Privacy policy for the apps

This is a translation of the German privacy policy for the apps. In case of doubt, the German version prevails.

This privacy policy applies to the mobile apps offered by Michael Linnerer (e.g. GoldFokus, TuneTime, BeeZucht and Spot67) on the Apple App Store and Google Play. A separate privacy policy applies to the website linnerer.com.

Dipl.-Inf. (FH) Michael Linnerer Developing and Consulting of Software and Architecture Fellerstr. 2a 83064 Raubling Germany

E-mail: info@linnerer.com Phone: +49 173 370 67 26

2. Scope

This policy describes which personal data is processed when you use my apps, for what purpose and on what legal basis. Not every app uses all of the functions described here – what matters is the specific function you actually use in the app.

3. Data processed, purposes and legal bases

a) User account and sign-in (Firebase Authentication). Depending on the sign-in method, I process the data arising at sign-in: for anonymous sign-in only a random device identifier (not linked to your Apple or Google account); for a registered sign-in additionally e.g. your e-mail address, display name and an encrypted password or a sign-in token of the chosen provider. Purpose: providing the account, sign-in and assigning your content. Legal basis: Art. 6(1)(b) GDPR.

b) Content stored in the app (cloud database, Firestore). Content you create in the app (e.g. entries, results, profiles, lists) is stored in a cloud database so it is available across devices. Purpose: core function of the app. Legal basis: Art. 6(1)(b) GDPR.

c) No usage analytics, no advertising. My apps contain no analytics or crash-reporting services – neither Firebase Analytics nor Crashlytics nor any comparable tool. No usage profiles are created and no advertising, no marketing cookies and no third-party tracking are used.

d) Device permissions (camera/photos, location, microphone). Some apps require access to device functions for specific features. Access is granted only after your explicit permission via the operating system and only for the respective function:

Camera / photos – to take or select a photo (e.g. target photo in GoldFokus, find photo or profile picture in Spot67).
Location – the required precision differs per app:
- BeeZucht processes your precise location to record an apiary and to retrieve location-based weather and pollen data for it (service Open-Meteo, see section 4).
- Spot67 processes only your approximate location to place a find on the map. This location becomes visible to other signed-in users – see section 3(g).
- GoldFokus and TuneTime do not access your location.
Microphone – e.g. for audio recognition of music. On iPhone, recognition runs entirely on-device via Apple ShazamKit – no audio is transmitted externally. Otherwise a short acoustic “fingerprint” is created and sent to the recognition service (ACRCloud); audio recordings are not stored and conversations are not permanently recorded.

Legal basis: Art. 6(1)(a) and (b) GDPR. You can revoke granted permissions at any time in your device settings.

e) Leaderboard and public player name. In apps with a leaderboard (e.g. TuneTime and Spot67) you may voluntarily enter a player name. It appears together with your score in a publicly visible leaderboard. Game statistics (e.g. attempts, points, streaks) are also processed. Participation is voluntary and can be disabled in settings or revoked by removing the name. For Spot67, section 3(g) applies in addition. Legal basis: Art. 6(1)(a) GDPR (consent).

f) AI photo analysis (GoldFokus only). GoldFokus offers optional AI features that analyse a photo you take or select: arrow detection on the target face, the scoresheet scan and the arrow reference photo in your profile. The photo is transmitted to our server (Google Cloud, European region) and to the AI interface Google Gemini (Google Ireland Ltd./Google LLC) solely for the purpose of detecting the hits or values shown on the photo. The image is not stored permanently; only the detected scores are stored.

Before you use the feature for the first time, the app asks for your consent with a separate notice. Use of this feature is voluntary: without consent you can use the app in full and enter your scores manually. You can withdraw your consent at any time with effect for the future in the app under “Impressum & Datenschutz”.

