Privacy policy
Version of 26 October 2026 · applies to the iOS app GET READY and this website
This is a translation for convenience. The German version is the legally binding one.
1. Controller
Robert Zurek
Zum Reiherstand 6
14469 Potsdam
Germany
Email: support@getready-app.de
2. What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (stored only as a cryptographic hash) | Creating an account, signing in, resetting the password | Art. 6(1)(b) GDPR (performance of a contract) |
| Practice data for each task solved: module, difficulty level, the task's seed, result (correct, incorrect, partial), score achieved, time taken, practice mode, timestamp and – for behavioural tasks – the associated traits. Your answer itself is not stored – only whether it was correct. | Showing progress, adapting difficulty, calculating the competence profile | Art. 6(1)(b) GDPR (performance of a contract) |
| Usage events with timestamp and app version, and only these thirteen: that an account was created (with the sign-in route “email” or “Apple”); that three tasks were solved; that the app was started; that a practice area was opened; that a hint was opened (and whether the app offered it after two misses); that the general approach was opened; that a task was left without an answer (with the task’s identifier and how many seconds it was open, so we can see which task is too hard or unclear); that a quick test (Blitztest) or aptitude test was started; that one was finished – with the number of tasks, the number answered and the percentage of correct answers; that the purchase page was opened (with the reason, e.g. “trial tasks used up”); that a purchase was started and that it was completed (monthly or yearly, with or without free trial – no payment data); and that the ten trial tasks of a Premium area were used up. Where relevant, each with module name and difficulty level. | Recognising which tasks are too hard, too long or unclear, in order to improve the app | Art. 6(1)(f) GDPR (legitimate interest in improving the app). You may object to this processing under Art. 21 GDPR – an informal email is enough. |
| Eight counters without any personal reference: that the app was opened on a device for the first time, that someone chose “Try without an account” and solved three tasks in that mode (only up to version 1.1.1, which had a guest mode), that an account was created, that the purchase page was seen, that a free trial was started or a subscription completed, and that the trial tasks of an area were used up – each only with timestamp and app version. Without any identifier: no account, no device, no installation number. Two such entries fundamentally cannot be attributed to the same person – not even by us. | Recognising how many people open the app and leave before signing up. Without this number it's impossible to judge whether sign-up is asked for too early. | Art. 6(1)(f) GDPR (legitimate interest in improving the app), insofar as the data has any personal reference at all. So that each counter is recorded at most once per installation, the app remembers one true/false value per counter on the device; it is never transmitted and disappears with the app. |
| When signing in with Apple: a permanent identifier of your Apple account and an email address. If you choose “Hide My Email” in Apple's dialog, we receive a forwarding address from Apple instead of your real address and never learn your actual address. | Creating an account and signing in without you having to set a password | Art. 6(1)(b) GDPR (performance of a contract) |
| When signing in with Apple: a token issued by Apple that allows the link to be revoked | Solely to revoke the link with Apple first when you delete your account | Art. 6(1)(b) GDPR (performance of a contract) |
| With a Premium subscription: Apple's signed confirmation of the purchase – containing the product identifier (monthly or yearly), a subscription number assigned by Apple, the expiry date, whether the purchase was revoked, and whether it comes from the Store or a test environment. No payment data: price, payment method, billing address and your name stay with Apple; we never learn them. | Verifying that the subscription is genuine and unlocking Premium on your account – also after reinstalling | Art. 6(1)(b) GDPR (performance of a contract) |
| Technical connection data: when connecting, your device necessarily transmits its IP address to our processor Supabase (section 4). It is processed there only briefly in security and operations logs – for example to throttle sign-in attempts – and is neither evaluated by us nor linked to your account. | Operating and securing the connection | Art. 6(1)(f) GDPR (legitimate interest in secure operation) |
| Crash reports via Apple: if you have agreed in iOS settings to share analytics with developers, we receive anonymised crash reports from Apple (device type, iOS version, location in the program). Without that consent we receive nothing; we cannot trigger it. | Finding and fixing crashes | Art. 6(1)(f) GDPR (legitimate interest in a working app) |
What you have to provide: for an account we need an email address (or Sign in with Apple) – otherwise progress cannot be tied to a device. Nothing more is required. Since version 1.2 the app requires an account: only then is your progress kept, and only then can we tell from the usage events which tasks are too hard, too easy or unclear. If you sign in with Apple and choose “Hide My Email”, we never learn your real address.
Signing in with Apple is optional. The route via email and password remains available as an equal alternative. If you sign in with Apple, we store no password of yours.
The Premium subscription is concluded with Apple, not with us: the purchase runs through your Apple ID, Apple bills it, and it is cancelled in your Apple ID settings. The app only receives Apple's signed confirmation described in the table above. The subscription belongs to your Apple ID; we also record its status in your account, so Premium applies after a reinstall or on a second device without any detour.
Before you sign in, the only data the app transmits are the eight counters from the table above – each at most once, without any identifier and without content. They show how many people open the app and how many of them create an account, but not who, and not whether two counters came from the same device. Your aptitude test results and – if you switch it on – the time and days of your reminder stay on the device even with an account.
3. What we don't do
- No advertising, no ad tracking, no advertising IDs.
- No third-party analytics services. Usage events are evaluated exclusively in our own database and passed on to nobody. Only fixed identifiers such as “module opened” are recorded – never task content (only a task’s identifier), never your answers, never free text.
- No device identifier, no IP address, no location – neither in the usage events nor in the eight counters.
- No recognition before sign-in. As long as you are not signed in, you receive no identifier – not an anonymous one, not a temporary one. What we know about this phase is counts and nothing else.
- No passing on or selling of your data to third parties.
- No profiling for purposes outside the app; the competence profile serves only to steer your own practice.
- No access to location, contacts, photos, camera or microphone.
- No automated decisions with legal effect within the meaning of Art. 22 GDPR. The app does adapt the difficulty automatically to your results – but that only decides which task comes next, nothing else.
- The app is aimed at people aged 16 and over preparing for a selection procedure. We do not knowingly collect data from children; purchases run through the Apple ID and its age rules.
3a. What stays stored on your device
The app stores on the device only what it needs to run – your account session, your language and appearance choice, goal and career, the subscription status, your aptitude test results, the time and days of your reminder, how many trial tasks per Premium area have been used, which milestones have already been shown, whether you were asked for a rating, the markers for the eight counters, and a queue of practice data not yet transmitted. None of it is read to recognise you outside the app, and none of it is advertising or tracking. This storage is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG, the German implementation of the ePrivacy Directive); no consent is therefore required. Deleting the app removes all of it.
3b. Reminders
If you switch on a reminder in the app, iOS asks once for permission to show notifications. The app schedules reminders only on your device (local notifications): no push service is involved, and neither the time nor the text is transmitted to us or anyone else. You can switch them off in the app at any time or withdraw the permission in the iOS settings.
4. Processors
For accounts and storage we use Supabase (Supabase, Inc., USA; Postgres database and authentication). The servers are located in the Frankfurt am Main region, Germany. A data processing agreement under Art. 28 GDPR is in place with the provider; should Supabase access data from the USA for support or maintenance, the EU standard contractual clauses apply.
The app's emails – address confirmation, password reset, notices about changes to the account – are sent on our behalf by Brevo (Sendinblue SAS, Paris, France). For this Brevo receives your email address and the content of the respective email and processes them on servers in the EU; a data processing agreement under Art. 28 GDPR is in place. We do not send marketing emails.
If you use Sign in with Apple, data is exchanged between your device, Apple and us. Apple acts as an independent controller (for users in the EU: Apple Distribution International Ltd., Cork, Ireland); what data Apple itself processes is governed by Apple's own privacy policy.
The app is distributed, and the Premium subscription billed, through Apple's App Store. What data Apple collects in doing so – such as your payment details – is governed by Apple's own privacy policy; we have no influence over it and do not receive that data.
5. Retention
We keep your data for as long as your account exists. If you delete your account, the account and all practice data are deleted immediately and irrevocably – including the usage events, the subscription confirmation and, if present, the Apple token. The subscription itself does not end with that: it exists with Apple and continues until you cancel it in your Apple ID settings.
One exception that cannot be avoided: the eight counters without personal reference from the table above remain when an account is deleted. They carry no identifier – so there is nothing by which they could be attributed to your account, and therefore nothing by which they could be deleted individually. That is precisely the price of collecting them without any personal reference at all. The database deletes them automatically once they are older than 400 days. They reveal only how many people have tried the app in total, never who.
6. Deleting your account
Deletion is possible directly in the app: Account → Delete account permanently. No contact with support is needed. Alternatively, an informal email to the address above is enough.
If you signed in with Apple, we first revoke the link with Apple and only then delete your account with all practice data. The token stored for this purpose is deleted along with it. As a result, the app also disappears from your Apple settings under “Sign in with Apple”.
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). To exercise them, contact the address above; we reply within one month.
Right to object (Art. 21 GDPR): where we process data on the basis of a legitimate interest – the usage events, the technical connection data and the crash reports – you may object at any time on grounds relating to your particular situation. An informal email to the address above is enough. We will then stop processing the data concerned unless there are compelling legitimate grounds that override your interests.
You may also lodge a complaint with a data protection supervisory authority – for example the one responsible for us: Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, lda.brandenburg.de. We have not appointed a data protection officer; the statutory thresholds are not met.
8. This website
The website getready-app.de is served via GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit it, your browser necessarily transmits your IP address; GitHub processes it together with the time, the page requested and browser details in server logs in order to deliver and secure the site. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, available website). For transfers to the USA, GitHub relies on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses; details are in GitHub's privacy statement. The website sets no cookies, loads no fonts or scripts from third-party servers and uses no analytics.
9. Changes
If the data processing changes, we update this policy and adjust the date above.