Turq

Privacy Policy

Turq · Last updated: 26 October 2026 · Version 1.20

The legally binding version is the German version ("Datenschutzerklärung"); this English translation is provided for convenience. In case of discrepancies, the German version prevails. This policy informs you pursuant to Article 13 GDPR about the processing of personal data in the "Turq" app and on our website turq.app (Section 7.6).

1. Controller

Tim Gröschke (sole proprietor), Berolinastr. 6, 10178 Berlin, Germany, contact: support@turq.app.

Contact person for data protection: Tim Gröschke, datenschutz@turq.app (address as above). No data protection officer has been appointed.

2. Overview

2.1 We process personal data only on one of the legal bases stated below. Here is a brief summary of the key points; the following Sections, which explain each processing activity with its purpose, legal basis, recipients, and storage period, are authoritative.

2.2 Required and voluntary information: You are neither legally nor contractually obliged to provide us with personal data. However, the App cannot be used meaningfully without the content you enter yourself (Section 4). Without an email address or sign-in service, use as a guest is possible (Section 3.1), though then without cross-device use and subject to the deletion periods stated in Section 12.9. For an in-app purchase, the information stated in Section 6 is required. All other information, in particular the consents under Sections 7.5 and 10.3, is voluntary; without it, the App remains fully usable.

2.3 Access to your device: The App stores and reads information on your device that is strictly necessary for its operation, such as your sign-in session, settings, cached content for offline use, the push token (Section 8), technical information for error diagnosis (Section 7.1) and for app updates (Section 8.4), and photos and files that you take or select yourself (Section 4.6). The legal basis for this is Section 25(2) no. 2 TDDDG. Access that is not strictly necessary, in particular for usage analytics (Section 7.5), takes place only with your consent (Section 25(1) TDDDG). Our website does not store anything on your device; only during a security check may Cloudflare set a technically necessary cookie (Section 25(2) no. 2 TDDDG). The reach measurement script does not store anything on your device and does not read stored information such as cookies or identifiers from it (Section 7.6).

3. Account and authentication

3.1 Anonymous use (guest): The App can be used without signing in. If you choose "Start as guest" on first launch, the Firebase Authentication service (Google) creates an anonymous identifier (UID); technical identifiers are processed in the process, no clear personal data. We automatically delete a guest account that has not been used online for a longer period (Section 12.9); you can avoid this by securing your account with a sign-in.

3.2 Registration/login: When an account is created or you log in, the login data (e.g. email address, display name) is processed. You can sign in with an email address and password, with a Google account and, on Apple devices, with "Sign in with Apple". When you sign in via Google or Apple, we receive from the respective provider the information you release there (usually name and email address; with Apple, if you wish, a forwarding address generated by Apple instead of your real address).

3.3 Purpose: provision of the account, authentication, cross-device use. Legal basis: Article 6(1)(b) GDPR (contract). Processor: Google (Firebase Authentication), see Section 11. Third country: USA (Section 11.3).

3.4 Confirmation of the email address: We send a confirmation email to an email address entered during registration or when securing a guest account; until it is confirmed, the App cannot be used with this account. If confirmation does not follow, we remove the address after 30 days at the latest; an account with content of its own then remains as a guest account, while we delete an account without content of its own (Section 12.8). If the address entered does not belong to you, you can have it removed immediately via the rejection link in the confirmation email or by message to support@turq.app; we then add it to a suppression list for at most six months so that no further registration confirmation emails are sent to it. Purpose: verifying that the address belongs to the person registering; preventing abusive registrations. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the accuracy of the data and in preventing abuse); you may object to this processing at any time under Article 21 GDPR, most easily via the rejection link.

3.5 Correcting a mistyped address: You can correct an email address that has not yet been confirmed in the App; the confirmation email is then sent to the corrected address. We remove the previous address from the account; to limit the number of confirmation emails per address, we keep, for at most 90 days, a pseudonymous check value of the previous address, which we generate using a secret key and from which the address cannot be derived. Corrections are only possible a limited number of times. Purpose: provision of the account; preventing abuse. Legal basis: Article 6(1)(b) GDPR; for preventing abuse, Article 6(1)(f) GDPR.

