Privacy Policy — Vumble

1. Controller

The controller under the GDPR is:

Daniel Wulf (sole proprietor)
Virchowstraße 19
72800 Eningen unter Achalm
Germany
Email: info@vumble.de

Where this policy says “we”, it refers to the controller named above.

Data protection officer: Appointing one is not legally required, as the conditions of Art. 37 GDPR and § 38 BDSG are not met.

2. Scope

This policy applies to the mobile app Vumble for iOS and Android and to the associated website vumble.de.

3. The essential point: your data stays on your device

Vumble processes all data exclusively on your device.

• There is no server operated by us.
• There is no user account and no sign-in.
• No data is transmitted to us or to third parties.
• The app contains no analytics, tracking or advertising services and no automated crash reporting.

On Android, the published app does not hold the INTERNET permission. The operating system therefore technically prevents any network connection by the app. iOS has no equivalent system permission; there, the app simply contains no code that transmits data.

We never have access to your trips, your locations or your statistics. We can neither view them, disclose them, nor delete them — technically, they never reach us.

4. What data the app processes on your device

4.1 Movement and location data. The app automatically detects how you travel (still, walking, running, cycling or in a vehicle) and measures the distance covered, using your operating system’s activity recognition (Android Activity Recognition, Apple CMMotionActivity) and your location. This also happens while the app runs in the background or is closed (see section 5).

4.2 Information you provide. A first name or nickname (freely chosen, a made-up name is fine), your body weight, and optionally your gender. Weight and the optional gender entry are used solely to estimate your calorie expenditure and for no other purpose.

4.3 Values calculated from this. Distance travelled, estimated active calories, CO₂ comparison figures, daily statistics, your streak of active days and the resulting state of the mascot.

4.4 Remembered routes. When the app detects a vehicle trip, it asks whether you travelled by car, bus, train or scooter. At your request it remembers that answer for the route in question so it does not ask again. For this, the start and end points are stored locally, rounded to roughly 100 metres. No route and no movement profile is stored.

5. Location data in the background

The app collects your location even when it is closed or not in use. This is central to its purpose: trips should be detected automatically, without you having to start anything beforehand.

How this works technically:

• Android: A foreground service with a persistent notification keeps detection running. The notification is mandated by the operating system and shows you at all times that recording is active.
• iOS: Location use continues in the background, with accuracy significantly reduced while you are stationary. iOS displays a visible indicator (blue status bar).

Data minimisation: Only what is needed for the calculation is captured. Individual location points are consolidated into trip segments with distance and duration; a continuous route is not stored permanently.

Legal basis: Art. 6(1)(a) GDPR (consent), which you give by granting the motion and location permissions. You may withdraw it at any time with effect for the future by revoking those permissions in your device settings. The app continues to work with reduced functionality.

6. Permissions and why they are needed

Permission	Purpose
Physical activity / motion data	Detect whether you are walking, running, cycling or in a vehicle
Location (foreground)	Measure the distance covered
Location (background / “Always allow”)	Record trips while the app is closed
Notifications (Android)	Display the service notification required by the system

Every permission is explained before it is requested. You can revoke them at any time in your device settings.

7. No recipients, no third countries

The data processed in the app is not shared with third parties. There are no processors, no embedded analytics or advertising services, and no transfer to third countries.

Exceptions exist solely outside the app: when visiting the website (section 10) and when you share a graphic yourself (section 8).

8. Sharing graphics

You can share or save your results as an image. This happens only when you trigger it yourself.

The graphic is generated on your device and then handed to the app you select in the share dialog (for example a messenger or social media app). Any further processing is governed by that provider’s privacy policy, over which we have no influence.

Shared graphics contain aggregated figures only — no maps, no routes, no locations and no timestamps.

Legal basis: Art. 6(1)(a) GDPR (consent given by your selection in the share dialog).

9. Storage and retention

All data is held exclusively in the app’s protected storage area on your device. We store nothing.

The data remains there until you delete it. Since we hold no backup, it is irretrievably gone afterwards.

To delete all data completely: clear the app’s data in your device settings, or uninstall the app.

10. Website vumble.de

The website serves solely to provide information about the app and to host the legal notice and this privacy policy.

No cookies are set for analytics or marketing purposes, no web tracking takes place and no analytics services are embedded. No access to information on your device within the meaning of § 25 TDDDG occurs beyond what is strictly necessary to deliver the page.

When you visit the website, our hosting provider processes technically necessary server log data (in particular IP address, date and time of access, page requested, volume of data transferred) in order to deliver the page securely and to prevent abuse. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.

The website is provided by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. This may involve a transfer of server log data to the USA. The transfer is based on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

The domain vumble.de is registered through IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

11. Contacting us

If you contact us by email, we process the data you provide (email address, content of your message) in order to handle your enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. The data is deleted once the enquiry has been dealt with, unless statutory retention obligations apply.

The email service for info@vumble.de is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Server location: Germany.

12. Minimum age

The app is not directed at children. Valid consent for processing based on consent requires a minimum age of 16 in Germany under Art. 8 GDPR. Users under 16 may only use the app with the consent of a parent or guardian.

13. No automated decision-making

No automated decision-making, including profiling, producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place. The mascot’s state, the energy levels and your streak serve motivation only and have no legal effect on you.

14. Your rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).

In practice: because none of your app data reaches us, we can neither provide information about it nor rectify or delete it. You can do all of this yourself at any time, completely and immediately, via your device settings (see section 9). For data you send us by email, your rights apply to us without restriction.

To exercise your rights, contact: info@vumble.de

Right to withdraw consent. Where processing is based on your consent (Art. 6(1)(a) GDPR), you may withdraw it at any time with effect for the future — for the app, by revoking the permissions in your device settings. The lawfulness of processing carried out before withdrawal remains unaffected (Art. 7(3) GDPR).

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

16. Data security

The app’s data resides in the protected, app-private storage area of your device and is shielded from other apps by the operating system’s security mechanisms. The website is delivered encrypted via HTTPS/TLS.

17. Changes to this policy

We will update this policy if the processing or the legal situation changes. The current version is available in the app and at vumble.de/privacy; version and date are shown above. We will give appropriate notice of material changes.

18. Contact

Daniel Wulf
Virchowstraße 19, 72800 Eningen unter Achalm, Germany
Email: info@vumble.de