Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) describes how Peter Schmidt, an individual developer based in Germany (“Developer”, “we”, “us”, “our”), collects, uses, shares, and protects your personal data when you use the Numbio mobile application (“App”) and the Numbio website at numbio.com (“Website”).

We are the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Policy applies to both the App and the Website.

2. Information We Collect

2.1 Information You Provide

• Account registration data. When you create an account, we collect your email address and a password. If you sign in with Apple or Google, we receive the name and email address you choose to share, along with authentication tokens.

• Age. We collect your age to personalize content difficulty and categorize your age group.

• Training preferences. Your training intent (e.g., why you practice math) and daily training goal.

• Content you create. Custom trainings, including their names and settings.

• Feedback. Answers you give in the App, for example the reason you choose when deleting your account.

• Support communications. When you email us, we receive your email address and message. Emails started from the App also include your app version, device model, OS version, and a reference code containing your account and device identifiers, so we can find your account.

2.2 Information Generated Through Use

• Usage and progress data. Your practice sessions, results, progress, statistics, and interactions with content in the App.

• Purchase information. Your subscription status and purchase history, received from Apple through RevenueCat.

2.3 Device & Technical Information

• Device and diagnostic information. Device identifiers (such as the identifier for vendor), device model, OS and app version, crash reports, and performance data.

You are not required to provide personal data, but some features need it to work.

3. How We Use Your Information

Performance of contract (Art. 6(1)(b)) — We process data that is necessary to deliver the service you signed up for:

• Core app functionality (exercises, scoring, progress tracking) — using your account data, progress data, and activity logs.

• Content personalization — using your age and performance statistics to adjust difficulty.

• Cross-device sync — storing your data so your progress stays in sync across your devices.

• Subscription processing — using your account identifiers, email address, and device identifiers.

• AI features — using your practice data and statistics to generate personalized content.

Legitimate interest (Art. 6(1)(f)) — We process data where we have a legitimate business interest that does not override your rights:

• Analytics and app improvement — using usage events, device identifiers, and device information.

• Crash reporting and bug fixes — using crash reports, error context, and device information.

• Performance monitoring — using app performance metrics and device information.

• Security and fraud prevention — using account activity and device identifiers.

• Ads attribution measurement — using app usage events, device information, and your email address to measure the effectiveness of our advertising (Google Ads and Apple Ads). You can turn off Google Ads measurement in the App’s privacy settings.

• Refund requests — sharing data about your usage of purchased content with Apple when you request a refund, so Apple can decide on the request (see Section 4).

You have the right to object to processing based on legitimate interest (see Section 8).

Consent (Art. 6(1)(a)) — We only process the following data with your consent:

• Game Center leaderboards — sharing scores and achievements when you opt in via Game Center.

You can withdraw consent at any time by disabling the relevant feature. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. Information Sharing & Third Parties

We do not sell your personal data.

We share data with the following service providers for the purposes described in this Policy. Where these providers act as our processors, they process data under data processing agreements.

• Cloud infrastructure and backend services (Google LLC — Privacy Policy): Authentication, data storage and sync, analytics, crash reporting, performance monitoring, remote configuration, and AI-powered features.

• Subscription management (RevenueCat, Inc. — Privacy Policy): Account identifiers, contact information, device identifiers, and attribution data, including the Apple Ads attribution token.

• Ads measurement (Google LLC — Privacy Policy): App usage events and device information from Google Analytics, and your email address, used to measure our Google Ads campaigns.

• Leaderboards (Apple Inc. — Privacy Policy): Scores and achievements via Game Center.

• Refund processing (Apple Inc. — Privacy Policy): Information about your use of purchased content when you request a refund.

• Website hosting (Framer B.V. — Privacy Policy): IP addresses, browser and device data, and access logs, used to serve and secure the Website, plus aggregated usage statistics via Framer Analytics. The Website does not track visitors across other websites and does not respond to Do Not Track signals.

We may also share your information in the following circumstances:

• Legal obligations. When required by law, regulation, legal process, or governmental request.

• Protection of rights. To enforce our Terms of Use, protect our rights, privacy, safety, or property, or that of our users or the public.

• Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data would remain subject to this Policy.

• Aggregated or anonymized data. We may share data that has been aggregated or anonymized so that it can no longer identify you, for research, analytics, or business purposes.

5. AI-Powered Features

5.1 How We Use AI

Some features use AI models provided by Google (Gemini), for example the AI Coach and AI-generated exercises.

5.2 Data Sent to Google AI

When you use an AI feature, we send Google only the data that request needs, such as:

• Your practice data and performance statistics (exercise results, accuracy, response times, trends)

• Preferences you have set in the App, for example your learning goal or a chosen theme

• Your app language

We do not include your name, email address, or device identifiers.

5.3 Google’s Use of Your Data

Under Google’s terms for paid services, Google does not use this data to train its AI models.

For more information, see Google’s AI terms.

6. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside of the European Economic Area (EEA), including the United States, where our service providers (e.g., Google and RevenueCat) operate servers.

These transfers are protected by appropriate safeguards maintained by our service providers, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy or to comply with legal obligations. Your account data and progress are retained until you delete your account or we delete it as described below. Analytics and crash data are retained for limited periods under our service providers’ retention policies. Anonymized and aggregated data that can no longer identify you may be retained indefinitely.

Inactive guest accounts are deleted automatically after 12 months, together with their data. We may also delete other accounts after a period of inactivity.

8. Your Rights

8.1 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have the following rights under the GDPR:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.

• Right to rectification (Art. 16) — Request correction of inaccurate or incomplete data.

• Right to erasure (Art. 17) — Request deletion of your personal data (“right to be forgotten”).

• Right to restriction of processing (Art. 18) — Request that we limit how we use your data.

• Right to data portability (Art. 20) — Receive your data in a structured, commonly used, machine-readable format.

• Right to object (Art. 21) — Object to processing based on legitimate interest, including analytics and ads attribution.

• Right to withdraw consent — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

• Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority (see Section 12).

How to exercise your rights: Send an email to hello@numbio.com. To protect your privacy, we may verify your identity before processing your request. We will respond within the time limits set by law.

8.2 Account Deletion

You can delete your account at any time using the account deletion feature within the App.

Account deletion is permanent and irreversible. Upon deletion:

• We delete your account data from our servers.

• Your progress, statistics, custom trainings, and all other user data are permanently lost.

• Our service providers may keep some data under their own retention policies, and we may keep data that no longer identifies you directly, such as scores used for app-wide statistics.

Important: Deleting your account does not automatically cancel your subscription. You must manage and cancel your subscription through the App Store. See Section 14 of our Terms of Use for details.

9. Children’s Privacy

Numbio can be used by learners of all ages. During setup, we ask for the learner’s age to adjust exercise difficulty.

If the learner is below the age of digital consent in their country, a parent or legal guardian must set up and manage the App for them. By doing so, the parent or guardian acts on the child’s behalf, including giving any consent this Policy requires.

We process the same categories of data for all users regardless of age, as described in Section 2. Analytics and marketing measurement can be switched off at any time in the App’s privacy settings.

Parents can delete their child’s data at any time by deleting the profile in the App or by contacting hello@numbio.com.

10. Data Security

We use appropriate technical and organizational measures to protect your data. No method of transmission or storage is completely secure.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will tell you in the App or by email before they take effect. Where a change requires your consent, we will ask for it.

The “Last updated” date at the top of this Policy indicates when it was last revised.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Peter Schmidt
c/o POSTFLEX PFX-240-632
Emsdettener Str. 10
48268 Greven
Germany

Email: hello@numbio.com