3.6 App integrity check: To protect our servers against automated access and manipulated versions of the App, the App uses the Firebase App Check service (Google) to verify whether requests originate from an unmodified installation of the App on a genuine device; on Android devices via Play Integrity (Google), on Apple devices via App Attest or DeviceCheck (Apple). In the process, technical information about the device and the App is transmitted to Google or Apple, no content from your aquariums. Purpose: preventing abuse and protecting the services. Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure operation); access to your device is strictly necessary for this purpose (Section 25(2) no. 2 TDDDG). Third country: USA (Section 11.3).

4. Usage and content data in the App

4.1 During use, we process the content you enter: aquarium data, water parameters/measurements, maintenance tasks, inhabitant and disease data (relating to the animals in the aquarium, not to persons), notes, and, where applicable, photos.

4.2 Purpose: provision of the core functions. Legal basis: Article 6(1)(b) GDPR. Photos and free text may contain personal data if you enter such data.

4.3 Shared aquariums: You can invite other users to an aquarium via invitation links. Members of a shared aquarium can view and edit its content data (Section 4.1). Among themselves, members see one another's display names or, in their absence, a neutral placeholder; email addresses and user IDs are not shown to other members. Members see who completed a task on the completed occurrence and, if completion notifications are switched on for the task, also by push notification (Section 8.2). In this respect, the recipients of this data are the members of the shared aquarium. Legal basis: Article 6(1)(b) GDPR (sharing initiated by you). If a member leaves the aquarium, is removed by the owner, or deletes their account, their contributions remain in the owner's aquarium until the owner deletes them or the aquarium; a neutral placeholder appears on the contributions of a deleted account. Legal basis for this: Article 6(1)(f) GDPR (legitimate interest of the owner and the other members in complete documentation of the aquarium; cf. Section 10.4 of the Terms of Service). If the owner removes a member, we store a block entry until the owner allows the member to rejoin, and at most until the aquarium or either of the two accounts is deleted. For the deletion of shared aquariums, see Section 12.2.

4.4 Systems connected by the user (API): Users whose tier includes the API can connect their own systems (e.g. smart-home or measurement integrations) via personal API keys; these systems transmit data to the App on the user's behalf (in particular measurements, dosing and task events, and notices). This data is processed like the other content data (Section 4.1). We store API keys only as a cryptographic hash, not in plain text. Legal basis: Article 6(1)(b) GDPR.

4.5 Photos: We store uploaded photos server-side in several resolutions. In doing so, we strip the metadata embedded in the image server-side, in particular location data and information about the capturing device. Location data from photos is therefore neither stored by us nor disclosed to members of shared aquariums (Section 4.3).

4.6 Camera, photos, and files: You add photos and files via the camera or your device's selection dialogs. The App accesses the camera only when you start taking a photo, and only after you have allowed this in your operating system's prompt. From your photo library and your files, the App receives only the images and files you select in the selection dialog; it does not read the rest of your library. To save a photo from the App to your device, the App needs, depending on the operating system, your permission to add photos. You can revoke these permissions at any time in your device settings; the other functions remain usable. Legal basis: Article 6(1)(b) GDPR; access to your device is strictly necessary for the function you have triggered (Section 25(2) no. 2 TDDDG).

5. AI-based functions (assistant "Qualy", file import, analysis, and inhabitant import)

5.1 When you use the AI assistant, your chat inputs and the associated context are transmitted to an AI service provider in order to generate a response and a conversation title. The context comprises the data of the aquarium selected at the time (master data and setup profile, stocking, diseases, hardware, most recently recorded water parameters, maintenance tasks, dosing, recently recorded journal events), including the free text written in them; in the case of shared aquariums (Section 4.3), it may also contain entries made by other members. Your name, your email address, and your user ID are not transmitted. So that Qualy can name suitable support services in an emergency, the App transmits your device's country code (e.g. "DE") to our server with each request; we do not store it, and only the reference to the matching support services is passed to the AI service provider (Legal basis in this respect: Article 6(1)(f) GDPR, legitimate interest in a suitable pointer in an emergency).

