Privacy Policy for the Appearance App

Last updated: 14 October 2026

This is a translation for your information. Only the German version is legally binding.

1. Summary

Personal data means any information that relates to you.

2. Controller

The controller responsible for data processing in the app is:

Dominik Nagel, Ziegelstr. 73, 73084 Salach, Germany

Email: appearancefb@gmail.com

You can contact us by email or post with any questions about data protection. We are not required to appoint a data protection officer.

3. Download from the App Store and Google Play

You download the app from the Apple App Store or Google Play. Apple or Google process data such as your store account, the time of download and device data under their own responsibility. We have no influence on this. We only receive aggregated statistics from the stores (for example number of downloads), not data about individuals. For more information, see the privacy policies of Apple and Google.

4. Sign-in and account

(1) You need an account to use the app. You sign in with your Apple account (“Sign in with Apple”, provided by Apple Inc., USA, or Apple Distribution International Ltd., Ireland) or your Google account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Existing accounts with email address and password continue to work.

(2) Through Firebase Authentication we receive a user ID, your email address and, if you share it, your name. With Apple, you can choose to hide your email address; we then only receive a relay address from Apple. We never see your Apple or Google password. For existing email accounts, Firebase stores the password only in encrypted form (as a hash).

(3) Purpose: we need this data to create your account, sign you in securely and assign your content to your account, including across several devices and between iPhone and Android. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

(4) You can also disconnect Apple or Google in the settings of your Apple or Google account. You delete your account with us in the app under Settings (see section 17).

5. Your content in the app

(1) When you use the app, we store the content you enter yourself in your account. This includes in particular:

(2) We reduce the size of photos before uploading and remove embedded metadata such as the location where they were taken.

(3) Purpose: we store this content so that you can capture it in the app, find it again and use it on your devices. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

(4) What you write or record can be very personal and may, for example, contain information about your health or how you feel. We process such special categories of personal data only because and insofar as you voluntarily enter them in the app, and only to show them to you. The legal basis for this is your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting the entries concerned or your account.

(5) We do not look at your content. Exceptions apply only where this is necessary to fix a problem you reported, with your consent, to prevent abuse or because of a legal obligation.

6. Calendar, recaps and personal feed

(1) To create your calendar and your weekly, monthly and yearly recaps, an automated server function (Firebase Cloud Functions, EU region) summarises your activities, for example on which days you wrote a gratitude entry, saved a moment or completed a journey day. A short excerpt of the entry (for example the title) may be stored in the calendar.

(2) The app automatically decides which cards your feed shows. It takes into account which areas you use, how much of your own content exists and what you have seen recently. For example, areas you rarely use appear less often.

(3) Both serve only to make the app personal and varied for you. They have no legal or similarly significant effects on you. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). You can switch off recaps, memories in the feed and other elements in the settings.

7. Reminders and notifications

(1) Reminders you set in the app (for example for the evening check-in, a journey or a letter to your future self) are scheduled directly on your device. We also store the times you set in your account so they are the same on your devices.

(2) For push notifications from the server, a technical identifier (push token) is created for your device via Firebase Cloud Messaging and stored in your account. Delivery runs via the Apple Push Notification service on iPhone and via Google on Android.

(3) You only receive notifications if you allow them in your system settings. You can switch them off there or in the app at any time. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

8. Our own usage statistics

(1) To understand which areas of the app are used and what we should improve, we collect our own simple usage statistics. We do not use third-party analytics services for this.

(2) We record which areas you open and how long you use them, the number of app launches, the platform (iOS or Android), the app version, the approximate time of day and your progress in the journeys. These values are stored with your user ID, not with your name or email address. We only evaluate them in aggregated form, for example as daily figures for all users. The content of your entries is not recorded.

(3) The legal basis is our legitimate interest in improving the app and operating it reliably (Art. 6(1)(f) GDPR). You can object at any time by emailing appearancefb@gmail.com (see section 19).

9. Feedback and contact

(1) If you send us feedback via the app, we store your text together with your user ID, the type of feedback, platform, app version, system version and language. This technical information helps us understand problems.

(2) If you email us, we process your email address and the content of your message in order to reply.

(3) The legal basis is our legitimate interest in answering enquiries and improving the app (Art. 6(1)(f) GDPR), or the performance of the contract of use if it concerns a problem with the app (Art. 6(1)(b) GDPR). Please do not send us sensitive data via feedback.

10. Security and abuse protection

(1) The connection between the app and the server is encrypted. Access rules on the server ensure that only you can access your content.

