Privacy­Policy

1Who we are

Heldenzeit is operated by DHX LLC. We are the controller for the personal data described in this policy, and the "operator" within the meaning of the US Children's Online Privacy Protection Act (COPPA).

2Our principles

We process personal data only where it is technically necessary, and we hold to the following:

• Data minimisation: we collect only what we actually need.
• Purpose limitation: data is used only for the purpose it was collected for.
• No personalised advertising: ads in the parent area are strictly non-personalised. There is no ad targeting based on your data and no remarketing. No advertising is shown in kiosk mode, which children use.
• No sale of data: we do not sell personal data to anyone.
• Protection of children: children's data is handled with particular care.

3What data we process

3.1 When you visit the website (heldenzeit.app)

Our hosting provider records technical access data (IP address, time of access, page requested, browser and operating system) in server logs. We do not use tracking cookies, Google Analytics or advertising pixels on this website. The only cookie we set is one that remembers your language choice.

3.2 In the app (de.heldenzeit.app)

About child profiles: we do not need email addresses, surnames or photographs for children. A first name or a nickname is enough — the parent decides what is entered.

3.3 When you contact us

If you email us, we process your address and the content of your message in order to reply, and we keep it only as long as needed for that purpose.

4Children's privacy (COPPA & GDPR Art. 8)

Heldenzeit is a family app. The account always belongs to a parent or legal guardian; children do not register themselves and cannot create an account.

What we collect about a child

Only what the parent enters: a first name or nickname and a chosen avatar, plus the tasks, point balances and redemptions that arise from using the app. We do not collect a child's surname, email address, telephone number, photographs, voice recordings, precise location or persistent identifiers for advertising purposes.

Parental consent

A parent creates the account, sets up the child profile and enters the child's name. Setting up a child profile constitutes the parent's consent to processing that data for the purpose of operating the app. We do not condition a child's participation on the disclosure of more personal information than is reasonably necessary.

Rights of parents

• Review: parents can see all data of a child profile in the app at any time.
• Correct: names, avatars, tasks and rewards can be edited at any time.
• Delete: a child profile can be deleted individually, and the whole account including all children can be deleted under Settings → Delete account, or at heldenzeit.app/konto-loeschen.
• Refuse further collection: deleting the profile or the account ends any further collection. You may also write to us at fragen@heldenzeit.app.

No advertising directed at children

No advertising is shown in kiosk mode, which is the part of the app children use, and no data is transmitted to third parties there. Ads appear only in the parent area, which sits behind the parent account. All ad requests are marked as child-directed and as subject to the age of consent, are strictly non-personalised, and are limited to the "General audiences" content rating. We do not carry out behavioural advertising or remarketing towards children.

Where data is held

All app data is stored on servers in the European Union (Frankfurt, Germany).

5Purposes and legal bases

6Sharing with third parties

As a rule we do not pass personal data to third parties. The exceptions are:

• Technical infrastructure: we use Supabase for authentication and database storage, on servers in the European Union. The provider acts as a processor and may not use the data for its own purposes. A data processing agreement under Art. 28 GDPR is in place.
• Google Play: downloading the app through the Google Play Store is subject to Google's own privacy terms, over which we have no influence.
• RevenueCat: subscription status and purchase history are processed in order to unlock Premium features.
• Google AdMob: see section 7 below.
• Legal obligation: data may be passed to authorities where we are legally required to do so or to prevent a criminal offence.

Transfers to the United States: our company (DHX LLC) and some service providers are based in the USA. Transfers take place on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) or other appropriate safeguards. We will provide the relevant documents on request.

7Advertising

In the parent area of the app we show interstitial ads via Google AdMob (Google Ireland Limited). This transmits the Android advertising ID, IP address and device information to Google in order to serve ads and prevent fraud.

• Ad requests are marked non-personalised — no profiling, no remarketing.
• They are marked as child-directed (COPPA) and as subject to the age of consent (GDPR).
• Ad content is limited to the "General audiences" (G) rating.
• No ads are shown in kiosk mode.
• Premium members see no ads at all, and no ad request is made for them.

Within the European Economic Area we obtain your consent through Google's consent dialogue before the first ad request (Art. 6(1)(a) GDPR). Without consent no ads are loaded. You can withdraw your consent at any time by clearing the app's data or by contacting us. Further information: Google's privacy policy.

8How long we keep data

• Account and family data: until you delete the account.
• Child profiles: until the profile or the account is deleted.
• Task photos: deleted immediately once a parent approves or declines the task.
• Server logs (website): a few days, then automatically deleted.
• Billing records: as required by applicable tax law.

After you delete your account, your data is removed within 30 days.

9Your rights

Under the GDPR you have the right to:

• Access (Art. 15): ask what data we hold about you.
• Rectification (Art. 16): have inaccurate data corrected.
• Erasure (Art. 17): have your data deleted.
• Restriction (Art. 18): have processing restricted.
• Portability (Art. 20): receive your data in a machine-readable format.
• Object (Art. 21): object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)): withdraw a consent you have given at any time.

Parents additionally have the COPPA rights set out in section 4. To exercise any of these, write to fragen@heldenzeit.app — we reply within 30 days. You also have the right to complain to a data protection authority.

10Security

All data is transmitted over encrypted connections (TLS) and stored encrypted. Passwords are never stored in plain text. Access to production systems is restricted and logged. The parent area of the app can additionally be protected with a PIN so that children cannot leave kiosk mode.

11Changes to this policy

We update this policy when the app changes or the legal position does. The current version always applies and carries the date shown at the top of this page. For significant changes affecting children's data we will inform parents in the app.

12Contact

For questions about privacy, to exercise your rights, or about how we process data, reach us at: