As of: October 2026
1. Controller
SynthScript Inh. Christoph Kretschmer
Hornisgrindestraße 9, 77855 Achern, Germany
Email: info@synthscript.de · Privacy: privacy@synthscript.de
2. General
We process your data exclusively in accordance with the GDPR. This policy informs you about the nature, scope and purpose of data processing when using the "DevProCo" app.
3. Ways of Using the App and What Is Transmitted
You can use DevProCo in two ways:
- Anonymously: Without registration, the app signs you in to Firebase anonymously. This creates an anonymous Firebase account with a user ID. Your development processes and your own catalogue entries are stored in the cloud in this case too (section 6).
- Signed in: with email/password, Google Sign-In or Sign in with Apple (section 5). Your data is stored in the cloud under your account and synchronised between your devices.
Regardless of whether and how you are signed in, the app transmits usage statistics (Firebase Analytics, section 7) and crash reports (Firebase Crashlytics, section 8) to Google from the first launch.
Your session history is stored only locally on your device (SQLite) and is not transmitted to the cloud.
4. Hosting and Storage Location (Firebase)
The app uses Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for:
- User management (Authentication)
- Database synchronisation (Firestore)
- Server-side functions (Cloud Functions)
- Push notifications (Cloud Messaging)
- Usage statistics (Analytics)
- Crash analysis (Crashlytics)
Storage location: The database (Firestore) is located in a multi-region in the USA; the server-side functions also run in the USA.
Transfers to third countries: These are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified, and additionally on Standard Contractual Clauses (Art. 46 GDPR).
More information: firebase.google.com/support/privacy
5. Registration and Sign-In
Registration via email/password, Google Sign-In or Sign in with Apple. Data processed: email address, user ID, authentication data.
With Google Sign-In we receive this data from Google, with Sign in with Apple from Apple: your email address (with Apple, possibly an Apple relay address) and your name, if you choose to share it.
Anonymous use is possible, but it creates an anonymous Firebase account with a user ID (section 3). An anonymous account can be converted into a regular account; your data is kept.
Legal basis: Art. 6(1)(b) GDPR
6. App Content
The following is stored in the cloud (Firestore, located in the USA, section 4) under your account, including when you use the app anonymously:
- your development processes with all their steps
- catalogue entries you created yourself (developers, films, papers)
Your session history stays on your device and is not transmitted.
Legal basis: Art. 6(1)(b) GDPR
7. Usage Statistics (Firebase Analytics)
The provider is Google Ireland Limited. Data is also processed in the USA; the transfer is based on the same grounds as in section 4.
Purpose: We want to see whether developments are completed and whether the purchase page works.
Events defined by us: development started, completed and cancelled; purchase page shown; purchase started, failed and successful. The only additional value is the store's technical error code when a purchase fails.
Collected automatically:
- Events: first launch, session start, usage time, screens viewed, app and operating system updates
- Attributes: device model, operating system and version, language, app version, a country or region derived from the IP address, and an app instance ID
Not collected: Events are not linked to your user ID. No user properties are set and no advertising ID is collected.
Start: from the first launch of the app, before onboarding and regardless of whether you have an account.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the app and the purchase flow based on aggregated usage data. You can object to this processing under Art. 21 GDPR by emailing privacy@synthscript.de.
Retention: Event data is deleted after 2 months.
8. Crash Reports (Firebase Crashlytics)
Every released version of the app sends a report to Google (Google Ireland Limited) when crashes and errors occur, regardless of whether you have an account. The following is transmitted:
- crash and error data including the stack trace
- device model, operating system, app version
- a Crashlytics installation ID
Your user ID is not transmitted. Reports are kept for 90 days. For transfers to third countries, see section 4.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free app)
9. Push Notifications
We use Firebase Cloud Messaging (Google) for push notifications. On iOS, delivery additionally runs through the Apple Push Notification service (Apple).
Push is only active if you grant the system permission for notifications. In that case we store under your account: device token, platform (iOS or Android), device language and a timestamp. Your device is also subscribed to the "Announcements" topic.
We send three kinds of notifications:
- Purchase status: a message when Premium ends, for example after a refund. It is triggered by a notice from RevenueCat (section 11).
- Reminder: once, if you have not completed a development for 14 days ("Time to develop?").
- Announcements to everyone who has enabled push.
Legal basis: Art. 6(1)(a) GDPR (your consent via the system permission)
Withdrawal: at any time in the app's settings or in your device's system settings. If you turn off push in the app, your device token is deleted. Our server removes tokens that have become invalid automatically.
