Privacy Policy

This is the English translation of our German privacy notice (Datenschutzerklärung). ChipMates gemeinnützige GmbH is a German company, so the German version is legally authoritative. We provide this English version so English-speaking users can read the notice in their own language. If anything differs, the German version prevails.

Preamble

With this privacy notice we want to explain to you which types of your personal data (also referred to below simply as "data") we process, for which purposes, and to what extent. This notice applies to all processing of personal data carried out by us, both in the provision of our services and in particular on our websites, in mobile applications, and within external online presences such as our social media profiles (collectively the "online offering").

The terms used are not gender-specific.

Contents
* Preamble
* Controller
* Overview of processing
* Relevant legal bases
* Security measures
* International data transfers
* Rights of data subjects
* Cookies and local storage
* Provision of the online offering and web hosting
* AI-powered chat service
* Audio service
* Community tally
* Bot protection (Cloudflare Turnstile)
* Conversion measurement (Google Ads)
* Reach measurement
* Processors

Controller

ChipMates gemeinnützige GmbH
represented by Michael Strasser
Schusterstr. 50
79098 Freiburg im Breisgau, Germany
Email: [email protected]

No data protection officer has been appointed, as the legal requirements for this are not met (Sect. 38 BDSG, the German Federal Data Protection Act).

Overview of processing

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed:
* Contact data
* Content data
* Usage data
* Meta, communication, and procedural data

Categories of data subjects:
* Communication partners
* Users

Purposes of processing:
* Contact requests and communication
* Security measures
* Management of and response to inquiries
* Feedback
* Provision of our online offering and usability
* Information technology infrastructure

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection rules in your or our country of residence or establishment may apply. Should more specific legal bases be relevant in an individual case, we will inform you of these in this privacy notice.

• Consent (Art. 6(1)(a) GDPR)
• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

National data protection rules in Germany: In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The BDSG contains special rules on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transmission, and automated decision-making in individual cases including profiling. Data protection laws of the individual federal states may also apply.

Application of the GDPR and the Swiss FADP: This privacy notice serves to provide information both under the Swiss Federal Act on Data Protection (Swiss FADP) and under the General Data Protection Regulation (GDPR). For this reason, please note that, due to the broader territorial application and for clarity, the terms of the GDPR are used. In particular, instead of the terms "processing" of "personal data", "overriding interest", and "particularly sensitive personal data" used in the Swiss FADP, the terms "processing" of "personal data", "legitimate interest", and "special categories of data" used in the GDPR are used. The legal meaning of the terms is, however, still determined in accordance with the Swiss FADP where the Swiss FADP applies.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements to ensure a level of protection appropriate to the risk. These measures cover in particular safeguarding the confidentiality, integrity, and availability of data.

The measures include controlling physical and electronic access to the data, safeguarding availability and segregation, and establishing procedures for exercising data subject rights, erasing data, and responding to threats to the data.

TLS/SSL encryption (https): To protect users' data, we use TLS/SSL encryption. This ensures the secure transmission of data between our website and the user's browser.

International data transfers

Where we process data in a third country (outside the EU or the EEA), this is done only in accordance with the legal requirements.

Data transfers to third countries take place only where the level of data protection has been recognized by an adequacy decision, through standard contractual clauses, explicit consent, or in the context of legally required transfers.

EU-US Trans-Atlantic Data Privacy Framework: Certain companies in the USA provide a recognized level of data protection through the Data Privacy Framework (DPF), which has been recognized as safe within the scope of an adequacy decision.

United Kingdom (AI inference in the free mode): The primary model of the free mode is served by Nebius from a data center in the United Kingdom. What is transferred is the text of your messages and the model's reply, no name, no account data and no IP address. The European Commission recognizes the United Kingdom as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR, renewed on 19 December 2025 and in force until 27 December 2031), so this transfer requires no additional safeguards. Should that decision lapse, the standard contractual clauses contained in our data processing agreement with Nebius apply as the safeguard. The fallback model runs in Finland (EEA).

Rights of data subjects

As a data subject, you have various rights under the GDPR, including:

• Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object to the processing of your data based on Art. 6(1)(f) GDPR (legitimate interest). This concerns in particular processing for security and rate-limiting purposes.
• Right to withdraw consent
• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Erasing your data: Because all chat data is stored exclusively locally on your device (encrypted in IndexedDB), you can remove it completely at any time by clearing your browser data. Server-side erasure is not necessary, as we do not store chat content on our servers.

Competent supervisory authority: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Cookies and local storage

We do NOT use tracking, analytics, or marketing cookies. The only cookie use is by Cloudflare (__cf_bm, and after a security check cf_clearance), technically necessary security cookies for bot protection and firewall (Sect. 25(2) No. 2 TDDDG, the German Telecommunications-Digital-Services Data Protection Act). These cookies are set automatically by Cloudflare and require no consent.

Provision of the online offering and web hosting

We process users' data in order to provide our online services. For this purpose we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

Types of data processed:
* Usage data

Data subjects:
* Users

Legal bases:
* Legitimate interests (Art. 6(1)(f) GDPR)

Web hosting: The website is delivered via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) as a content delivery network. Cloudflare is certified under the EU-US Data Privacy Framework (DPF). When delivering the static website files (HTML, CSS, JavaScript), IP addresses are recorded in Cloudflare access logs. No chat content, audio data, or other user data is processed via Cloudflare Pages.

Audio servers: For voice processing (TTS/STT) we operate our own servers at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Locations: Falkenstein and Nuremberg, Germany. Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy.

Data is collected on the basis of Art. 6(1)(f) GDPR. The operator has a legitimate interest in the technically error-free presentation and reliable provision of the service.

AI-powered chat service

Our chat service uses artificial intelligence (AI) to generate educational content. The following data is processed:

Data processed:

• Your chat inputs, together with the conversation so far, which the app sends with each message so the figure can answer in context
• Technical data: IP address, time, and a random browser ID that the app keeps in your browser for the daily free quota
• Language setting

Purpose of processing: Provision of the AI-powered educational service (Art. 6(1)(b) GDPR, performance of a contract).

Processors:

• Nebius B.V. (Netherlands), processing in uk-south1 (United Kingdom) and eu-north1 (Finland, EEA). Purpose: AI inference (text generation) in the free mode. The primary model answers from the United Kingdom. The fallback model in Finland answers when the primary model's daily budget is used up or the model is unavailable. No data retention (Zero Data Retention enabled, which Nebius applies to our whole organization account and to every region). No training on user data. The data processing agreement is integrated into the Nebius terms of use.
• Cloudflare, Inc. (USA), processing predominantly in Europe. Purpose: API proxy, security (WAF, bot protection), rate limiting. The data processing agreement is available in the Cloudflare dashboard. EU Cloud Code of Conduct compliance mark.

Your own key (BYOK): If you add your own OpenRouter key, your browser sends your typed messages straight to OpenRouter, Inc. (USA), under your own OpenRouter account and its terms. These messages do not pass through our servers, and we do not see or receive them. Your key is stored only in your browser, encrypted. While the "Zero Data Retention" switch is on (the default), the app asks OpenRouter to route only to providers that keep no data. OpenRouter's privacy policy: https://openrouter.ai/privacy.

Storage period: We do not store chat content on our servers. Each message passes through our server to the AI model, and the answer streams back to your browser. Our server logs record errors without message content. To enforce the daily free quota and protect the service, our servers keep the random browser ID and the IP address, or a hash of it made with a secret key, for at most 24 hours. When the content filter blocks a message, we keep a security record without the message text for up to 90 days: the time, the kind of block, the figure, the mode, the language and a hash of the IP address made with a secret key (pseudonymized). IP addresses never enter our analytics records.

Note: Please do not enter personal data (name, address, phone number, email, bank details) into the chat.

