Privacy Policy

1. Controller

The controller responsible for data processing under this Privacy Policy is:

Max Gerbeth
Am Eisweiher 9
36039 Fulda, Germany
Email: info@maxmatics.de

2. General Information

The "maxmatics" app is provided by Max Gerbeth ("Provider") as a free application. This Privacy Policy informs you which personal data is processed when using the app, for what purpose, and what rights you have under the General Data Protection Regulation (GDPR).

3. What Data Is Processed?

3.1 Account and Usage Data (Sign in with Apple & Supabase)

To use features such as multiplayer, leaderboards, and cross-device sync, you sign in using Sign in with Apple. Depending on your choices in the Apple sign-in dialog, the following data may be processed and stored in a backend provided by Supabase, Inc.:

A unique user ID (UUID) generated for your account
Your email address (either your real address or an Apple-generated private relay address, depending on your choice during sign-in)
A display name (either provided by Apple, chosen by you, or a default name)
Game results, scores, leaderboard data, and daily streak/goal progress
Timestamps of game sessions (to synchronize multiplayer matches)

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract – multiplayer, leaderboards, and cross-device sync cannot function without this data).

Account deletion: You can delete your account and associated data at any time from within the app's settings. This triggers a server-side deletion process via Supabase.

3.2 Analytics and Crash Data (Apple)

The app uses Apple's built-in app analytics and diagnostic reports (App Analytics), provided you have consented to this data sharing in your iOS settings. This data is generally pseudonymized/aggregated and processed directly by Apple.

For more information, see Apple's Privacy Policy: https://www.apple.com/legal/privacy/en-ww/

Legal basis: Art. 6(1)(a) GDPR (consent, which you grant or can withdraw via your device settings).

3.3 Push Notifications

The app can schedule local reminder notifications (e.g. daily streak reminders, motivational messages) directly on your device, based on locally stored data such as your current streak and score. These notifications are scheduled and delivered entirely on-device; no notification content is transmitted to or generated by an external server.

Legal basis: Art. 6(1)(a) GDPR (consent, granted via the notification permission prompt). You can disable notifications at any time in your device's notification settings.

3.4 Automatically Collected Technical Data

Operating the app may involve technically necessary data, such as:

IP address (in the context of server communication with Supabase)
Device type and operating system version
Timestamps of requests

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the app).

4. No In-App Purchases

The app currently does not offer any in-app purchases, and no payment data is processed.

5. No Location Data

The app does not collect precise location data from your device.

6. Disclosure to Third Parties

Your data is only shared:

with the processor named above (Supabase) to provide multiplayer and leaderboard functionality,
with Apple Inc., to the extent you have consented to sharing diagnostic and usage data,
where the Provider is legally obligated to do so (e.g. by court order or government request),
where necessary to enforce legal claims, investigate fraud, or protect the rights of the Provider or third parties.

Your data is not shared for advertising purposes.

7. Data Retention

Account and game data is stored for as long as your account/profile remains active. Upon deletion of your account or upon request, this data will be deleted within a reasonable period (typically 30 days), unless legal retention obligations require otherwise.

8. Your Rights

Under the GDPR, you have the following rights:

Access (Art. 15 GDPR) to the data stored about you
Rectification (Art. 16 GDPR) of inaccurate data
Erasure (Art. 17 GDPR) of your data ("right to be forgotten")
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR), where based on Art. 6(1)(f) GDPR
Withdrawal of consent with future effect (Art. 7(3) GDPR)

To exercise these rights, contact us at info@maxmatics.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is generally that of the federal state of your habitual residence, e.g. for Hesse:

The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 3163, 65021 Wiesbaden, Germany
https://datenschutz.hessen.de

9. Data Security

The Provider takes appropriate technical and organizational measures to protect your data against loss, misuse, and unauthorized access (e.g. transmission via TLS/HTTPS, access restrictions in Supabase).

10. Children

The app is not specifically directed at children under the age of 13. If the Provider becomes aware that personal data of a child under 13 has been collected without the necessary parental consent, this data will be deleted promptly. Parents/guardians can contact info@maxmatics.de regarding this matter.

11. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time, e.g. when new features are introduced. The current version is always available within the app or at maxmatics.de.

Last updated: June 2026