This policy applies worldwide to richartz.me, its contact options and my Google Play apps that link to it. Mandatory privacy rights in your country remain unaffected.
This policy describes shared privacy principles and services. Information about an individual app is provided additionally on Google Play and in privacy notices accessible within the app. The country notices explain additional regional rights.
1. Controller
Marco Richartz
Sole proprietor
54673 Bauler
Germany
I am responsible for this website and the apps I publish insofar as I determine the purposes and means of processing personal data. For privacy questions about an app, contact me using the details above and name the app concerned.
2. Website access and logs
Delivery and security
When you visit this website, technically necessary data may be processed to deliver it and protect its stability and security. This can include your IP address, date and time, requested URL, data volume, referrer, browser, operating system, HTTP status and security events.
Purposes: website delivery, troubleshooting and protection against misuse. Legal basis: Article 6(1)(f) GDPR, my legitimate interest in secure and reliable operation. Recipients: OpenAI as hosting and platform provider and Cloudflare as infrastructure provider, where necessary. The connection uses HTTPS/TLS.
You are not obliged to visit or provide personal data, but the IP address and connection data are necessary to display the website. Logs are retained as long as needed for operational or security purposes, investigations and applicable legal duties. Data relating to a security incident may be kept until the investigation and any proceedings end; otherwise it is deleted or anonymised once no longer needed.
3. Hosting by OpenAI and Cloudflare
Hosting, domain and infrastructure
The richartz.me domain is registered and managed with Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. Domain registration concerns the registrant's contact data; Spaceship does not host the site content or email inbox.
The site is hosted by OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, and delivered on Cloudflare infrastructure. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, may process connection and security data, including IP addresses, at locations worldwide.
OpenAI processes visitor data on my behalf under its Sites hosting terms and data processing addendum. Purpose: reliable delivery, TLS encryption and protection against harmful traffic. Legal basis: Article 6(1)(f) GDPR. Recipients include OpenAI, Cloudflare and relevant subprocessors. Processing solely in Germany or the EEA is not guaranteed. OpenAI's addendum provides for EU standard contractual clauses or an adequacy decision for relevant transfers. Further information is available in the providers' privacy notices; you may request information about safeguards through my contact address.
4. Cookies and device access
Cloudflare __cf_bm
Cloudflare's security infrastructure may set the __cf_bm cookie to detect bots and protect the website. It is not used by me for advertising or audience measurement. Cloudflare states that it generally expires after 30 minutes of continuous inactivity.
Where storage or access is strictly necessary for the service requested, Section 25(2)(2) TDDDG applies; subsequent security processing relies on Article 6(1)(f) GDPR. Non-essential device access would require prior consent under Section 25(1) TDDDG. The website's own code sets no analytics or advertising cookies.
5. Contact
Email and phone
If you contact me, I process your contact details and the content of your enquiry to respond and take necessary follow-up steps. Legal basis: Article 6(1)(b) GDPR for contract-related enquiries, otherwise Article 6(1)(f) GDPR for my legitimate interest in answering them.
The email inbox uses Google Workspace. For German billing addresses, Google generally names Google Cloud EMEA Limited, Dublin, as the contracting entity, subject to existing agreements. Email addresses, times, subjects, message contents, attachments and delivery information may be processed. Google companies and subprocessors may process data outside the EEA under an adequacy decision or EU standard contractual clauses, as applicable.
Phone service uses congstar, a brand of Telekom Deutschland GmbH, Landgrabenweg 149, 53227 Bonn, Germany. Call numbers, times, durations and connection data may be processed. Telekom also processes telecommunications data under its own responsibility. Contact is voluntary. Enquiries are deleted after completion unless retention duties or legitimate reasons for further storage apply, including legal claims. These criteria also apply to WhatsApp messages I store.
6. WhatsApp
Optional contact by messenger
The WhatsApp button links externally to wa.me; no chat plugin loads on this site. Visiting this page does not itself transmit data to WhatsApp. Opening the link connects your browser or app to WhatsApp and may transmit device and connection details; clicking the link alone does not send me a message.
If you message me, I process your number, displayed name, messages, attachments and communication times to handle your enquiry. Article 6(1)(b) GDPR applies to contract-related matters and otherwise Article 6(1)(f) GDPR. WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, also processes account, device and usage data for its own purposes and may transfer it internationally. Its EEA privacy policy explains recipients, retention and safeguards. You can contact me by email or phone instead. Please do not send passwords, health data or similarly confidential material through this channel.
