Conviction

Privacy Policy for the Use of Our App

1. Controller for Data Processing (hereinafter: “we”)

Mr. Phillip Paul
Kolonnenstr. 8
10827 Berlin
Germany
E-mail: support@tryconviction.com
Phone: +49 30 43974929

Further details about us can be found in our Legal Notice.

This Privacy Policy is also available in German (Datenschutzerklärung).

Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the identity of that natural person.

The purpose of processing data is the operation of this app with information about our service offerings and contact options. Personal data is collected in our app when this is

  • necessary for the use of the app and its functions (legal basis: Art. 6(1)(b) of the General Data Protection Regulation (GDPR)),
  • necessary to safeguard our interest in improving user experience and maintaining the security of use (legal basis: Art. 6(1)(f) GDPR),
  • necessary for the use of the services offered in the app as well as for pre-contractual measures, in particular for form submissions (legal basis: Art. 6(1)(b) GDPR), or
  • necessary for entering into a contract and for performing the contract (legal basis: Art. 6(1)(b) GDPR).

Further details on the processing of data can be found below under the corresponding headings:

3. Access Data / Server Log Files

When you use our app, the servers automatically store server log files. The information includes:

  • IP address (pseudonymized)
  • Device ID (this is generated once per user via your smartphone account upon registration for use of the app)
  • Time of login in the app

No combination of this data with other data sources takes place. The information is used pursuant to Art. 6(1)(f) GDPR exclusively for the analysis and maintenance of the technical operation of the servers and the network.

4. Apple App Store / Apple Services

Our app is downloaded via the Apple App Store (provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA).

In the course of the download and use of the app, personal data may be processed by the App Store, in particular: username, e-mail address, customer number of the App Store, information about the download and payment process, device information.

In addition, our app uses various services and interfaces from Apple to provide and improve features of the app. These include in particular Sign in with Apple for authentication , Apple StoreKit , and Apple Intelligence .

In the course of the use of these features, personal data such as device information, usage data, token IDs, or account information may be processed and transmitted to Apple. The specific processing depends on the features used and your device settings.

The processing of personal data in connection with Sign in with Apple for authentication, Apple StoreKit, and Apple Intelligence is carried out pursuant to Art. 6(1)(b) GDPR for the performance of a contract, and pursuant to Art. 6(1)(f) GDPR (legitimate interest in the secure, stable, and functional provision of the app).

We have no influence on the type and scope of data collected and processed by the App Store. The processing of this data takes place exclusively within the responsibility of Apple. Further information on data processing can be found in the privacy policies at Apple at https://www.apple.com/de/privacy/.

5. Contact via E-Mail

If you send us inquiries by e-mail, your information provided there, including the contact details you provide, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions, pursuant to Art. 6(1)(b) GDPR. We never disclose this data without your consent.

6. Registration / Entered Data

To use Conviction, you need a customer account. The information required for this (mandatory information) is specified to you during the registration process. Providing this data is necessary so that we can set up the customer account for you. Via the customer account, you can maintain your profile, enter and view your journaling data and analyses, and manage your app settings. The data processing is based on the necessity of performing the contract pursuant to Art. 6(1)(b) GDPR. Your journaling data entered in the app remains encrypted on your device at all times. The recovery key is installed for you when the app is first set up. Only you have access to this key. No transmission of the data to Apple takes place. This only applies differently if you decide, pursuant to Sections 9 and 11 of this policy, to create backups and to link with Apple Health.

7. Subscriptions

The use of our app is available free of charge. Alternatively, a paid Pro version can be purchased for a one-time payment. If you purchase the Pro version, we collect your address data. The data processing is based on the necessity of performing the contract pursuant to Art. 6(1)(b) GDPR.

8. Payment Processing via In-App Purchases (StoreKit)

Payment processing is handled by us via Apple’s StoreKit. The provider of the payment processing is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (“Apple”). Payment is processed via the payment method stored with Apple (e.g., credit card, PayPal, or other payment methods accepted by Apple). We ourselves do not receive any information about your

payment data or the payment methods stored with Apple. In the course of payment processing, Apple independently processes personal data. We have no influence over this. Further information on data processing by Apple can be found in Apple’s privacy policy at: https://www.apple.com/legal/privacy/. Additional information on in-app purchases and their processing is provided by Apple at the following link: https://support.apple.com/de-de/HT202023.

The legal basis for the processing is Art. 6(1)(b) GDPR (performance of a contract), as the processing is necessary for the performance of the purchase contract.

