Privacy Policy

Last updated: August 10, 2026

This privacy policy explains how personal data is processed on the website flasche-bitte.de and in the mobile app “Flasche, bitte!” (iOS & Android).

1. Controller

2. Data processing on this website

2.1 No cookies, no tracking

This website is a static website. It sets no cookies, uses no analytics or tracking services and embeds no third-party content (fonts, scripts and images are served exclusively from this domain). For this reason no cookie banner is required.

2.2 Hosting and delivery (Cloudflare)

The website is delivered via Cloudflare Pages and the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the website, Cloudflare processes technically necessary connection data (in particular IP address, date and time of access, requested URL, user agent) in order to deliver the page and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and fast operation of the website). Transfers to the USA are based on the EU-US Data Privacy Framework and/or EU standard contractual clauses. More information: cloudflare.com/privacypolicy.

3. Data processing in the app

3.1 Account and sign-in

An account is required to use the app. The following is processed:

• E-mail address and password (when registering via e-mail) — for account creation, sign-in and important system messages (e.g. password reset).
• Sign in with Google or Apple — only the e-mail address required for authentication is used. The privacy policies of Google and Apple additionally apply.
• Game data (e.g. collected bottles, level, points, inventory, friend lists) — assigned to a random user identifier and containing no further personal details.

The legal basis is Art. 6(1)(b) GDPR (providing the game) and Art. 6(1)(f) GDPR (secure operation, abuse prevention).

3.2 Backend (Supabase)

Account and game data are stored and processed with Supabase (Supabase, Inc.) — database, authentication and server functions. Details: supabase.com/privacy.

3.3 E-mail delivery (Resend)

System e-mails (e.g. confirmations, password resets) are sent via Resend (Resend, Inc.). The recipient's e-mail address is processed for this purpose. Details: resend.com/legal/privacy-policy.

3.4 Push notifications

On request, the app sends push notifications (e.g. when friends send you gifts). A pseudonymous device token is processed via the push services of Apple and Google. Push notifications can be disabled at any time in your system settings.

3.5 No ads, no tracking

The app contains no advertising SDKs and no third-party trackers.

4. Storage period

• Account and game data are stored for as long as the account exists.
• When the account is deleted, the associated personal data is deleted unless statutory retention obligations require otherwise.
• Website server logs are only stored for as long as necessary for operation and security.

5. Your rights

Under the GDPR you have in particular the right to:

• access to the data processed about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) (Art. 21),
• lodge a complaint with a data protection supervisory authority (Art. 77).

To exercise your rights, an informal e-mail to yyoshidev@gmail.com is sufficient.

6. Transfers to third countries

Where the service providers mentioned above process data outside the EU/EEA, this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR (EU-US Data Privacy Framework and/or EU standard contractual clauses).

7. Changes

This privacy policy will be updated when the app or website changes. The current version is always available at flasche-bitte.de/en/privacy.