Privacy Policy

01Controller and contact

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR / DSGVO) for the processing described here is:

Levin David Schwab
Sole proprietor (Einzelunternehmer), Germany
Email: levin.schwab@gmx.de

A postal address for written correspondence is supplied on request to the email address above. No data protection officer has been appointed, because the statutory thresholds of Art. 37 GDPR and § 38 BDSG are not met; enquiries reach me directly at the address above.

02Data processed by the app itself

Everything you enter into CO2Scape, meaning tank profiles, carbonate hardness, pH, temperature, substrate and additive declarations, the readings you save, the sessions you log and your app settings, is written to the app’s own storage on your device using Apple’s SwiftData persistence layer. This data:

• is not transmitted to me or to any third party by the app,
• is not synchronised to a cloud service by the app,
• is not readable by me under any circumstance, since no copy exists outside your device,
• is removed together with the app when you delete it from the device.

None of it is sent anywhere by the app. It integrates no analytics service of mine, no attribution component and no crash reporting SDK, and it offers no account, no login and no synchronisation. I therefore do not process this content data at all in the sense of the GDPR; it remains under your sole control on your own equipment.

Two things do use the network, and neither of them touches the data above. Apple’s own App Store and StoreKit infrastructure delivers the app, its updates and the in-app purchase described in section 04. And the free version shows advertising, which is described in section 03.

03Advertising in the free version

The free version of CO2Scape shows advertising. It appears as a banner on the Tools and History screens, and as one full screen advert after a degassed sample has been taken over as a baseline. It never appears on a result and never on a running timer. CO2Scape Pro removes the advertising entirely.

The adverts are delivered by the Google Mobile Ads SDK. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users in the European Economic Area, the United Kingdom and Switzerland, and Google LLC elsewhere. To fill an advert slot, Google receives technical data from the device such as an IP address, device and operating system characteristics and, if you allow it, an advertising identifier.

Your consent comes first. Before the advertising kit is started at all, the app shows Google’s User Messaging Platform consent form, and iOS then asks its own App Tracking Transparency question. Only after that does any advert load. The legal basis is your consent, Art. 6(1)(a) GDPR, and you may withdraw it at any time with effect for the future: open Settings inside the app and choose Advertising privacy choices. Buying CO2Scape Pro removes the advertising altogether.

Google’s own processing is described at policies.google.com/privacy and, for advertising specifically, at business.safety.google/privacy. Beyond Google’s advertising kit I use no analytics service, no attribution SDK, no crash reporting service of my own, and no newsletter or messaging system.

04In-app purchase and Apple

CO2Scape Pro is purchased through Apple’s in-app purchase system. The contract for that purchase is concluded with Apple; Apple handles payment, invoicing, tax and refunds. I receive no payment details, no name, no billing address and no email address of a purchaser.

The app verifies the purchase through Apple’s StoreKit interface on the device, which is what enables the purchase to be restored on your other devices signed in to the same Apple Account and, if enabled, shared through Family Sharing. From App Store Connect I receive only aggregated, anonymous sales and download statistics that permit no conclusion about individual persons. Apple’s processing is described in the Apple Privacy Policy at apple.com/legal/privacy.

05Notifications

The app can set two kinds of local reminder, and only if you start them yourself: a nudge at the interval you choose while a pH session is running, and one when a degassing sample has finished. iOS asks for your permission the first time either is started, and declining costs you nothing else. The session and the degassing timer both keep working, they simply do not call you.

These are local notifications. They are scheduled by the app on your device and delivered by iOS from the same device. They travel over no network, they reach no push server, neither Apple’s nor mine, and the app holds no push token. Their text contains no reading and no tank name. Stopping the reminders in the app, or turning notifications off for CO2Scape in the Settings app, removes the pending ones.

06Crash and performance data

The app contains no crash reporting SDK. If you have enabled “Share with App Developers” in iOS under Settings → Privacy & Security → Analytics & Improvements, Apple may make aggregated crash and energy statistics available to me through App Store Connect. These reports are generated and aggregated by Apple; they contain no data that identifies you, and I have no way of connecting them to a person or device.

07This website

These pages are static. They set no cookies, and they embed no fonts, images or scripts from third party domains. Nothing on this site is loaded from a domain other than the one you are reading.

The pages do use Vercel Web Analytics, a measurement service of the hosting provider named below. It runs from this same domain, sets no cookie, stores nothing on your device and builds no cross site profile. It counts page views and records when a visitor follows a link to the App Store, together with which button on the page was used. The purpose is to see which pages actually help someone find the app; the legal basis is my legitimate interest in understanding that, Art. 6(1)(f) GDPR. No visitor is identified and no data from it is combined with anything else.

The site is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, and its European affiliate. As is technically unavoidable for any web server, the hosting provider processes access data when a page is requested: IP address, date and time of the request, the requested path, HTTP status, referrer and user agent. This serves the delivery of the page and the security and stability of the service; the legal basis is my legitimate interest in providing this site securely, Art. 6(1)(f) GDPR. These logs are held by the provider for a short period and are not merged with other data or used to profile visitors.

If you write to me by email, your address and the content of your message are processed for the purpose of answering you, on the basis of Art. 6(1)(b) or (f) GDPR. Correspondence is deleted once it is no longer required and no statutory retention obligation applies.

08Children

The app is a technical tool for aquarium keepers and is not directed at children. I do not knowingly process personal data of children under 16 years of age. If you believe a child has used the app in a way that involved such processing, please contact me and I will look into it, noting that content data never leaves the device in the first place.

09Transfers outside the EU/EEA

Nothing you enter into the app is transferred to anyone. A transfer can arise in three contexts described above: the advertising in the free version (section 3), the hosting and measurement of this website (section 7) and Apple’s handling of distribution and payment (section 4), each of which involves companies in the United States. Such transfers are based on the adequacy decision of the European Commission of 10 July 2023 for the EU and US Data Privacy Framework, where the recipient is certified under that framework, and otherwise on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR together with supplementary measures. Despite these safeguards, it cannot be ruled out that authorities in a third country access such data, and that the level of protection there differs from that within the EU.

10Storage duration

• App content on your device: for as long as you keep it. It is erased when you delete the entries or the app.
• Data held by me from your use of the app: none exists, so no retention period applies.
• Server logs of this website: short-term, as set by the hosting provider.
• Email correspondence: deleted when the matter is settled, subject to statutory retention obligations.

11Your rights under the GDPR

In relation to personal data concerning you, you have the following rights:

• Access to the data processed about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR),
• Objection to processing based on legitimate interests, including profiling, on grounds relating to your particular situation (Art. 21 GDPR).

To exercise any of these, write to levin.schwab@gmx.de. Please note an inherent limitation: I hold essentially no data about you. Your measurements are on your device and unreachable for me; what remains on my side is the short-lived server log of this website and any email you have sent me. Data connected with a purchase sits with Apple under Apple’s own responsibility, and data connected with advertising sits with Google. Where a request concerns either, I will tell you so and point you to the appropriate route, since I cannot act on data I do not control.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

12Changes to this policy

This policy is amended when the app changes in a way that affects data processing, for example if a component is added or removed. The version in force is always the one published here, and the date at the top states when it was last revised. It describes the app as it is released today, not what it might do later: should a future version process data differently, this page is updated before that version ships.