Privacy Policy

1. Data Controller

Johannes Kropatschek
Vienna, Austria
Email: office@hydrapt.com

2. Scope and Purpose

This policy applies to the use of the App on iOS/iPadOS and to the website hydrapt.com (Section 12). The App provides cognitive training and self-assessment features for informational and entertainment purposes.

3. What Data Does the App Process?

The following data generally remains on your device. Only the data listed in Sections 3a and 3b is transmitted to our server:

• Usage and performance data (on-device): Test progress, answers, scores, timer states, local result overviews.
• App settings (on-device): e.g., light/dark mode, UI preferences.
• No special categories: No health or biometric data in the legal sense is collected or transmitted.
• No advertising IDs or analytics SDKs.

When you install Hydra Trainer from the App Store, Apple collects and aggregates telemetry data and provides it to us. This information includes the number of people who downloaded the app, the number of people who used it on a given day, and the total number of users per country. Apple does not share information about specific users with us.

3a. Account, Leaderboard, and Friends (Server-Side Processing)

On first launch, the App automatically creates an anonymous account on our server. A random account identifier is generated; no name, email address, or device identifiers are required for this. The App therefore connects to our server from the first launch. All training and test features run entirely locally regardless.

Participating in the leaderboard requires signing in with Apple or Google. In that case, we process and store:

• The email address provided by Apple or Google (with Apple's "Hide My Email" option, the relay address generated by Apple) and the sign-in provider used.
• Your self-chosen username.
• Your country, determined automatically from your App Store region or system region (shown as a flag on the leaderboard).
• Test scores and associated timestamps.
• Friend connections between accounts if you use the friends feature.

Only your username, country, and scores are publicly visible on the leaderboard, never your email address.

IP addresses are processed for technical reasons when a connection is established and may briefly appear in server logs; these are deleted automatically (analytics logs after 14 days) and are not used for tracking or profiling. Our server does not collect device identifiers.

Server location: The server is hosted by Hetzner Online GmbH, Nuremberg, Germany (EU). A data processing agreement (AVV/DPA) is in place with Hetzner.

Purpose: Providing the account, leaderboard, and friends features, allowing you to compare your results with other users.

Voluntary participation: Leaderboard participation is optional. All training and test features can be used without signing in.

3b. Purchases and Subscriptions

Pro purchases and subscriptions are handled entirely by Apple. Payment details (e.g., credit card) remain with Apple and never reach us.

To manage purchase status, we use RevenueCat, Inc. (USA) as a data processor. For this, the App transmits your pseudonymous account identifier, transaction data provided by Apple (e.g., product, purchase and expiry date), and technical device information to RevenueCat. The transfer to the USA is based on a data processing agreement including EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The subscription status (e.g., active/expired, product, platform) is additionally stored with your account identifier on our server in the EU so that your Pro access works across devices and on the web.

4. Purposes and Legal Bases (GDPR)

• Performance of contract (Art. 6(1)(b) GDPR): Providing the App features and the account, and processing and managing purchases and subscriptions (Section 3b).
• Consent (Art. 6(1)(a) GDPR): Leaderboard participation. The data listed in Section 3a is only transmitted once you actively sign in with Apple or Google. You can withdraw consent at any time by deleting your account in the App (Profile > Leaderboard Profile > "Delete Account"); this removes your profile and your submitted results from the server.
• Legitimate interest (Art. 6(1)(f) GDPR): Security and stability of the App and the service (e.g., technical server logs).

5. Retention and Deletion

• On the device: Data remains stored until you reset it in the App (if a reset function is available) or uninstall the App.
• Account and leaderboard data on the server: stored until you delete your account in the App (Profile > Leaderboard Profile > "Delete Account"). This removes your profile, your sign-in data, and your submitted results from the server. Uninstalling the App alone does not delete server-side data. Please delete your account in the App first, or contact office@hydrapt.com.
• Subscription status: stored for as long as necessary to provide your Pro access and to meet legal obligations.

6. Recipients and Disclosure

Account and leaderboard data is hosted on servers provided by Hetzner Online GmbH (Nuremberg, Germany). Hetzner acts as a data processor under a data processing agreement (AVV/DPA). For subscription management, we use RevenueCat, Inc. (USA) as a data processor; the transfer to the USA is based on EU Standard Contractual Clauses (Section 3b).

When you sign in with Apple or Google, Apple or Google process data under their own responsibility; their privacy policies apply.

Beyond that, no data is shared with third parties.

7. App Permissions

The App does not use any sensitive device permissions such as camera, microphone, contacts, calendar, photos, location, or HealthKit. Should this change in the future, you will be asked for consent before use, and this policy will be updated.

8. Your Rights (Art. 12-23 GDPR)

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection.

For on-device data, these rights can be exercised by you directly (reset function or uninstallation).

For server-side account and leaderboard data, you can exercise your right to erasure directly in the App (Profile > Leaderboard Profile > "Delete Account"); this removes all associated data from the server. For all other rights regarding server-stored data (e.g., access, rectification, data portability), please contact office@hydrapt.com.

9. Minors

The App is not specifically aimed at children. No tracking for advertising purposes takes place; personal data is only processed to the extent described in this policy.

10. Data Security

On-device data processing is subject to the security mechanisms of iOS/iPadOS. Please protect your device (e.g., device passcode, Face/Touch ID).

Server-side account and leaderboard data is transmitted over encrypted connections (TLS) and stored on servers within the EU operated by Hetzner Online GmbH, which maintains appropriate technical and organizational security measures.

11. External Services

The App does not integrate any ad networks, external analytics services, or social plugins. The App connects to the following services: our server (Hetzner, Germany) for account, leaderboard, and subscription status, starting from the first launch; RevenueCat (USA) for subscription management (Section 3b); Apple or Google only as part of sign-in. Any operating system functions (e.g., system-wide crash reports to Apple, if enabled by you) are Apple's responsibility.

12. Website (hydrapt.com)

When you visit this website, our server processes connection data (including IP address, time, and requested page) in server logs for technical reasons. These logs are used for security and error analysis, are not combined with other data, and are deleted automatically on a regular basis.

For reach measurement, we use a self-hosted instance of Plausible Analytics (stats.hydrapt.com). Plausible works without cookies, only aggregate statistics are produced, IP addresses are not stored permanently, and no data is shared with third parties. The legal basis is our legitimate interest in privacy-friendly reach measurement (Art. 6(1)(f) GDPR).

Fonts are served exclusively from our own server; no connection to Google Fonts or other font services takes place.

To display the current app version, your browser retrieves version information directly from Apple (itunes.apple.com) when you visit the website; Apple technically receives your IP address in the process. Apple's privacy policy applies.

13. Changes to This Policy

We may update this privacy policy if features or legal requirements change. The current version is always available in the app or via the linked notice. See date above.

14. Contact & Right to Complain

Privacy questions: office@hydrapt.com

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria: Austrian Data Protection Authority (dsb.gv.at).

Disclaimer (Not a Medical Device)

The App serves training, information, and entertainment purposes. It is not a medical or psychological diagnostic or therapeutic tool and does not replace professional advice, diagnosis, or treatment.