that measurements are not lost when your browser blocks the tags; a shared identifier per event prevents it from being counted twice. In doing so the server transmits your IP address, the identification of your browser (user agent), the address of the page and the identifiers from the cookies of the platform concerned, for a project request also the hashed values from the previous paragraph and the click identifiers of the stored origin. To protect against misuse it counts the reports per IP address and minute; for this it keeps a hash of the address, which it deletes with the first report after three minutes.

In addition, the website remembers in the local storage of your browser which advertisement or page brought you to us: the campaign details of the address visited (utm parameters), the click identifiers of the platforms (gclid, gbraid and wbraid of Google, msclkid of Microsoft, fbclid of Meta, li_fat_id of LinkedIn), the first page visited, a referring page outside our website and the time, each for your first and your last such visit. The contact form sends this information along (section 3.2). If your request leads to an order, we may report this to the platform whose advertisement brought you to us, with the click identifier and the hashed values from this section.

Google Ads is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you have also agreed to “Statistics”, it additionally receives the events from section 4.4; Google Ads and Google Analytics may then link the data with Google Signals and use them for personalised advertising. Google processes the data of Google Ads as an independent controller (section 5.3); Google describes how at policies.google.com/technologies/partner-sites.

The Meta pixel is a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It only records the events named above, no automatically captured clicks or page contents. For the collection of the data on our website and their transmission to Meta we are joint controllers with Meta (Art. 26 GDPR) and have concluded the joint controller agreement with Meta for this (facebook.com/legal/controller_addendum). Under it Meta is responsible for fulfilling your rights under Art. 15 to 20 GDPR regarding the data stored by Meta; you may also contact us. What Meta does with the data after the transmission is the sole responsibility of Meta; the privacy policy of Meta applies (facebook.com/privacy/policy).

Microsoft Advertising with its Universal Event Tracking (UET) is a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes the data as an independent controller (section 5.3); the privacy statement of Microsoft applies (privacy.microsoft.com/privacystatement).

The LinkedIn Insight Tag is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn may assign the data to the accounts of its members and only provides us with aggregated reports on audiences and conversions that do not reveal individual persons. LinkedIn processes the data as an independent controller (section 5.3); the privacy policy (linkedin.com/legal/privacy-policy) and the cookie policy of LinkedIn (linkedin.com/legal/cookie-policy) apply.

The processing takes place only with your consent (Section 25 (1) TDDDG, Art. 6 para. 1 lit. a GDPR), which you can withdraw at any time under “Cookie settings”. After that the website sends nothing more to any platform, switches the tags off as far as they allow it and deletes their cookies under our domain as well as the stored origin. The website cannot delete cookies that the platforms set under their own domains; you can do so in your browser. The platforms may also process data in the USA (section 6).

4.6 Form Protection (Google reCAPTCHA)

We protect the contact form, newsletter sign up and display of our email address against spam and automated access with Google reCAPTCHA v3. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you agree to “Form protection”, in the notice, at a form or when displaying the address, the page loads the Google script for this function. According to Google, it transmits information on your device hardware and software, such as browser, operating system and screen, your IP address, the page address, your interactions and Google cookies to Google; data may also be processed in the USA (section 6). When you send a form or request the address, our server receives an assessment of the request from Google and rejects requests very likely to be automated. For the contact form, the assessment reaches us with your request. To limit attempts and detect reused verification tokens, we store short-lived hashes instead of plain IP addresses and tokens. These entries remain valid for at most ten minutes and are removed on the next request.

Google states that it processes this data to improve reCAPTCHA and for security purposes. Its privacy policy applies. Integration requires your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR). Without it, the contact form and newsletter signup cannot be submitted. You can contact us directly at support@softdot.studio, including without JavaScript or Google consent. The contact details in the legal notice, privacy policy and withdrawal information are equally accessible. Newsletter management and unsubscribe using a personal token do not require CAPTCHA. You can withdraw consent at any time through “Cookie settings”.

