Contents

1. Controller
2. Data on your device
3. Permissions
4. Account and cloud sync
5. Purchases and subscriptions
6. Sharing and invites
7. App Store and Google Play
8. Website
9. Support requests
10. Recipients and international transfers
11. Retention
12. Your rights
13. Changes

1. Controller

Spacifik UG (haftungsbeschränkt)
Gerichtstr. 19, 13347 Berlin, Germany
Managing director: Luis Rieke
Email: [email protected]

For any privacy question, contact us at this address or through our support form. We are not required to appoint a data protection officer under Art. 37 GDPR and § 38 BDSG.

2. Data on your device

Tell Me Why is local-first. Everything you enter in the app is stored in an encrypted database (SQLCipher) on your device. The key is kept in the operating system's secure storage (iOS Keychain or Android Keystore). As long as you don't use an account, this data is never sent to us and we have no access to it.

Notifications (for example your Sunday Weekly Wrapped or check-in prompts) are local notifications scheduled on your device. We don't use a push service and don't create a push token.

In Settings you can export all your data (“Export my data”) or delete all data on the device at any time. Uninstalling the app also removes the local data.

Because this processing happens only on your device and under your control, we don't process personal data in the sense of the GDPR here. Access to information on your device is strictly necessary for the features you explicitly request (§ 25(2) no. 2 TDDDG).

3. Permissions

All permissions are optional. The app explains each one before your device asks.

iPhone: Screen Time (Family Controls)

Using Apple's Screen Time interface, you choose the apps and categories where Tell Me Why should check in. Apple only gives the app anonymous placeholders (“tokens”) instead of app names. Your usage times are displayed only inside a sandboxed Apple extension on your device. Neither the app itself nor we can read them, and they are never transmitted.

Android: usage access, display over other apps, background service

Usage access lets the app see when an app you selected is in the foreground and for how long. Display over other apps shows the check-in directly. A foreground service keeps this running. This data is processed only on your device. Package names and usage durations are never transmitted, not even with cloud sync.

Photos

When you add a photo to a goal, the app only gets the photo you pick. It stays on the device unless you use cloud sync (see below).

Notifications

For local reminders and check-in prompts. No data is sent to us.

4. Account and cloud sync (optional)

You can create an account to back up your data across devices. For this we use Supabase (Supabase Pte. Ltd., Singapore) as a processor. The database and file storage are located in data centres in Frankfurt am Main, Germany (AWS region eu-central-1).

Sign-in

• Email code: we process your email address and send you a one-time code. It is sent via Supabase's email service or an email delivery provider we engage.
• Sign in with Apple: Apple sends us an identifier and your email address. If you choose “Hide My Email”, this is a relay address from Apple.
• Sign in with Google: Google sends us an identifier, your email address and basic profile information (name, profile picture link). Sign-in happens on a Google page, where Google's privacy policy applies.

Supabase also stores technical data such as sign-in times and IP addresses in security logs.

What is synced

Sync is off by default. Existing data is only uploaded after you explicitly agree. The following is synced:

• Check-ins: time, date, hour, time zone, random device ID, platform, reason, your own reason and intention if entered, app name (if shown), chosen next step, source of the check-in
• Journal entries
• Goals with title, description and photo (in a private storage area)

Never synced: Screen Time and usage data, Android package names, Screen Time tokens, your onboarding answers and sample data from demo mode. Data is encrypted in transit. Access is restricted at the database level so that each account can only read its own data.

Legal basis

Processing is necessary to provide the account and sync you request (Art. 6(1)(b) GDPR). Your reasons and journal entries may reveal information about your health or mood. Where these are special categories of personal data, we process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when you turn on sync. You can withdraw it at any time with effect for the future by turning off sync or deleting your account.

Deletion

In the app under Settings → “Delete account”, your account, all synced entries and your photos are deleted immediately. See Delete account for details.

5. Purchases and subscriptions

You buy Tell Me Why Pro through the App Store (Apple) or Google Play (Google). Payment is handled exclusively by Apple or Google. We don't receive any payment details.

To manage subscriptions we use RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) as a processor. RevenueCat receives:

• a random app user ID or, if you are signed in, your account ID (not your email address)
• purchase and subscription data from Apple or Google (product, dates, period, renewal and refund status, receipt)
• technical data such as operating system, app version, store country, language and IP address

The legal basis is the performance of your subscription contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

6. Sharing and invites

When you share your Weekly Wrapped, the image is created on your device and sent through your system's share sheet to the app or person you choose. You decide which values appear on it. Personal details are off by default and journal text is never included. “Copy invite link” only copies a text with a link to this website to your clipboard. There are no personalised links and no tracking of who invited whom. Nothing is sent to us.

7. App Store and Google Play

Downloads, updates, ratings and purchases are subject to the privacy policies of Apple (apple.com/legal/privacy) and Google (policies.google.com/privacy), who are responsible for them. Crash reports and anonymous statistics you choose to share there are provided to us by Apple or Google only in aggregated form.

8. Website

Hosting

This website is served by Netlify (Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA). When you visit, Netlify processes technically necessary data such as IP address, time, page requested, referrer and browser identifier in server logs to deliver the site securely and reliably (Art. 6(1)(f) GDPR).

No cookies, no tracking

The website sets no cookies, uses no analytics or advertising services, and loads fonts from our own server, not from Google.

Support form (Tally)

The support page embeds a form from Tally (Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium). When you open that page, your browser loads the form from Tally's servers, which transmits your IP address to Tally. Tally stores data in the EU and acts as our processor.

9. Support requests

When you contact us through the form or by email, we process your email address, your name (if given), the topic, your platform and app version (if given) and your message in order to answer your request (Art. 6(1)(b) GDPR for questions about your contract or subscription, otherwise Art. 6(1)(f) GDPR). Please don't send sensitive content such as journal entries unless it's necessary.

10. Recipients and international transfers

We only share your data with the following providers, who act on our behalf:

We have data processing agreements (Art. 28 GDPR) with all providers. Netlify is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). For RevenueCat, and for any access by Supabase from Singapore or the USA, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). We don't sell data or share it for advertising.

11. Retention

• Local data: until you delete it or uninstall the app.
• Account and synced data: until you delete individual entries or your account. Our hosting provider's backups are overwritten on a rolling basis, usually within 7 days.
• Purchase and subscription data: as long as needed for the subscription, and beyond that only as required by statutory retention obligations (up to 10 years under German commercial and tax law).
• Website server logs: only briefly, according to Netlify's defaults.
• Support requests: until resolved, then at most 2 years for follow-up questions, unless statutory retention applies.

12. Your rights

You have the right to:

• access your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR). You can also export directly in the app.
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Just write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

We don't use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes

If the app or the services we use change, we'll update this policy. The date at the top shows the current version. We'll let you know about material changes in the app.

In case of discrepancies, the German version of this policy prevails.