Privacy Policy

1. Controller

Sebastian Gronert
DigitalWebIT
Essenheimer Straße 120
55128 Mainz, Germany
Email: digitalwebitandgames@gmail.com

On Google Play the operator publishes under the developer name DerGronert.

2. Which feature processes which data

• Game progress and settings
  Data: solved trees, revealed photos, coins, streak, settings and timestamps (e.g. when a reminder was last scheduled or a rating was last requested)
  Where and why: only locally in the app storage on your device. Nothing is sent to us or third parties.
• Tree photos
  Data: IP address, time, requested image file, technical device and client information (user agent)
  Where and why: servers of the Wikimedia Foundation (upload.wikimedia.org), to display the photos. See 4.
• Usage analytics and crash reports (only with consent)
  Data: app interactions, diagnostic and crash data, device information, random identifiers of the app installation, approximate location derived from the IP address
  Where and why: Google Firebase Analytics and Firebase Crashlytics (Google Ireland Limited), to improve the game and fix errors. See 5.
• Reminders (optional)
  Data: time and text of the reminder
  Where and why: local notifications of the operating system, no server. See 6.
• Google Play and rating dialog
  Data: none by us; installation, updates, the dialog and any rating you give are handled by Google Play
  Where and why: Google Play (Google Ireland Limited). See 7.
• External links
  Data: as with any website visit in your browser
  Where and why: only after you tap them (e.g. the photo's source page on Wikimedia Commons, a licence text). See 8.
• Email to us
  Data: content of your message and your email address
  Where and why: your email app; on our side the mailbox at Google Gmail. See 9.
• This website
  Data: IP address, time, page requested, browser information (server logs)
  Where and why: GitHub Pages (GitHub, Inc., USA). No cookies, no tracking. See 9.

What the app does not do

• No user account, no sign-in, no own server, no cloud sync.
• No advertising. The app does not read the advertising ID; the corresponding Android permission is explicitly removed. The Android ID is not collected either.
• Without your consent no usage analytics and no crash reports. Even with consent no names, no email address, no words you spell or other input, no precise location, no advertising profile.
• No access to location, camera, microphone, contacts or files.
• No purchases: this version offers no in-app purchases. The purchase feature is technically prepared but switched off and does not connect to Google Play Billing. Should purchases be offered later, we will update this policy beforehand.

3. Local storage

Your progress is stored only in the app's local storage. We cannot read it. Android's automatic cloud backup is disabled for the app, so the game starts over on a new device. You can delete the data in the app under Settings → "Fortschritt zurücksetzen" (reset progress), via Android's "Clear app data" or by uninstalling.

4. Tree photos from Wikimedia Commons

All photos come from Wikimedia Commons. Some are bundled with the app; the others are loaded on demand directly from the servers of the Wikimedia Foundation, Inc. (1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA) over an encrypted connection (HTTPS). For technical reasons the Wikimedia Foundation receives your IP address, the time, the requested file and the user agent (information about the app, operating system and network library; the app puts its name and a developer contact address there, but no data about you). We do not receive this data. Loaded photos are cached on the device.

The Wikimedia Foundation processes this data as an independent controller to deliver the images and protect its servers. Its privacy policy applies: foundation.wikimedia.org/wiki/Policy:Privacy_policy. Processing may take place in the USA.

Legal basis: providing the game you want to use (Art. 6(1)(b) GDPR) and our legitimate interest in showing photos from a free source instead of hosting them ourselves (Art. 6(1)(f) GDPR). Without internet the game keeps working; photos that are not bundled are then not shown.

5. Usage analytics and crash reports (Google Firebase) – only with consent

On first launch the app asks whether it may send usage statistics and crash reports. "Agree" and "Decline" are equally easy and nothing is preselected. Until you answer, and after you decline, the app sends none of this; events from before your answer are kept only in memory and discarded if you decline.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with the services Google Analytics for Firebase and Firebase Crashlytics. Google processes the data on our behalf (data processing under Art. 28 GDPR).

