Privacy Policy

Last updated: 6 November 2026

1. Controller

Janek Bieler Paul-Schallück-Straße 11 50939 Köln Deutschland Email: kontakt@quapp-app.de

2. What data we process

• Account: a random user ID; for email accounts your email address and password; for “Sign in with Apple” the identifier and email address provided by Apple (possibly an anonymous relay address from Apple) and, on first sign-in, your first name. • Profile: your player name. • Your content: decks, cards, values and images you upload. • Games: lobbies, moves, results and your stats. • Reporting and blocking: whom or what you report or block, and who reports or blocks you. • Notifications: a push token of your device, if you allow notifications. • Technical data: accessing our servers creates log data (e.g. IP address, time, device type). • Contact: if you email us, we process your address and the content to reply to you.

3. Purposes and legal bases

We process data to provide the app – account, decks, sharing and playing (Art. 6(1)(b) GDPR). We process reports, blocks and log data to run the app securely, prevent abuse and establish or defend legal claims (legitimate interest, Art. 6(1)(f) GDPR). We only send push notifications if you allow them on your device. Where legally required, we disclose data to authorities (Art. 6(1)(c) GDPR).

4. Who sees the data

Other players see your player name and the cards revealed during a game. Anyone who knows the link or code of a deck sees the deck with its images and your player name as the creator. Service providers processing data on our behalf (Art. 28 GDPR): Supabase Inc. for database, sign-in and image storage (servers in the EU), Resend (Plus Five Five, Inc.) for sending emails such as confirmation codes, ImprovMX for forwarding emails to our contact address, 650 Industries Inc. (Expo, USA) and Apple for delivering push notifications. If you use “Sign in with Apple”, Apple’s privacy policy also applies. Where data is transferred to countries outside the EU, this is based on an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses.

5. Retention

We keep data as long as your account exists and the data is needed for the purposes above. If you delete your account, we delete your profile, decks and images. In other players’ games the game history and the deck content used there remain, without your player name. We usually delete reports after one year, and images no longer belonging to any deck or game usually after 30 days. We only keep data longer where required by law or needed to clarify legal violations.

6. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Contact us at the email address above. You can delete your account yourself in the app. You can also lodge a complaint with a data protection supervisory authority.

7. Minimum age

The app is intended for people aged 13 and over. Anyone under 16 needs their parents’ consent.

8. Changes

We update this privacy policy when the app or the legal situation changes. The version available in the app applies.