PRIVACY POLICY
App: Rettungssanitäter Prüfung 2026
Last updated: 1 September 2026
1. CONTROLLER
Email: labskiro@gmail.com
Please use the address above for any privacy question or to exercise your
rights. We have not appointed a data protection officer, as the statutory
thresholds for doing so are not met.
2. THE PRINCIPLE: YOUR STUDY DATA STAYS ON YOUR DEVICE
The app needs no account. There is no sign-up, no email address and no name.
Everything you produce while studying is stored only in the app's local
database on your device:
- the questions you answered and whether each answer was right or wrong
- your mistake list and your bookmarks
- the review schedule of the spaced-repetition algorithm
- the exam simulations you took and their results
- your streak, your progress and your settings
- your chosen interface language, your chosen federal state and your reminder
time
None of this is transmitted to us or to anyone else. We have no access to it at
any time. There is no cloud sync and no backup on our servers. Uninstalling the
app removes this data through the operating system's own mechanisms.
Please note: if you have your operating system's device backup switched on
(Google One Backup or iCloud Backup), that backup may include app data. It
takes place between you and Google or Apple; we are not involved and have no
access to it.
3. PROCESSING ACTIVITIES IN DETAIL
3.1 Providing the app and storing data on your device
Purpose: running the app, storing your study progress, your settings and the
downloaded learning content.
Data: as described in section 2. Processing is purely local.
Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract), and
section 25(2) no. 2 TDDDG for storing data on your device, as this is strictly
necessary for the service you explicitly requested.
Retention: until you uninstall the app or reset your data inside the app.
3.2 Usage analytics with Google Analytics for Firebase
Purpose: to understand which parts of the app are used, where learners drop
off, and whether a change made the app better or worse. The analysis is
aggregated and pseudonymous; we do not build profiles of individuals and we do
not identify individual users.
Data: a randomly generated, pseudonymous app instance ID; in-app events (for
example: a chapter was opened, a learner moved from a chapter into practice, an
exam simulation was started or finished); technical information about the
device and the app (device model, OS version, app version, language setting,
approximate region derived from the IP address). Analytics never carries
content you entered, names, email addresses or health data.
Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland, and Google LLC, USA, as processors under a data processing agreement
pursuant to Art. 28 GDPR.
International transfers: processing in the United States cannot be ruled out.
Google LLC is certified under the EU-US Data Privacy Framework; in addition,
the European Commission's Standard Contractual Clauses apply under
Art. 46(2)(c) GDPR.
Legal basis: [your choice - see the note at the end of this document]
Art. 6(1)(a) GDPR (consent), which you give on first launch and can withdraw at
any time.
Retention: Google deletes event data after two months by default, and after 14
months at the latest.
Withdrawal: you can switch analytics off at any time in the app's settings
under "Mehr". Withdrawal takes effect for the future; it does not affect the
lawfulness of processing carried out beforehand.
Further information: https://firebase.google.com/support/privacy and
https://policies.google.com/privacy
3.3 Firebase Remote Config
Purpose: Remote Config lets us adjust the app's settings without shipping an
update - which topics are free, whether a minimum version is required, and when
new learning content is available.
Data: fetching the configuration transmits a pseudonymous Firebase installation
ID together with technical information about the device, the operating system
and the app version. Your IP address is processed because it is technically
necessary to establish the connection.
Recipients and international transfers: as in section 3.2.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest
is delivering the app in a secure, current and functional state and being able
to detect outdated versions.
Retention: the installation ID is deleted when you uninstall the app.
Please note: this function is required for the app to operate and cannot be
switched off. It transmits no study data and no answers.
3.4 Buying the full version (in-app purchase)
Purpose: unlocking the complete question bank and exam simulations after a
one-time purchase, and restoring an existing purchase on another device.
How it works: the purchase is handled entirely by Apple's App Store or the
Google Play Store. Your payment details are processed there; the app never
receives them and never stores them. Apple and Google are independent
controllers for the payment itself.