5.2 AI service providers: We use the following paid API services for the AI-based functions: Google (Gemini API), whose contracting entity in the EEA is Google Ireland Limited, Ireland (processing also by Google LLC, USA), and OpenAI (OpenAI API), whose contracting entity in the EEA is OpenAI Ireland Ltd., Ireland (processing also by OpenAI, L.L.C., USA). We determine which of the two services is used for which function and may change this at any time; both services may be in use at the same time, and if one service is disrupted, a request may be forwarded to the other. We do not use any other AI service providers. On request, we will tell you which service is currently used for which function.

5.3 No use for training, time-limited storage by the service provider: With both services, any use of your inputs and outputs to train the models is contractually excluded. The service providers store inputs and outputs for a limited period in accordance with their contractual terms in order to detect abuse and violations of their usage policies, currently Google for at most 55 days and OpenAI for at most 30 days; within this framework, flagged content may be reviewed by the service provider's staff. We do not use any storage by the service provider beyond this; files are passed to the services directly with the request and are not stored there separately.

5.4 Third-country transfer: Both service providers also process data in the USA. Google bases the transfer on the EU-US Data Privacy Framework and on EU Standard Contractual Clauses, OpenAI solely on EU Standard Contractual Clauses (Section 11.3).

5.5 Purpose: provision of the assistant. Legal basis: Article 6(1)(b) GDPR. Insofar as the transmitted context contains entries made by other members of a shared aquarium (Section 5.1), the transmission of those entries is based on their usage contract (Article 6(1)(b) GDPR, Section 10.3 of the Terms of Service) and on Article 6(1)(f) GDPR (legitimate interest of the members in a joint evaluation of the aquarium). Storage: You can delete conversations yourself at any time. Without active paid access, we additionally delete conversations automatically no later than 90 days after the most recent message. With active paid access of any tier, including free trial access, no automatic deletion takes place; conversations are retained until you delete them or until the account is deleted. If the paid access ends, the 90-day rule applies again.

5.6 AI-based file import: If you use the function to import values from uploaded files (e.g. reports, photos, or spreadsheets), the file is transmitted to one of the AI service providers named in Section 5.2 in order to extract structured values (in particular water parameters) from it. We strip the embedded metadata from photos server-side before transmission (Section 4.5); other files are transmitted unchanged. Sections 5.3 and 5.4 apply accordingly.

5.7 The extracted values are shown to you for review before they are adopted into your aquarium data; no adoption takes place without your review. Purpose: adoption of the values you provide in structured form. Legal basis: Article 6(1)(b) GDPR. Storage: The adopted values become part of your content data (Section 4); for the uploaded file, see Section 12.7.

5.8 AI-based analysis of water parameters ("Analysis"): At your request, the App generates an automated analysis of an aquarium's water parameters over a period you select. For this purpose, the measurement series and the aquarium context as described in Section 5.1, including the free text (such as health and disease notes) and, where applicable, the entries of other members, are transmitted to one of the AI service providers named in Section 5.2; Sections 5.3 to 5.5 apply accordingly. We store the result as an analysis and delete it after 180 days at the latest, and otherwise upon deletion of the aquarium or the account. Purpose: provision of the analysis you requested. Legal basis: Article 6(1)(b) GDPR; for entries made by other members, Section 5.5 applies accordingly.

5.9 AI-based inhabitant import: Users with a secured account can adopt inhabitants of an aquarium from a text, a photo of a list, or photos of the animals. The text or photos are transmitted to one of the AI service providers named in Section 5.2, which reads the inhabitants from them and, for photos of animals, suggests the species; we strip the embedded metadata from photos before transmission. Uploaded files are stored only temporarily in our object storage (Section 11.2) and are deleted immediately after the evaluation. We store the suggestions for up to 24 hours so that you can review, change, and adopt them; only the inhabitants you adopt are stored permanently (Section 4). Sections 5.3 and 5.4 apply accordingly. Purpose: adoption of the information you provide in structured form. Legal basis: Article 6(1)(b) GDPR.

5.10 Notice before first use: Before data is transmitted to an AI service provider for the first time, the App informs you which data goes to which service provider and asks whether you want to use the AI-based functions. This satisfies the requirements of the app stores and leaves the decision to you; it is not consent within the meaning of Article 6(1)(a) GDPR, the legal basis remains Article 6(1)(b) GDPR. If you decline, we transmit nothing from your requests to the AI service providers; the AI-based functions are then not available to you, all other functions remain usable. The decision applies to your account on all devices and to your own requests; content you contribute to a shared aquarium may still be transmitted if another member makes a request for that aquarium. You can change the decision in the settings. As evidence, we store the decision, its time, the version of the notice, and the place in the App, including later changes, until your account is deleted.

5.11 No routine access to conversations: We do not routinely look at your conversations with Qualy or the results of the other AI-based functions, and we do not analyse their content for product improvement. We access them only (1) if you expressly ask us to in a support request, (2) if you report an answer and expressly include the relevant excerpt of the conversation, and (3) in individual cases where this is necessary to fix a specific technical error. You decide with each report whether to include an excerpt; we use it to review the reported answer and to improve the AI-based functions, do not pass it on to third parties, and do not use it to train AI models. Legal basis: Article 6(1)(b) GDPR (support at your request); for improvement based on an included excerpt, Article 6(1)(a) GDPR (consent given by including it, which you can withdraw at any time in the App in the respective request or by message to datenschutz@turq.app; we then delete the excerpt); for fixing errors, Article 6(1)(f) GDPR (legitimate interest in a functioning App). Storage of included excerpts: Section 9.2.

6. Purchases (in-app purchases)

6.1 Paid functions are handled via Apple or Google as in-app purchases. Payment is processed by the respective store operator; we do not receive complete payment data. We use RevenueCat, Inc. (USA) to manage purchase entitlements; the transfer to the USA is based solely on EU Standard Contractual Clauses (Section 11.3).

6.2 Purpose: provision of purchased functions, prevention of misuse. With regard to your entitlement status, we store whether and until when a paid subscription exists, including any grace period granted by the store following a failed payment; this information is derived from the reconciliation with RevenueCat and is updated with each reconciliation. Legal basis: Article 6(1)(b) GDPR; for the prevention of misuse, Article 6(1)(f) GDPR.

6.3 Purchase event log (statistics): Via RevenueCat, we receive event notifications for each subscription (e.g. purchase, renewal, cancellation, expiry, refund, or change of plan). From these, we store, for each event and account, the type of event, the store, the plan, the times of the event, the purchase, and the expiry, and the price as reported by RevenueCat in US dollars; no payment data and no transaction numbers. Purpose: statistics on purchases, renewals, cancellations, refunds, and revenue for the commercial management of the App; evaluation takes place only in aggregated form. The log does not determine which functions are available to you (Section 6.2 applies to that) and is not disclosed to third parties. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the economic operation of the App); for the right to object, see Section 13.4. Storage: at most 25 months from the event, and at the latest until your account is deleted.

7. Error diagnosis, stability, logs, and internal statistics

7.1 To detect and fix errors, we use the Sentry service (Functional Software, Inc., USA). Technical data is processed in the process (e.g. device type, app version, error messages, technical identifiers), as well as the last technical steps before the error, such as tapped controls without their labels and server requests without parameters.

7.2 Purpose: stability and security of the App. Legal basis: Article 6(1)(f) GDPR (legitimate interest in a functional, error-free App). We do not intentionally transmit your name, your email address, or content from your aquariums; error messages are cleansed of email addresses and access credentials before transmission, and only your technical user ID serves as an identifier. Data is only sent to Sentry if an error occurs in the App; Sentry does not record how often or for how long you use the App. The data is stored in Sentry's EU data region and deleted after 90 days at the latest; a third-country element arises only from possible operator access from the USA (Section 11.3).

7.3 Server and access logs: When our servers are accessed, technical log data is generated (in particular IP address, time, endpoint accessed, and technical status information). It serves the secure and stable operation, error analysis, and the prevention of misuse, and is deleted after 30 days at the latest; we do not store IP addresses in our database. The processing takes place on our servers in Germany (Section 11.2). Legal basis: Article 6(1)(f) GDPR (legitimate interest in security and operation).

7.4 Internal usage statistics: To improve the App and plan capacity, we record sparse usage signals in our own database: daily activity counters per account (e.g. login, measurement recorded, task completed), events relating to the use of the photo features (storage at most 90 days), the status of individual feature milestones, and, for the AI-based functions, technical metrics without access to content (number and size of requests, quota consumption, errors, response times, number of ratings and reports). These statistics do not leave our infrastructure: no disclosure to third parties, no advertising analysis, no profiling. Legal basis: Article 6(1)(f) GDPR (legitimate interest in improving and economically operating the App). Storage: at the latest until account deletion. For the separate, voluntary usage analytics via a third party, see Section 7.5.

7.5 Usage analytics (only with your consent): You can enable usage analytics via Google Analytics for Firebase (provider: Google Ireland Limited, Ireland; Google LLC, USA, may be involved in the processing). We ask you about this once, when you first start the App; independently of that, you can switch usage analytics on and off at any time in the settings. This feature is switched off by default; the prompt shown at first start is not pre-selected and can be passed over. Without your consent, no collection takes place and no data is transmitted to Google.

When enabled, the following is processed: which screens you open and which functions you use (based on a list of events defined by us; this also includes events relating to Pro offers, trial access, and purchases, for example whether an offer was shown, trial access was started, or a purchase was begun, completed, or abandoned, where in the App this happened, and which type of plan was involved), the standard events recorded automatically by Google (e.g. first launch, start of a session, app update), technical details about device type, operating system, and app version, and a randomly generated app instance identifier. Not transmitted are content from your aquariums (measurements, inhabitants, notes, photos), your name, your email address, your user ID, the device's advertising IDs, and prices, transaction data, or payment data. Purpose: identifying which functions are used and where the App gets in the way. There is no advertising analysis, no sale, and no combination into a profile about you. Legal basis: Article 6(1)(a) GDPR (consent) and Section 25(1) TDDDG for storing and reading information on your device. Third country: USA (Section 11.3).

You can withdraw your consent at any time in the settings; withdrawal is as easy as giving consent. With the withdrawal, collection ends immediately on the device you are using and on further devices as soon as they next connect to your account; the app instance identifier is reset, and consenting again later creates a new identifier that cannot be linked to the previous one. Data already transmitted to Google is deleted after the retention period set there, currently two months. Declining or withdrawing has no effect whatsoever on the usability of the App.

7.6 Website turq.app: Our website turq.app, with its home page, legal texts and invitation page, is delivered by Cloudflare via its global network (Cloudflare Pages; processor, Section 11.1). When you visit it, Cloudflare processes your IP address, the address requested, the page you came from (referrer), if your browser transmits it, and technical details of your browser (user agent) at the data centre closest to your location, which may be outside the EU. This serves to deliver the website and protect it against attacks and overload. Cloudflare stores this connection data only for as long as necessary for these purposes, in accordance with our data processing agreement; we do not receive it as individual records. We do not set cookies; only if Cloudflare classifies a request as a possible attack can a security check set a technically necessary cookie. Legal basis: Article 6(1)(f) GDPR (legitimate interest in a fast website protected against attacks). Section 11.3 applies to processing outside the EU.

