App Privacy Policy

1. Controller

The controller responsible for processing personal data under the GDPR is:

For questions about data protection or to exercise your rights, write to us at support@choosl.net.

2. Scope and principles

This privacy policy applies to the Choosl app for iOS and Android. Our websites and the public wishlist view are covered by the website privacy policy.

• Choosl is made for parents. Children use the app under supervision on their parents' device and have no account of their own.
• We show no ads from advertising networks, do not use the advertising ID and do not sell data.
• We only collect usage statistics with your consent.
• The parent PIN never leaves your device.

3. Account and sign-in

For sign-in we use Firebase Authentication by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), as our processor. You can choose:

• Email and password: Google stores your email address and a hash of your password.
• Sign-in link by email: Firebase sends a link to your email address that opens the app via auth.choosl.net. The same route lets you reset a forgotten parent PIN.
• Without registering (guest mode):an anonymous account without an email address is created and tied to the app on your device. You can turn it into a regular account later and keep your data. Guest accounts that are no longer used are deleted automatically (see "Retention and deletion").
• Sign in with Google or Apple(where available in your app version): Google or Apple confirms your identity and passes an identity token to Firebase. With Apple we request only your email address, not your name; if you use Apple's "Hide My Email", we only receive a relay address from Apple. With Google, Firebase may also store your Google account's name and profile picture in the account record; Choosl does not use them. Sign in with Apple is provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Apple's privacy policy applies.

Firebase also stores a random user ID (UID), when the account was created and last signed in, and the sign-in method used. Choosl does not store your email address, name or profile picture in its own database – the Firebase account record is the only place for them.

Purpose and legal basis: providing your account and the app's features (Art. 6(1)(b) GDPR). Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); the European Commission's standard contractual clauses also apply (Art. 46 GDPR). This applies to all Firebase services named in this policy.

4. Your data in the app

We store your account's content in Google Cloud Firestore (Google, processor):

• Parent profile: language and country (with Amazon marketplace and currency), creation date and technical fields; the parent PIN is not stored here.
• Child profiles:first name or nickname, age, an avatar colour, the occasion, optionally "boy" or "girl" to choose suitable product categories, the filters (price range, categories, maximum number of wishes) and the sharing status. Choosl does not process photos.
• Wishlists: products your child picked or skipped and that you highlighted or hid – each with Amazon product number (ASIN), title, image, price and time – the purchase status and, where applicable, the name of the person who reserved a gift.
• Shares: the secret share token of a shared wishlist and the time of its latest public visit.

Only your signed-in account has access; access rules per user ID ensure this. Changes to the profile, child profiles, highlights and hidden products go through our server (see next section). So the app also works offline, it keeps a copy of this data on your device.

Legal basis: providing the app's features (Art. 6(1)(b) GDPR).

5. Our server (api.choosl.net)

The app talks to our own server api.choosl.net, which we run at Hetzner Online GmbH in Germany (see website privacy policy, "Hosting"). With every request the server processes your sign-in token (and from it your user ID), an App Check token (see below), your IP address, app version and platform, and the content of the request, such as search term, category, price range and marketplace.

Product search

For search and product suggestions our server fetches Amazon product data via the Canopy API service. We send Canopy only the search term, category, price range, page number and Amazon marketplace, or a product number – no identifier, no IP address and no other information about you or your child. We cache the results for a few days without any personal reference.

Abuse prevention and error analysis

We limit the number of requests per IP address; the counters each cover one minute and are kept in a database on our server. The server logs requests and errors with IP address, time and requested address (without tokens). These logs are deleted after 14 days at the latest.

Change log

We record every change to the parent profile, child profiles, highlights and hidden products in a log: user ID, type of change, affected record, content before and after the change (which may include a child profile's name, age and filters), app version, platform, request ID and IP address. The log serves security, the investigation of errors and abuse, and support; the app cannot read it. We delete it completely when the account is deleted. Only a deletion record remains (user ID, the account's creation and deletion time, app version, platform, request ID and IP address of the deletion request), which lets us prove that the deletion took place.

Legal bases

Providing the features (Art. 6(1)(b) GDPR); legitimate interest in security, abuse prevention and error analysis for rate limiting, logs and the change log (Art. 6(1)(f) GDPR); proof of deletion (Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 17 GDPR).

6. Sharing wishlists

When you turn on sharing for a child profile, our server creates a random, secret link. Anyone who knows it can see, at wishlist.choosl.net and without signing in, your child's first name, the occasion and the wishes with their status and the names of people who reserved something. So only pass the link on to people you want to show the list to.

