Privacy Policy

1. Controller

Deen Labs GmbH
Propsteistraße 3
65795 Hattersheim am Main
Germany

Email: [email protected]

We have not appointed a Data Protection Officer because there is currently no legal requirement to do so.

2. Data we process and purposes

• Website technical data: server and security log data required to deliver the website and protect infrastructure.
• App session, installation, and settings data: anonymous account/session identifiers, installation identifiers, language, age band, app preferences, and entitlement status.
• Notification and reminder data: if you enable optional story updates or daily reminders, we process notification-related data such as device or installation registration data, push token, platform, app version, permission status, language, enabled notification preferences, and reminder preference data such as enabled state, local reminder time, timezone, and quiet-hours preference.
• Purchase and entitlement data: product IDs, transaction metadata, entitlement state for the one-time Full Library purchase, and restore-purchase results.
• Child profiles (stored on your device only): if you create profiles in the Parent Area, their nickname, avatar, age band, language, progress, favorites, and bedtime queue stay in local storage on your device. They are not sent to our servers, not included in analytics events, and are removed when you delete the profile or the app.
• Diagnostics and analytics data: anonymous usage, performance, warning, and crash data in the app, subject to your settings. Analytics and diagnostics controls are available in the app settings.
• Support communication data: information you send to us when you contact support or request deletion/rights handling.

3. Legal bases (Art. 6 GDPR)

• Art. 6(1)(b) GDPR: providing the app/service, offline content, reminders, and purchase functionality.
• Art. 6(1)(a) GDPR: consent-based processing where required, in particular for optional notification permissions and similar optional device-level permissions.
• Art. 6(1)(c) GDPR: compliance with legal obligations (for example tax/commercial retention duties).
• Art. 6(1)(f) GDPR: legitimate interests in security, fraud prevention, product stability, service improvement, and keeping installations and app features functioning reliably.

4. Recipients and processors

Depending on your use of the service, personal data may be shared with the following categories of recipients/processors:

• Hosting and infrastructure providers.
• Google Firebase (Google Ireland Limited / Google LLC): Cloud Messaging for push notifications, Analytics for anonymous usage statistics, and Crashlytics for crash reports.
• RevenueCat, Inc.: purchase and entitlement management for the Full Library.
• Payment and billing platform operators (such as app store operators).
• Public authorities, advisors, or courts where legally required.

Where required, data processing agreements are in place. Specific recipient identities are disclosed on request where legally required.

5. International data transfers

Some providers, including Google Firebase and RevenueCat, may process data outside the EU/EEA. Where this happens, we use appropriate safeguards, such as adequacy decisions and/or EU Standard Contractual Clauses.

6. Retention

• Operational/session and installation data is retained only as long as necessary for service operation, security, and support.
• Reminder and notification preference data is retained while needed to provide the relevant optional feature and may be cleared when you disable the feature, reinstall the app, or request deletion, subject to legitimate operational needs.
• Analytics and diagnostic data is retained according to the retention settings and limits of the relevant analytics/diagnostics systems and our internal operational needs.
• Support and rights-request data is retained as required to resolve the request, document compliance, and prevent abuse or duplicate processing.
• Legally required records (for example billing/tax-relevant records) are retained according to statutory retention periods.

7. Children and parents

Anbiya is designed for family use. Children should use the app under parental/guardian supervision. Rights requests regarding child-related use can be submitted via [email protected].

8. Your rights

Under GDPR, you may have the right to access, rectification, erasure, restriction, data portability, and objection, as well as the right to withdraw consent at any time for consent-based processing.

To exercise your rights, contact [email protected]. We target completion of account deletion requests within 30 days, subject to legal retention obligations and the fact that some data may be held under pseudonymous guest or installation-based identifiers rather than a traditional named account.

9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. For our registered office, this is generally the Hessian supervisory authority.

10. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or product changes. The current version is always published on this page.