Privacy Policy
This Privacy Policy provides information on the nature, scope and purpose of the processing of personal data in connection with the use of the mobile application SNIZ (the “App”), distributed under the package name app.sniz (Android) and the corresponding Bundle Identifier (iOS), and of the website sniz.app. Section 13 applies exclusively to the website and section 14 to the Provider’s social media presences; sections 2 to 10 refer to the App.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Suther Kommunikationsdesign
Owner: Samuel Suther
Am Aschenkrug 72
41169 Mönchengladbach
Germany
E-mail: info@suther.de
Phone: +49 2161 277 18 99
VAT ID: DE230786495
Hereinafter referred to as the “Provider”. Person responsible for content pursuant to § 18(2) MStV (German Interstate Media Treaty): Samuel Suther (address as above).
2. Principles of Data Processing
SNIZ is designed as a privacy-first application. All content entered in the App (section 3) is stored exclusively locally on the user’s device in encrypted form. This content is not automatically transmitted to servers of the Provider or to third parties.
Data is transmitted in the following cases:
- Feedback: at the user’s request, upon submission of a feedback message (section 4).
- SNIZ PRO: at the user’s request, upon opening the purchase screen and upon completion of a purchase. A pseudonymous identifier and purchase data are transmitted to RevenueCat (section 5).
- Error reports for purchase attempts: automatically, if a purchase started by the user fails for technical reasons; without any user or device identifier (section 5.5).
- Refund verification: automatically, if a purchase is no longer confirmed on the device, within 120 days of the purchase; the pseudonymous identifier and the purchased feature are transmitted (section 5.6).
- Backup export: at the user’s request, upon creation of an encrypted backup file, the storage location or recipient of which is determined by the user (section 10.2).
- Loading of content: The App may load content from a server of the Provider; no content from the App and no identifiers are transmitted (section 8.3).
- Selection of offers: at the user’s request, upon selection of an offer; the selected offer and the area of the App are transmitted, without any user or device identifier (section 8.2).
The account and tax exemption order data entered in the App are not transmitted to the Provider or to third parties in any of these cases.
2.1 Server Log Files
Whenever the App connects to a server of the Provider (sections 4, 5.5, 5.6, 8.2 and 8.3), the web server automatically logs technical access data: IP address, date and time of access, address requested, status code, amount of data transferred and the software identifier transmitted by the device (user agent). This data serves exclusively to ensure secure and stable operation, is not combined with other data sources and is deleted after 14 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).
3. Locally Processed Data
The following data can be entered in SNIZ. Providing any of this data is voluntary; it is stored exclusively locally on the device:
- Savings account data: bank name, label, amount, interest rate, term/guarantee date, status, optionally IBAN, BIC, deposit insurance, notes
- Reference account: bank name, optionally IBAN
- Tax exemption order data: bank name, granted amount, tax year, optionally amount used
- Interest payment data: generated payment dates, status, actual amounts
- App settings: language, country of residence (DE/AT/CH), font size, reminder lead time, type of tax assessment
- Security data: PIN hash, PUK hash, biometric activation status
3.1 Encryption
The local database is fully encrypted with SQLCipher using AES-256. The database key is bound to the device and stored in the operating system’s secure key storage (Android Keystore or iOS Keychain).
3.2 Legal Basis
Local processing is carried out for the performance of the contract for the use of the App (Art. 6(1)(b) GDPR). As this data is not transmitted to the Provider, the Provider has no access to it at any time.
4. Feedback Feature (optional)
The App offers two optional ways of sending a message to the Provider: a feedback form in the settings and a feedback dialog offered after rating the App. If these are actively used, the message written is transmitted to a server of the Provider. The rating itself is not transmitted.
4.1 Transmitted Data
- Content of the message (free text, max. 500 characters)
- E-mail address (only if provided voluntarily)
- App version
- Platform (Android or iOS)
- App language setting
- Origin of the message (form in the settings or dialog after a rating)
- Time of submission
If no e-mail address is provided, no user or device identifiers are transmitted.
4.2 IP Address
The IP address is processed briefly in the server’s memory solely for rate limiting (max. 3 requests per hour). In addition, it is stored in the server log files (section 2.1).
4.3 Storage Location and Retention Period
The data is stored on servers in Germany for a maximum period of 12 months.
4.4 Legal Basis
Art. 6(1)(a) GDPR (consent by active submission) and Art. 6(1)(f) GDPR (legitimate interest in improving the App). Consent given may be withdrawn at any time with effect for the future (section 11).
4.5 Feedback during Onboarding (optional)
An optional free-text field is offered during onboarding. If text is entered there and the option “Send feedback to SNIZ” remains enabled, the input is transmitted without identifiers: text, language setting, platform, App version and time of submission, but no user or device identifiers and no e-mail address. The IP address is processed briefly for rate limiting and stored in the server log files (section 2.1); the stored message does not contain it. The transmission can be prevented at any time by deselecting the option.