4.7 YouTube Integrations

YouTube videos may be embedded on our website. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. This informs YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube can associate your browsing behavior with you personally. The use is carried out pursuant to Art. 6 para. 1 lit. a GDPR only with your consent.

4.8 Payment Processing (Paddle)

We use the service of Paddle, a payment service provider, for payment processing. For payment transactions, the necessary payment data is transmitted to Paddle. The transmission of your data takes place exclusively for payment purposes and only to the extent that it is necessary for this, pursuant to Art. 6 para. 1 lit. b GDPR.

You can set your browser to inform you about the setting of cookies and to allow cookies only in individual cases, to exclude the acceptance of cookies for certain cases or in general, and to activate the automatic deletion of cookies when closing the browser.

5. Disclosure of Personal Data

Your personal data will not be transmitted to third parties for purposes other than those listed below:

5.1 Processors

We pass on personal data to processors who assist us in providing our services and act exclusively on our instructions when doing so, in particular to:

• Host Europe GmbH (hosting provider)
• Google Ireland Limited (Google Analytics on this website; Google Analytics for Firebase in our apps, including the measurement of advertising success, in each case only with your consent)
• Paddle (payment processing)
• External AI service providers (when using corresponding functions)

We have concluded data processing agreements with these service providers in accordance with Art. 28 GDPR, where legally required.

5.2 Legal Obligations

We only disclose your data to third parties if we are legally obliged to do so or if this is necessary for the enforcement of our rights, in particular for the enforcement of claims from the contractual relationship.

5.3 Independent and Joint Controllers

Not every recipient acts on our behalf. When serving advertising in our apps via Google AdMob, Google states that it is not our processor but an independent controller alongside us: Google itself decides on the purposes and means of processing the data arising in this context and also uses it for its own purposes, for example to provide and improve its advertising services, for measurement, and to detect fraud and abuse. We cannot control this processing and give Google no instructions in this respect.

The privacy terms of Google apply to it, which Google describes at policies.google.com/technologies/partner-sites and in its privacy policy at policies.google.com/privacy. Which data arises in this context and on which legal basis we obtain your consent is set out in section 3.5.

Google for Google Ads, Microsoft for Microsoft Advertising and LinkedIn for the Insight Tag are independent controllers as well, each for the data they receive with your consent from this website and from our server (section 4.5). With Meta we are joint controllers for the collection on this website and the transmission to Meta; Meta alone is responsible for the further processing (section 4.5).

6. Data Transfer to Third Countries

When using services such as Google Analytics, Google Ads, Google reCAPTCHA, Google AdMob, YouTube, Meta, Microsoft Advertising, LinkedIn, or AI services, data may be transferred to the USA or other countries outside the EU/EEA. For such transfers, the EU Commission has determined an adequate level of data protection for some countries, such as Canada. For the USA, an adequacy decision exists in the form of the EU-US Data Privacy Framework, under which Google LLC, Meta Platforms, Inc., Microsoft Corporation and LinkedIn Corporation are certified and on which Google relies for transfers relating to its advertising services; in addition, appropriate safeguards such as EU standard contractual clauses apply. Where a recipient is an independent controller, as Google is when serving advertising in our apps and for Google Ads, and as Microsoft and LinkedIn are (section 5.3), it selects the safeguards for its transfers itself; we have no influence on this. Please note, however, that for some services, despite these measures, an equivalent level of data protection as in the EU may not be guaranteed.

The processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR or for the performance of a contract pursuant to Art. 6 para. 1 lit. b GDPR.

7. Duration of Storage

We store your personal data only for as long as is necessary for the purposes for which they were collected or as required by law:

7.1 Server Logs

Ordinary website access logs may contain full IP addresses. A daily cleanup removes logs no later than seven days after collection. Necessary extracts concerning specifically documented security incidents may be retained separately with restricted access. Their purpose, scope and review date are recorded; the extracts are deleted when no longer needed. The legal basis is Article 6(1)(f) GDPR, our interest in secure operation and defending against attacks.

7.2 Contact Requests

Are stored for a period of up to 24 months to ensure continuous customer service, improve service, and reference previous requests. This is done on the basis of our legitimate interest in effective customer communication pursuant to Art. 6 para. 1 lit. f GDPR. After this period, the data is deleted, unless there are legal retention obligations or an ongoing customer relationship requires longer storage.

7.3 Contract Data

Is stored for the duration of the contractual relationship and beyond in accordance with legal retention periods (usually 6-10 years).

7.4 Consents, Analytics and Advertising Data of This Website

The cookie with your decision is valid for twelve months; our server deletes the proof of your consent after three years. The list of chapters seen remains until no new one has been added for 30 days. The cookies of Google Analytics remain on your device for up to two years, and so does, for two years at most, the own identifier used when your browser blocks the script (section 4.4). Under our domain the cookies of Google Ads and Meta (_fbp, _fbc) remain for up to 90 days, those of Microsoft for one day (_uetsid), 90 days (_uetmsclkid) and up to 13 months (_uetvid) and that of LinkedIn for up to 30 days (li_fat_id). Under their own domains Microsoft (for example MUID, one year) and LinkedIn (for example bcookie, one year) set further cookies. The website uses the stored origin (section 4.5) until no new visit through an advertisement or a referral has been added for 90 days and then deletes it on the next visit; once it is stored in a request, section 7.2 applies to it. If you withdraw your consent, the website deletes the cookies under our domain and the stored information earlier. At Google Analytics the event data are deleted after the period configured in the respective account; aggregated reports that do not identify individual users may remain longer. How long Google, Meta, Microsoft and LinkedIn store the data of their advertising services and Google the data of Google reCAPTCHA is determined by them. For advertising data in our apps, section 7.5 applies.

7.5 Advertising Data in Our Apps

The control data that an app stores on your device in order to limit how often advertisements are shown remains there until you uninstall the app or delete its data via the system settings. If it was previously captured by the automatic backup function of your operating system, it may return to a device through a restore; see section 3.4.

Your consent decision is stored by the Google consent module on your device until you change it or the app data is deleted.

How long Google stores the data processed for the delivery of the advertisements is determined by Google as an independent controller; you can find information on this in the privacy policy of Google.

7.6 Error Reports from Our Apps

For each report, our server stores only its number, the time, the size and the number of screenshots, but not the content, and deletes this information after 30 days. To protect against mass sending, it derives a non-reversible key from your IP address (for IPv6 from the network prefix) and deletes it after 24 hours; it does not store the IP address itself for this purpose. Section 7.1 applies to the logs of the web server.

We treat the e-mail containing your report like a contact request and keep it for up to 24 months; see section 7.2.

A report that has not yet been sent remains on your device for at most 14 days. The debug log remains there until newer entries overwrite it or you delete the app data.

7.7 Usage Statistics and Purchase Verification in Our Apps

Our server deletes inventory data and events of the optional usage statistics after 60 days at the latest and immediately upon withdrawal. After that it keeps only an irreversibly derived identifier of the withdrawn installation without any content, so that it cannot be used again, and the time at which Google accepted the deletion request. Our server deletes texts from optional text analysis 30 days after last receiving a new or changed version of the text. Once a request to withdraw consent, delete the moment or mark it private arrives, the texts are deleted immediately; offline requests are sent later. Content-free deletion barriers prevent deleted texts from returning through a restored backup. Operator read-access records are deleted after 60 days.

In Google Analytics for Firebase, the retention of event and user data is set to two months; aggregated reports that do not identify individual users may remain longer.

Our server deletes unused purchase references after 30 days and booked purchases including refunds 24 months after the purchase, even if their amount is still open. It deletes the keys of revoked purchases from Google Play's list 24 months after the revocation; it does not store the requests of the background check. For App Store purchases it keeps no such list, because every transaction signed by Apple shows a revocation itself.

