Privacy Policy

PRIVACY POLICY – CRIS Last updated: July 2026 This privacy policy consists of two parts: Part A concerns your visit to this website (cris-app.com). Part B concerns your use of the mobile app "CRIS". CONTROLLER (for website and app) Christoph Zimmermann (Zemantix Studio) c/o Online-Impressum #9783 Europaring 90 53757 Sankt Augustin Germany E-mail: cris.app@mail.online-impressum.de Data deletion: https://www.cris-app.com/datenloeschung.html ═══════════════════════════════════════════════ PART A – USING THIS WEBSITE (cris-app.com) ═══════════════════════════════════════════════ This website is purely an information and marketing page for the CRIS app. It sets no cookies and embeds no external services that load content. A.1 Hosting and Server Log Files This website is hosted by: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich Hauptstraße 68, 02742 Friedersdorf, Germany The servers are located in Germany. When the website is accessed, the host automatically processes technical access data in what are known as server log files. This includes: IP address, date and time of access, the page accessed, the volume of data transferred, the previously visited page (referrer) and information about the browser and operating system. Purpose and legitimate interest: This data is technically necessary in order to deliver the website, ensure its stable operation and defend against attacks or misuse. The legal basis is our legitimate interest in secure and trouble-free operation (Art. 6(1)(f) GDPR). Storage period: The IP address in the server log files is automatically deleted after 7 days at the latest. Longer storage takes place only insofar as it is necessary to investigate a specific security incident. Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with the host. A.2 Anonymous Reach Measurement We anonymously count visits to this website as well as clicks on the "Google Play" button in order to understand how the page is used. Only the following are stored: the time of the event, the type of event (page view or button click), the language transmitted by the browser, the rough device type (mobile or desktop) and the page visited (the path only, without any query parameters). No IP addresses are stored, no cookies are set and no user profiles going beyond the individual visit are created. Individual visitors are not recognized. Purpose and legitimate interest: statistical reach analysis for the needs-based design and improvement of the service. The legal basis is our legitimate interest therein (Art. 6(1)(f) GDPR). Since no cookies or comparable technologies for accessing your device are used, no consent under Section 25 TDDDG is required. A.3 Cookies This website sets no cookies. A.4 Fonts The fonts used are embedded locally on our server. No fonts are loaded from external servers (e.g. Google Fonts). A.5 Redirection to Google Play The download button links to the App in the Google Play Store (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only when you click the button do you leave this website; in doing so, your IP address is transmitted to Google. Google is independently responsible for this and any further processing. Google's privacy policy applies: https://policies.google.com/privacy A.6 Your Rights When Visiting the Website You are entitled to the data-subject rights set out in Part B, Section II (access, rectification, erasure, restriction, data portability, complaint to the supervisory authority). In particular, you have the right, on grounds relating to your particular situation, to object at any time to the processing based on Art. 6(1)(f) GDPR (server log files and reach measurement) (Art. 21 GDPR). To do so, please contact the address given above. ═══════════════════════════════════════════════ PART B – USING THE CRIS APP ═══════════════════════════════════════════════ The following information applies to data processing within the mobile app "CRIS" and also serves as the privacy policy within the meaning of the Google Play requirements. I. GENERAL CRIS is an offline-capable mobile app and is intended exclusively for adults (18+). All data you enter is stored exclusively locally on your device. We do not operate a production server. No automatic data transfer to our servers takes place. The App itself performs no tracking, collects no usage statistics and no analytics data. (The anonymous reach measurement described in Part A concerns this website only, not the App.) II. RIGHTS OF DATA SUBJECTS – Right of access (Art. 15 GDPR): You can see all of your data directly in the App. – Right to rectification (Art. 16 GDPR): You can edit all data in the App at any time. – Right to erasure (Art. 17 GDPR): You can delete data or uninstall the App. – Right to data portability (Art. 20 GDPR): Export as a ZIP backup is possible. – Right to object (Art. 21 GDPR): cris.app@mail.online-impressum.de – Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit NRW), Postfach 20 04 44, 40102 Düsseldorf III. INFORMATION ON DATA PROCESSING 1. Locally Stored App Data The following data is stored exclusively locally in an SQLite database: – Grow data: name, strain, growth phases, start dates, descriptions – Diary entries: date, photos, care measures, measurement values – Purchase and cost data: seeds, substrates, fertilizers, prices – App settings: language, colour scheme, start page – Age verification: date of birth (exclusively local, never transmitted) – Disclaimer confirmation: acceptance flag Legal basis: Art. 6(1)(b) and (f) GDPR. Note on sensitive data: Some of the information you voluntarily enter (e.g. regarding cannabis cultivation) may allow inferences to be drawn about special categories of personal data within the meaning of Art. 9 GDPR. This data never leaves your device at any time and is neither collected nor processed by the Provider. Any processing takes place solely on the basis of your voluntary local input on your device; no transmission to us takes place. Storage period: Local App data remains stored on your device until you delete it yourself or uninstall the App. No storage or deletion controlled by the Provider takes place. For RevenueCat/Google, the storage period is governed by their respective privacy policies. 2. Camera Permission CRIS can access your camera in order to take photos for the diary. Photos are stored exclusively locally. Legal basis: consent (Art. 6(1)(a) GDPR). 3. Storage Permission CRIS requires access to device storage for backup exports and photos. Legal basis: consent (Art. 6(1)(a) GDPR). 4. Sharing the Backup File You can transfer your backup (ZIP file) yourself to a location of your choice via your device's share function — e.g. cloud storage, by e-mail or to another app. This operation runs entirely via your operating system and the service you have chosen. In doing so, the App does not transmit any data to us or to third parties. Any third-party provider you choose is subject to its own data protection terms. Legal basis: consent (Art. 6(1)(a) GDPR). Important note: The backup file is exported unencrypted and, depending on its content, may contain sensitive information. You are responsible for storing and sharing it securely and, where appropriate, in encrypted form. 5. In-App Purchases and Subscription Payment processing via Google Play Billing (Google Ireland Limited) and RevenueCat (RevenueCat, Inc., 633 Taraval Street #101, San Francisco, CA 94116, USA). RevenueCat verifies purchase receipts and, in doing so, transmits technical device identifiers and purchase information. Only technical data and purchase receipts are processed, no grow, diary or other content data. CRIS itself does not store any payment data. Transfer to a third country: Since RevenueCat, Inc. is based in the USA, these technical purchase data may be transferred to a third country (USA). The transfer is based on the EU-US Data Privacy Framework or on standard contractual clauses pursuant to Art. 46 GDPR. RevenueCat privacy policy: https://www.revenuecat.com/privacy Legal basis: Art. 6(1)(b) GDPR. IV. NO DISCLOSURE TO THIRD PARTIES Your data is not disclosed to third parties, except: – RevenueCat: only for subscription validation (technical data, no grow data) – Statutory obligations: upon official request on a statutory legal basis Note: If you share a backup with a third-party service (e.g. cloud storage) via your device's share function, this is your own action carried out via the operating system — the App transmits nothing in the process. V. DATA SECURITY CRIS uses the security mechanisms of the operating system for the local SQLite database. CRIS offers an optional app lock (biometric authentication on launch). VI. AMENDMENTS TO THIS PRIVACY POLICY In the case of material amendments, we will inform you the next time the App is launched. The current version is available in the App settings under "About CRIS". VII. CONTACT Christoph Zimmermann (Zemantix Studio) E-mail: cris.app@mail.online-impressum.de Address: c/o Online-Impressum #9783, Europaring 90, 53757 Sankt Augustin