Entitlement management: to check whether a purchase exists, we use RevenueCat
(RevenueCat, Inc., 833 Market Street, San Francisco, CA 94103, USA). This
involves an anonymous user ID generated by the app, the receipt issued by the
store, the store country, and technical information about the device and app
version. No names, addresses or payment methods are transmitted.
International transfers: RevenueCat processes data in the United States, on the
basis of a data processing agreement under Art. 28 GDPR and the European
Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR.
Legal basis: Art. 6(1)(b) GDPR (performance of the purchase contract).
Retention: for as long as the entitlement exists, and beyond that within the
commercial and tax retention periods of the stores involved.
Further information: https://www.revenuecat.com/privacy
3.5 Daily study reminder
Purpose: if you want it, the app reminds you once a day at a time you choose.
Data: the time you chose and the scheduling of the notification. Both stay
entirely on your device. These are local notifications; no push messages are
sent from our servers, and no push token is transmitted to us or to anyone
else.
Legal basis: Art. 6(1)(a) GDPR (your consent, given when you allow
notifications).
Withdrawal: at any time in the app's settings or in your device's system
settings.
3.6 Translation
Inside a chapter you can invoke a translation. The passage in question is
handed through a system interface to whichever translation app is set up on
your device - for example Google Translate or Apple's translation feature. We
do not operate that service and we do not send the content to a translation
provider ourselves; the processing takes place between you and the provider of
the app you chose, under that provider's privacy terms. It happens only when
you explicitly trigger it.
Legal basis: Art. 6(1)(a) GDPR (your consent, given by explicitly invoking it).
3.7 Sharing and rating
If you use "Share app", the link to the app is handed to your operating
system's share sheet; where it goes next is your decision. "Rate app" opens the
app's page in the relevant store. We collect no personal data in either case.
3.8 Contacting us by email
If you write to us, we process your email address and the content of your
message in order to answer it.
Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries, otherwise
Art. 6(1)(f) GDPR (our interest in answering enquiries).
Retention: until the enquiry has been dealt with, and beyond that only within
statutory retention periods.
4. WHAT THE APP DOES NOT DO
- It requires no account and no registration.
- It shows no advertising and embeds no ad networks.
- It sells no data and shares no data for advertising purposes.
- It uses no cross-app advertising identifiers for tracking across companies,
and therefore shows no App Tracking Transparency prompt on iOS.
- It does not access location, camera, microphone, contacts, calendar, photos
or health data.
- It collects no health data about you. The medical content in the app is
study material, not information about you.
5. RECIPIENTS AND PROCESSORS AT A GLANCE
Google Ireland Limited / Google LLC - analytics and configuration (Firebase)
Apple Inc. or Google Ireland Limited - app distribution and payment processing
RevenueCat, Inc. - purchase entitlement management
Beyond this we disclose data only where we are legally obliged to do so or
where it is necessary to enforce our rights.
6. YOUR RIGHTS
Under the GDPR you have the right to
- request access to the data we process about you (Art. 15),
- request its rectification (Art. 16),
- request its erasure (Art. 17),
- request restriction of processing (Art. 18),
- receive your data in a portable format (Art. 20),
- object to processing based on legitimate interests (Art. 21), and
- withdraw any consent at any time with effect for the future (Art. 7(3)).
A practical note: because the app keeps no account and your study data lives
only on your device, we are generally unable to identify you from the
pseudonymous data available to us (Art. 11 GDPR). You can erase your study data
completely by uninstalling the app or by resetting your progress in the
settings.
You also have the right to lodge a complaint with a supervisory authority, in
particular the authority where you habitually reside or the one responsible for
us:
[Competent German state data protection authority, address and website]
7. MINIMUM AGE
The app is aimed at people in Rettungssanitäter training and is not intended
for children under 16. We do not knowingly collect data from children under 16.
8. DATA SECURITY
All transmissions to the services named above are encrypted with TLS. Study
data never leaves your device and is protected by the operating system's
application sandbox.
9. CHANGES TO THIS POLICY
We update this policy when the app or the legal situation changes. The version
published on this page is the one that applies. The date under "Last updated"
shows the most recent change.