Skip to main content
Techlogia — AI and Web Development Berlin

Privacy Policy

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Jaciel Antonio Acea Ruiz
Prinzenallee 38
13359 Berlin, Germany
Email: kontakt@techlogia.de

2. Overview of Data Processing

Below, we inform you about the processing of personal data when using our website. Personal data is any data that can be related to you personally.

3. Hosting and Server Log Files

Provider: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.
Server location: Germany.
Data processing agreement: A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Hetzner.

Access data (server log files): Each time our website is accessed, the server automatically records:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the retrieved file
  • Amount of data transferred
  • Whether the retrieval was successful (HTTP status code)
  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the security and stability of the service).
Retention period: Log files are automatically deleted after 90 days.

4. Contact Form

When you use our contact form, we collect the following data:

  • Your name
  • Your email address
  • Your message
  • Time of the inquiry

Purpose: Processing your inquiry and communicating with you.
Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).
Retention period: Your inquiry is stored until you request deletion or the purpose of storage no longer applies.

5. Cookies

5.1 Technically Necessary Cookies

We use the following technically necessary cookies:

  • access_token: Authentication cookie for the admin area. httpOnly, secure, samesite=strict. Lifetime: 30 minutes.
  • refresh_token: Token renewal for the admin area. httpOnly, secure, samesite=strict. Lifetime: 7 days.

Legal basis: § 25 para. 2 TDDDG (technical necessity).

5.2 Analytics Cookies

Analytics cookies are only set with your explicit consent. You can revoke your consent at any time via the cookie banner.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

6. Web Analytics (Umami)

We use the self-hosted web analytics software Umami, which is designed with privacy in mind:

  • No personal data is stored
  • No cookies are set for analytics
  • No data is transmitted to third parties
  • Data is processed exclusively on our own server in Germany

Umami is only activated when you consent via the cookie banner.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

7. Download Tracking

When downloading our software products, we collect for statistical purposes:

  • IP address: Stored as SHA256 hash (one-way encryption). Reverse calculation to the original IP address is not possible.
  • User agent: Browser identification, truncated to 500 characters
  • Country: Two-digit country code (optional)
  • Timestamp: Date and time of download

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in analyzing software usage).

8. Fonts

This website uses the "Inter" font. The font is hosted locally on our server via Next.js Font Optimization. No connections to external servers (such as Google) are established when loading the font.

9. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7 para. 3 GDPR)
  • Right to lodge a complaint (Art. 77 GDPR) with the supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59-61, 10555 Berlin, Germany.

To exercise your rights, contact: kontakt@techlogia.de

10. Data Security

We implement technical and organizational security measures including TLS 1.3 encryption, HSTS, encrypted backups, role-based access control, brute-force protection, and regular security updates.

11. Data Transfer to Third Countries

All data processing within the scope of the website (techlogia.de) takes place exclusively on servers in Germany. No personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) during web usage.

An exception applies when using our mobile app (Techlogia App): distribution takes place via the app stores of Apple Inc. (Cupertino, California, USA) and Google LLC (Mountain View, California, USA). During store download, updates and any user-enabled device-level diagnostics or crash-reporting features, personal data (in particular device identifiers, the app's version and, where applicable, anonymized crash data) may be transferred to Apple or Google in the USA. The legal basis for this transfer is Art. 45(3) GDPR in conjunction with the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (confirmed by the EU General Court ruling of 3 September 2025); the Standard Contractual Clauses of the platform operators apply additionally. See the "Mobile App" section below for details.

12. No Automated Decision-Making

No automated decision-making including profiling pursuant to Art. 22 GDPR takes place.

12. Mobile App (Techlogia App)

Our mobile companion app "Techlogia App" for Android and iOS consumes the same backend API as the techlogia.de website. Backend-side processing (server logs, contact requests, Lab usage, admin area) takes place as described in the preceding sections. The following additionally applies to app usage:

12.1 Data flows between app and backend

  • User-Agent: every API request sends a User-Agent of the form TechlogiaApp/<version> (<platform>/<OS-version>). Purpose: distinguishing app from mobile web browser (routing, separate rate-limit pools, bypassing a web-only mobile block for the Lab platform).
  • App-Version header: every request includes an X-App-Version header (e.g. 1.2.3+45). Purpose: detecting outdated clients for targeted force-update recommendations (response header X-Min-App-Version).
  • IP address + server logs: as described in section 3 (retention 90 days).
  • Authentication: Lab learner login transmits JWT access/refresh tokens to the app via HTTPS.