Legal basis: Art. 6(1)(f) GDPR.
5. In-App Purchases: SNIZ PRO (optional)
SNIZ offers optional paid add-on features (“SNIZ PRO”). Purchases are processed via the service provider RevenueCat, Inc., San Francisco, USA. Data is transmitted to RevenueCat only when the purchase screen (paywall) is opened or a purchase is completed.
5.1 Transmitted Data
- Pseudonymous identifier: an identifier (UUID) randomly generated in the App, which is not linked to any real identity
- Purchase and transaction data: product ID, price, purchase date, payment status, type of purchase or subscription
- Technical device and platform information, to the extent required for purchase processing via Google Play or the Apple App Store
Payment itself is processed by Google Play or the Apple App Store. Neither the Provider nor RevenueCat obtain access to payment instrument data (e.g. credit card numbers).
5.2 Transfer to Third Countries
RevenueCat processes the data as a processor on behalf of the Provider. The data processing agreement (Data Processing Addendum) pursuant to Art. 28 GDPR forms part of RevenueCat’s contractual terms.
RevenueCat, Inc. is based in the USA. The transfer is based on appropriate safeguards in the form of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which are incorporated into the data processing agreement. Further information is available in RevenueCat’s Privacy Policy (external).
5.3 Legal Basis
Processing is carried out for the purpose of executing the purchase and providing the purchased features (Art. 6(1)(b) GDPR). The purchase contract is concluded with the respective store operator (Google Commerce Limited or Apple Distribution International Ltd.). Use of the App is governed by the Terms of Use at sniz.app/terms.
5.4 Purchase Notifications to the Provider
RevenueCat sends the Provider notifications of purchase events (e.g. purchase, renewal, cancellation, refund). These are stored on a server of the Provider in Germany and contain the pseudonymous identifier (section 5.1), product ID, type of event, the reason communicated by the store in the event of a cancellation or refund, price and currency, country, store and time. They serve to handle support requests, to verify purchase and refund transactions and for statistical evaluation. After 12 months, the data is anonymised so that it can no longer be attributed to a pseudonymous identifier and serves statistical purposes only.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in support, prevention of misuse and statistical evaluation).
5.5 Error Reports for Purchase Attempts
If a purchase attempt fails for technical reasons, the App sends an error report to a server of the Provider in Germany. Cancelling a purchase is not reported. The report contains the error code and error description of the purchase system, the product ID, the platform (Android or iOS) and the App version. No identifier of the device or the person is transmitted. The IP address is processed briefly in the server’s memory solely to limit the request rate (max. 10 reports per hour) and is not stored; beyond this, section 2.1 (server log files) applies. The reports serve to detect and fix technical problems with purchases and are deleted after 12 months.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning purchase process).
5.6 Refund Verification
If RevenueCat no longer confirms a purchase on the device, in particular after the purchase has been restored on another device, the App transmits the pseudonymous identifier (section 5.1) and the name of the purchased feature to a server of the Provider in Germany within 120 days of the purchase. The server compares this information with the stored purchase notifications (section 5.4) and transmits to the App solely the information whether a refund has been issued. The request is not stored. The IP address is processed briefly in memory to limit the request rate; otherwise, section 2.1 applies.
Legal basis: Art. 6(1)(b) GDPR (provision of the purchased feature on multiple devices) and Art. 6(1)(f) GDPR (legitimate interest in preventing the use of refunded purchases).
6. App Lock, PIN and Biometrics (optional)
PIN and PUK are stored exclusively as cryptographic hash values. Biometric data is processed exclusively by the operating system; the App merely receives confirmation of whether authentication succeeded or failed.
7. Notifications (optional)
SNIZ uses local notifications only. No push tokens are registered and no data is transmitted to third parties (Apple Push Notification Service, Google Firebase Cloud Messaging) beyond what is technically strictly necessary.
8. Tracking, External Services and Loaded Content
8.1 No Tracking, No Advertising Networks
SNIZ contains no tracking libraries, no advertising networks, no analytics tools and no third-party crash reporting. The only integrated third-party library that transmits data is the RevenueCat SDK. It is used exclusively for processing in-app purchases and only to the extent described in section 5.
8.2 Offers for Banking Products
The App may contain offers for banking products labelled as “advertising”. If an account is opened via such an offer, the Provider receives a commission.
