Privacy policy

Controller

Matthias Cuadrado

Jochbergweg 7, 85748 Garching b. München, Germany

Email: dev@blub.me

Please send data protection requests to the email address above.

What data we store

• Without an account: Your calendar stays on your device only; we receive nothing from it. It is only uploaded once you sign up and connect your partner.
• Account: email address and password (stored only as a secure hash). If you use “Continue with Apple/Google”, we store your email address instead (with Apple, possibly an anonymous relay address), your name and an account identifier from the provider; we do not store the provider’s access tokens.
• Sign-ins: IP address and device/app identifier (user agent) per session, plus the day you last used the app (for deleting inactive accounts).
• Profile: display name, language, time zone, notification settings.
• Consent: version and time of your consent for personal content (as proof).
• Connection: who you are connected with and since when.
• Calendar: your photos (downsized, without location metadata), voice messages with their volume curve, videos with a preview image, optional messages, publishing and opening times.
• Reminders: whether you have turned them on and at what time. Your phone schedules the reminders itself; when they go off, no data is sent to us, Apple or Google.
• Purchases: product (“Christmas 2026” or “Lovvent Pro”), transaction number and purchase and expiry dates from the App Store or Google Play, to check the unlock for you and your connected partner. Your partner only sees that something is unlocked through you and until when. Our server verifies every purchase, every subscription renewal and any later refund directly with Apple or Google.
• Advertising: only in the free version from 5 to 20 December; see the “Advertising” section for details. On your device, the app only remembers on which day an ad was last shown.
• Security logs: IP address and time of sign-ins, codes and invitations, to limit abuse.
• Usage statistics only with your consent (default: off) – event names only, never pictures or messages.

Purposes and legal bases

Solely to provide the Advent calendar: sign-in, connecting with your partner, time-controlled unlocking, reminder settings and purchases. No selling of data, no tracking across other apps. There is advertising only in the free version from 5 to 20 December, and it is not personalised (see “Advertising”). Your content is never used for advertising.

• Account, calendars, content, reminder settings and purchases, including the unlock for your connected partner: to perform the contract of use (Art. 6(1)(b) GDPR).
• Advertising: your consent via Google’s consent form (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time under Profile → “Ad privacy”.
• Security logs: legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).
• Notice to your partner before your account is deleted due to inactivity: your partner’s legitimate interest in not losing the calendars made for them without warning (Art. 6(1)(f) GDPR).
• Usage statistics: your consent (Art. 6(1)(a) GDPR, Section 25 TDDDG), which you can withdraw at any time.
• Personal content (photos, voice messages, videos, messages) may contain special categories of personal data or allow conclusions about them, for example about health or sex life. For this, we additionally ask for your explicit consent after you sign in (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting your content or your account; processing carried out until then remains lawful.

Who can see your content

Only you and the partner you are currently connected with – your partner sees each door no earlier than the day it opens. Photos, voice messages and videos are kept in private storage; they can only be accessed through short-lived links checked by the server. If the connection is ended, your partner’s access ends immediately.

“View once”: Once your partner has viewed this photo, the server blocks their access to it. The file itself remains stored in your calendar, you can still see it, and it is deleted together with the calendar or your account. No app can completely prevent screenshots or photographing the screen with another device.

Service providers and transfers to the USA

• Neon (Databricks, Inc., USA): database with accounts, calendars and logs, server location Frankfurt.
• Cloudflare, Inc. (USA): the app’s servers (globally distributed network), file storage (stored in the EU), sending of verification codes and delivery of the website with these texts (no cookies or tracking; Cloudflare processes your IP address as technically necessary).
• Apple App Store and Google Play: processing and verification of purchases and subscriptions.
• Google AdMob (Google Ireland Limited, Ireland): advertising, see the “Advertising” section.
• Apple (“Sign in with Apple”) and Google (Google Sign-In): confirming your identity, only if you choose this way of signing in. Their privacy policies also apply.

We have data processing agreements with Neon and Cloudflare (Art. 28 GDPR). We base transfers to the USA on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, insofar as the provider is certified under it (list: dataprivacyframework.gov). Independently of this, EU Standard Contractual Clauses have been agreed in both contracts (Art. 46(2)(c) GDPR).

Advertising

In the free version, from 5 to 20 December the app shows at most one full-screen ad per day before a new door opens. Anyone with “Christmas 2026” or “Lovvent Pro”, including through their partner, sees no ads.

The ads are served by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We only request non-personalised ads and do not use an advertising ID (iOS: no tracking prompt, Android: advertising ID disabled). Google still processes data from your device, such as IP address, device type, operating system, language, the approximate location derived from the IP address and interactions with the ad, and may use local identifiers to limit how often ads are shown, prevent fraud and bill ads. Google does not receive your calendar content, your name or your email address.

Before an ad is loaded, the app asks for your consent via Google’s consent form (User Messaging Platform, IAB TCF). If you decline, you see no or only limited ads; the door opens either way. You can change your choice at any time under Profile → “Ad privacy”.

We are responsible for integrating the ads into the app; Google processes the data for serving ads as an independent controller. Google’s Privacy Policy (policies.google.com/privacy) and Google’s information on advertising (policies.google.com/technologies/ads) also apply. Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Retention and deletion

• Account, profile, calendars and content: as long as you use the app, so that you can still look at calendars from previous years. You can delete calendars and your account yourself at any time.
• Inactive accounts: If you haven’t used the app for 12 months, we delete your account with all calendars, photos, voice messages and videos. You’ll receive an email about 30 days beforehand. If you are connected with someone, they also receive a notice, because the calendars you made for them will then be gone. If you open the app before then, everything is kept.
• Unconfirmed sign-ups (email address never confirmed): after 7 days.
• Sign-in sessions: up to 30 days after last use or until you sign out.
• Verification codes: valid for 10 minutes, stored only as a hash and deleted no later than one day after they expire.
• Security logs: sign-in and code counters 1 day, invitation attempts 30 days.
• Purchases: as long as your account exists; the log of purchase notifications 13 months. Invoices and payment data are held exclusively by Apple or Google.
• Usage statistics: 13 months.
• Server logs: Cloudflare stores samples of requests (without link signatures) for up to 7 days and email delivery logs for up to 30 days.
• Backups: Neon keeps a restore window of 1 day; deleted data disappears from there no later than after that.

You can delete your account in the app at any time. This immediately deletes your profile, calendars, photos, voice messages, videos, sessions, statistics and purchase data, and the app removes the scheduled reminders from your phone. Calendars your partner made for you belong to their account and remain there.

Minimum age

The app is for people aged 18 and over. When signing up, you confirm that you are at least 18 years old.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a data protection supervisory authority. You can withdraw your consent to usage statistics at any time in the settings, and your consent for personal content by deleting your content or your account.

You can export a copy of your data as a file (JSON) at any time under Profile → “Download my data”. Your photos, voice messages and videos are listed in it; you can get copies of the files themselves on request to the address above.