Privacy Policy
1. Controller
The controller within the meaning of the GDPR is:
BlueBranch GmbH
Hans-Vogel-Straße 59
90765 Fürth
Germany
Phone: +49 9131 9430090
Email: hello@bluebranch.de
2. Overview: which data we process
Pepp processes the following categories of personal data:
- Account data: Name, email address, encrypted password, role (Owner/Parent/Child)
- Family data: Family name, member list (name, role, avatar)
- Usage data: Created and completed quests, credit transactions
- Communication data: Messages and photos in the family chat
- Profile picture: A photo of the user uploaded voluntarily
- Device data: Push notification token, operating system, app version
- Usage analytics: Pseudonymised event data (no PII, no advertising ID)
3. Legal bases
We process your personal data on the basis of the following legal bases of the GDPR:
- Art. 6(1)(b) GDPR – Performance of a contract: all data required to provide the app's functions (quests, credits, chat, user account).
- Art. 6(1)(a) GDPR – Consent: for optional services such as push notifications and anonymous usage analytics.
- Art. 6(1)(c) GDPR – Legal obligation: for legally required retention (e.g. accounting records).
- Art. 6(1)(f) GDPR – Legitimate interest: for the security of our systems and to improve the app.
4. Registration & user account
Using Pepp requires registration. You can register with an email address and a password or use a social sign-in (Google, Apple).
We store your name, your email address and an encrypted password on our servers. This data is required to provide the service (Art. 6(1)(b) GDPR).
Passwords are stored exclusively as a bcrypt hash – we have no access to your plaintext password.
5. Google Sign-In & Apple Sign-In
As an alternative to email registration, you can sign in with your Google or Apple account. In this case the respective provider transmits an identification token to our servers. We receive your name and email address in the process.
Google LLC: You can find more information about data processing by Google at https://policies.google.com/privacy.
Apple Inc.: You can find more information about data processing by Apple at https://www.apple.com/de/privacy/. With Apple Sign-In you can optionally have your email address hidden.
6. Push notifications
With your consent, Pepp sends push notifications to your device. For this, a device-specific push token is transmitted to and stored on our servers.
On iOS, notifications are delivered via the Apple Push Notification Service (APNs) . On Android we use Firebase Cloud Messaging (FCM) from Google LLC. These services process only the push token and the notification content – no other personal data.
You can disable push notifications at any time in your device's system settings. Legal basis: Art. 6(1)(a) GDPR.
7. Usage analytics (Amplitude)
We use Amplitude (Amplitude, Inc., 201 3rd Street, Suite 200, San Francisco, CA 94103, USA) for app analytics. Our Amplitude organisation is located in the EU data region – data is stored exclusively on EU servers.
Amplitude collects anonymised event data (e.g. page views, button clicks), no personal data (no name, no email), no advertising ID (disabled for the children's app), no IP address. All events are linked to a pseudonymous user ID, not to your email.
Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in improving the app). More information: amplitude.com/privacy.
8. Firebase Analytics (Google)
For conversion tracking within Google Ads we use Firebase Analytics (Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA). Firebase Analytics records certain app events such as successful registrations or purchases.
The advertising ID (IDFA/GAID) is completely disabled in Pepp (analytics_adid_collection_enabled: false). Firebase Analytics is disabled in the development environment. More information: firebase.google.com/support/privacy.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in conversion measurement for marketing purposes).
9. In-app purchases & RevenueCat
Premium subscriptions are processed exclusively via the Apple App Store or Google Play Store . BlueBranch receives no payment data (credit card number, bank details). Payment processing lies entirely with the respective app store.
To manage subscription status and entitlements we use RevenueCat, Inc. (633 Tasman Drive, San Jose, CA 95134, USA). RevenueCat receives your anonymous app user identifier and information about active subscriptions. No payment data is transmitted to RevenueCat. More information: revenuecat.com/privacy.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
10. User content (photos, messages)
Users can upload photos (as quest proof or profile picture), chat messages and comments in Pepp. This content is stored on our servers and is accessible exclusively to members of the respective family group.
Uploaded images are converted to WebP format on the server. Parents are responsible for ensuring that photos depicting minors are uploaded lawfully.
Legal basis: Art. 6(1)(b) GDPR.
11. Sharing data with third parties
We only share your data with third parties in the following cases:
- With processors within the meaning of Art. 28 GDPR (e.g. server hosting, analytics – each with a data processing agreement)
- When we are legally obliged to do so
- To protect our rights, your safety or the safety of others
We do not sell personal data to third parties. No data trading takes place.
12. Data storage & deletion
We store your data only as long as is necessary for the respective purpose:
- Account data: For the duration of the existing user account. After account deletion: without delay, unless statutory retention obligations prevent this.
- Chat messages, photos: For the duration of the family account or until manual deletion.
- Billing data: 10 years pursuant to Section 147 AO (German commercial and tax law).
- Analytics data: Anonymised, max. 12 months in Amplitude.
You can permanently delete your account at any time in the app under Settings → Account → Delete account. All personal data is then deleted without delay.
13. Your rights
Under the GDPR you have the following rights vis-à-vis us:
- Access (Art. 15 GDPR): You can request information about the data stored about you at any time.
- Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
- Erasure (Art. 17 GDPR): You can request the deletion of your data, unless statutory retention obligations prevent this.
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR): You can object to the processing of your data insofar as it is based on a legitimate interest.
- Withdrawal of consent (Art. 7(3) GDPR): You can withdraw consent you have given at any time.
- Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR): Bavarian State Office for Data Protection Supervision (BayLDA), www.lda.bayern.de.
To exercise your rights, please contact: hello@bluebranch.de
14. Data security
All data transfers between the app and our servers are encrypted with TLS/HTTPS . Passwords are stored exclusively as a bcrypt hash. Access rights are strictly limited to the necessary minimum.
Authentication tokens (JWTs) are stored on the device in the system's secure storage (iOS: Keychain/SecureStore, Android: EncryptedSharedPreferences).
15. Special provisions for minors
Pepp is designed as a family application. Children can only use the app via an invitation from a legal guardian. By inviting a child, the inviting parent expressly confirms that they are the legal guardian and consent to the child's use.
We never collect data from children for advertising purposes. The advertising ID is completely disabled. Children have no direct registration form – their accounts are created exclusively by parents.
16. Cookies & tracking on this website
This website (taschengeldapp.com) uses no tracking cookies. No data about browsing behaviour is collected. The website is purely informational and does not use third-party analytics.
17. Changes to this privacy policy
We reserve the right to adapt this privacy policy in the event of changes to the app or applicable law. The current version is always available on this page and in the app. In the event of material changes, we will inform you by email or in-app notification.
18. Privacy contact
If you have any questions about data protection, you can reach us at:
BlueBranch GmbH
attn. Data Protection
Hans-Vogel-Straße 59
90765 Fürth
Email: hello@bluebranch.de
This English privacy policy is a translation provided for your convenience. In case of any discrepancy, the German version is legally binding.