When an offer is selected, the App transmits to a server of the Provider in Germany the identifier of the selected offer and the area of the App in which the selection was made (e.g. offer overview, notice of the end of an interest rate guarantee, introduction). Only the number of selections per offer, day and area is stored. IP addresses, user or device identifiers and data entered in the App are not stored. The IP address is processed briefly in memory solely to limit the request rate and to avoid duplicate counts; otherwise, section 2.1 applies.
The page of the respective bank is then accessed in the device’s browser. In order to attribute a referral, the area of the selection is transmitted to the affiliate programme as a technical attribute; the link may also contain an identifier of the affiliate programme. Data processing on the page accessed is governed by the privacy policy of its operator.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in evaluating the use of offers).
8.3 Loading of Content
The App may load content (e.g. offers and bank logos under section 8.2) from a server of the Provider in Germany. No content from the App and no identifiers are transmitted. For technical reasons, the device’s IP address is transmitted; it is stored exclusively in the server log files (section 2.1).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing up-to-date App content).
8.4 Discord Community
The App contains a link to the Provider’s community on the Discord platform (Discord Inc., San Francisco, USA). When the link is selected, the community is accessed outside the App; no data entered in the App is transmitted.
The use of Discord, including registration and joining the community, is governed by Discord’s terms of service and privacy policy (discord.com/privacy). Data may be transferred to the USA in the process. As operator of the community, the Provider has access to the content and public profile information (e.g. user name) shared there by members and processes it to manage the community and to answer enquiries.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with and supporting users). Use of the community is voluntary; enquiries can also be sent by e-mail to info@suther.de at any time.
9. App Permissions
| Permission | Purpose | Required |
|---|---|---|
| Notifications | Local reminders about the end of interest rate guarantees | Optional |
| Biometrics | Unlocking the App lock | Optional |
| Internet access | Feedback feature (section 4), the purchase screen, purchase processing and refund verification for SNIZ PRO via RevenueCat and Google Play or the Apple App Store (section 5), and loading of content (section 8.3) | Required; data transmitted only to the extent described |
The App does not request permissions for location, camera, microphone, contacts or calendar.
10. Backup, Export and Deletion
10.1 Device Backup
Local App data can be backed up using the operating system’s standard backup function.
10.2 Backup Export and Import (optional, SNIZ PRO)
With SNIZ PRO, App data can be exported to an encrypted backup file and imported on another device, for example when changing devices. Encryption uses the AES-256 standard with a password set by the user. This password is not stored, neither in the App nor elsewhere. Without the password, the data cannot be restored. PIN and PUK are not part of the backup file.
The export is carried out solely at the user’s request. The backup file is not transmitted to the Provider, to RevenueCat or to any other third party. The file is made available via the device’s share function; the storage location and method of transmission (e.g. local device storage, cloud storage or e-mail) are determined by the user.
The Provider has no access to the exported file. The user decides on its storage, disclosure and deletion on their own responsibility. When third-party services are used (e.g. cloud storage or e-mail providers), their privacy policies apply.
10.3 Deletion
- App data: Uninstalling the App permanently deletes all locally stored App data from the device.
- Backup files: Backup files created by the user are not affected by uninstalling the App and remain at their respective storage location until deleted by the user.
- Purchase data: Purchase and transaction data stored by RevenueCat and by Google Play or the Apple App Store are not affected by uninstalling the App. Their storage is governed by the terms of the respective provider and by statutory retention obligations (e.g. under tax law). Purchase notifications stored by the Provider are anonymised after 12 months (section 5.4). Deletion of the data stored by RevenueCat may be requested by e-mail to info@suther.de, provided that no statutory retention obligations apply.
- Feedback: Deletion of submitted feedback messages may be requested by e-mail to info@suther.de.
11. Rights of Data Subjects
In accordance with the statutory provisions, data subjects have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal message to info@suther.de is sufficient to exercise these rights.
Right to object: Where processing is based on Art. 6(1)(f) GDPR, it may be objected to at any time on grounds relating to the particular situation of the data subject (Art. 21(1) GDPR).
Right to lodge a complaint: Data subjects have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for the Provider is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
12. Changes to this Privacy Policy
The Provider reserves the right to update this Privacy Policy in the event of changes to the legal situation or to the App or the website. The current version is available at sniz.app/privacy. Material changes will be announced as part of an App update.
13. Website sniz.app
The following sections apply exclusively to visits to the website sniz.app, not to the App.
13.1 Hosting and Server Log Files
The website is operated by a hosting provider in Germany. With each visit, the web server automatically processes the following information transmitted by the browser: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser type and operating system. The log files are deleted after 14 days.
This data serves exclusively to ensure secure and stable operation and is not combined with other data sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website).
13.2 Fonts
The fonts used (Google Fonts: Manrope, Sora) are served locally from the Provider’s server. No connection to Google servers is established and no IP address is transmitted to third parties.
