Abos Privacy Policy

Deutsche Fassung

Summary

Abos is an app for managing subscriptions and fixed costs, splitting expenses in groups and tracking your net worth. To do so, the app only processes the information you enter yourself plus the technical data needed for sign-in, sync and notifications.

• The app has no bank connection and does not read any accounts.
• No ads and no sharing of data for advertising.
• Your data is stored on Google Firebase so it is available on all your devices and to your groups.
• You can delete your account in the app at any time.

This policy covers the iOS app. The website maxmuhr.com has its own privacy policy (in German).

1. Controller

Max Muhr
Paul-Schallück-Straße 5
50939 Köln
Germany
Email: app@maxmuhr.com

We are not required by law to appoint a data protection officer.

2. Account and sign-in

To use the app you create an account. Sign-in is handled by Firebase Authentication, a service of Google Ireland Limited:

• Sign in with Apple: Apple provides a user identifier and – if you agree – your name and email address. With “Hide My Email” you can have your address replaced.
• Sign in with Google: Google provides the name, email address and user identifier of your Google account.
• Email and password: We store your email address; Firebase stores your password only as an encrypted hash.

Processed are your email address, your name (if provided), a unique user ID and the times of sign-in and account creation. Legal basis is Article 6(1)(b) GDPR (performance of the user agreement).

3. Your content and sync

What you enter in the app is stored with your account in Cloud Firestore, the database of Google Firebase. In particular:

• subscriptions and expenses with name, amount, interval, category and notes
• categories and settings you create
• asset accounts and the balances you record
• your display name and – if you choose one – your profile picture
• groups, members and shared expenses

The purpose is that your data is the same on all your devices and is kept when you switch devices. Data is transmitted encrypted. A cache is also kept on your device so the app works offline and widgets can show their values. Legal basis is Article 6(1)(b) GDPR.

Shared groups

When you create or join a group, all members of that group see your display name, your profile picture and the group’s expenses and balances. Invite codes are created and checked via Firebase Cloud Functions. The same groups are also available in our app “Splitaway” if members use it.

Members without an account are added by name only. Please do not enter more about them than the split requires.

4. Notifications

Reminders about upcoming charges are scheduled locally on your device; no data is sent to us for this.

For notices about group activity – for example when someone adds an expense – the app uses Firebase Cloud Messaging and Apple’s push service. For this, a device token is stored with your account. You only receive notifications if you allow them in iOS, and you can turn them off at any time in the iPhone settings. Legal basis is Article 6(1)(b) GDPR.

5. Usage analytics

To understand which features are used and where flows get stuck, the app uses Google Analytics for Firebase. It records events such as app launch, screens viewed, completed setup and successful sign-in, along with device type, iOS version, app version, country and a random app instance ID.

The content of your subscriptions, expenses or groups is not recorded. The app does not use the advertising identifier (IDFA) and does no cross-app tracking. Legal basis is Article 6(1)(f) GDPR; our legitimate interest is improving the app and fixing errors. You can object to this processing at any time by emailing app@maxmuhr.com.

6. Protection against abuse

Firebase App Check uses Apple’s App Attest service to verify that requests to our database come from a genuine installation of the app. No content is transmitted, only a proof of verification. Legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting your data from unauthorised access.

7. Provider logos

For well-known providers the app shows a logo. To do so it requests the image from the service Logo.dev (img.logo.dev) and sends the name or domain of the provider. As with any request on the internet, Logo.dev receives your device’s IP address. No information about you or about amounts is sent. Images are cached on the device. Legal basis is Article 6(1)(f) GDPR.

8. Calendar, photos and widgets

Calendar: If you turn it on, the app adds renewal dates to your calendar. It only requests write access and does not read existing events.

Photos: For a profile picture you pick a single image using the iOS photo picker. The app only receives that image and has no access to your photo library.

Widgets and shortcuts: The data for widgets is kept in a protected area on your device and does not leave it for this.

9. In-app purchases

You buy Premium through the App Store. Payment is handled solely by Apple; we receive no payment data, only whether and which product is active. We store the purchase status with your account so Premium applies on all your devices. Legal basis is Article 6(1)(b) GDPR.

10. Contact and feedback

If you send feedback from the app, your mail app opens with a prepared message containing the app version, iOS version and device model. Nothing is sent unless you send it. We store your message and email address to handle your request. Legal basis is Article 6(1)(b) or (f) GDPR.

11. Recipients and transfers to third countries

Your data is only received by these service providers, each for the purposes stated:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase: sign-in, database, Cloud Functions, notifications, analytics, App Check) – as processor
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland (App Store, purchases, push service, Sign in with Apple)
• Logo.dev (provider logos, see section 7)

Processing in the USA cannot be ruled out for Google and Apple. It is covered by the EU-US Data Privacy Framework, under which both companies are certified, and by EU Standard Contractual Clauses.

12. Retention and deletion

We keep your data as long as your account exists. You can delete your account in the app under Account → “Delete account”; we then delete the associated content from the database. Expenses you added to shared groups remain available to the other members so their balances stay correct. Analytics data is deleted after the configured retention period, at most after 14 months. Emails are deleted once the request is resolved and no statutory retention periods apply.

13. Your rights

You have the right to

• access your stored data (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)

An informal message to app@maxmuhr.com is sufficient.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

14. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

15. Changes

We update this policy whenever the app changes. The version published here applies. If the German and English versions differ, the German version prevails.

Terms of use (EULA)

Use of the app is governed by Apple’s standard Licensed Application End User License Agreement: Apple Standard EULA. Subscriptions and purchases are also subject to the App Store terms. A yearly subscription renews automatically unless cancelled at least 24 hours before the end of the current period in your Apple ID settings.

Provider

Max Muhr, Paul-Schallück-Straße 5, 50939 Köln, Germany
Email: app@maxmuhr.com · VAT ID: DE348601719

Full provider information is in the Impressum (in German). Help for the app: Help & support.