(2) To protect against abuse and automated attacks, we use Firebase App Check. The app uses Apple (App Attest) or Google (Play Integrity) to check whether requests come from a genuine, unmodified version of the app. In addition, the app checks at launch whether your app version is still supported.

(3) You can protect individual areas with Face ID or your device lock. This check takes place exclusively on your device. We do not receive any biometric data.

(4) The legal basis for App Check and the version check is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

11. Access to your device

The app only asks for permissions that a feature really needs, and only when you use that feature. You can revoke any permission at any time in your system settings.

Permission

Purpose

Photos

To choose a picture for your moments or vision board. The app only sees the pictures you select.

Add photos (iOS)

Only when you save a card or recap as an image yourself.

Microphone

Only while you record a thought as a voice recording.

Notifications

For the reminders you set (section 7).

Face ID or fingerprint

To unlock protected areas. The check stays on your device.

Vibration, alarms, restart (Android)

For haptics and so that reminders arrive on time, even after a restart.

The app does not use location data, contacts, the device calendar or the camera.

12. Data on your device and widgets

(1) So that the app starts quickly and also works offline, it stores settings and a copy of your content (cache) on your device. Home screen widgets receive selected content for this purpose, such as an affirmation or your journey progress.

(2) This data stays on your device. It is deleted when you sign out, delete your account or uninstall the app. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR) and Section 25(2) no. 2 of the German TDDDG, because this storage is strictly necessary for the features you request.

13. Sharing and data export

(1) When you share content as an image, the app creates the image on your device and opens your system’s share function. You decide where to send it. The respective recipient or service is then responsible for further processing.

(2) Under Settings you can create an export of your data at any time: a designed PDF and a complete file in JSON format. The export is created on your device and handed to you. This also fulfils your right to a copy of your data and to data portability (Art. 15(3) and Art. 20 GDPR).

14. Service provider: Google Firebase

(1) To operate the app, we use Google Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes the data on our behalf under a data processing agreement (Art. 28 GDPR). We use:

(2) More information: Firebase privacy and security and Google Privacy Policy.

(3) The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR) and, for abuse protection, our legitimate interest (Art. 6(1)(f) GDPR).

15. Transfers to third countries

(1) We have chosen EU locations for the database and the server functions. However, some Firebase services (for example Authentication and Cloud Messaging) are operated globally. It therefore cannot be ruled out that data is transferred to Google LLC in the USA or to other Google companies outside the EU.

(2) Google LLC is certified under the EU-US Data Privacy Framework. There is therefore an adequacy decision of the European Commission for the USA (Art. 45 GDPR). In addition, Google has agreed to the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

(3) When you sign in with Apple and for push notifications on iPhone, data is also transferred to Apple. Apple Inc. is also certified under the EU-US Data Privacy Framework.

16. No advertising, no tracking, no automated decisions

(1) The app contains no advertising. We do not use an advertising ID, do not track you across other apps or websites and do not pass data on to third parties for advertising or marketing purposes. We do not sell data.

(2) We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automatic selection in the feed (section 6) only serves the presentation in the app.

(3) We only pass your data on to the service providers named in this policy or if we are legally obliged to do so.

17. Storage period and deletion

(1) We store your content and account data for as long as you have your account. You can delete individual entries yourself in the app at any time.

(2) If you delete your account in the app under Settings, we delete your account and all associated data, including photos, voice recordings, calendar, usage statistics and push token. A server function additionally checks that nothing is left behind. Simply uninstalling the app does not delete your account.

(3) We store feedback until we have dealt with it, for a maximum of two years; if you delete your account, the link to your account is removed. We delete emails once your enquiry has been dealt with and no statutory retention obligations apply.

(4) We may retain statistics that no longer relate to individual persons (for example the total number of app launches on a given day) indefinitely.

(5) Technical backups are automatically overwritten once their retention period has expired.

18. Minimum age

The app is intended for people aged 16 and over. We do not knowingly process data of younger children. If we become aware of this, we will delete the account.

19. Your rights

You have the following rights against us, which you can exercise at any time by emailing appearancefb@gmail.com:

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for example for usage statistics, you can object at any time on grounds relating to your particular situation. We will then no longer process this data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

20. Complaints to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

21. Changes to this privacy policy

We update this privacy policy when the app or the law changes. The current version is available in the app and at www.appearance.community/privacy-policy/. This policy is available in German, English, French and Spanish; the German version is binding.