Privacy Policy

As of: September 2026 · This policy applies to the Pepp Allowance & Chores app (iOS & Android) and to this website.

1. Controller

The controller within the meaning of the GDPR is:

BlueBranch GmbH
Hans-Vogel-Straße 59
90765 Fürth
Germany

Phone: +49 9131 9430090
Email: hello@bluebranch.de

2. Overview: which data we process

Pepp processes the following categories of personal data:

• Account data: Name, email address, encrypted password, role (Owner/Parent/Child)
• Family data: Family name, member list (name, role, avatar)
• Usage data: Created and completed quests, credit transactions
• Communication data: Messages and photos in the family chat
• Profile picture: A photo of the user uploaded voluntarily
• Device data: Push notification token, operating system, app version
• Usage analytics: Pseudonymised event data (no PII, no advertising ID)

3. Legal bases

We process your personal data on the basis of the following legal bases of the GDPR:

• Art. 6(1)(b) GDPR – Performance of a contract: all data required to provide the app's functions (quests, credits, chat, user account).
• Art. 6(1)(a) GDPR – Consent: for optional services such as push notifications and anonymous usage analytics.
• Art. 6(1)(c) GDPR – Legal obligation: for legally required retention (e.g. accounting records).
• Art. 6(1)(f) GDPR – Legitimate interest: for the security of our systems and to improve the app.

4. Registration & user account

Using Pepp requires registration. You can register with an email address and a password or use a social sign-in (Google, Apple).

We store your name, your email address and an encrypted password on our servers. This data is required to provide the service (Art. 6(1)(b) GDPR).

Passwords are stored exclusively as a bcrypt hash – we have no access to your plaintext password.

5. Google Sign-In & Apple Sign-In

As an alternative to email registration, you can sign in with your Google or Apple account. In this case the respective provider transmits an identification token to our servers. We receive your name and email address in the process.

Google LLC: You can find more information about data processing by Google at https://policies.google.com/privacy.

Apple Inc.: You can find more information about data processing by Apple at https://www.apple.com/de/privacy/. With Apple Sign-In you can optionally have your email address hidden.

6. Push notifications

With your consent, Pepp sends push notifications to your device. For this, a device-specific push token is transmitted to and stored on our servers.

On iOS, notifications are delivered via the Apple Push Notification Service (APNs) . On Android we use Firebase Cloud Messaging (FCM) from Google LLC. These services process only the push token and the notification content – no other personal data.

You can disable push notifications at any time in your device's system settings. Legal basis: Art. 6(1)(a) GDPR.

7. Usage analytics (Amplitude)

We use Amplitude (Amplitude, Inc., 201 3rd Street, Suite 200, San Francisco, CA 94103, USA) for app analytics. Our Amplitude organisation is located in the EU data region – data is stored exclusively on EU servers.

Amplitude collects anonymised event data (e.g. page views, button clicks), no personal data (no name, no email), no advertising ID (disabled for the children's app), no IP address. All events are linked to a pseudonymous user ID, not to your email.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in improving the app). More information: amplitude.com/privacy.

8. Firebase Analytics (Google)

For conversion tracking within Google Ads we use Firebase Analytics (Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA). Firebase Analytics records certain app events such as successful registrations or purchases.

The advertising ID (IDFA/GAID) is completely disabled in Pepp (analytics_adid_collection_enabled: false). Firebase Analytics is disabled in the development environment. More information: firebase.google.com/support/privacy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in conversion measurement for marketing purposes).

9. In-app purchases & Adapty

Premium subscriptions are processed exclusively via the Apple App Store or Google Play Store. BlueBranch receives no payment data (credit card number, bank details). Payment processing lies entirely with the respective app store.

To manage subscription status and entitlements and to display the subscription screen (paywall) we use Adapty (Adapty Tech Inc., 2093 Philadelphia Pike #9181, Claymont, DE 19703, USA). Adapty receives a pseudonymous user identifier (our internal account ID), information about purchases and active subscriptions, and technical device data (e.g. operating system, app version, IP address). No payment data is transmitted to Adapty. Adapty processes this data on our behalf (Art. 28 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework, in which Adapty participates, and on the EU Standard Contractual Clauses. More information: adapty.io/privacy.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

10. User content (photos, messages)

Users can upload photos (as quest proof or profile picture), chat messages and comments in Pepp. This content is stored on our servers and is accessible exclusively to members of the respective family group.

Uploaded images are converted to WebP format on the server. Parents are responsible for ensuring that photos depicting minors are uploaded lawfully.

Legal basis: Art. 6(1)(b) GDPR.

11. Sharing data with third parties

We only share your data with third parties in the following cases:

• With processors within the meaning of Art. 28 GDPR (e.g. server hosting, analytics – each with a data processing agreement)
• When we are legally obliged to do so
• To protect our rights, your safety or the safety of others

We do not sell personal data to third parties. No data trading takes place.

