Privacy Policy

This policy explains what personal data we process when you use the app "Novara", and your rights, under the UK GDPR and the Data Protection Act 2018. The app is designed for children and built around data minimisation.

1. Controller

The controller (Article 4(7) UK GDPR) is:
Mark Berger
Sole trader (individual)
Naukler Straße 18, 71065 Sindelfingen, Germany
Email: Bergermark@myyahoo.com
Telephone: +49 151 58600975

2. What data we process

a) Account of the registering adult (parent or individual account):

• email address;
• password — only if you register with email and password; stored solely as a cryptographic hash by the authentication provider (Firebase Authentication) and never accessible to us in clear text;
• name or display name;
• country (to set the applicable jurisdiction and language);
• account type (parent or individual);
• proof of consent (timestamp, consent version, confirmation of the minimum age and, for a parent account, consent to processing the children's data);
• parent code — optional, to protect the adult area; stored only as a cryptographic hash;
• account creation date.

b) If you sign in with Apple or Google:

• a user identifier from the provider (Apple or Google), used to link your account;
• your name and email address, to the extent the provider passes them to us (with "Sign in with Apple" this may be an anonymised relay address ending in @privaterelay.appleid.com).

See section 5 for detail.

c) Technical data processed by Firebase Authentication:

• a unique user identifier (UID);
• the IP address and sign-in / sign-out timestamps (to secure authentication against abuse);
• the identifiers of linked providers (Apple/Google) and the email-verification status.

d) Child profiles created by the parent or guardian:

• display name;
• avatar (symbol and colour);
• age band / optional year of birth, if provided;
• the child's optional select-PIN — stored only as a cryptographic hash;
• learning data (quiz scores, streaks, savings goals, budget, challenges, notes).

Children provide no email address and need no contact details of their own.

e) Local storage on your device:

For the app to work we store technically necessary data locally on your device (in browser or app storage): the last email address used (to pre-fill it), a cached copy of your profile, the chosen language and country, the current view (adult mode or child mode), a local copy of the learning data, and the unlock status (a yes/no value indicating whether the in-app unlock has been purchased; see section 8). No advertising or tracking cookies are set.

3. Purposes and lawful bases

• Providing and operating the account and learning features — performance of a contract (Article 6(1)(b) UK GDPR).
• Sign-in and authentication, including via Apple or Google — performance of a contract (Article 6(1)(b)).
• Securing the sign-in process (IP address, timestamps) — our legitimate interest in secure operation (Article 6(1)(f)).
• Processing children's data — consent of the holder of parental responsibility (Article 6(1)(a) with Article 8).

4. Whether you have to provide the data

An email address (or signing in with Apple or Google) and the required consent are needed to create and use an account; without them we cannot provide the service. Entering child-profile data (including an optional year of birth) is voluntary and based on your consent; without it, the children's learning features are unavailable.

5. Signing in with Apple or Google

Instead of email and password, you can use "Sign in with Apple" or "Sign in with Google". The provider carries out the sign-in and acts as an independent controller for the data it collects; we then receive only the information needed to create the account — as a rule, your name and an email address.

With "Sign in with Apple", the "Hide My Email" (Private Relay) feature lets you have Apple pass us an anonymised relay address (@privaterelay.appleid.com) instead of your real address, which Apple forwards to you.

Google LLC is based in the United States. For that transfer Google relies on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"; Google LLC is certified under the Framework) and, as a further safeguard, on the ICO's International Data Transfer Agreement (IDTA) / the UK Addendum to the EU standard contractual clauses. Our lawful basis is Article 6(1)(b) UK GDPR.

See the privacy notices of Apple and Google.

6. Children and parental consent

In the UK, a child aged 13 or over can consent on their own behalf to an information society service (Article 8 UK GDPR); for younger children, the holder of parental responsibility consents and manages the child's data. When creating a parent account, the adult confirms that they are at least 18 and hold parental responsibility, and separately consents to the processing of the learning data of the children in their care. Users aged 13 or over may hold their own account.

The app is deliberately designed to protect children: no third-party advertising or tracking technologies are used, and we have regard to the ICO's Children's Code (the Age Appropriate Design Code), including data protection by design and by default and data minimisation.

7. Processors and international transfers

We use Google Firebase (Firebase Authentication and Firebase Realtime Database) as a processor, under a data processing agreement with Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Account and learning data in the Firebase Realtime Database is stored in the European Union region (europe-west1). Transfers from the UK to the EEA are covered by the UK's adequacy regulations recognising the EEA.

Firebase Authentication (sign-in credentials, password hashes and connection metadata such as IP address and timestamps) is not restricted to the europe-west1 region and may be processed on Google's global infrastructure, including outside the UK and the EEA, in particular in the United States. For that transfer Google relies on the UK Extension to the EU-US Data Privacy Framework (Google LLC is certified under the Framework) and, as a further safeguard, on the ICO's International Data Transfer Agreement (IDTA) / the UK Addendum to the EU standard contractual clauses under the Google data processing agreement.

We use no third-party advertising and no third-party analytics or tracking services.

8. In-app purchases

A single optional in-app purchase permanently unlocks all chapters. It is handled entirely by Apple through your Apple ID; Apple is the seller and an independent controller for the payment, and we receive no payment data (card number, billing address, etc.).

We store on your device only an unlock status — a yes/no value indicating whether the unlock has been purchased. Your purchase and payment history is kept by Apple within your Apple account under Apple's privacy policy.

9. Retention

We keep your data for as long as your account exists. If you delete your account (in the app, under "Settings" → "Delete account"), your profile and learning data (data/<uid> and users/<uid>) and your authentication account are deleted immediately, along with the data stored locally on the device. Any brief technical logs at the processor are deleted under its data processing agreement. Deletion is user-triggered; there is no automatic deletion of dormant accounts.

10. No automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 UK GDPR takes place.

11. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the rights to:

• access your data (Article 15);
• rectification (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object to processing based on legitimate interests (Article 21);
• withdraw a consent at any time, with effect for the future, without affecting the lawfulness of earlier processing (Article 7(3)).

To exercise your rights, email Bergermark@myyahoo.com. The app also provides an in-app account-deletion function, and a copy of your data (data portability) is available on request.

You may also lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk/make-a-complaint).

12. UK representative (Article 27 UK GDPR)

We are established outside the United Kingdom (in Germany) but offer this service to UK users, so Article 3(2) UK GDPR can apply. Given the limited, low-risk nature of our processing — a small educational app with no advertising, no third-party tracking or profiling, and no special-category data — we have decided not to appoint a UK representative under Article 27 at this time. You can exercise all of your rights by contacting us directly (section 1) and can complain to the ICO (section 11). We keep this position under review.

13. Data security

Data is transmitted using encryption (HTTPS/TLS). Passwords and codes (for example the parent code) are stored only as cryptographic hashes. Access to account data is restricted to the account holder by server-side access rules.

14. Data protection contact

For any data protection question, contact Bergermark@myyahoo.com.