Privacy Policy

1. Controller

Peter Hildel
Gustav-Adolf-Str. 19
90513 Zirndorf, Germany
Email: peter@hildel.com

2. Overview

Kids Bucket List is built so that your content – activities, notes, ratings and your children's profiles – stays on your device. Some features do rely on external services. This policy explains which ones, what data they process and how you can control it.

• No user account with us is required to use the app.
• Your content is stored locally and is only synchronised if you enable iCloud.
• We use RevenueCat and Apple for subscriptions, and TelemetryDeck to improve the app.
• You can disable usage analytics at any time in the app settings.

3. Data in the App

The app stores the data you enter locally on your device using SwiftData. This includes bucket list entries and activities, categories, notes, ratings and the child profiles you create (e.g. first name, colour, avatar).

We as the provider have no access to this content unless you send it to us yourself, for example in a support email. If you enable iCloud synchronisation, it is additionally stored in your personal iCloud (see section 4).

Legal basis: Art. 6(1)(b) GDPR – processing is necessary to provide the app functions you requested.

Retention: Local data remains stored until you delete it in the app or remove the app from your device.

4. iCloud Synchronisation (Apple CloudKit)

You can enable synchronisation via iCloud in the app. When active, your content is stored in your personal iCloud through Apple's CloudKit service and synchronised across your Apple devices. iCloud is operated by Apple; we have no access to the content stored there.

Legal basis: Art. 6(1)(a) GDPR – synchronisation only takes place if you enable it. You can disable it again at any time in the app; this does not affect the lawfulness of processing carried out beforehand.

Retention: determined by your iCloud settings and Apple's policies.

Further information: Apple Privacy Policy

5. Subscriptions and Purchases (RevenueCat, Apple)

We use RevenueCat (RevenueCat, Inc., USA) to manage and verify auto-renewable subscriptions.

• Data processed: a randomly generated app user ID, purchase history and the status of your entitlements, plus technical information about the app and device required to process the purchase.
• Purposes: providing the features you subscribed to, verifying entitlements, fraud prevention and analysis of subscription metrics.
• Payment data: neither we nor RevenueCat receive credit card numbers or comparable payment details. Payment is handled exclusively by Apple.
• Link to identity: in the configuration currently used we do not transmit identity attributes such as your name or email address to RevenueCat. Records are keyed solely to the randomly generated app user ID, so from our side the data is not directly linked to your identity.
• No advertising tracking: the data is not used for cross-device tracking or personalised advertising.

The purchase itself is processed through Apple's StoreKit and the App Store. Apple processes the purchase and payment data associated with your Apple Account as a separate controller.

Legal basis: Art. 6(1)(b) GDPR for performance of the subscription contract, and Art. 6(1)(f) GDPR for our legitimate interest in fraud prevention and in evaluating subscription metrics.

Retention: determined by RevenueCat's and Apple's own policies; see their privacy statements for details.

RevenueCat Privacy Policy · Apple Privacy Policy

6. Usage Analytics (TelemetryDeck)

To find issues and improve the app we use TelemetryDeck, an analytics service designed around data minimisation.

• Data processed: a pseudonymous device or installation ID, information about the app and device (such as app version, operating system version, device type, language and region) and product interactions or events, for example which views are opened.
• Not transmitted: real names and email addresses. The contents of your bucket list – such as activity titles, notes or your children's names – are not sent to TelemetryDeck either.
• Purpose: analysing usage in order to improve and stabilise the app.
• No advertising tracking: no sharing for personalised advertising and no cross-device tracking.

Objection and opt-out: you can disable usage analytics at any time in the app settings. No further analytics events are sent afterwards.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in improving and stabilising the app.

Retention: determined by TelemetryDeck's own policy; see their privacy statement for details.

TelemetryDeck Privacy Policy

7. External Search and Content Services

For the optional import of activities, the following external services may be queried:

• Open Library data catalog – for book search through a static catalog file hosted on GitHub Pages
• OMDb API – for movie and series search
• IGDB API – for game search

These requests are only made when you explicitly start a search. The search term you entered is transmitted. For technical reasons the respective service also receives connection data such as your IP address. Contents of your bucket list and your children's names are not transmitted.

Legal basis: Art. 6(1)(b) GDPR – the request is made at your explicit instruction in order to provide the search function.

8. This Website (GitHub Pages)

This landing page is hosted via GitHub Pages. When you visit this page, GitHub automatically collects server log files which may include your IP address. For more information, please see GitHub's Privacy Statement.

This website loads fonts from Google Fonts and the Tailwind CSS CDN. Loading these resources transmits your IP address to the respective providers. For details on processing by Google, see the Google Privacy Policy.

We do not use any cookies, tracking or analytics tools on this website ourselves. Your light or dark mode preference is stored only locally in your browser (localStorage) and is not transmitted to us.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the secure and technically sound operation of the website.

9. Recipients and International Transfers

Apart from the services listed above we do not share your data with third parties. Overview of the providers used:

• RevenueCat – subscription management; purchase history, app user ID
• TelemetryDeck – usage analytics; device/installation ID, product interactions
• Apple – App Store and StoreKit for purchases, iCloud/CloudKit for optional synchronisation
• GitHub – hosting of this website and of the static book catalog file
• OMDb and IGDB – only when you explicitly start a search

Some of these providers may process data outside the European Union or the EEA, in particular in the United States. Details of the safeguards applied can be found in the providers' privacy statements linked above.

10. Your Rights

Where we process personal data, you have the following rights:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

Data held only locally on your device can be deleted by you at any time in the app or by uninstalling it. For requests regarding the rights above, please contact peter@hildel.com. Because we deliberately do not identify you within the app, we may need additional information in order to locate any data relating to you.

11. Changes to This Privacy Policy

We update this privacy policy when the app, the services we use or the legal framework change. The version published here, with the date shown above, is the one that applies.