Audio service (speech synthesis and speech recognition)

For speech output (text-to-speech) and speech input (speech-to-text) we use our own servers in Germany:

• Location: Hetzner GEX130, Falkenstein and Nuremberg, Germany
• Speech is generated and transcribed only on these servers
• For speech output, the text to be spoken is sent there, for example a figure's answer or a story. For speech input, your recording is sent there and turned into text.
• Both pass through our audio proxy at Cloudflare, which forwards them and stores nothing
• Texts and recordings are deleted right after processing. Your voice is not recorded or stored.
• To prevent abuse, the proxy keeps a hash of your IP address, made with a secret key, for up to 24 hours

Community tally

The Community page in the app can show how many people take part and their combined voting power. When you add yourself to the tally, the app creates a random ID for this browser, stores it in your browser (localStorage) and sends it to our server with your voting power and the number of figures you have completed, and again each time you open the Community page after that, so that each browser counts once. Our server keeps these values under a hash of the ID made with a secret key and deletes them 12 months after your last visit to the Community page. To prevent abuse, it also keeps a hash of your IP address, made with a secret key, for 6 hours.

Legal basis: Art. 6(1)(f) GDPR, our interest in a fair count. The ID on your device is needed for this feature you use (Sect. 25(2) No. 2 TDDDG).

Minors / users under 16

Pursuant to Art. 8 GDPR, persons under 16 require the consent of a parent or guardian to use the chat service insofar as personal data is processed.

We have implemented the following protective measures:

• Age confirmation before first use of the chat
• Notice of the requirement for parental consent
• Technical content safeguarding (multi-layered content filtering)
• Youth Protection Officer appointed (see Imprint)

Storage on your device

We do not use tracking, analytics or marketing cookies. Our pages and the app store the following in your browser.

Technically necessary for a function you use (Sect. 25(2) No. 2 TDDDG, no consent needed):

• Your conversations and progress (IndexedDB, encrypted with AES-256-GCM, only on your device), and app state such as reading progress, stories played and hints already seen (localStorage)
• Your own API key, if you use BYOK (IndexedDB, encrypted, only on your device)
• Language setting (localStorage)
• Consent to the terms of use, and age confirmation (localStorage)
• A random browser ID for the daily free quota, created when you open the app without your own key (localStorage) and renewed every day
• A random ID for the community tally, created only when you add yourself to it (localStorage)
• Your answer to the ad-measurement question, yes or no, with version and date, so that we can respect it (localStorage) for 12 months
• Short-lived data for the current tab (sessionStorage, deleted when the tab closes): what you picked on our pages before entering the app (figure, council, chapter, question), whether the home page has already taken you on to the app, summaries already made, and interface state such as whether an animation already played
• Cloudflare security cookies: __cf_bm (bot protection, 30 minutes) and, after a security check, cf_clearance

Only with your consent to ad measurement (Sect. 25(1) TDDDG, see "Conversion measurement"), in sessionStorage, deleted when the tab closes or when you withdraw:

• The ad's click ID
• Markers that stop a step from being sent to Google twice, and the seconds listened toward the 30-second step

You can remove all of it at any time by clearing your browser data.

Processors

Bot protection (Cloudflare Turnstile)

To protect against automated abuse we use Cloudflare Turnstile, a bot-protection service from Cloudflare, Inc. This loads an external script from challenges.cloudflare.com. Turnstile works in invisible mode (no CAPTCHA) and generates a security token to verify that the request comes from a real user. No personal data is transmitted to Cloudflare beyond the technically necessary connection.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in the security and integrity of the service.

Conversion measurement (Google Ads, only with your consent)

We run free ads through Google's program for nonprofits (Google Ad Grants). If you reach us through one of these ads, the web address contains a click ID issued by Google (gclid). Google can link it to your click and possibly to your Google account, so we treat it as personal data.

