Privacy Policy
Version: 3.5 | As of: August 10, 2026
Preamble
Protecting your privacy is an integral part of the corporate ethics of HistoryBytes GmbH. In this policy, we transparently disclose how we process personal data within our HistoryBytes platform. We operate in accordance with the strict requirements of the EU GDPR, the Austrian DSG and TKG 2021, as well as relevant US laws (CCPA/CPRA, COPPA).
1. Data Controller and Contact
HistoryBytes GmbH
Wasserfallstraße 249
A-5440 Torren
Austria
Represented by the Managing Director (CEO): Johannes Egger
Commercial Register Number: FN 679541 a
Commercial Court: Landesgericht Salzburg (Regional Court of Salzburg)
VAT Number (UID): ATU83288336
DUNS Number: 30-118-7437
Email: hello@historybytes.app
2. Categories of Processed Data
2.1 Data from Active User Interactions
- Identity Data: First name, last name, email address, profile picture.
- Authentication: User ID (token) and login provider data via Clerk (e.g., for Apple/Google logins).
- Transaction Data: Purchase date, package type (Single/Family), billing address. Payments are processed exclusively through the in-app purchase systems of the Apple App Store and Google Play Store; credit card details are never stored or processed on our servers.
- Referral Data: Email addresses of invited friends are processed solely to send the invitation after you actively trigger it.
2.2 Automatically Collected Technical Data (Telemetry)
- Usage Data: Learning progress, quiz answers, collected fragments, ELO score, unlocked eras, as well as anonymized performance data for asynchronous duels (Ghost Profiles).
- Device Data: Masked IP address, browser type, operating system, device model, push notification token.
- Security Logs: Login timestamps, failed attempts, and security events from our hosting and backend infrastructure.
2.3 Safety and Moderation Data
To protect our user community (particularly within Family groups and league rankings), we process the following data:
- Report Data: If you report another user, we process your user ID, the reported person's user ID and the username visible at the time of the report, the context of the report (e.g. Family or League), and the timestamp. This data is used exclusively for internal review and moderation of reported content.
- Block Lists: If you block another user, we store this association so the blocked person is no longer displayed to you in the league view.
3. Legal Bases and Purposes
| Purpose | Data Category | Legal Basis |
|---|---|---|
| Core Service Provision & Login | Profile, progress, auth token | Art. 6 (1) b (Contract) |
| Purchase Processing | Payment details, email | Art. 6 (1) b (Contract) |
| Infrastructure Security | IP address, logs | Art. 6 (1) f (Legit. Interest) |
| Marketing Updates (Future Option) | Email address | Art. 6 (1) a (Consent) |
| Learning Progress & App Usage (Telemetry) | Usage data, device data | Art. 6 (1) b (Contract) & f (Legit. Interest) |
| Community Protection & Moderation | Report and block data | Art. 6 (1) f (Legit. Interest) |
| Inviting Friends (Referral) | Email address of invited person | Art. 6 (1) f (Legit. Interest, triggered by your action) |
Our legitimate interest lies in the prevention of fraud (anti-cheating), IT security, and the continuous educational improvement of the app.
4. Partners and International Transfers (Data Processors)
We cooperate with the following partners to provide our services. For data transfers to the US, we rely on the EU-US Data Privacy Framework (DPF) or EU Standard Contractual Clauses (SCCs):
- Vercel Inc. (USA): Application hosting and web infrastructure provision.
- Google LLC / Firebase (USA): Cloud backend, database infrastructure & storage of learning progress.
- Clerk Inc. (USA): Identity and access management (secure authentication).
- RevenueCat Inc. (USA): Management and synchronization of subscriptions and purchases across the App Store and Play Store (processes user ID, purchase history, entitlement status).
- Mapbox Inc. (USA): Provision of interactive map material within the app (processes technical access data to deliver map tiles).
- Resend (USA): Sends automated internal notification emails to our team, e.g. for incoming user reports (reporting feature).
- Google LLC (USA): Optional application analytics via Firebase Analytics / Google Analytics (strictly subject to your explicit opt-in consent within the app or cookie banner).
- Meta Platforms Ireland Ltd. / Meta Platforms Inc. (Ireland/USA): Optional use of the Meta Pixel for targeted advertising and conversion tracking on our marketing pages (strictly subject to your explicit consent via the cookie banner).
5. Special US Rights & Child Protection
California (CCPA/CPRA): We collect the categories of personal data mentioned in section 2. We state unequivocally: We do not sell your personal data for monetary value to anyone. However, the use of third-party marketing cookies (such as the Meta Pixel or Google Analytics) on our websites may be considered "sharing" for cross-context behavioral advertising under California law. You can opt out of this sharing at any time via our "Do Not Sell or Share" page or by adjusting your cookie settings. In addition to the rights described in Section 7, California consumers have the right to Know the categories of data processed, the right to Delete, the right to Correct, and the right to Non-Discrimination for exercising these rights. We also honor browser-based opt-out signals such as Global Privacy Control (GPC) as a valid request to opt out of sharing.
Other US States: If you reside in another US state with its own comprehensive privacy law (e.g. Virginia/VCDPA, Colorado/CPA, Connecticut/CTDPA), you have comparable rights to access, correct, delete, and object to processing under the law applicable to you. Please contact us using the details in Section 1, and we will handle your request in accordance with the law that applies to you.
Child Protection (COPPA): Our services are not directed at children under the age of 13. We do not knowingly collect data from this age group. Please contact us in cases of suspicion for immediate deletion.
6. Data Retention and Management
- Regular Data: Deletion after 24 months of inactivity.
- Founder Status & Lifetime Passes: Permanent storage of authorization data to secure your acquired lifetime guarantee.
- Report and Block Data: Stored for a maximum of 12 months, then automatically deleted.
- Archiving: Invoice and transaction data are kept for 7 years in accordance with the Austrian Federal Fiscal Code (BAO).
7. Your Data Subject Rights
In accordance with the GDPR, you have the right to access, rectification, erasure, restriction of processing, and data portability.
Right to Object (Art. 21 GDPR): You have the right to object at any time to processing based on our legitimate interests.
Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent (e.g. marketing emails, Meta Pixel, Google Analytics), you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.
Please send requests to hello@historybytes.app. Complaints can be directed to the Austrian Data Protection Authority (DSB) or your local supervisory authority.