Privacy Policy

Last updated: August 2026

1. Scope

This privacy policy applies to the website buergerblitz.de and to the mobile app "BürgerBlitz" (the "App"). It explains the nature, scope and purpose of the processing of personal data.

2. Your rights as a data subject

Under the GDPR you have the following rights:

To exercise these rights, an informal message to the contact address provided below is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR).

3. Data processing on the website

3.1 Hosting and server log files

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) via the "Cloudflare Pages" service. When the website is accessed, technically necessary data (including IP address, date and time of the request, the file requested, volume of data transferred, browser type and operating system) is processed to deliver the page and ensure its security and stability.

The legal basis is our legitimate interest in providing a secure and functional website (Art. 6(1)(f) GDPR). As Cloudflare is based in the USA, a transfer to a third country may occur; it is safeguarded by appropriate measures (EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework).

3.2 Fonts and rendering

The fonts used and the CSS framework are served directly from our own server (self-hosted). No data is transmitted to third parties for this and no external content delivery networks are used.

3.3 Cookies and reach measurement

We set technically necessary cookies only where they are required to operate the website (Art. 6(1)(f) GDPR). Cookies and comparable technologies for statistics and advertising are set exclusively after your explicit consent given via our cookie banner (see section 3.4). You can change your choice at any time via the "Cookie settings" link in the footer.

Independently of cookies, to analyse website usage statistically we use Cloudflare Web Analytics, a privacy-friendly analytics solution provided by our host Cloudflare. Collection is cookieless and does not recognise individual visitors; no personal usage profiles are created and no data is shared with third parties for advertising. Only aggregated data is processed, such as the pages viewed, the referrer source, the approximate geographic region and technical performance metrics (e.g. load times).

The legal basis is our legitimate interest in the statistical analysis of website usage (Art. 6(1)(f) GDPR). The processing is carried out by Cloudflare; the safeguards described in section 3.1 apply to any transfer to the USA.

3.4 Google Analytics and Google Ads (only with consent)

Only with your consent do we use Google Analytics 4 and Google Ads (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). They are loaded via Google Tag Manager.

We use Google Consent Mode v2: before your consent none of these cookies are set and only limited signals that cannot be used to recognise you are sent to Google. The services listed above are fully activated only after your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You can withdraw or change your consent at any time with effect for the future — via the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing carried out up to that point.

As Google also processes data in the USA, a transfer to a third country may occur; it is safeguarded by appropriate measures (EU Standard Contractual Clauses and/or EU-US Data Privacy Framework). For more information see Google's privacy policy: https://policies.google.com/privacy.

4. Data processing in the App

4.1 Data stored locally

Your learning progress and settings are stored exclusively on your device and are not transmitted to us. No user account is required; we collect neither names nor email addresses.

4.2 Usage statistics and crash reports (only with consent)

Only if you explicitly consent after first launch do we collect anonymous usage statistics and crash reports to improve the App. For this purpose we use:

The data processed includes in particular: an anonymous, randomly generated device/installation identifier, your device's advertising ID, app version and build number, platform (e.g. Android/iOS), aggregated usage events (e.g. number of active days, reaching learning goals) and technical crash diagnostics. The advertising ID is processed by Firebase Analytics for analytics purposes; for its use to display ads, see section 4.3. No real names, email addresses or contact details are collected.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future — in the App under "Settings → Share usage data". After withdrawal, no further statistics or crash data are transmitted.

As the providers named above are based in the USA, a transfer to a third country may occur; it is safeguarded by appropriate measures (EU Standard Contractual Clauses and/or EU-US Data Privacy Framework).

4.3 Advertising (Google AdMob)

The App is free to use, and to support that we occasionally show full-screen ads (interstitials) between questions. For this we use Google AdMob (Google Mobile Ads SDK; Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Google also receives access to your device's advertising ID via our AdMob account to serve and bill the ads (Art. 6(1)(f) GDPR — our legitimate interest in funding the free App).

On first launch, we ask users in the European Economic Area (EEA), the UK and Switzerland to consent to personalized advertising via a consent form (Google User Messaging Platform / UMP). Only with this consent does AdMob process the advertising ID and technical identifiers (e.g. IP address, device type) to serve personalized ads; without consent, or outside that scope, only non-personalized ads based on non-personal contextual information are served.

The legal basis for personalized ads is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time via the consent form in the App. As Google also processes data in the USA, a transfer to a third country may occur; it is safeguarded by appropriate measures (EU Standard Contractual Clauses and/or EU-US Data Privacy Framework). More information: https://policies.google.com/privacy.

If you'd rather use the App without ads, you can remove them permanently with a one-time purchase (see section 4.4).

4.4 In-app purchase (ad-free)

The one-time purchase to permanently remove ads is processed through the respective app store (Apple App Store or Google Play). Payment processing and the associated data are handled exclusively by Apple or Google; we do not receive any payment data.

4.5 Feedback (voluntary)

In the App you can send us a rating of one to five stars and, optionally, a message via the feedback function (megaphone icon on the home screen). The transmission happens solely at your initiative, i.e. only once you tap “Feedback senden” (send feedback). Nothing is transmitted without your action.

The data transmitted is: the star rating, your optional free text, app version and build number, the platform (e.g. Android/iOS), the Bundesland selected in the App, your learning progress as figures (number of questions mastered and the total), the number of days you have used the App, whether the ad-free option has been purchased, and a randomly generated installation identifier. That identifier is neither the advertising ID nor a device identifier; it is regenerated on reinstall and serves only to relate several submissions from the same installation to one another. We ask you not to include personal data in the free text.

For storage we use Google Cloud Firestore (Firebase; Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). The storage location is the europe-west3 (Frankfurt am Main) region, so the data is stored in the European Union. In addition, Firebase App Check verifies whether a submission originates from a genuine, unmodified installation of the App; this serves solely to protect against abusive submissions.

The purpose of the processing is to improve the App and to handle bug reports. The legal basis is our legitimate interest in improving the App (Art. 6(1)(f) GDPR) or, where you submit a request to us, handling that request (Art. 6(1)(b) GDPR). The transmission is independent of your consent to usage statistics (section 4.2): we transmit your feedback even if you declined statistics collection, because you initiate the transmission yourself. Your free text is not transmitted to Mixpanel or Firebase Analytics.

We delete feedback submissions no later than 24 months after receipt.

5. Storage period

Server log files are stored only for as long as necessary to ensure operation. Anonymous statistics and crash data are stored and processed in accordance with the default settings of the services used, for as long as necessary for the stated purposes or until consent is withdrawn. Locally stored data remains on your device until you delete it or the App. Feedback submissions (section 4.5) are deleted no later than 24 months after receipt.

The controller for the data processing described here and operator of this service is Greg Kazmierczak, Hohenbrunnerstr. 19, 81825 Munich, Germany, reachable at [email protected].

6. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The new version will apply to your next visit.