10. Activity Timestamp for Reminders
For the reminder described in section 9, we store the time of your most recent completed development under your account after every completed development. We do this for every signed-in and every anonymous account, even if you have not enabled push. We also store when we last sent you a reminder. Our server evaluates these timestamps to determine whether no development has been completed for 14 days. Only users who have enabled push receive a reminder.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is reminding users who allow notifications about the app. You can object to this processing under Art. 21 GDPR by emailing privacy@synthscript.de.
11. In-App Purchases (RevenueCat)
Purchases (DevProCo Premium) are processed through the respective app store (Apple App Store or Google Play). Purchase status is managed via RevenueCat Inc. (San Francisco, USA). For this, the app transmits your user ID (the Firebase user ID) as the RevenueCat customer ID; RevenueCat also processes your purchase status and purchase history from the store. We receive no payment data.
RevenueCat reports purchase events to our server, where your Premium status is mirrored under your account (active yes/no, last event, time).
RevenueCat acts as our processor (Art. 28 GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of RevenueCat's data processing addendum.
Legal basis: Art. 6(1)(b) GDPR
More information: revenuecat.com/privacy
12. Product Suggestions
You can suggest products for the catalogue. A suggestion consists of category, name, manufacturer, attributes and a free-text note. It is stored in Firestore together with your user ID (located in the USA, section 4).
Our administrators are notified of new suggestions by push and by email. The email contains the suggestion including the note and your user ID. It is sent via Brevo (Sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France), with whom we have concluded a data processing agreement.
Please do not include personal data in the note.
Legal basis: Art. 6(1)(b) GDPR (you actively submit the suggestion)
13. Microphone / Voice Control (Planned)
Voice control is in preparation and not yet included in the current version. The app does not currently request microphone access and does not process any audio.
Once voice control is available and you enable it, the app will only then ask for microphone permission. Recognition uses your device's speech recognition; we do not store any audio. Depending on platform and settings, the system's speech recognition may run on Apple or Google servers. You can revoke the permission at any time in your device settings.
Legal basis: Art. 6(1)(a) GDPR
Voice output: The announcements during a development use your device's text-to-speech. Nothing is transmitted.
14. Retention
| Data | Retention |
|---|---|
| Local data (processes, session history) | until the app is uninstalled or the account is deleted |
| Processes and steps, your own catalogue entries, push tokens, activity timestamps, mirrored Premium status, your own product suggestions (in the cloud) | until the account is deleted, then erased |
| Product suggestion emails in the administrators' mailbox | until the suggestion has been processed, at most 12 months. They are outside the app; deleting your account does not cover them. |
| Anonymous accounts | indefinitely, until deleted in the app. Anonymous accounts are not cleaned up automatically. |
| Firebase Analytics | 2 months |
| Firebase Crashlytics | 90 days |
| RevenueCat, Apple App Store, Google Play | according to the respective provider's terms; purchase receipts are subject to statutory retention obligations |
15. Delete Your Account: DevProCo (SynthScript)
This is how you delete your account in the "DevProCo" app by SynthScript and the associated data.
In the app: Settings → Account → Delete account. If you use the app anonymously, "Delete account" is directly in the settings. Deletion takes effect immediately and removes your account and your cloud data.
Without the app: Send an email to privacy@synthscript.de from the email address your account is registered with. We handle the request manually and delete your account within 30 days.
Anonymous accounts have no email address through which we could match them to you. They can therefore only be deleted in the app. If you have already deleted the app, we can no longer reliably identify an anonymous account; it is not cleaned up automatically.
What is deleted: your sign-in account and all cloud data under your account: processes and steps, your own catalogue entries, push tokens, activity timestamps, mirrored Premium status and your product suggestions.
What is kept and for how long:
- emails about your product suggestions in the administrators' mailbox, until processed, at most 12 months
- data in Firebase Analytics (2 months) and Crashlytics (90 days) until these periods expire; it is not linked to your user ID
- purchase data at RevenueCat, Apple and Google according to their terms and statutory retention obligations
Premium purchase: Your purchase remains linked to your Apple or Google account. After signing in again, you can get it back via "Restore purchase".
16. Your Rights (GDPR)
- Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17)
- Restriction (Art. 18), Portability (Art. 20), Objection (Art. 21)
Contact: privacy@synthscript.de
17. Right to Lodge a Complaint
Supervisory authority: LfDI Baden-Württemberg
18. Data Security
We implement technical and organisational measures to protect your data.
19. Changes
We publish changes to this privacy policy on this page with a new "As of" date.