On your device, your choice, a deletion order that has not yet been confirmed and purchase tokens not yet transmitted (for at most 30 days) remain in a storage area that is excluded from the automatic device backup. The result of the last background check remains with the app's settings and, like them, is included in the device backup; the app deletes it as soon as a restoration shows that your Google account no longer owns the purchase.

7.8 Measurement of Advertising Success in Our Apps

Our server keeps the record of your consent for as long as the measurement of advertising success is switched on. After a withdrawal it only retains when and in which version you consented and when you withdrew, so that it can demonstrate that the processing up to then was lawful; it deletes these details when you switch off the usage statistics. The assignment of a booked purchase to your installation remains until Google confirms the amount, at most until the purchase is deleted after 24 months (section 7.7); a withdrawal removes it at once. It deletes purchase events not yet transmitted after 30 days at the latest, and the assignment of a reported purchase to your installation 60 days after the report; this assignment serves only to report a later refund.

In Google Analytics for Firebase, the reported purchase events are subject to the same retention of two months as the usage statistics (section 7.7); aggregated reports that do not identify individual users may remain longer.

8. Your Rights

You have the following rights regarding your personal data stored by us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7 para. 3 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise these rights, please contact the contact details mentioned in points 1 or 2. The easiest and fastest way to reach us is through our #contact form.

9. Data Security

We use technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or against access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

10. Currency and Amendment of this Privacy Policy

This privacy policy is current and valid. Due to changed legal or regulatory requirements, it may be necessary to adapt this privacy policy. The current privacy policy can be accessed at any time on our website.

Right of Withdrawal

You have the right to withdraw from this contract within fourteen days without giving any reason.

For service contracts, the withdrawal period is fourteen days from the day the contract is concluded.

For digital content not supplied on a physical medium, such as downloads, the withdrawal period is also fourteen days from conclusion of the contract. In either case, the period does not start before you have been properly informed of your right of withdrawal.

To exercise your right of withdrawal, inform us (Softdot.Studio, owner Maurice Tusche, Buchenweg 5, 85283 Wolnzach, Germany, email: support@softdot.studio) of your decision by a clear statement, for example by letter or email. You may use the model form below, but this is not mandatory.

To comply with the withdrawal period, it is sufficient for you to send the communication concerning the exercise of the right of withdrawal before the withdrawal period has expired.

Consequences of Withdrawal

If you withdraw from this contract, we reimburse all payments received from you without undue delay and no later than fourteen days after receiving your withdrawal. We use the same means of payment as for the original transaction unless expressly agreed otherwise. You will not incur a fee for the reimbursement.

If you expressly requested that a service start during the withdrawal period, compensation for services performed up to withdrawal is payable only where the statutory requirements are met. The amount corresponds to the proportion of the agreed total service already performed.

Compensation for services requires in particular that you were properly informed before contracting about withdrawal and compensation and expressly requested the early start. For off-premises contracts this request must be provided on a durable medium.

For digital content not supplied on a physical medium, you owe no compensation for digital content already provided if you validly withdraw.

A valid withdrawal ends your right to continue using the affected digital content or digital services or make them available to others. Statutory rights to retrieve content you provided or created remain unaffected.

Early expiry for digital content

For paid digital content not supplied on a physical medium, the right of withdrawal expires early only if you expressly consented to performance starting before the withdrawal period ends and acknowledged that you lose your right of withdrawal when performance starts, we have actually begun performance, and we have provided a contract confirmation under section 312f BGB on a durable medium, such as email. That confirmation also records your consent and acknowledgement. All requirements must be satisfied (section 356(6) BGB).

Early expiry for services

For paid services, the right of withdrawal expires early only upon full performance, provided that before performance started you expressly consented to the early start and acknowledged that full performance ends your right of withdrawal. For off-premises contracts, consent must be provided on a durable medium (section 356(5) BGB). Merely starting a service does not extinguish the right of withdrawal.

Model Withdrawal Form

(If you want to withdraw from the contract, please fill out this form and send it back.)