Visitors can reserve gifts or mark them as bought and give a name when doing so, which is stored in your wishlist and shown to you in the app. When the page is visited, we record the time of the latest visit at most once a day. You can turn sharing off at any time; the link then stops working. Details on the visitor view are in the website privacy policy.

Legal basis: Art. 6(1)(b) GDPR.

7. Products, Amazon and affiliate links

The products in the app come from Amazon. The app loads product images directly from Amazon's servers, which for technical reasons gives Amazon your IP address. When you open a product, you switch to the Amazon website or app. The link contains our Amazon Associates tag so that Amazon can attribute a purchase to us. Amazon (Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg) then processes data as an independent controller under its own privacy notice. We receive no information from Amazon that identifies you. As an Amazon Associate we earn from qualifying purchases.

Products labelled "sponsored" may appear in the parent area. They are not selected based on personal data, and no data is passed to third parties for them.

8. Usage statistics (only with consent)

In the parent area we ask you once ("Help us improve Choosl") whether we may collect usage data. Only if you agree do we use Google Analytics for Firebase (Google). We then record screens viewed and events such as sign-in, upgrading a guest account, swiping, picked products (ASIN), sending the wishlist, purchase-status changes and error codes, plus device type, operating system, app version, an approximate location derived from the IP address (country, region), an app instance ID and your user ID. We do not record names, email addresses or free text.

The advertising ID is never collected; advertising signals are permanently switched off (Google Consent Mode: storage and use for advertising denied).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the app under Settings → Usage statistics; the choice applies to that device. Google keeps the data for at most 14 months.

9. Crash reports and performance monitoring

To keep the app stable we use Firebase Crashlytics and Firebase Performance Monitoring (Google). Both run independently of the consent for usage statistics; the consent dialog says so too.

• Crashlytics records, on crashes and technical errors, the error description with stack trace, device model, operating system and version, app version, time, an installation ID, your user ID and technical notes on what happened before the error – without names, email addresses or tokens; web addresses are shortened.
• Performance Monitoring measures loading times of the app, individual steps and network requests together with device, operating system, app version, country and network type.

The legal basis is our legitimate interest in a stable, error-free app (Art. 6(1)(f) GDPR). You can object (see "Your rights"). Google deletes crash reports after 90 days and performance data according to Google's own retention periods.

10. Protection against tampered apps (App Check)

So that only genuine Choosl apps can use our server, Firebase App Check verifies the integrity of the app and device: on Android with Google's Play Integrity API, on iOS with Apple's App Attest or DeviceCheck. Google or Apple process device and app characteristics for this; our server only receives a token confirming authenticity. The legal basis is our legitimate interest in security and abuse prevention (Art. 6(1)(f) GDPR).

11. Data on your device

The app stores the following only on your device; it is not sent to us:

• Parent PIN:only as a hash (PBKDF2 with a random salt) in the operating system's encrypted storage (iOS Keychain or Android Keystore), plus a counter of failed attempts.
• Unlocking with the device lock or biometrics: the operating system checks your fingerprint or face. The app only learns whether the check succeeded and stores your preferred unlock method.
• Your choice on usage statistics, display settings, onboarding progress, the most recently selected child and occasion, and temporarily the email address a sign-in link was sent to.

In addition there is the offline copy of your account data (see "Your data in the app"). When you delete the app, the operating system removes this data; entries in the iOS Keychain may remain until the device is reset. Legal basis: Art. 6(1)(b) GDPR; storing this on the device is strictly necessary for the features you use (Section 25(2) no. 2 TDDDG).

12. Children

Choosl is aimed at parents. Children use the app on their parents' device and under their supervision; the parent area is protected by a PIN or the device lock. Children have no account of their own and do not enter any personal data themselves. About children we process only what the parents enter in the child profile and the choices the child makes while swiping. The child sees only Amazon products within the filters the parents set. There are no ads and no sponsored products in the child view. Please enter only what the wishlist needs – a first name or nickname is enough.

13. Recipients and transfers to third countries

Beyond this we only pass on data where we are legally obliged to (Art. 6(1)(c) GDPR).

14. Retention and deletion

Deleting your account

In the app under Settings → Account → Delete account. We then immediately and permanently delete your parent profile, all child profiles and wishlists, the change log and your Firebase account record; shared links stop working. Without the app you can request deletion via www.choosl.net/delete-account or by email to support@choosl.net.

15. Your rights

You have the following rights regarding your personal data:

• access to the data we hold (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
• withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

An informal email to support@choosl.netis enough. So that we never hand data to the wrong person, we may ask you to identify yourself, for example via your account's email address.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

The authority competent for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

17. Changes to this policy

We update this privacy policy when our processing changes, for example when we add features. The version published here applies; the date at the top shows when it was last updated.