7. Embedded content and statistics
External content and visitor counts
The website's own code contains no additional analytics or advertising scripts or embedded social plugins. WhatsApp is an external link. Fonts come from the device, and images and the icon are served by this site. No external maps, videos or forms are embedded.
The hosting platform automatically records page views and visitor counts, according to OpenAI's documentation. Technical access data may be used to understand use of and improve the site. Where personal data is processed without consent-requiring device access, the legal basis is Article 6(1)(f) GDPR. OpenAI and its infrastructure providers receive the data. External links are contacted only when opened.
8. Your rights
Data subject rights
Subject to legal requirements, you have rights of access, rectification, erasure, restriction and data portability. Consent can be withdrawn at any time for the future without affecting prior lawful processing.
Under Article 21 GDPR, you may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. I will then stop processing unless compelling legitimate grounds override your rights or the processing is needed for legal claims. Send objections to mail@richartz.me. You may also complain to a data protection supervisory authority, including the authority for your residence, workplace or the alleged infringement. In Rhineland-Palatinate, this may be the State Commissioner for Data Protection and Freedom of Information.
9. Automated decisions
No profiling
I do not make solely automated decisions about contact enquiries with legal or similarly significant effects within the meaning of Article 22 GDPR.
10. Apps on Google Play
Apps: data, features and services
These app notices apply worldwide. Additional rights for individual countries are described under “Countries and regions”.
Marco Richartz is responsible for the apps I offer. This section applies to my Google Play apps that link to this policy. The website sections apply when you visit richartz.me, including from an app; they do not mean that each app uses the same services.
This is the shared privacy policy for my apps that link to it, regardless of their country of publication. Depending on the app, local functions and Google Firebase or Google Play services may be used. The sections below apply only to functions and services actually used. Listing them does not mean every app uses every service and does not provide consent.
App-specific information on Google Play
Information about an individual app is available on its Google Play product page, particularly its description and the Data safety, permissions and content rating information where displayed. These details supplement this shared policy and relate to the published app version. A content rating is not the same as the legal ability to consent to data processing.
How to read the app-specific notices
In this policy, app-specific notices mean information clearly assigned to an app and accessible through its Google Play listing or within the app. Processing not sufficiently described here, or differing from this policy, requires supplementary privacy information, particularly about data categories, purposes, recipients, legal bases, retention and international transfers. Data safety is a supplementary overview, not a replacement for these disclosures. Notices and any required consent for a particular function must be provided before processing begins. The Store listing, this policy and in-app information must match the app's actual processing; neither publication on Google Play nor naming a service permits additional data collection.
Google Play downloads
Google processes account, device, connection and possibly purchase data under its own responsibility when you find, download or update an app. Store processing differs from processing within an app. Google's privacy policy applies.
App features and local data
Apps may process information you enter and settings such as options, reminders and alarm times on your device. Data stored only locally is not thereby sent to me. The app-specific notice explains whether an app transmits data or uses outside services. Necessary requested functions may rely on Article 6(1)(b) GDPR; optional processing may rely on consent under Article 6(1)(a), legal obligations on Article 6(1)(c), and specifically explained legitimate interests on Article 6(1)(f).
Firebase infrastructure, accounts and content
Firebase may store, synchronise or process app data in the cloud where needed. Google Cloud EMEA Limited is generally the contracting entity for relevant services for German customers, depending on the service and terms. Firebase Authentication may process account IDs, email addresses and login details, including technical IDs for anonymous accounts. Firestore, Realtime Database and Cloud Storage may hold app content, settings and files linked to accounts. Cloud Functions and Firebase Hosting may process requests, connection data and logs. Each app explains the data and access involved. Necessary functions rely on Article 6(1)(b) GDPR; optional ones may rely on consent.
Firebase Installations, Extensions and connected cloud services
Firebase functions may use an app-specific installation ID together with app, device, time and connection data to address, configure or protect an installation. An installation ID is not automatically a user account. Firebase Extensions or connected Google Cloud services may process data for an enabled function such as email delivery, image processing, search or synchronisation. They apply only when actually enabled, and the app-specific notice identifies the provider, data, purpose and retention.
Notifications, configuration and security
Firebase Cloud Messaging and In-App Messaging may process installation IDs and delivery details. Optional or promotional messages require the applicable consent; device settings can disable push notifications. Local reminders differ from server push. Remote Config may use installation IDs to provide settings. Firebase App Check and Google Play Integrity may process attestation and verification tokens to prevent abuse under Article 6(1)(f) GDPR where appropriate, subject also to Section 25 TDDDG for device access.
ML Kit, translation and AI services
Google ML Kit features may download models and process content on the device. On-device processing does not by itself transmit the edited documents or text to me, although model downloads and updates can create technical connection, app and device data at Google. Firebase AI Logic, Vertex AI and other cloud or generative AI services are not generally enabled. If an app sends prompts, documents or other content to an AI model, it must first disclose the provider, data, purpose, legal basis, retention, international transfers and required choices in its app-specific notice.
Crash reports and analytics
Crashlytics and Performance Monitoring, if enabled, may process crash, device, app, installation and performance data to improve reliability. The app-specific notice states the actual scope and legal basis and obtains consent if required. Google Analytics for Firebase, A/B testing and personalisation are optional and are not automatically enabled by Firebase. Where consent is required for analysis or personalisation, it is obtained in advance under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. This policy does not generally authorise ad networks, advertising IDs or tracking across apps.
App Distribution and Test Lab
Voluntary test programmes may process a tester's email address, assignment, app version, invitation status and feedback, as well as test logs, device information, screenshots or recordings. These services do not automatically affect ordinary app users. Test participants receive the required information before participating.
Purchases, subscriptions and reviews
Google handles Play payments under its own terms. To unlock or restore a purchase, I may process purchase IDs, product, time and status under Article 6(1)(b) GDPR and applicable legal duties. Reviews and quality information made available by Google may be used for support and reliability. Public reviews are visible to others; do not include confidential information.
Recipients and international transfers
Google companies and their subprocessors receive data where needed for Firebase or Google Play. Depending on the service, Firebase data processing terms or the Google Cloud Data Processing Addendum apply; Google handles its own Store purposes under its privacy policy. Processing solely in Germany or the EU is not generally guaranteed. Transfers may rely on an adequacy decision, the EU–US Data Privacy Framework for certified recipients, or EU standard contractual clauses with necessary safeguards. Ask mail@richartz.me about safeguards for a particular app.
Development with OpenAI and Android Studio
I use OpenAI and Android Studio to develop Android apps. Android Studio is used to build, test and prepare apps; use of a development tool alone does not mean published app data is sent to its provider. Using OpenAI as a development tool differs from an AI feature within a published app. Naming the tool does not disclose or authorise transfers of your app inputs to OpenAI or another AI provider; such a feature requires specific privacy information before use. Separately, this website is hosted through OpenAI and Cloudflare, so the website sections apply when you open this policy.
Other Android tools and testing
Projects may also use the Android SDK and Build Tools, Gradle, Kotlin or Java, AndroidX, Jetpack Compose, Room, DataStore, WorkManager, the Android Emulator, ADB, local diagnostic tools and Git. Their mention does not mean every app uses them or sends data to an external provider. Internal or closed Google Play tests, Firebase App Distribution or Test Lab may process tester emails, invitations, versions, feedback, logs and recordings when used. Testers receive details in advance. Synthetic or effectively anonymised test data should be preferred; optional cloud or AI features of development tools are not implied.
Permissions and device access
Depending on its function, an app may need Android permissions such as notifications or alarms. Manage these in Android settings; denying a necessary permission may restrict the feature. A device permission does not replace any required privacy consent. Section 25 TDDDG applies to storage or access on your device; further personal-data processing also needs a GDPR legal basis.
Support, deletion and retention
For app support or privacy requests, email mail@richartz.me and name the app and relevant version. I process the details you provide under the contact section above. Local app data can generally be deleted through app controls or Android's storage settings; uninstalling generally removes private app storage, but exported files and backups may remain. Uninstalling alone does not delete cloud data or accounts. App-specific notices set out retention for server data. You may request deletion of your app data or account at mail@richartz.me even without the app installed; name the app and identifying details, but do not send a password. Identity verification may be needed to prevent unauthorised deletion. Account deletion must address associated database and file data, subject to legal retention.
Security and sensitive functions
Appropriate safeguards include encrypted transfer, restricted access and app-specific Firebase security rules; absolute security cannot be guaranteed. This policy does not generally authorise collection of location, contacts, camera, microphone or health data. Any app that processes such data must explain the scope, purposes, recipients, legal basis and permissions beforehand. The same applies to children where relevant. Your GDPR rights described above also apply to app data.
11. International privacy notice
Worldwide scope and regional rights
My apps may be offered through Google Play in many countries. This policy is intended to explain the actual processing of personal data to users regardless of location. It does not replace mandatory legal rights. If the privacy law of your country grants additional requirements or rights, they apply in addition and prevail in case of conflict.
To make a privacy request, email mail@richartz.me and identify the app, your country or US state, and your request. I may ask for reasonable information to verify your identity and prevent unauthorised disclosure or deletion. Requests are answered within the period required by applicable law. Exercising privacy rights is generally free of charge and will not result in discrimination, subject to lawful exceptions.
European Union and European Economic Area
People in the EU and EEA have the GDPR principles, legal protections and rights described in this policy, including where applicable access, correction, erasure, restriction, portability, objection, withdrawal of consent and a complaint to a supervisory authority.
Switzerland
Where Swiss data protection law applies, its transparency, access, correction and deletion rights and its rules for disclosures abroad are respected. Swiss users may contact me at the address above and, where appropriate, contact the Federal Data Protection and Information Commissioner.
United Kingdom
Where the UK GDPR and Data Protection Act 2018 apply, the corresponding rights to information, access, correction, erasure, restriction, portability, objection and protection regarding automated decisions are respected. Complaints may be submitted to the Information Commissioner's Office as provided by applicable law.
United States and US states
Where an applicable US state privacy law grants such rights, residents may request information, access, correction, deletion and a copy of their personal information, and may opt out of certain processing. Depending on the law, they may also appeal a denied privacy request or use an authorised agent.
California: I do not sell personal information or share it for cross-context behavioural advertising as those terms are defined by California law. I do not use sensitive personal information to infer characteristics about a person, and I do not discriminate against anyone for exercising statutory privacy rights. If future app features introduce such practices, this policy and the required choices will be updated beforehand. This statement does not claim that the CCPA applies to every processing activity or to my business regardless of its statutory thresholds.
Brazil
Where Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) applies, data subjects may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability as provided by law, information about recipients, withdrawal of consent and review of certain automated decisions. A complaint may also be made to Brazil's data protection authority, the ANPD.
Canada
Where PIPEDA or an applicable provincial law applies, people may request access to personal information, its source, use and recipients, and correction of inaccurate information. Consent may be withdrawn and complaints may be made to the competent Canadian privacy authority as provided by law.
Australia and New Zealand
Where the Australian Privacy Act and Australian Privacy Principles or New Zealand's Privacy Act apply, transparency, security, access, correction, complaint procedures and applicable cross-border disclosure rules are respected.
Japan and South Korea
Where Japan's APPI or South Korea's PIPA applies, the applicable information, access, correction, deletion, restriction, complaint and international-transfer requirements are respected.
Singapore, India and other Asian jurisdictions
Where Singapore's PDPA, India's DPDP Act or another applicable Asian privacy law applies, its requirements concerning purpose, transparency, reasonable security, correction, deletion or withdrawal and complaint procedures are respected.
Mexico, other Latin American countries, South Africa and Türkiye
Where these countries' privacy laws apply, their rights to information, access, correction, deletion, objection, withdrawal and complaint, and their cross-border transfer requirements, are respected. Depending on the processing, this may include Mexico's privacy law, South Africa's POPIA and Türkiye's KVKK.
All other countries and regions
If a country is not named separately, its mandatory privacy and consumer rights still apply where they govern the relevant processing. These may include information, access, correction, deletion, restriction, portability, withdrawal, objection, protection from unlawful automated decisions and complaint rights. Scope, conditions, deadlines and exceptions always follow applicable local law.
Local app data and international transfers
Data stored only locally on your device is not transmitted to me. I cannot access, export, correct or remotely delete it. You control such data through the app, Android settings, device backups or uninstallation. A privacy request to me can concern only data actually processed by me or by a service provider I use.
Where personal data is processed across borders, I use transfer mechanisms recognised by applicable law, such as adequacy decisions, standard contractual clauses or comparable contractual and technical safeguards. The general and app-specific notices identify the recipients and safeguards actually used.
Children and young people
This shared policy does not set a blanket minimum age for all apps. The intended audience and content rating are described in the individual offering and its Google Play information; the app's actual audience and applicable law remain decisive. Where processing requires parental or guardian consent, special notices or safeguards, these must be implemented before processing begins. A Store content rating or this paragraph does not replace them.
If a parent or guardian believes a child's personal data is being processed unlawfully, please contact mail@richartz.me and identify the app. The concern will be reviewed and any deletion or restriction required by applicable law will be carried out.
12. Updates
Current version
This shared policy explains this website, its contact options and the internationally offered apps published by Marco Richartz that link to it. Supplementary information about an individual app is accessible through Google Play and within the app. Changes to the website, app functions, services or legal requirements may require updates to this policy and related app notices. Additional or different processing must be sufficiently described before it begins. If translations differ, the German version controls unless mandatory local law requires otherwise.
Last updated: 1 October 2026. The German version is the original wording.