When you arrive through such an ad, we ask whether we may count your visit for Google. The question is optional, and the whole library stays open either way. If you are under 16, we ask you to say no. Until you answer, the click ID stays only in the page's memory and is not stored. If you say no, it is discarded, and your browser remembers the no. If you close the question with the X, that counts as a no for this visit: the click ID is discarded, nothing is stored and nothing is sent to Google. Your browser does not remember this no, so we ask again the next time you arrive through one of our ads. After any answer we also take the click ID out of the address bar, so a reload does not ask again and a shared link does not pass it on. An empty placeholder (gclid=) stays in its place, so our anonymous count still recognises a reload as an arrival from an ad. If you say yes, your browser keeps the click ID in this tab (sessionStorage) until the tab closes, and remembers the yes (localStorage) for 12 months, so that later visits through our ads are counted too. Visitors from our paid ads (their web address contains p=1) are never asked, and their click ID is discarded at once.

With your consent, our server sends Google the click ID each time you take one of these steps: saying yes to the question, opening the app from one of our pages, accepting the app's terms when you first enter it, listening to 30 seconds of audio, sending a first message to a figure, sending a third message in the same conversation, and using a council. With each step, Google receives the click ID, the step (as a conversion action), a value and a currency, the time, an order number (click ID plus step, so nothing counts twice) and a consent signal (use for measurement allowed, use for personalized advertising not allowed). Google receives neither the figure nor your country, no conversation content and no other data about you. No Google script or pixel runs on our pages. The transfer goes from our server to Google (Google Ads API).

Recipient: Google Ireland Limited and Google LLC (USA). A transfer to the USA can take place. Google is certified under the EU-US Data Privacy Framework. How Google uses data from partner sites: https://business.safety.google/privacy.

Storage period: We do not keep the click ID on our servers. For each step sent, we keep a record without the click ID (the step, the figure if there was one, and the time) for 90 days, to check that the counting works. Google keeps the data according to its own retention rules for advertising data.

Legal basis and withdrawal: Your consent (Art. 6(1)(a) GDPR and Sect. 25(1) TDDDG). You can withdraw it at any time with effect for the future: with the "Ad measurement" link at the foot of every page, or in the app under Settings › Legal & Privacy. Withdrawing deletes the stored click ID and records your no. After that, nothing more is sent.

Reach measurement

We count how our pages and the app are used, without cookies and without identifying anyone. When something happens, for example a page opens, a chat starts or a story plays, the page sends a short count to our server. Each count is one row with a few coarse labels, depending on what happened: what happened (for example "chat started" or "story finished"), the page path, the figure, the mode or chapter, the language (en or de), the country as a two-letter code that Cloudflare derives from the connection (for example DE, or XX when unknown), the type of device (mobile, tablet or desktop), how long our server took to answer, and for some steps a rough range instead of an exact number (for example "1 to 3 minutes listened"). Our measurement documentation lists every label. This is also how we count how often the question about our ads was on screen, and how often it was answered yes or no, or closed with the X.

When a visit starts, the count also notes in one coarse word what kind of place the visitor came from, for example "search", "Google ad", "AI assistant" or "direct". The page works this out from the address of the page that linked here, which browsers normally pass along, or for an ad from its mark in the address you arrive at, and keeps only that word. The same word can also go with the counts for entering the app, for the first chat and for the first real use, when you come into the app through a link on our pages. Real use means you typed a first message yourself, or heard two minutes or the first quarter of a story, a teaching or a council.

No count contains an IP address, a user ID or anything you typed. We build no profiles, and we do not recognize a browser from one visit to the next for counting. The counts are kept for 90 days.

Legal basis: Our legitimate interest in knowing whether our nonprofit service works and whom it reaches (Art. 6(1)(f) GDPR). The counts carry no identifier and cannot be traced back to a person by us, so they are not personal data (Recital 26 GDPR). For the counting, nothing is stored on your device and nothing already stored there is read, which is why we do not ask for consent under Sect. 25 TDDDG. What the app stores on your device for its own functions is listed under "Storage on your device".

Dispute resolution

We are not willing or obliged to participate in dispute resolution proceedings before a consumer conciliation body.