12. Data storage & deletion

We store your data only as long as is necessary for the respective purpose:

• Account data: For the duration of the existing user account. After account deletion: without delay, unless statutory retention obligations prevent this.
• Chat messages, photos: For the duration of the family account or until manual deletion.
• Billing data: 10 years pursuant to Section 147 AO (German commercial and tax law).
• Analytics data: Anonymised, max. 12 months in Amplitude.

You can permanently delete your account at any time in the app under Settings → Account → Delete account. All personal data is then deleted without delay.

13. Your rights

Under the GDPR you have the following rights vis-à-vis us:

• Access (Art. 15 GDPR): You can request information about the data stored about you at any time.
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data, unless statutory retention obligations prevent this.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR): You can object to the processing of your data insofar as it is based on a legitimate interest.
• Withdrawal of consent (Art. 7(3) GDPR): You can withdraw consent you have given at any time.
• Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR): Bavarian State Office for Data Protection Supervision (BayLDA), www.lda.bayern.de.

To exercise your rights, please contact: hello@bluebranch.de

14. Data security

All data transfers between the app and our servers are encrypted with TLS/HTTPS . Passwords are stored exclusively as a bcrypt hash. Access rights are strictly limited to the necessary minimum.

Authentication tokens (JWTs) are stored on the device in the system's secure storage (iOS: Keychain/SecureStore, Android: EncryptedSharedPreferences).

15. Special provisions for minors

Pepp is designed as a family application. Children can only use the app via an invitation from a legal guardian. By inviting a child, the inviting parent expressly confirms that they are the legal guardian and consent to the child's use.

We never collect data from children for advertising purposes. The advertising ID is completely disabled. Children have no direct registration form – their accounts are created exclusively by parents.

16. This website: cookies, analytics and app download

Hosting and server log files. This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit, the server processes technically necessary data (IP address, date and time, page requested, referrer, browser and operating system) to deliver and secure the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Consent. On your first visit we ask separately for two purposes: statistics (Google Analytics) and marketing (Google Ads). Without your consent, neither Google Tag Manager nor any analytics or advertising script is loaded. We store your choice in your browser's local storage (entry pepp-consent-v2, not a cookie). You can change or withdraw it at any time via the “Cookie settings” link in the footer or here. On withdrawal we delete this site's Google cookies (_ga, _gcl).

Google Analytics 4 and Google Tag Manager. Only if you consent do we use Google Analytics 4 and Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Cookies (e.g. _ga) are set and pseudonymous usage data is processed: pages visited, time on page, approximate location, device and browser, and events in the starter plan (e.g. which step was reached – without names and without free text). Google Analytics 4 does not store IP addresses. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). More information: policies.google.com/privacy.

Google Ads (marketing). Only if you consent to the marketing category may Google Ads services (Google Ireland Limited) be used via Google Tag Manager, for example to measure whether an ad led to a visit or an app install (conversion measurement) and to show relevant ads. Cookies (e.g. _gcl_au) may be set and data such as IP address, device information and click identifiers transmitted to Google; data may be transferred to the USA (EU-U.S. Data Privacy Framework). Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Starter plan (/start/). Your answers in the starter plan (e.g. your child's age, optional first name, savings goal) are kept only in your browser's session storage and are not sent to our server. They are deleted as soon as you close the tab.

App download via Adapty. When you tap “Start 7 days free” or “Straight to the store” on your smartphone, we forward you to the right app store via a link from our service provider Adapty (see section 9). Adapty receives your IP address, device and browser information, the time, and your starter plan choices as categories (age group, main topic, chosen task or value, reward type, language) – no names and no free text. This lets the app recognise on first launch that you already created a starter plan, take it over and spare you the questions you already answered; it also lets us measure how many installs come from the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a seamless transition from the website to the app and in measuring success). If you do not want this, you can search for and install the app directly in the App Store or on Google Play.

Explainer videos (YouTube). On some pages we embed explainer videos about Pepp that are hosted on YouTube (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the page loads, only a preview image from our own server is shown; a connection to YouTube is made only when you click the video. The video is then loaded in privacy-enhanced mode via youtube-nocookie.com, and Google receives in particular your IP address, browser and device information and the page you are on; during playback YouTube may use cookies or similar technologies. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent by clicking the video (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without a click, no data is sent to YouTube. More in Google's privacy policy: policies.google.com/privacy.

17. Changes to this privacy policy

We reserve the right to adapt this privacy policy in the event of changes to the app or applicable law. The current version is always available on this page and in the app. In the event of material changes, we will inform you by email or in-app notification.

18. Privacy contact

If you have any questions about data protection, you can reach us at:

BlueBranch GmbH
attn. Data Protection
Hans-Vogel-Straße 59
90765 Fürth
Email: hello@bluebranch.de

This English privacy policy is a translation provided for your convenience. In case of any discrepancy, the German version is legally binding.