Which data:

• App interactions: which trees you start, solve, skip or abandon (trees only as a Wikidata identifier such as "Q12345"), hints and photo hints used, playing time, coin balance, screens viewed, changed settings, daily reward and streak.
• Diagnostic data: start-up time, loading times and loading errors of photos, crash reports and other errors with a technical error log and game counters (e.g. current level).
• Device information collected automatically by Firebase, such as device model, operating system and app version, language setting and sessions.
• Identifiers: the Firebase app instance ID (Analytics) and the Crashlytics installation ID. These are random identifiers of this app installation, not the advertising ID and not the Android ID.
• Approximate location: Google derives country, region and city from the IP address. According to Google, Google Analytics does not store the IP address itself.

Not sent: names, email addresses, tree names, words you spell or any other input, the advertising ID and precise location. We set no user ID. Google Signals and ad personalisation are switched off.

Purpose: to understand how the game is used (e.g. which trees are too hard or where players stop) and to find and fix loading problems and crashes.

Legal basis: your consent (Art. 6(1)(a) GDPR); for storing and reading the identifiers on your device, Section 25(1) TDDDG.

Retention: event and user data in Google Analytics are deleted automatically after 14 months. According to Google, Crashlytics keeps crash reports for 90 days. For our own analysis we also export the data to Google BigQuery with storage location in the EU; these tables expire after 60 days.

Third countries: Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission's Standard Contractual Clauses apply in addition.

Withdrawal: at any time in the app under Settings › Datenschutz (Privacy) › "Nutzungsanalyse" (usage analytics). Collection stops immediately, the app resets the analytics identifier and deletes crash reports not yet sent. Data already sent remains until the end of the retention period; it is linked only to the random identifier, not to your name. Withdrawal does not affect the lawfulness of processing before it. Google's privacy information: firebase.google.com/support/privacy.

6. Local reminders

After a few solved trees the app asks once whether it may remind you to keep playing. If you agree, it schedules local notifications through your operating system (e.g. "your next tree is waiting"). There are no push messages from a server. You can revoke the permission at any time in Android's settings.

7. Google Play

You get the app through Google Play (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Download, installation, updates and any rating are subject to Google's terms and privacy policy (policies.google.com/privacy). The app may occasionally show Google Play's rating dialog; for this it uses Google Play's in-app review library (Play Core), which talks to the Play Store app on your device. Whether the dialog appears and what you enter there is processed by Google. From Google Play we only receive aggregated statistics (e.g. install counts) and, depending on your Google settings, anonymised technical crash and performance data of the operating system; the app itself sends none of this to Google Play.

8. External links

Links to photo sources, licence texts, the Play Store page or these legal texts open only after you tap them, in your browser or the Play Store app. The privacy terms of the respective provider apply there. We do not pass on any data about you.

9. This website and email

These legal texts are hosted on GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit, GitHub processes technically necessary data, in particular IP address, date and time, page requested and browser information, including in server logs. On this website we use no cookies, no analytics and no tracking and have no access to these logs.

We receive and store emails via Google Gmail (Google Ireland Limited, with processing also in the USA).

Legal basis is our legitimate interest in providing the website securely and in answering your request (Art. 6(1)(f) GDPR). For transfers to the USA, GitHub and Google rely on the EU-US Data Privacy Framework and additionally on Standard Contractual Clauses.

10. Legal bases and retention

Storing your progress on your device is technically necessary for the game (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). The other legal bases are stated in the respective sections.

• Local data: until you reset it, clear the app data or uninstall the app.
• Usage analytics and crash reports: see 5 (Google Analytics 14 months, Crashlytics 90 days, BigQuery export 60 days).
• Data at Wikimedia, Google Play and GitHub: according to these providers' terms; we do not store it.
• Emails to us: as long as needed to handle them, then deleted unless a legal retention duty applies.

11. Your rights

Where the legal requirements are met, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR), most easily in the app (see 5). Analytics data is linked only to a random identifier; without that identifier we cannot attribute it to you. You delete the data on your device yourself (see 3). For anything else an informal email is enough.

Right to object (Art. 21 GDPR): Where we process data based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation, informally, e.g. by email.

You may also lodge a complaint with a data protection supervisory authority. Competent for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, datenschutz.rlp.de.

12. Audience and security

Baumkreis is intended for teenagers aged 13 and over and adults. There is no profiling for advertising and no automated decision-making with legal effect. The connections to Wikimedia and Google are encrypted with TLS.

13. Contact and changes

Please send privacy requests to digitalwebitandgames@gmail.com. We update this policy when the app or the law changes, in particular before new features such as purchases are added. Version and date are shown at the top.