Skip to main content
Techlogia — AI and Web Development Berlin

Privacy Policy

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Jaciel Antonio Acea Ruiz
Prinzenallee 38
13359 Berlin, Germany
Email: kontakt@techlogia.de

2. Overview of Data Processing

Below, we inform you about the processing of personal data when using our website. Personal data is any data that can be related to you personally.

3. Hosting and Server Log Files

Provider: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.
Server location: Germany.
Data processing agreement: A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Hetzner.

Access data (server log files): Each time our website is accessed, the server automatically records:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the retrieved file
  • Amount of data transferred
  • Whether the retrieval was successful (HTTP status code)
  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the security and stability of the service).
Retention period: Log files are automatically deleted after 90 days.

4. Contact Form

When you use our contact form, we collect the following data:

  • Your name
  • Your email address
  • Your message
  • Time of the inquiry

Purpose: Processing your inquiry and communicating with you.
Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).
Retention period: Your inquiry is stored until you request deletion or the purpose of storage no longer applies.

5. Cookies

5.1 Technically Necessary Cookies

We use the following technically necessary cookies:

  • access_token: Authentication cookie for the admin area. httpOnly, secure, samesite=strict. Lifetime: 30 minutes.
  • refresh_token: Token renewal for the admin area. httpOnly, secure, samesite=strict. Lifetime: 7 days.

Legal basis: § 25 para. 2 TDDDG (technical necessity).

5.2 Analytics Cookies

Analytics cookies are only set with your explicit consent. You can revoke your consent at any time via the cookie banner.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

6. Web Analytics (Umami)

We use the self-hosted web analytics software Umami, which is designed with privacy in mind:

  • No personal data is stored
  • No cookies are set for analytics
  • No data is transmitted to third parties
  • Data is processed exclusively on our own server in Germany

Umami is only activated when you consent via the cookie banner.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

7. Download Tracking

When downloading our software products, we collect for statistical purposes:

  • IP address: Stored as SHA256 hash (one-way encryption). Reverse calculation to the original IP address is not possible.
  • User agent: Browser identification, truncated to 500 characters
  • Country: Two-digit country code (optional)
  • Timestamp: Date and time of download

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in analyzing software usage).

8. Fonts

This website uses the "Inter" font. The font is hosted locally on our server via Next.js Font Optimization. No connections to external servers (such as Google) are established when loading the font.

9. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7 para. 3 GDPR)
  • Right to lodge a complaint (Art. 77 GDPR) with the supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59-61, 10555 Berlin, Germany.

To exercise your rights, contact: kontakt@techlogia.de

10. Data Security

We implement technical and organizational security measures including TLS 1.3 encryption, HSTS, encrypted backups, role-based access control, brute-force protection, and regular security updates.

11. Data Transfer to Third Countries

All data processing within the scope of the website (techlogia.de) takes place exclusively on servers in Germany. No personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) during web usage.

An exception applies when using our mobile app (Techlogia App): distribution takes place via the app stores of Apple Inc. (Cupertino, California, USA) and Google LLC (Mountain View, California, USA). During store download, updates and any user-enabled device-level diagnostics or crash-reporting features, personal data (in particular device identifiers, the app's version and, where applicable, anonymized crash data) may be transferred to Apple or Google in the USA. The legal basis for this transfer is Art. 45(3) GDPR in conjunction with the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (confirmed by the EU General Court ruling of 3 September 2025); the Standard Contractual Clauses of the platform operators apply additionally. See the "Mobile App" section below for details.

12. No Automated Decision-Making

No automated decision-making including profiling pursuant to Art. 22 GDPR takes place.

12. Mobile App (Techlogia App)

Our mobile companion app "Techlogia App" for Android and iOS consumes the same backend API as the techlogia.de website. Backend-side processing (server logs, contact requests, Lab usage, admin area) takes place as described in the preceding sections. The following additionally applies to app usage:

12.1 Data flows between app and backend

  • User-Agent: every API request sends a User-Agent of the form TechlogiaApp/<version> (<platform>/<OS-version>). Purpose: distinguishing app from mobile web browser (routing, separate rate-limit pools, bypassing a web-only mobile block for the Lab platform).
  • App-Version header: every request includes an X-App-Version header (e.g. 1.2.3+45). Purpose: detecting outdated clients for targeted force-update recommendations (response header X-Min-App-Version).
  • IP address + server logs: as described in section 3 (retention 90 days).
  • Authentication: Lab learner login transmits JWT access/refresh tokens to the app via HTTPS.

Legal basis: Art. 6(1)(b) GDPR (provision of app functionality) and (f) GDPR (legitimate interest in abuse prevention, version compatibility, and security).

12.2 Local storage on your device

The app stores the following data exclusively on your device; no transfer to us or to third parties takes place:

  • Auth tokens (JWT access/refresh): stored encrypted in the iOS Keychain or Android EncryptedSharedPreferences (flutter_secure_storage).
  • Image cache: preview images of blog and news articles (cached_network_image); source is exclusively techlogia.de.
  • App settings: language (DE/EN), theme (light/dark/system), last selected tabs (shared_preferences).

All of this data is removed entirely from the device upon uninstall. Signing out from the app profile additionally deletes stored auth tokens immediately.

12.3 Platform operators as recipients (Apple App Store, Google Play)

The app is distributed exclusively via:

  • Apple App Store — Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
  • Google Play — Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

During download, updates and any device-level diagnostics/crash reports enabled by the user, the platform operators process inter alia: Apple/Google account ID, device identifiers, OS version, app version, country/region, timestamps, anonymized crash data where applicable. This processing takes place under the platform operators' own responsibility; we receive only aggregated, non-personal statistics (installations, crashes, country aggregate) from the respective developer consoles.

Privacy notices of the platform operators:

US transfer: Apple Inc. and Google LLC are listed under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, confirmed by EU General Court ruling of 3 September 2025). The legal basis for the transfer is Art. 45(3) GDPR; the Standard Contractual Clauses of the platform operators apply in addition.

12.4 Data processing currently NOT active

The Techlogia App currently does not process the following categories:

  • Analytics / telemetry: no analytics SDK (e.g. Google Analytics for Firebase, Facebook SDK) is integrated. The web analytics solution (Umami, section 6) is not accessed in the app.
  • Tracking / advertising: no cross-device tracking (Apple IDFA / Android Advertising ID) and no advertising.

Should anything change (e.g. enabling push notifications in a future app version), this privacy policy and the privacy disclosures in the app stores (Apple "Privacy Nutrition Labels" and Google "Data Safety") will be updated before the relevant app version is released.

12.5 App-specific data subject rights

The rights named in section 9 (access, rectification, erasure, restriction, portability, objection, withdrawal, complaint) apply identically when using the app. Requests: datenschutz@techlogia.de.

As of: April 2026

Push notifications and in-app news (mobile app)

The Techlogia mobile app can deliver push notifications via Apple Push Notification service (APNs, Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA) and Firebase Cloud Messaging (FCM, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Data processed: device token (a technical identifier of the device for the push service), registration timestamp, platform (iOS/Android), optional device label and app version for diagnostics.

Legal basis: Art. 6 (1) (a) GDPR (consent), granted via the iOS/Android system push permission. You can disable push notifications at any time in the device settings or inside the app. Transfer to third countries: USA; both Apple and Google are certified under the EU-US Data Privacy Framework. Retention: until you log out or disable push notifications, after which the token is deleted. Tokens unused for more than 60 days are removed automatically.

News items shown in the app are edited centrally. Your read-status markers (which news items you have opened) are used exclusively to display the unread indicator in the app interface. No profiling or reach analysis takes place.

Processing in a school context

When our platform is used within a school context (school contract with a data processing agreement / DPA), additional rules apply. A school can — via its school admin — create teacher accounts; teachers in turn create classes with a class code and student accounts. In this mode the school is the controller under the GDPR, and we are processor under Art. 28 GDPR.

Class-code students do not have their own email account with us: login is done with the class code (provided by the teacher) plus the student's login name. For the student we store: an internal pseudonymous identifier, the login name, optionally the birth year (entered by the teacher) and learning progress in the lab. We do not store an email address, no password hash is used, no push tokens are registered.

The teacher sees the learning progress of their students (number of passed tasks, failed tasks). The teacher does not see the contents of the student's terminal or commands entered by the student, except under an explicitly enabled and DPA-provisioned supervised teaching mode. Student accounts are deleted no later than 90 days after the class is dissolved or the school contract ends.

OAuth login with Google and GitHub

As an alternative to classic email registration, you can sign in to our platform using an existing Google or GitHub account ("Sign in with Google" / "Sign in with GitHub"). When you choose this login path, you authorize us at first sign-in to read single-sign-on data. We obtain these data directly from the respective provider; you do not enter a password with us.

Google OAuth 2.0 (OpenID Connect)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Requested scopes: openid email profile.
Processed data: the email address stored with your Google account, your display name, your unique Google account identifier ("sub"). Optionally your Google profile picture if delivered with the profile scope; we do not store it permanently.
Google privacy policy: policies.google.com/privacy.

GitHub OAuth 2.0

Provider: GitHub Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA (subsidiary of Microsoft Corporation).
Requested scopes: read:user user:email — this lets us read your public profile name, your primary email address and your GitHub user ID. We explicitly do not request write access or access to your repositories.
Processed data: GitHub username, primary verified email address, GitHub user ID (numeric, unique).
GitHub privacy policy: docs.github.com/en/site-policy/privacy-policies.

What we do with these data

The email address obtained from Google or GitHub and the respective provider user ID are stored in our user database so that you can log back in with the same account on later visits. The display name or username is pre-filled into your profile but can be changed at any time. We do not build a profile across third-party sites; Google and GitHub also do not tell us which other sites you visit.

Legal basis: Art. 6 (1) (b) GDPR (contract performance — providing the user account at the user's request) and Art. 6 (1) (a) GDPR (consent given by clicking "Sign in with Google" / "Sign in with GitHub").
Transfer to the USA: Google LLC and GitHub Inc. are certified under the "EU-U.S. Data Privacy Framework" (adequacy decision of the EU Commission of 10 July 2023). This provides an adequate level of protection under Art. 45 GDPR. Should the adequacy decision be overturned, we will add Standard Contractual Clauses under Art. 46 GDPR.
Retention: as long as your account exists with us. Upon account deletion we remove the link to Google/GitHub.
Revocation: you can disconnect the linked account at any time in your account settings, or have your account with us deleted entirely. The app permission granted at Google / GitHub can additionally be revoked there (Google: "Third-party access to my account"; GitHub: Settings → Applications → Authorized OAuth Apps).

14. Techlogia CLI

The Techlogia CLI is an optional command-line tool for the learning platform and complementary features. It can be obtained from the official npm registry via npm install -g techlogia. The source code is published under the MIT licence at github.com/TechLogia-de/techlogia-cli.

14.1 Local data storage (tokens)

After successful login the CLI stores the JSON Web Tokens needed for session management (access and refresh token) exclusively on your device:

  • Preferably in your operating system's secure keychain (macOS Keychain, GNOME Keyring/libsecret, Windows Credential Manager) via the keytar library.
  • Fallback: in the file ~/.techlogia/tokens.json with file permissions 0600 (readable by your user account only).

These tokens are not shared with third parties and only leave your device as an Authorization header on HTTPS requests to our server techlogia.de. The command techlogia logout deletes the tokens locally and adds them to a server-side denylist (Redis blacklist) until they would naturally expire.

14.2 CLI identification (user agent)

Every API call sends a User-Agent header of the form TechlogiaCLI/<version> (<platform>; node-<version>), e. g. TechlogiaCLI/0.2.1 (darwin-arm64; node-v20.10.0). This header does not contain personal data. It is used solely to distinguish web from CLI traffic on the server side (rate-limit pools, mobile-browser blocking on routes unsuitable for small viewports).

14.3 Server log files

CLI API calls are recorded in the same server log files as browser calls (see section 3 — Hosting and server log files). The CLI itself does not send any additional telemetry.

14.4 Version check (update notifier)

On startup the CLI checks at most once a day whether a newer version is available. The update-notifier library sends an HTTPS request to the public npm registry (registry.npmjs.org, operator: GitHub Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA). This request goes directly from your device to npm; we do not receive any information about it. The legal basis for the international transfer is the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR). You can disable this check by setting the environment variable NO_UPDATE_NOTIFIER=1.

14.5 Lab VM terminal via the CLI

The command techlogia lab attach opens a WebSocket connection (wss://techlogia.de/api/lab/ws/terminal/…) to a lab VM that you have started. Keystrokes are forwarded by our server to the VM, screen output is relayed back. This processing is identical to the web terminal player and is subject to the same terms: keystrokes are processed only to relay them to the VM and to validate task checks. Audit-relevant events (provisioning, termination, suspensions) are logged under section 9 (Admin area and security).

14.6 Legal bases

  • Art. 6(1)(b) GDPR (performance of a contract) for authentication, lab sessions and API usage.
  • Art. 6(1)(f) GDPR (legitimate interest: platform security, stability, abuse detection) for sending the user agent and for server logs.
  • Art. 45(3) GDPR in conjunction with the EU-US Data Privacy Framework for the version check against the npm registry.

14.7 Uninstallation and revocation

You can uninstall the CLI at any time via npm uninstall -g techlogia. Any remaining tokens can additionally be deleted via techlogia logout from the keychain or fallback file. A full account deletion can be requested under section 10 (Your rights).

14.8 Open source

Because the CLI is open source under the MIT licence (see the GitHub link above), you can verify all data processing described here in the source code. We recommend technically-minded users to review the dependencies (axios, commander, ws, keytar) before installation.

15. Payment processing via Stripe

For the paid school and university licences of our learning platform “Lab” we use the payment processor Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). Stripe acts as our processor under Art. 28 GDPR; we have a Data Processing Agreement (DPA) with Stripe in place and EU Standard Contractual Clauses under Art. 46 GDPR cover any third-country transfers.

15.1 Data shared with Stripe

For contract and payment processing the following data are shared with Stripe:

  • Billing address (name of the school/institution, street, postal code, city, country)
  • VAT identification number (if provided)
  • Email address of the billing / school-admin contact
  • SEPA mandate data (IBAN, account holder) if SEPA direct debit is chosen
  • For card payments: the last 4 digits of the card and brand/type. The full card number is processed exclusively by Stripe at PCI-DSS Level 1 and is never transmitted to us.
  • Licence / subscription metadata (e.g. school slug, tier code, school-year period)

15.2 Legal basis and purpose

The legal basis is Art. 6(1)(b) GDPR (performance of the contract — school licence). The purposes are:

  • Initial and recurring billing of the annual school licence
  • Issuing invoices (PDF) and payment receipts
  • Handling chargebacks, refunds, and dunning processes
  • Tax / VAT calculation (Stripe Tax) including intra-EU B2B reverse charge
  • Fraud, money-laundering and duplicate-order prevention

15.3 Third-country transfer

Stripe Payments Europe, Ltd. is established in the EU; processing happens primarily on EU servers. For technical support some data may be transferred to the US parent company (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA). The transfer is based on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework dated 10 July 2023 (Art. 45 GDPR); additionally the EU Standard Contractual Clauses (Art. 46 GDPR) apply.

15.4 Retention

We keep invoicing and payment data for 10 years (§§ 257 HGB / 147 AO — statutory retention duties for business records under German law). During that period processing is restricted to satisfying these duties; afterwards the data are deleted.

15.5 Your rights

You may request access, rectification, erasure (within the statutory retention limits) and portability. Please address requests to the controller named in section 1. Stripe additionally offers its own access / deletion workflows at stripe.com/privacy which you can use in parallel.

Supplement 2026-05-26 — Additional Processing Activities

Contact Form

  • Name and email — to process and respond
  • Message — your inquiry
  • IP address — rate limiting
  • DOI token — inquiry processed only after email confirmation

Legal basis: Art. 6(1)(b) GDPR. Retention: until processed, max 6 months. Unconfirmed: deleted after 48h.

Blog Comments

  • Name (public), email (not public), comment text (public), IP hash (SHA-256, spam prevention)

Legal basis: Art. 6(1)(f) GDPR. Retention: until deletion by operator or author request.

Newsletter

  • Email, name (optional), DOI token

Legal basis: Art. 6(1)(a) GDPR (consent). Unsubscribe link in every email. Data deleted upon unsubscription.

Payment Processing (Stripe)

Stripe, Inc. (South San Francisco, USA) processes school license payments. Only Stripe customer ID and subscription status stored on our servers — no payment data. Legal basis: Art. 6(1)(b) GDPR. US transfer: EU-US DPF + SCCs.

EduPlaces — School Login (OIDC)

Schools can authenticate via EduPlaces SSO. School claims (ID, name, location) and teacher role transmitted via OIDC. EU-only processing. Legal basis: Art. 6(1)(b) GDPR.

TikTok Pixel (Marketing)

With marketing cookie consent, TikTok Pixel loads on all public pages. Only anonymous conversion signals sent — no PII. TikTok Technology Limited, Dublin, Ireland. Legal basis: Art. 6(1)(a) GDPR.

Server Log Retention Correction

Server logs with IP addresses are retained for 7 days (per DSK recommendation). A previous version stated 90 days — this was an editorial error, now corrected.

Supplement date: 2026-05-26

Supplement 2026-06-08 — Password Check (Pwned Passwords)

On the page /passwort-check we offer a free tool that lets you check whether a password has appeared in known data breaches. The check uses the principle of k-anonymity:

  • Your password is hashed with SHA-1 entirely within your browser. The password itself never leaves your device.
  • Only the first five characters of that hash are transmitted to the service. Neither the password nor the full hash is sent; the password cannot be reconstructed from these five characters.
  • The comparison of whether your password is affected then happens locally in your browser again.

Your browser sends the query directly to the Pwned Passwords API of the service „Have I Been Pwned“. For technical reasons your IP address is transmitted to the provider and its upstream content delivery network:

Have I Been Pwned Pty Ltd (Troy Hunt), Australia
Delivered via: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in providing a security tool that you actively invoke and in your interest in checking password safety. The query is triggered solely by your click on „Check“; merely opening the page sends no data to third parties.

Third-country transfer: Delivery is via Cloudflare (USA). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply additionally (Art. 46 GDPR).

Storage: Techlogia receives, processes and stores no data in connection with this feature. No cookie and no entry in local browser storage (localStorage/sessionStorage) are set. For pure reach measurement we keep an anonymous total count of checks performed (category „found“/„not found“) — without storing IP, without password and without hash. The general server logs (IP, 7 days) apply to this counting request, as for any page request. The entered password is discarded from the browser's memory immediately after the hash is computed.

Provider privacy notices: haveibeenpwned.com/Privacy · cloudflare.com/privacypolicy

Supplement date: 2026-06-08

Addendum 2026-06-09 — Email direct marketing & re-engagement

We send emails of a promotional or re-engaging nature solely on the following bases:

  • Newsletter (consent): only to subscribers who opted in via double opt-in (Art. 6(1)(a) GDPR). Unsubscribe any time via the link in every newsletter.
  • Existing-customer advertising (§ 7(3) UWG): existing customers may receive emails about our own similar products and services (Art. 6(1)(f) GDPR). You may object to this advertising at any time, free of charge.
  • Re-engagement for Lab learners: registered learners may receive reminders about a module they started themselves but have not yet completed (Art. 6(1)(f) GDPR; legitimate interest in re-activating our own users for their own learning activity). For this we process email, display name and the most recently worked-on module title.

Right to object (Art. 21 GDPR): every such email contains a one-click unsubscribe link. An objection is stored in a central suppression list checked before any further send; the address then receives no further such emails. Transactional and service emails (e.g. about your account) are not affected.

Sending is done via our own mail server (mail.techlogia.de); no external marketing providers are used. Where learners are minors, re-engagement is limited to their own learning activity and can be unsubscribed at any time.

Supplement 2026-06-13 — App usage statistics

Usage statistics of the mobile app

In the Techlogia app we measure — unless you have objected — an anonymous usage statistic to understand which areas are used and to improve the app. We collect only: the visited app area from a fixed list (e.g. „Blog“, „Lab terminal“), the session duration in seconds and a timestamp. To group related views we use a random, locally generated identifier (install_id) that is not linked to your account, e-mail or device hardware.

We transmit no personal data, no free text, no content and no precise device IDs. Processing is done as anonymous aggregate counters on our own server in Germany (retention 90 days). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in product improvement). You can object to this collection anytime in the app under Settings → Usage statistics (Art. 21 GDPR).

Supplement 2026-06-15 — Project configurator

Requests via the project configurator

When you use our project configurator, we process the details you provide about your project (project type, desired features, scope, budget range, timeframe and optional free text) together with your contact details (name, e-mail address and optionally company and phone number) in order to create a non-binding price estimate and a first requirements specification and to contact you regarding your request.

Processing is based on your consent (Art. 6(1)(a) GDPR) and for pre-contractual measures (Art. 6(1)(b) GDPR). We use a double opt-in procedure to confirm your e-mail address. The data is stored on our server in Germany and not shared with third parties. You can withdraw your consent at any time with effect for the future and request deletion of your request (info@techlogia.de).

Supplement 2026-07-12 — Sign in with Apple

Login via Apple („Sign in with Apple“)

You can alternatively sign in with your Apple account („Sign in with Apple“). From Apple we receive only: a pseudonymous user identifier („sub“), your e-mail address — optionally an Apple-generated private relay address („Hide My Email“) so we never see your real address — and, on first login only, optionally your name. There is no tracking via Apple; we receive no further profile or device data.

This data is used solely for account creation and login (legal basis Art. 6(1)(b) GDPR — performance of contract). Provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; see Apple’s privacy policy for details. Transactional e-mails (e.g. sign-in codes or system notifications) are sent to the address provided by Apple — for relay addresses Apple forwards them to your mailbox.

Supplement 2026-07-12 — Push notifications

Push notifications of the mobile app

If you enable notifications in the Techlogia app, your device generates a device identifier (push token) which we store so we can send you targeted notifications (e.g. new lab modules or a reminder that your lab environment will shut down automatically soon). For delivery the push token is transmitted to the Apple Push service (APNs); Apple forwards the notification to your device. No account content beyond the title and body of the notification is shared with third parties in this process.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via the iOS permission prompt. You can withdraw it at any time — either in iOS Settings → Notifications or by logging out of the app; the push token is then deleted. The delivery service provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.

Supplement 2026-07-17 — Error and crash diagnostics

Error reports (website, learning platform and app)

When a technical error or crash occurs on our website, in the learning platform or in the Techlogia app, the application transmits an error report to our own, self-hosted error-analysis system (Sentry, operated on our servers in Germany — there is no transfer to third parties or third countries). An error report contains: the technical error message including the program execution path, the affected page or app area, browser or device type and operating-system version, and a timestamp.

We have technically configured the reports so that they contain no passwords, login tokens, cookies, e-mail addresses or form input — such fields are automatically removed or masked before sending; IP addresses are not stored. Reports are automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, error-free operation).

Supplement 2026-07-17 — Anonymous performance measurement

Performance data (website, learning platform and app)

In addition to error reports, our applications transmit anonymous performance metrics to the same self-hosted analysis system (servers in Germany, no third-country transfer): the name of the accessed area or operation (e.g. „app start“, „load lab overview“), the loading duration in milliseconds, device type/operating-system version and a timestamp. This lets us identify slow areas and make the application noticeably faster.

The metrics contain no personal data, no input and no account linkage; only a sample of operations is transmitted. The data is automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, reliable operation).

Supplement 2026-08-07 — CRA reporting assistant

Processing in your browser

The CRA reporting assistant at /cra-meldeassistent processes all details of your case exclusively locally in your browser. Product names, vulnerability descriptions, timestamps, generated notification texts, PDF, JSON and calendar files are produced on your device and are not transmitted to us and not stored on our servers. Interim storage takes place in your browser's local storage and can be removed by you at any time via „discard case“ or by clearing your browser data.

Launch notification sign-up (CRA file)

After an export we offer to notify you when our paid follow-up product launches. We process only your email address together with the selected language and the time of your sign-up and confirmation. No link to your case is created, and none is transmitted.

Sign-up uses a double opt-in procedure: you first receive a confirmation email, and we only add you to the list once you click the link it contains. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future — via the unsubscribe link in every email or informally to info@techlogia.de. The data is kept in a list separate from the newsletter and is deleted after withdrawal or at the latest once the product has launched and the related information has ended.

Supplement 2026-08-08 — Signed-in devices

So that you can tell whether someone signs in to your account without permission, we keep an overview of your signed-in devices. We store: a device label derived from the browser or app identifier (e.g. „iPhone · Techlogia App 1.4.0“), the platform, the app version, the time of first and last use, and an approximate location at city and country level.

Your IP address is not stored for this feature and is not shown to you either. The approximate location is determined without passing data to third parties: the lookup happens on our own server against a database held there (DB-IP City Lite, db-ip.com, licensed under CC BY 4.0). Your IP address never leaves our systems.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest and yours in the security of the account. Regulation (EU) 2024/2847 (Cyber Resilience Act) explicitly requires reporting on possible unauthorised access in Annex I Part I No. 2(d).

You can sign out individual devices at any time. Entries are deleted when you delete your account, and at the latest 90 days after the device in question was signed out. The data is part of your subject access request under Art. 15 GDPR.

You will receive a security notice when a previously unknown device signs in and when there are indications that your session is being misused. This notice cannot be switched off — a warning about an account takeover is not a message one can opt out of.

Supplement 2026-08-14 — Page speed measurement on the website

Page speed metrics

In addition to page views, our self-hosted analytics (Umami, servers in Germany) records page speed metrics for the page you open: the point in time at which the largest visible content is rendered, unexpected layout shifts during page construction, the response time to the first interaction, the first visible content and the server response time. Alongside these we store the page path, a coarse device class (mobile, tablet or desktop), browser and operating-system family and a timestamp.

The sole purpose is to identify slow pages and make the site faster. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fast, reliable service).

Retention: The metrics are stored together with the remaining access statistics on our own servers in Germany. They are automatically deleted after 14 months at the latest. Deletion runs daily and is logged. The period allows page speed to be compared across a full year including seasonal variation.

As with the rest of our analytics, collection happens without cookies: no identifiers are stored on or read from your device, there is no link to a user account, and the data never leaves our own servers in Germany. No transfer to third countries takes place. You can object to analytics via the cookie notice as before.

Explicitly not collected are session recordings (session replay), mouse and click heatmaps, or form field input. These features exist in the analytics software in use and remain deliberately switched off.

Push notifications and crash diagnostics are active. Both are described in the sections „Push notifications and in-app news (mobile app)“ and „Error and crash diagnostics“ of this policy — including the data processed, the legal basis and the retention period. Crash diagnostics transmit exclusively to our own self-hosted system in Germany; no transfer to third parties takes place.

Supplement 2026-10-04 — Retention of server and security logs

This information replaces all earlier statements in this policy on the retention of log files and server logs (stated there as 90 days or 7 days).

  • Web server access logs (IP address, time, requested address without query parameters, status code, browser identifier): 14 days, then deleted automatically.
  • Application logs of the platform (including IP address, requested path, status code, internal account identifier; passwords, tokens and e-mail addresses are automatically removed or masked before storage): 7 days.
  • Security and system logs in our central logging system (sign-ins to our servers, system events, audit logs; these may contain IP addresses): 12 months, then deleted automatically.

Purpose: to detect attacks, misuse and faults and to be able to investigate them even if they only come to light weeks or months later, and to demonstrate the security of our systems (information security under BSI IT-Grundschutz and ISO/IEC 27001). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and integrity of our services and your data.

The logs are stored on our own servers in Germany (Hetzner, Falkenstein data centre), are not passed on to third parties and can only be viewed by administrators over encrypted connections. Individual entries are kept longer only where this is necessary to investigate a specific security incident or to pursue legal claims.

Supplement 2026-10-07 — Learning events in the Lab

To improve the learning platform — for example to see which task learners get stuck on, which hints are too brief and whether learners come back — we store learning events for your Lab account:

  • your first visit to the Lab on a given day, opening the module catalogue, lessons and tasks, opening hints (including the hint level) and the solution, completing a lesson and reaching the daily quota,
  • that the terminal of your practice VM was connected and when you first typed something,
  • in each case the time, the module or task concerned and whether you used the website or the app; for practice sessions also whether they were started from the website or the app.

For school accounts (sign-in with a class code or via Eduplaces) we store no learning events: we process their data solely on behalf of the school.

We store no terminal content (no commands, no output), no IP addresses and no free text. Evaluation is aggregated (e.g. „share of learners who pass a task“) in our administration area; there is no disclosure to third parties, no advertising and no profiling with legal effect. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the learning platform and its tasks. Retention: 13 months, after which the events are deleted automatically; they are deleted immediately together with your account. The events are part of your data access request (Art. 15 GDPR, „Download my data“). You can object to this processing at any time (Art. 21 GDPR) by e-mail to datenschutz@techlogia.de.

Supplement 2026-10-08 — Quiz answers and reflections in the Lab

In the Lab you can answer knowledge checks (quiz questions without a practice VM) and, at the end of a lesson, optionally save a short reflection („What do you take away?“, at most 500 characters). For this we store for your Lab account:

  • for each quiz question you answer, whether your answer was correct and when — not the answer you chose,
  • the text of your reflection, the lesson it belongs to and the time.

Answering a quiz question (correct or wrong, without the answer itself) is also one of the learning events described in the section „Learning events in the Lab“ — with the same legal basis, retention period and exception for school accounts.

Purpose: showing your learning progress (which questions you already answer reliably), suggesting questions for review later and improving the tasks. Only you see your reflections, in your data access export; we do not evaluate them individually and do not pass them on. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre).

The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use). For school accounts we process the data on behalf of the school. Retention: 13 months, after which quiz answers and reflections are deleted automatically; they are deleted immediately together with your account. They are part of your data access request (Art. 15 GDPR, „Download my data“). A reflection is optional — everything works the same without it.

Supplement 2026-10-08 — Review, learning streak and personal notices in the Lab

So that you do not forget what you have learned, the Lab suggests short reviews (quiz questions without a practice VM). For this we store for your Lab account, per skill you practised (e.g. „disable SSH root login“): a review level from 0 to 4, when the next review is due, whether the last review was correct, how often you reviewed and when you last did. We do not store the answers you chose.

From your learning activity (checked tasks, quiz questions, reviews) we calculate your learning streak (days or weeks in a row). No new data is stored for this, only your setting „count weeks or days“ and whether the streak should be shown. For learners under 16 it is hidden by default.

Personal notices may appear in the bell in the Lab, e.g. a new badge, a finished module with a suggestion for the next one, „almost done“ (module at least 70 % done and untouched for two days, at most once per module) or „reviews are due today“ (at most twice a week). We send no emails and no push notifications for this. No notices are created between 9 pm and 7 am; after 30 days without learning activity we stop reminding you. Learners under 16 and school accounts get no reminders, only notices about badges and completions.

Purpose: reviewing material at the right time and making your progress visible. The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use); for school accounts we process the data on behalf of the school. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre). Retention: the review level is kept as long as your account exists and is deleted immediately with it; personal notices are deleted automatically after 180 days. Both are part of your data access request (Art. 15 GDPR, „Download my data“).

Supplement 2026-10-08 — Learning path certificates and class weekly goal in the Lab

Learning path certificates. Once you have completed all modules of a learning path, you can issue a certificate if you want to. For this we store: your display name at the time of issue, the path, the modules it contains, the date and a random, unguessable verification code. Via the verification link (techlogia.de/verify/…) anyone who knows the link can check that it is genuine; they only see display name, path, date and modules — no real name, no email address and no individual results. So choose a display name you are happy to share.

The legal basis is Art. 6(1)(b) GDPR (providing the function you use). Retention: until you withdraw the certificate (at any time under „My progress“; the verification link stops working immediately) or delete your account. Certificates are part of your data access request (Art. 15 GDPR).

Class weekly goal. If your teacher sets a weekly goal, the class only sees the total of tasks solved this week — no names, no individual values, no ranking. No new data about you is stored for this; the total is calculated from the existing learning progress (processing on behalf of the school).

Supplement 2026-10-08 — Hint levels in the Lab

Hints for a Lab task come in levels: the next level and finally the solution can only be opened once the previous one has been opened. So that this order still applies after reloading the page, we store for your Lab account, per task, only up to which hint level you got and whether you opened the solution, each with the time of the first and last change.

The sole purpose is providing the staged hints; we do not analyse this data. The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use); for school accounts we process the data on behalf of the school. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre). Retention: 13 months after the last change; it is deleted immediately together with your account. It is part of your data access request (Art. 15 GDPR, „Download my data“).

Supplement 2026-10-13 — Referral program and review request in the Lab

Referral program

If you take part in the referral program, we store your personal invite code, the link between you and the people who sign up with your code (or the person who invited you), date and status of each invite, and your bonus-minute bookings (credit, use, return, expiry). The purpose is running the program (Art. 6(1)(b) GDPR) and preventing abuse, such as inviting your own second e-mail address; for that we compare e-mail addresses in a normalized form (Art. 6(1)(f) GDPR, legitimate interest in a fair distribution of practice VMs). An administrator reviews suspicious invites manually. If you invite someone, you only see their sign-up date and status — no name and no e-mail address. Bonus minutes expire after 90 days; we keep the data itself until you delete your account. Free learners aged 16 and over can take part; class and school accounts do not.

Review request

After your first completed module we ask you — at most twice — for a review on Google. For this we only store how often the request was shown, whether you chose "Later" and that it has ended. Whether someone clicks "Review on Google" is counted only as a daily total without reference to a person. We don't learn whether or how you review us on Google; Google's privacy policy applies to the review itself. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in feedback on the Lab). Class and school accounts and learners under 16 don't receive the request. There is nothing in return for a review.

Supplement 2026-10-16 — Name on certificates in the Lab

Name on certificates. Under „Settings → Names“ you can voluntarily store a name for your certificates, separate from your display name. It appears on your module and learning path certificates. Anyone who knows the verification link (techlogia.de/verify/…) only sees it with the surname shortened (e.g. „Kim W.“). If you share the link to the PDF file yourself, the recipient sees the full name. It never appears on the leaderboard — that only shows your display name. If you don't store a name for certificates, we use your display name, otherwise your username. Once you set it, we also apply it to earlier module certificates that still show your username.

This supplement replaces the statement in the supplement of 2026-10-08 that the verification page of a learning path certificate shows the display name and no real name. The legal basis is Art. 6(1)(b) GDPR (providing the function you use). Retention: until you clear the field or delete your account; issued certificates keep the name until you withdraw them. The name is part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Daily challenge and leagues in the Lab

Daily challenge. When you start a challenge, we store the calendar day you started so we can unlock its steps day by day. Nobody but you sees it. Leagues. If you agreed to the public leaderboard and solved at least two tasks, you take part in the weekly leagues. For each week we store tier, group, points, rank and whether you were promoted or demoted. The up to 29 other people in your group see your display name and your weekly points — never your email, username or certificate name. If you withdraw your leaderboard consent, you stop taking part from the next week and immediately no longer appear in any group. The legal basis is Art. 6(1)(a) GDPR (your leaderboard consent), for the challenge Art. 6(1)(b) (providing the function). Retention: We keep the start day of a challenge until you delete your account. We delete completed league weeks 4 weeks after the week ends; we only keep the most recent one so that you start in your tier when you return. If you withdraw your leaderboard consent, we delete your league history after the current week ends. Everything is deleted with your account at the latest. Both are part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Personal storage folder in the Lab

Folder ~/ablage. Your practice VM is deleted at the end of every session. Whatever you put into the folder ~/ablage is saved when the session ends regularly (you end it, it expires or you repeat a module) and restored when your next session starts. Only this folder is saved, at most 5 MB compressed and 500 entries, and only the latest version. The content is stored encrypted in our database in Germany; nobody looks at it. If a session is ended for security reasons, nothing is saved.

The legal basis is Art. 6(1)(b) GDPR (providing the function you use; for school accounts on behalf of the school). Retention: 30 days after last use (save or restore), then deleted automatically. In your profile under „Data export“ you can download the storage at any time or delete it immediately; it is also deleted with your account. It is part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Practice time, idle end and flag tasks in the Lab

Practice time instead of starts. We calculate your daily practice time from the timestamps of your Lab sessions (VM ready, end), which we store anyway. For the first complete finish of a module we book a one-time bonus of minutes; the booking is part of your data access request and expires after 90 days.

Idle end. So that unused practice VMs don't keep running, we store the time of the last terminal connection per session — no input, no content. The value only lives in the cache and is deleted automatically after 6 hours at the latest.

Flag tasks. For tasks where you enter a flag found on the VM, we only store per attempt whether the input was right or wrong, and when — not the input itself. This serves your learning progress and protects against guessing. The legal basis for all three points is Art. 6(1)(b) GDPR (providing the learning platform). Deleted with your account unless something shorter is stated above.

Supplement 2026-10-18 — Test features and additional practice time

We may enable test features (beta) in the Lab for individual accounts or give them additional practice time, such as a higher daily allowance or a one-off credit in minutes. For this we store with your account which feature or allowance applies since when and until when, a short reason (e.g. „learning video“) and which admin account made the change.

The legal basis is Art. 6(1)(b) GDPR (providing the enabled service). Retention: until the entry is removed in the admin area, at the latest with your account; credits expire on the stated date. This information is part of your data access request (Art. 15 GDPR); it does not name the admin account that made the change.

Supplement 2026-10-20 — Country statistics of the learning platform

To understand from which countries our learning platform is used – for example to plan languages and capacity – we evaluate the country from the approximate location of your signed-in devices (see „Signed-in devices“) in aggregated form. For each learning account we count the country of its first sign-in. The result is only a number per country; countries with fewer than three learners are grouped under „Other“ so that nobody can be identified individually. Nothing additional is stored, no profile is created, and only our administrators see the evaluation. Internal accounts and school accounts (classes, Eduplaces) are not included.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in developing and planning our service). You can object to this evaluation at any time under Art. 21 GDPR, for example by email to the contact address above; your account will then no longer be counted.

Supplement 2026-10-23 — Electronic signature of contracts

Business customers can sign contracts with us (e.g. maintenance contracts or data processing agreements) electronically via a personal link. In doing so we store the name and role of the signing person, the signature drawn on screen, the time, the IP address, the browser identifier and a checksum of the signed document. This information appears on the signature page of the contract and serves as proof of who agreed to which wording and when.

The legal basis is Art. 6(1)(b) GDPR (conclusion of a contract) and Art. 6(1)(f) GDPR (legitimate interest in verifiable proof of the contract). We keep this information together with the contract for as long as it is in force and statutory retention periods apply (up to ten years under Section 147 AO and Section 257 HGB).

Supplement 2026-10-28 — Interim backup of the storage folder

In courses where you change the firewall or SSH access of your practice VM yourself, you can accidentally lock yourself out. So that your folder ~/ablage is not lost in that case, we additionally save it there after every check you start yourself (at most every two minutes). The same rules as above apply: only this folder, encrypted, only the latest version, retention 30 days after last use.

Contacting schools and companies by post

We occasionally write to selected schools and companies by post to present our offering (for example the pilot programme of the Techlogia Lab for vocational colleges). For this we process the name, job function and business address of the person we write to.

Source: The data comes from publicly accessible websites of the school or company (for example a “Contact” page). We do not receive it from third parties.

Purpose and legal basis: The sole purpose is to send this offer and to handle a reply. The legal basis is our legitimate interest in presenting our offering to schools and companies, Art. 6(1)(f) GDPR; direct marketing can be a legitimate interest under recital 47 GDPR.

Retention: If you do not reply, we delete your data by 31 July 2027 at the latest. If you reply, we keep it for as long as needed to handle your enquiry and any resulting business relationship; statutory retention periods remain unaffected. We do not pass the data on.

Objection: You can object to the use of your data for marketing at any time, without giving reasons and free of charge (Art. 21(2) and (4) GDPR), informally by email to datenschutz@techlogia.de or by post. We will then not write to you again. To make sure of that, we record the school and job function on a suppression list instead of deleting the data; only this note remains stored.

Your other rights (access, rectification, erasure, restriction, data portability, complaint to a supervisory authority) are described in the other sections of this privacy policy.

How do you like this page?