Please photograph the target face only — no photos showing identifiable persons. This ensures no third-party data is transmitted. Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal does not affect the lawfulness of processing carried out before it.

g) Content visible to other users (Spot67 only). Spot67 is a community app. For the game to work, certain content becomes visible to other signed-in users. Please keep this in mind before you save a find:

Find on the map: When you save a find (“67”), it appears on a map that all signed-in users can see. Visible are your display name, your profile picture (if set), the approximate location, the time and – if you provide them – category and note. You may decline location sharing; the find is then saved without a location.
Leaderboard and profile: Display name, profile picture and your game statistics (e.g. number of finds, streaks) are visible to other signed-in users.
Buddies and duels: You can add other users as a “buddy” and play duels. The data of a duel is visible only to the two participants.
Reporting and blocking: You can report other users or content and block users. Reports are transmitted to me for review only and are not visible to other users.

Your find photos stay exclusively on your device. They are not uploaded and are visible to no one but you; when you delete your account they are removed from the device. Only a profile picture – if you choose one – is uploaded and is visible to other signed-in users.

Purpose: core and community functions of the game (map, leaderboard, duels). Legal basis: Art. 6(1)(a) GDPR (consent – publication only happens when you actively save a find or upload a profile picture). You can delete individual finds and your profile picture in the app at any time.

4. Services and recipients

a) Processors – service providers that process data on my behalf and on my instructions. Data processing agreements pursuant to Art. 28 GDPR are in place with them:

Google Firebase – Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Hosting). App data (e.g. accounts and content) is stored in data centres within the European Union. A transfer to servers of Google LLC in the USA cannot be excluded in every case; this is based on the EU Commission’s Standard Contractual Clauses (Art. 46 GDPR).
Google Gemini (AI features, GoldFokus only) – Google Ireland Ltd./Google LLC. For the optional AI feature, a photo is transmitted for processing; the image is not stored permanently. The feature uses the paid tier of the Gemini API: Google does not use the transmitted content to improve its own products or to train AI models. A transfer to the USA is technically possible; this is based on the EU Commission’s Standard Contractual Clauses (Art. 46 GDPR).
ACRCloud – audio recognition service (in apps with music recognition, e.g. TuneTime, where ShazamKit is not used). A short acoustic fingerprint is processed to identify songs; audio recordings are not stored.

b) Other external services contacted when you use a feature. They are not processors; for technical reasons your IP address (and, where stated, further data) is transmitted to the respective provider:

Open-Meteo (BeeZucht only) – Open-Meteo, Zurich/Switzerland. To show weather and pollen data for an apiary, the coordinates of that apiary are transmitted to the service.
OpenStreetMap Foundation (Spot67 only) – St John’s Innovation Centre, Cambridge, United Kingdom. Provides the map tiles for the find map. An adequacy decision of the EU Commission is in place for the United Kingdom.
Google Fonts (Spot67 only) – Google Ireland Ltd./Google LLC. The app downloads the fonts it uses from Google servers on first launch.
MusicBrainz and Cover Art Archive – retrieval of public track information and album covers (e.g. release year, image) in music-related apps.
Apple ShazamKit – Apple Inc. In apps with music recognition, recognition on iPhone runs entirely on-device; no audio is transmitted externally.
Apple App Store / Google Play – provision, installation and, where applicable, payment handling by the respective platform operators (Apple Distribution International Ltd. and Google Ireland Ltd.) under their own responsibility.

5. Retention period

Personal data is stored as long as your account exists or as long as required for the stated purposes. After deletion of your account, the associated data is deleted unless statutory retention obligations apply.

6. Deleting your account and data

You can delete your account and the associated data at any time:

directly in the app via the account or profile settings (where offered), or
by e-mail to info@linnerer.com requesting deletion of your account.

Upon receipt, your account and the associated data will be deleted. For step-by-step instructions per app see /en/apps/konto-loeschen/.

7. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21). You can withdraw any consent at any time with effect for the future. Please contact info@linnerer.com.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Children

The apps are not directed at children under 16. If accounts of minors are created without the consent of their guardians, I will delete the relevant data once I become aware of it.

10. Changes to this policy

I update this privacy policy when the apps or legal requirements change. The version published in the app or here applies in each case.

Last updated: July 2026

1. Controller (Art. 4 No. 7 GDPR)