9. Supabase for Creation of Backups and Linking with Apple Health

To provide backup and synchronization functions, for authentication via Sign in with Apple, and for the technical connection to Apple Health, we use the service Supabase from Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Supabase is used for the creation and storage of backups, provided this function is activated by the user, and for the synchronization of data in connection with the use of Apple Health when the user actively selects this. The legal basis is then your consent pursuant to Art. 6(1)(a) GDPR, Section 25(1) TDDDG, and the processing is also necessary for the fulfillment of the contractual obligation pursuant to Art. 6(1)(b) GDPR. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Supabase. Supabase Inc. is certified accordingly. Further information on data processing can be found here: https://supabase.com/privacy.

10. App Analytics (PostHog)

We use the web analytics service PostHog from the provider PostHog Inc., 2261 Market Street, #4008, San Francisco, CA 94114, USA. PostHog enables us to collect basic information about the use of our app in order to improve stability and usability. Only pseudonymized data that cannot be traced back to individual users is processed.

The creation of user profiles, cross-device tracking, or the transfer of data to third parties for their own purposes does not take place. The processing is based on Art. 6(1)(f) GDPR (legitimate interest in the improvement and stable provision of our app). Further information on data protection at PostHog can be found at: https://posthog.com/privacy.

11. Health Data

In the course of using the diary or journaling function of our app, you can voluntarily provide information about your physical or mental well-being (e.g., mood, emotions, personal thoughts, or health conditions). Such information may constitute health data within the meaning of Art. 9(1) GDPR. The content you enter is generally stored and processed exclusively locally on your device, cf. Section 6 of this privacy policy. No transmission to us or third parties takes place. Processing outside your device only takes place if you actively initiate it, e.g., by: creating a backup for synchronization with other devices. The processing of your journaling entries, insofar as these contain health data, is then carried out exclusively on the basis of your express consent pursuant to Art. 9(2)(a) GDPR. You can withdraw your consent at any time with effect for the future by e-mail to: support@tryconviction.com. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

12. Other Recipients of Personal Data

Beyond this, your personal data will not be disclosed to third parties without your express consent, unless we are legally obligated to do so within the meaning of Art. 6(1)(c) GDPR, or the data disclosure is mandatory pursuant to Art. 6(1)(b) GDPR for the performance of a contractual relationship.

We note that data transmission on the internet (e.g., in communication by e-mail) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

13. Duration of Storage

We delete your personal data immediately after the purpose has been achieved. Accordingly, we store your data from your e-mails until your inquiry has been fully processed and completed. Thereafter, the information is generally deleted. We delete your customer account and the associated information about you upon your request.

Otherwise, a review is carried out annually to determine whether the data you have stored can be deleted. Access data and server log files are deleted after one week. Insofar as we use external service providers and technical services, the storage duration of the personal data processed there is governed by the respective purposes of the processing as well as the contractual agreements with the providers. We ensure that personal data is only stored with these services for as long as is necessary for the respective purposes. Where possible, we have defined deletion periods or made corresponding restrictions on the storage duration. Further information on the storage duration can be found in the respective privacy policies of the providers used. Please note that for certain data, statutory retention obligations under commercial and tax law apply, of at least six (§ 257 HGB) or ten (§ 147 AO) years.

15. Rights of the Data Subjects

You are not legally obligated to provide your personal data. However, the provision may be necessary for entering into a contract or for functions of the app. If data is not provided, a contract or a function in the app may, in certain cases, not be offered.

There is no automated decision-making in the app; profiling does not take place. The rights of data subjects arise in particular from Articles 15 to 23 and Article 77 GDPR, as well as from Sections 32 to 37 of the German Federal Data Protection Act (BDSG-neu).

With regard to your personal data, you have the right, vis-à-vis us, to:

  • Access , Art. 15 GDPR
  • Rectification , Art. 16 GDPR
  • Erasure , Art. 17 GDPR
  • Restriction of Processing , Art. 18 GDPR
  • Data Portability , Art. 20 GDPR.

If you have given consent to the processing of personal data, you have the right of

• Withdrawal , Art. 7 GDPR

with effect for the future.

You furthermore have the right to lodge an

• Objection , Art. 21 GDPR

to the processing of your personal data.

  1. You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is carried out pursuant to Art. 6(1)(f) GDPR (data processing based on a balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

  2. In individual cases, we process personal data for the purpose of direct marketing. If this is the case for you, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. The objection can be made informally and should, if possible, be directed to us, see above under 1. If you are of the opinion that the processing of personal data concerning you violates data protection law, you always have the

  • Right to Lodge a Complaint with the competent supervisory authority, cf. Art. 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have this right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or place of the alleged infringement, if you are of the opinion that the processing of personal data concerning you violates the GDPR. The contact details of the data protection officers in the German federal states, the supervisory authorities for the non-public sector, broadcasting, the churches, in Europe and in the rest of the world, as well as of the Virtual Data Protection Office, can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

The supervisory authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin.

Last updated: