This policy applies to the NorthCue Android app (app.northcue.android) and this website.
1. Controller
The controller is Martin Nahrwold. The postal address and contact details are in the legal notice.
2. Data in the app
The compass, calibration and North Game run on your device. NorthCue does not require its own user account and contains no advertising or usage analytics of its own. The app does not request GPS location or access your camera, microphone or contacts.
Orientation sensors provide the direction for vibration feedback. Their readings are processed locally, not stored as movement histories and not sent to us. Notifications and a foreground service support compass monitoring that you start.
Local storage holds settings, profiles, calibration, game progress, Pro status and the last purchase-status check. Protected activation also stores local activation and security data. Sensor readings, game progress and these activation details are not sent to us.
Data is held in protected app storage. Cloud backup and device transfer are disabled. You can delete local data in Android settings; uninstalling the app also removes it. Otherwise, it remains until changed or deleted. This does not remove a Google Play purchase or Google's purchase history.
3. Google Play: purchases and diagnostics
The optional Pro activation is a one-time Google Play purchase. Google processes account and payment data; NorthCue does not receive credit card details or banking credentials. To check, acknowledge and restore purchases, the app processes product identifiers, purchase status and purchase tokens. Our app logic does not store purchase tokens persistently or use a purchase-verification server of our own.
Purchase status can be checked when the app starts. Pending purchase acknowledgements can be retried with Google Play in the background and after a device restart. Android stores a scheduled task for this purpose, without a purchase token.
The Google Play billing library can send technical diagnostics to Google, even without a new purchase:
- app, library and Android versions, plus device, hardware and memory characteristics;
- language, region, time zone, network type and mobile network operator code, where available;
- billing events, error codes and random session and operation identifiers.
Connections also transmit the IP address. Diagnostics support operation and troubleshooting of billing. NorthCue has no separate switch to disable them, and they can be buffered locally until transmission or cleanup.
Where we process personal data for these purposes, purchases and activation are based on Article 6(1)(b) GDPR; necessary technical troubleshooting is based on our legitimate interest in reliable billing under Article 6(1)(f). For Google's processing and retention periods, see Google's privacy policy and data retention information.
4. Website and hosting
This website uses Google's Firebase Hosting. When a page is requested, the service processes connection data, particularly IP addresses, to deliver the website, detect abuse and analyse service usage. Google states that IP data is retained for a few months.
The website itself uses no cookies or browser storage and contains no analytics or advertising scripts, external fonts or embedded social-media content. Connections use HTTPS. Firebase Hosting for this website does not receive local app game progress.
The legal basis is our legitimate interest in a secure, accessible website under Article 6(1)(f) GDPR. See Firebase privacy information and the data processing terms.
5. Contact enquiries
When you email us, we process your sender address, message and any attachments through our email provider to handle the enquiry. The basis is Article 6(1)(b) GDPR for contractual matters, or our legitimate interest in responding under Article 6(1)(f) for other enquiries.
Correspondence is retained for as long as needed to handle and document resolution of the enquiry. Statutory retention duties remain applicable under Article 6(1)(c) GDPR.
6. Service providers and international processing
Recipients are the Google services described above and our email provider. Google can use affiliated companies and other service providers. The linked data processing terms apply to Firebase.
Google may process data outside the European Economic Area, particularly in the United States. Google describes safeguards including the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses. Details are available in Google's data transfer information and the Firebase terms.
7. Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability.
Right to object: You can object to processing based on legitimate interests on grounds relating to your particular situation.
You can complain to a data protection supervisory authority, for example where you live or work. For privacy enquiries, use the contact details in the legal notice.