13.3 Web Analytics (Matomo, without cookies)
For the anonymised analysis of visits, the Provider uses the open-source analytics tool Matomo. Matomo is operated exclusively on the Provider’s own server (stats.suther.de); no data is transmitted to third parties.
Data is collected without cookies. Only the following data is recorded pseudonymously: page accessed, referrer URL, approximate time spent, sections of the page viewed or clicked, screen resolution, browser type and operating system, and the IP address shortened by its last bytes (anonymised). Before anonymisation, an approximate location (country/region) is derived from the IP address; the full IP address is not stored. Attribution to individual persons or cross-device recognition is not possible.
As no cookies are set, no personal or device-related identifiers are stored and no data is disclosed to third parties, no consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is required according to the guidance of the German Data Protection Conference (DSK). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the needs-based design and statistical evaluation of the website).
The analysis may be objected to at any time (Art. 21 GDPR), for example by e-mail to info@suther.de or by enabling the “Do Not Track” setting in the browser, which is automatically respected by the Matomo integration.
13.4 External Links
The website contains links to external services (e.g. Google Play, Apple App Store). The privacy policies of the respective operators apply to data processing on those sites.
14. Social Media Presences
The Provider maintains presences on the social networks listed below in order to provide information about SNIZ and to communicate with interested parties and users. This section applies to visits to these presences; the other sections apply to the App and the website.
14.1 General Information
When a presence is visited, the respective platform operator processes personal data of visitors, including visitors who are not logged in, for example by means of cookies and similar technologies. The nature, scope and purpose of this processing are determined by the platform operator; the Provider has no influence on it. The privacy policies of the respective platform operator apply. Where the platform operator obtains consent for this purpose, the processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent may be withdrawn vis-à-vis the platform operator.
The Provider itself processes the content that visitors share with it via the presences (e.g. messages, comments and reactions) as well as the public profile information visible in the process (e.g. name or user name) in order to answer enquiries and to communicate with interested parties. This processing takes place within the respective platform. Messages and comments are stored for as long as this is necessary for handling the enquiry or for communication; otherwise, the storage period is governed by the settings and policies of the respective platform. In addition, the platform operators provide the Provider with aggregated statistics on the use of the presences (sections 14.2 and 14.3); the Provider does not receive personal data of individual visitors in this context.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing information about SNIZ, in communicating with interested parties and users, and in designing the presences according to demand). Use of the presences is voluntary; enquiries can also be sent by e-mail to info@suther.de at any time.
Transfers to third countries: The platform operators may also transfer data to the USA. The parent companies Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-U.S. Data Privacy Framework; transfers to them are covered by the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).
14.2 Facebook and Instagram
The Provider operates a Facebook page (facebook.com/snizapp) and an Instagram profile (@sniz.app). For users in the European Union, both platforms are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).
The Provider and Meta are joint controllers within the meaning of Art. 26 GDPR for the creation of statistics on the Facebook page (“Page Insights”). The essence of the arrangement is set out in the Page Insights Controller Addendum. Under it, Meta assumes primary responsibility for the processing of Insights data, in particular for informing data subjects and for fulfilling their rights under Art. 15 to 21 GDPR; the lead supervisory authority is the Irish Data Protection Commission. The data Meta processes for this purpose is described in Meta’s Information about Page Insights. The Provider receives aggregated statistics only. Meta also provides the Provider with aggregated statistics for the Instagram profile.
Further information is available in Meta’s Privacy Policy and Instagram’s Privacy Policy.
14.3 LinkedIn
The Provider operates a showcase page for SNIZ on LinkedIn. For users in the European Economic Area and Switzerland, the platform is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”).
The Provider and LinkedIn are joint controllers within the meaning of Art. 26 GDPR for the creation of statistics on the page (“Page Insights”). This is governed by LinkedIn’s Page Insights Joint Controller Addendum. Under it, LinkedIn provides information about the processing and responds to requests to exercise rights under the GDPR; the lead supervisory authority is the Irish Data Protection Commission. Further details are available in LinkedIn’s information on joint controllership and LinkedIn’s Privacy Policy. The Provider receives aggregated statistics only.
14.4 Rights of Data Subjects
The rights under section 11 may also be exercised vis-à-vis the Provider with regard to the presences. Where a request concerns processing by a platform operator, in particular the statistics under sections 14.2 and 14.3, the Provider forwards it to the platform operator, as only the platform operator has access to the underlying data. For direct handling, it is advisable in such cases to address the request directly to the platform operator.
For the Provider’s community on Discord, see section 8.4.
15. Contact
For questions regarding data protection, the Provider can be contacted at:
Suther Kommunikationsdesign
Samuel Suther, Am Aschenkrug 72, 41169 Mönchengladbach, Germany
E-mail: info@suther.de