Legal basis: Art. 6(1)(b) GDPR (provision of app functionality) and (f) GDPR (legitimate interest in abuse prevention, version compatibility, and security).

12.2 Local storage on your device

The app stores the following data exclusively on your device; no transfer to us or to third parties takes place:

  • Auth tokens (JWT access/refresh): stored encrypted in the iOS Keychain or Android EncryptedSharedPreferences (flutter_secure_storage).
  • Image cache: preview images of blog and news articles (cached_network_image); source is exclusively techlogia.de.
  • App settings: language (DE/EN), theme (light/dark/system), last selected tabs (shared_preferences).

All of this data is removed entirely from the device upon uninstall. Signing out from the app profile additionally deletes stored auth tokens immediately.

12.3 Platform operators as recipients (Apple App Store, Google Play)

The app is distributed exclusively via:

  • Apple App Store — Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
  • Google Play — Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

During download, updates and any device-level diagnostics/crash reports enabled by the user, the platform operators process inter alia: Apple/Google account ID, device identifiers, OS version, app version, country/region, timestamps, anonymized crash data where applicable. This processing takes place under the platform operators' own responsibility; we receive only aggregated, non-personal statistics (installations, crashes, country aggregate) from the respective developer consoles.

Privacy notices of the platform operators:

US transfer: Apple Inc. and Google LLC are listed under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, confirmed by EU General Court ruling of 3 September 2025). The legal basis for the transfer is Art. 45(3) GDPR; the Standard Contractual Clauses of the platform operators apply in addition.

12.4 Data processing currently NOT active

The Techlogia App currently does not process the following categories:

  • Push notifications: no push tokens (Firebase Cloud Messaging / Apple Push Notification Service) are collected, no push messages are sent.
  • Third-party crash reporting: no third-party crash reporting SDK (e.g. Sentry, Firebase Crashlytics) is integrated. Device-level crash reports to Apple/Google are controllable by the user in device settings.
  • Analytics / telemetry: no analytics SDK (e.g. Google Analytics for Firebase, Facebook SDK) is integrated. The web analytics solution (Umami, section 6) is not accessed in the app.
  • Tracking / advertising: no cross-device tracking (Apple IDFA / Android Advertising ID) and no advertising.

Should anything change (e.g. enabling push notifications in a future app version), this privacy policy and the privacy disclosures in the app stores (Apple "Privacy Nutrition Labels" and Google "Data Safety") will be updated before the relevant app version is released.

12.5 App-specific data subject rights

The rights named in section 9 (access, rectification, erasure, restriction, portability, objection, withdrawal, complaint) apply identically when using the app. Requests: datenschutz@techlogia.de.

As of: April 2026

Push notifications and in-app news (mobile app)

The Techlogia mobile app can deliver push notifications via Apple Push Notification service (APNs, Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA) and Firebase Cloud Messaging (FCM, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Data processed: device token (a technical identifier of the device for the push service), registration timestamp, platform (iOS/Android), optional device label and app version for diagnostics.

Legal basis: Art. 6 (1) (a) GDPR (consent), granted via the iOS/Android system push permission. You can disable push notifications at any time in the device settings or inside the app. Transfer to third countries: USA; both Apple and Google are certified under the EU-US Data Privacy Framework. Retention: until you log out or disable push notifications, after which the token is deleted. Tokens unused for more than 60 days are removed automatically.

News items shown in the app are edited centrally. Your read-status markers (which news items you have opened) are used exclusively to display the unread indicator in the app interface. No profiling or reach analysis takes place.

Processing in a school context

When our platform is used within a school context (school contract with a data processing agreement / DPA), additional rules apply. A school can — via its school admin — create teacher accounts; teachers in turn create classes with a class code and student accounts. In this mode the school is the controller under the GDPR, and we are processor under Art. 28 GDPR.

Class-code students do not have their own email account with us: login is done with the class code (provided by the teacher) plus the student's login name. For the student we store: an internal pseudonymous identifier, the login name, optionally the birth year (entered by the teacher) and learning progress in the lab. We do not store an email address, no password hash is used, no push tokens are registered.

The teacher sees the learning progress of their students (number of passed tasks, failed tasks). The teacher does not see the contents of the student's terminal or commands entered by the student, except under an explicitly enabled and DPA-provisioned supervised teaching mode. Student accounts are deleted no later than 90 days after the class is dissolved or the school contract ends.

OAuth login with Google and GitHub

As an alternative to classic email registration, you can sign in to our platform using an existing Google or GitHub account ("Sign in with Google" / "Sign in with GitHub"). When you choose this login path, you authorize us at first sign-in to read single-sign-on data. We obtain these data directly from the respective provider; you do not enter a password with us.

Google OAuth 2.0 (OpenID Connect)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Requested scopes: openid email profile.
Processed data: the email address stored with your Google account, your display name, your unique Google account identifier ("sub"). Optionally your Google profile picture if delivered with the profile scope; we do not store it permanently.
Google privacy policy: policies.google.com/privacy.

GitHub OAuth 2.0

Provider: GitHub Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA (subsidiary of Microsoft Corporation).
Requested scopes: read:user user:email — this lets us read your public profile name, your primary email address and your GitHub user ID. We explicitly do not request write access or access to your repositories.
Processed data: GitHub username, primary verified email address, GitHub user ID (numeric, unique).
GitHub privacy policy: docs.github.com/en/site-policy/privacy-policies.

What we do with these data

The email address obtained from Google or GitHub and the respective provider user ID are stored in our user database so that you can log back in with the same account on later visits. The display name or username is pre-filled into your profile but can be changed at any time. We do not build a profile across third-party sites; Google and GitHub also do not tell us which other sites you visit.

Legal basis: Art. 6 (1) (b) GDPR (contract performance — providing the user account at the user's request) and Art. 6 (1) (a) GDPR (consent given by clicking "Sign in with Google" / "Sign in with GitHub").
Transfer to the USA: Google LLC and GitHub Inc. are certified under the "EU-U.S. Data Privacy Framework" (adequacy decision of the EU Commission of 10 July 2023). This provides an adequate level of protection under Art. 45 GDPR. Should the adequacy decision be overturned, we will add Standard Contractual Clauses under Art. 46 GDPR.
Retention: as long as your account exists with us. Upon account deletion we remove the link to Google/GitHub.
Revocation: you can disconnect the linked account at any time in your account settings, or have your account with us deleted entirely. The app permission granted at Google / GitHub can additionally be revoked there (Google: "Third-party access to my account"; GitHub: Settings → Applications → Authorized OAuth Apps).

14. Techlogia CLI

The Techlogia CLI is an optional command-line tool for the learning platform and complementary features. It can be obtained from the official npm registry via npm install -g techlogia. The source code is published under the MIT licence at github.com/TechLogia-de/techlogia-cli.

14.1 Local data storage (tokens)

After successful login the CLI stores the JSON Web Tokens needed for session management (access and refresh token) exclusively on your device:

  • Preferably in your operating system's secure keychain (macOS Keychain, GNOME Keyring/libsecret, Windows Credential Manager) via the keytar library.
  • Fallback: in the file ~/.techlogia/tokens.json with file permissions 0600 (readable by your user account only).

These tokens are not shared with third parties and only leave your device as an Authorization header on HTTPS requests to our server techlogia.de. The command techlogia logout deletes the tokens locally and adds them to a server-side denylist (Redis blacklist) until they would naturally expire.

14.2 CLI identification (user agent)

Every API call sends a User-Agent header of the form TechlogiaCLI/<version> (<platform>; node-<version>), e. g. TechlogiaCLI/0.2.1 (darwin-arm64; node-v20.10.0). This header does not contain personal data. It is used solely to distinguish web from CLI traffic on the server side (rate-limit pools, mobile-browser blocking on routes unsuitable for small viewports).

14.3 Server log files

CLI API calls are recorded in the same server log files as browser calls (see section 3 — Hosting and server log files). The CLI itself does not send any additional telemetry.

14.4 Version check (update notifier)

On startup the CLI checks at most once a day whether a newer version is available. The update-notifier library sends an HTTPS request to the public npm registry (registry.npmjs.org, operator: GitHub Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA). This request goes directly from your device to npm; we do not receive any information about it. The legal basis for the international transfer is the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR). You can disable this check by setting the environment variable NO_UPDATE_NOTIFIER=1.

14.5 Lab VM terminal via the CLI

The command techlogia lab attach opens a WebSocket connection (wss://techlogia.de/api/lab/ws/terminal/…) to a lab VM that you have started. Keystrokes are forwarded by our server to the VM, screen output is relayed back. This processing is identical to the web terminal player and is subject to the same terms: keystrokes are processed only to relay them to the VM and to validate task checks. Audit-relevant events (provisioning, termination, suspensions) are logged under section 9 (Admin area and security).

14.6 Legal bases

  • Art. 6(1)(b) GDPR (performance of a contract) for authentication, lab sessions and API usage.
  • Art. 6(1)(f) GDPR (legitimate interest: platform security, stability, abuse detection) for sending the user agent and for server logs.
  • Art. 45(3) GDPR in conjunction with the EU-US Data Privacy Framework for the version check against the npm registry.

14.7 Uninstallation and revocation

You can uninstall the CLI at any time via npm uninstall -g techlogia. Any remaining tokens can additionally be deleted via techlogia logout from the keychain or fallback file. A full account deletion can be requested under section 10 (Your rights).

14.8 Open source

Because the CLI is open source under the MIT licence (see the GitHub link above), you can verify all data processing described here in the source code. We recommend technically-minded users to review the dependencies (axios, commander, ws, keytar) before installation.

15. Payment processing via Stripe

For the paid school and university licences of our learning platform “Lab” we use the payment processor Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). Stripe acts as our processor under Art. 28 GDPR; we have a Data Processing Agreement (DPA) with Stripe in place and EU Standard Contractual Clauses under Art. 46 GDPR cover any third-country transfers.

15.1 Data shared with Stripe

For contract and payment processing the following data are shared with Stripe:

  • Billing address (name of the school/institution, street, postal code, city, country)
  • VAT identification number (if provided)
  • Email address of the billing / school-admin contact
  • SEPA mandate data (IBAN, account holder) if SEPA direct debit is chosen
  • For card payments: the last 4 digits of the card and brand/type. The full card number is processed exclusively by Stripe at PCI-DSS Level 1 and is never transmitted to us.
  • Licence / subscription metadata (e.g. school slug, tier code, school-year period)

15.2 Legal basis and purpose

The legal basis is Art. 6(1)(b) GDPR (performance of the contract — school licence). The purposes are:

  • Initial and recurring billing of the annual school licence
  • Issuing invoices (PDF) and payment receipts
  • Handling chargebacks, refunds, and dunning processes
  • Tax / VAT calculation (Stripe Tax) including intra-EU B2B reverse charge
  • Fraud, money-laundering and duplicate-order prevention

15.3 Third-country transfer

Stripe Payments Europe, Ltd. is established in the EU; processing happens primarily on EU servers. For technical support some data may be transferred to the US parent company (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA). The transfer is based on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework dated 10 July 2023 (Art. 45 GDPR); additionally the EU Standard Contractual Clauses (Art. 46 GDPR) apply.

15.4 Retention

We keep invoicing and payment data for 10 years (§§ 257 HGB / 147 AO — statutory retention duties for business records under German law). During that period processing is restricted to satisfying these duties; afterwards the data are deleted.

15.5 Your rights

You may request access, rectification, erasure (within the statutory retention limits) and portability. Please address requests to the controller named in section 1. Stripe additionally offers its own access / deletion workflows at stripe.com/privacy which you can use in parallel.

Supplement 2026-05-26 — Additional Processing Activities

Contact Form

  • Name and email — to process and respond
  • Message — your inquiry
  • IP address — rate limiting
  • DOI token — inquiry processed only after email confirmation

Legal basis: Art. 6(1)(b) GDPR. Retention: until processed, max 6 months. Unconfirmed: deleted after 48h.

Blog Comments

  • Name (public), email (not public), comment text (public), IP hash (SHA-256, spam prevention)

Legal basis: Art. 6(1)(f) GDPR. Retention: until deletion by operator or author request.

Newsletter

  • Email, name (optional), DOI token

Legal basis: Art. 6(1)(a) GDPR (consent). Unsubscribe link in every email. Data deleted upon unsubscription.

Payment Processing (Stripe)

Stripe, Inc. (South San Francisco, USA) processes school license payments. Only Stripe customer ID and subscription status stored on our servers — no payment data. Legal basis: Art. 6(1)(b) GDPR. US transfer: EU-US DPF + SCCs.

EduPlaces — School Login (OIDC)

Schools can authenticate via EduPlaces SSO. School claims (ID, name, location) and teacher role transmitted via OIDC. EU-only processing. Legal basis: Art. 6(1)(b) GDPR.

TikTok Pixel (Marketing)

With marketing cookie consent, TikTok Pixel loads on all public pages. Only anonymous conversion signals sent — no PII. TikTok Technology Limited, Dublin, Ireland. Legal basis: Art. 6(1)(a) GDPR.

Server Log Retention Correction

Server logs with IP addresses are retained for 7 days (per DSK recommendation). A previous version stated 90 days — this was an editorial error, now corrected.

Supplement date: 2026-05-26

Supplement 2026-06-08 — Password Check (Pwned Passwords)

On the page /passwort-check we offer a free tool that lets you check whether a password has appeared in known data breaches. The check uses the principle of k-anonymity:

  • Your password is hashed with SHA-1 entirely within your browser. The password itself never leaves your device.
  • Only the first five characters of that hash are transmitted to the service. Neither the password nor the full hash is sent; the password cannot be reconstructed from these five characters.
  • The comparison of whether your password is affected then happens locally in your browser again.

Your browser sends the query directly to the Pwned Passwords API of the service „Have I Been Pwned“. For technical reasons your IP address is transmitted to the provider and its upstream content delivery network:

Have I Been Pwned Pty Ltd (Troy Hunt), Australia
Delivered via: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in providing a security tool that you actively invoke and in your interest in checking password safety. The query is triggered solely by your click on „Check“; merely opening the page sends no data to third parties.

Third-country transfer: Delivery is via Cloudflare (USA). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply additionally (Art. 46 GDPR).

Storage: Techlogia receives, processes and stores no data in connection with this feature. No cookie and no entry in local browser storage (localStorage/sessionStorage) are set. For pure reach measurement we keep an anonymous total count of checks performed (category „found“/„not found“) — without storing IP, without password and without hash. The general server logs (IP, 7 days) apply to this counting request, as for any page request. The entered password is discarded from the browser's memory immediately after the hash is computed.

Provider privacy notices: haveibeenpwned.com/Privacy · cloudflare.com/privacypolicy

Supplement date: 2026-06-08

Addendum 2026-06-09 — Email direct marketing & re-engagement

We send emails of a promotional or re-engaging nature solely on the following bases:

  • Newsletter (consent): only to subscribers who opted in via double opt-in (Art. 6(1)(a) GDPR). Unsubscribe any time via the link in every newsletter.
  • Existing-customer advertising (§ 7(3) UWG): existing customers may receive emails about our own similar products and services (Art. 6(1)(f) GDPR). You may object to this advertising at any time, free of charge.
  • Re-engagement for Lab learners: registered learners may receive reminders about a module they started themselves but have not yet completed (Art. 6(1)(f) GDPR; legitimate interest in re-activating our own users for their own learning activity). For this we process email, display name and the most recently worked-on module title.

Right to object (Art. 21 GDPR): every such email contains a one-click unsubscribe link. An objection is stored in a central suppression list checked before any further send; the address then receives no further such emails. Transactional and service emails (e.g. about your account) are not affected.

Sending is done via our own mail server (mail.techlogia.de); no external marketing providers are used. Where learners are minors, re-engagement is limited to their own learning activity and can be unsubscribed at any time.

Supplement 2026-06-13 — App usage statistics

Usage statistics of the mobile app

In the Techlogia app we measure — unless you have objected — an anonymous usage statistic to understand which areas are used and to improve the app. We collect only: the visited app area from a fixed list (e.g. „Blog“, „Lab terminal“), the session duration in seconds and a timestamp. To group related views we use a random, locally generated identifier (install_id) that is not linked to your account, e-mail or device hardware.

We transmit no personal data, no free text, no content and no precise device IDs. Processing is done as anonymous aggregate counters on our own server in Germany (retention 90 days). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in product improvement). You can object to this collection anytime in the app under Settings → Usage statistics (Art. 21 GDPR).

Supplement 2026-06-15 — Project configurator

Requests via the project configurator

When you use our project configurator, we process the details you provide about your project (project type, desired features, scope, budget range, timeframe and optional free text) together with your contact details (name, e-mail address and optionally company and phone number) in order to create a non-binding price estimate and a first requirements specification and to contact you regarding your request.

Processing is based on your consent (Art. 6(1)(a) GDPR) and for pre-contractual measures (Art. 6(1)(b) GDPR). We use a double opt-in procedure to confirm your e-mail address. The data is stored on our server in Germany and not shared with third parties. You can withdraw your consent at any time with effect for the future and request deletion of your request (info@techlogia.de).

Supplement 2026-07-12 — Sign in with Apple

Login via Apple („Sign in with Apple“)

You can alternatively sign in with your Apple account („Sign in with Apple“). From Apple we receive only: a pseudonymous user identifier („sub“), your e-mail address — optionally an Apple-generated private relay address („Hide My Email“) so we never see your real address — and, on first login only, optionally your name. There is no tracking via Apple; we receive no further profile or device data.

This data is used solely for account creation and login (legal basis Art. 6(1)(b) GDPR — performance of contract). Provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; see Apple’s privacy policy for details. Transactional e-mails (e.g. sign-in codes or system notifications) are sent to the address provided by Apple — for relay addresses Apple forwards them to your mailbox.

Supplement 2026-07-12 — Push notifications

Push notifications of the mobile app

If you enable notifications in the Techlogia app, your device generates a device identifier (push token) which we store so we can send you targeted notifications (e.g. new lab modules or a reminder that your lab environment will shut down automatically soon). For delivery the push token is transmitted to the Apple Push service (APNs); Apple forwards the notification to your device. No account content beyond the title and body of the notification is shared with third parties in this process.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via the iOS permission prompt. You can withdraw it at any time — either in iOS Settings → Notifications or by logging out of the app; the push token is then deleted. The delivery service provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.

Supplement 2026-07-17 — Error and crash diagnostics

Error reports (website, learning platform and app)

When a technical error or crash occurs on our website, in the learning platform or in the Techlogia app, the application transmits an error report to our own, self-hosted error-analysis system (Sentry, operated on our servers in Germany — there is no transfer to third parties or third countries). An error report contains: the technical error message including the program execution path, the affected page or app area, browser or device type and operating-system version, and a timestamp.

We have technically configured the reports so that they contain no passwords, login tokens, cookies, e-mail addresses or form input — such fields are automatically removed or masked before sending; IP addresses are not stored. Reports are automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, error-free operation).

Supplement 2026-07-17 — Anonymous performance measurement

Performance data (website, learning platform and app)

In addition to error reports, our applications transmit anonymous performance metrics to the same self-hosted analysis system (servers in Germany, no third-country transfer): the name of the accessed area or operation (e.g. „app start“, „load lab overview“), the loading duration in milliseconds, device type/operating-system version and a timestamp. This lets us identify slow areas and make the application noticeably faster.

The metrics contain no personal data, no input and no account linkage; only a sample of operations is transmitted. The data is automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, reliable operation).

Supplement 2026-08-07 — CRA reporting assistant

Processing in your browser

The CRA reporting assistant at /cra-meldeassistent processes all details of your case exclusively locally in your browser. Product names, vulnerability descriptions, timestamps, generated notification texts, PDF, JSON and calendar files are produced on your device and are not transmitted to us and not stored on our servers. Interim storage takes place in your browser's local storage and can be removed by you at any time via „discard case“ or by clearing your browser data.

Launch notification sign-up (CRA file)

After an export we offer to notify you when our paid follow-up product launches. We process only your email address together with the selected language and the time of your sign-up and confirmation. No link to your case is created, and none is transmitted.

Sign-up uses a double opt-in procedure: you first receive a confirmation email, and we only add you to the list once you click the link it contains. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future — via the unsubscribe link in every email or informally to info@techlogia.de. The data is kept in a list separate from the newsletter and is deleted after withdrawal or at the latest once the product has launched and the related information has ended.

Supplement 2026-08-08 — Signed-in devices

So that you can tell whether someone signs in to your account without permission, we keep an overview of your signed-in devices. We store: a device label derived from the browser or app identifier (e.g. „iPhone · Techlogia App 1.4.0“), the platform, the app version, the time of first and last use, and an approximate location at city and country level.

Your IP address is not stored for this feature and is not shown to you either. The approximate location is determined without passing data to third parties.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest and yours in the security of the account. Regulation (EU) 2024/2847 (Cyber Resilience Act) explicitly requires reporting on possible unauthorised access in Annex I Part I No. 2(d).

You can sign out individual devices at any time. Entries are deleted when you delete your account, and at the latest 90 days after the device in question was signed out. The data is part of your subject access request under Art. 15 GDPR.

You will receive a security notice when a previously unknown device signs in and when there are indications that your session is being misused. This notice cannot be switched off — a warning about an account takeover is not a message one can opt out of.

How do you like this page?