Privacy Policy

Patrik Kluge, Rothemühleweg 35A, 38112 Braunschweig, Germany.

Contact for privacy requests: privacy@appik.net.

When you visit the website, server log data such as IP address, date, time, requested URL, referrer, browser, and device information may be processed to deliver the service securely and reliably.

When you sign in, APPIK processes account and session data through Auth.js and Keycloak, especially name, email address, session status, and technical tokens.

When you use profile or settings features, voluntary details such as display name, city, preferences, and settings may be stored.

Newsletter and waitlist forms process the email address you enter and, optionally, your name. Double opt-in is planned for production mailings.

Processing is used to provide the website, secure operations, manage user accounts, answer requests, and send product information that users voluntarily request.

Depending on the process, legal bases are Article 6(1)(b) GDPR, Article 6(1)(f) GDPR, and, for voluntary consent, Article 6(1)(a) GDPR.

Required cookies may be set for login, session protection, security, and technically necessary functions.

Your analytics choice is stored in your browser's local storage together with the time of the decision, so that the choice can be respected. Before you give explicit consent, no analytics code is loaded, nothing is stored on or read from your device for analytics, and no analytics data is sent, as required under Section 25 TDDDG.

With your explicit consent (Allow analytics), appik.net uses PostHog Cloud EU to understand and improve the website. One consent covers page views and page exits; a small set of interactions such as calls to action, sign-in starts, registration and passkey steps, and viewed updates; loading performance (web vitals); session replays; heatmaps of clicks, scrolling, and mouse movement; and feature flags used to test variants of the website.

Session replays record the page layout and your interactions with it, including mouse movement, clicks, and scrolling. All text on the page and every form input are masked, so replays show neither names, email addresses, nor what you type; network request contents and console messages are not recorded. Administration, sign-in, and API pages are never captured.

Analytics events contain the page path without query parameters or fragments, browser and device information, the app environment and release, and the selected interaction. IP-based location lookup is disabled, so your IP address is not used to determine your location; PostHog receives the IP address of your connection with each request. After sign-in, a pseudonymous account identifier links consented activity to your account; names, email addresses, profile content, and authentication tokens are never sent as analytics properties.

With consent, a pseudonymous identifier and session information are stored in your browser's local storage and session storage. They are used for at most 180 days: your consent then expires, the identifier is deleted, and you are asked again. Withdrawing consent stops capture immediately and deletes the identifier from your browser.

Independently of this choice, the server counts completed actions such as saved interests and access requests, without a device identifier, cookie, or your IP address. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in knowing how often these actions succeed. If you have allowed analytics, such a count is linked to your pseudonymous identifier.

Analytics are not used for advertising, retargeting, or cross-site tracking. You can change or withdraw your choice at any time through Analytics settings here or in the website footer.

Technical service providers may support hosting, authentication, email delivery, error analysis, and infrastructure. PostHog Cloud EU acts as a processor for consent-based product analytics and for the server-side counts described above. Providers are used only to the necessary extent.

Data is not shared with third parties for advertising purposes. Transfers to third countries occur only with a suitable legal basis and safeguards.

Server log data is stored only as long as required for security, error analysis, and operation.

Account and profile data remains stored while the account exists or while legal obligations require longer retention.

Newsletter or waitlist data is processed until withdrawal, unsubscribe, or completion of the respective purpose.

Analytics events are retained only as long as needed for product measurement. Your analytics choice remains on your device for 180 days, until you change it or clear site data, or until the scope of analytics changes and you are asked again.

Under the GDPR, you have rights to access, rectification, erasure, restriction of processing, data portability, and objection.

You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority.

APPIK uses technical and organizational measures to protect personal data against loss, misuse, and unauthorized access.

This policy will be updated when product scope, processors, or data processing changes materially.