Reach measurement: To see how many people visit the home page and from which pages they find us, we use Cloudflare Web Analytics there. When the page loads, a Cloudflare measurement script records technical values such as loading times and transmits them to Cloudflare together with the page requested (without parameters in the address), the referring page and details of your browser, operating system and device type. The script does not set cookies, does not store anything on your device and does not read stored information such as cookies or identifiers from it; visits are not recognised via an identifier. Cloudflare discards the IP address at the data centre and only derives the country from it. We only see aggregated figures such as page views, referring pages and countries. There is no attribution to individual persons, no profiling and no combination with data from the App. Cloudflare keeps the measurement data in full for seven days and afterwards only as an aggregated sample; the analysis goes back six months. Legal basis: Article 6(1)(f) GDPR (legitimate interest in a data-minimising measurement of the reach of our offering). Objection: If you have enabled "Global Privacy Control" or "Do Not Track" in your browser, we do not load the measurement script; we treat this as an objection under Article 21 GDPR. You can also object informally at any time (Section 13); since we do not attribute visits to any person, the simplest way is the browser setting mentioned or a content blocker. Section 11.3 applies to processing outside the EU.

If you follow a link to the Google group or to Google Play, Google's privacy notices apply there.

8. Push notifications

8.1 If you allow notifications in your device settings, we send you push notifications (e.g. reminders for maintenance tasks) via the Expo push service (650 Industries, Inc., USA), Firebase Cloud Messaging (Google), and the Apple Push Notification service (Apple). The data processed in this context (push token, device information) may also be processed in the USA (Section 11.3).

8.2 Legal basis: Article 6(1)(b) GDPR (reminders and notices are part of the functions you have chosen to use). The system permission for notifications is the technical prerequisite; you can revoke it at any time in your device settings, after which we no longer send push notifications. The content of a notification may include designations such as task or aquarium names created by you or, in shared aquariums, by other members and, for systems you have connected (Section 4.4), notices transmitted by those systems. Storage: We store a device's push token for as long as the device is registered for notifications, and at most until the account is deleted.

Completion notifications in shared aquariums: For each task in a shared aquarium, members can switch on that the other members are notified when the task has been completed; this is off by default. If it is switched on, the other members, including the owner, receive a push notification about one minute after the task is checked off, containing the name of the aquarium, the title of the task and the display name of the member who completed it or, in its absence, "a member", and for guest accounts "a guest". It does not contain email addresses or user IDs. If the check-off is undone within this time, no notification is sent. Recipients are the other members of the aquarium (Section 4.3); delivery takes place via the services named in Section 8.1. Legal basis for naming the member who completed the task: Article 6(1)(f) GDPR (legitimate interest of the members in coordinating the care of a jointly managed aquarium and avoiding duplicate care steps); the notification contains only what the members already see on the completed occurrence. You can object under Section 13.4; in addition, the notification can be switched off for the task at any time.

8.3 In-app notifications: Independently of push notifications, the App maintains a notification center within the App. The notifications displayed there are stored in our database (Section 11.2) and deleted upon account deletion. Legal basis: Article 6(1)(b) GDPR.

8.4 App updates (over-the-air updates): We deliver minor updates to the App via Expo's EAS Update service (650 Industries, Inc., USA). When checking for updates, the App transmits technical information (app and runtime version, platform, device type) to Expo; content from your aquariums, your name, your email address, and your user ID are not transmitted. Purpose: provision of an up-to-date and secure App. Legal basis: Article 6(1)(b) GDPR (provision of the App) and Section 25(2) no. 2 TDDDG for storing the update on your device. Third country: USA (Section 11.3).

9. Feedback and support

9.1 When you use the in-app feedback/support function, we process the information submitted to handle the request and store it in our database (Section 11.2). In addition, we receive a notification in an internal Discord channel via an automated webhook. It contains metadata only of the request (a technical ticket identifier, the type/category, the origin within the App, and an internal management link), not the content of your message, your email address, your name, or your user ID. In this respect, Discord Inc. (USA) is an independent recipient of this metadata, not our processor; Third country: USA (Section 11.3). We delete the notifications in the internal channel regularly, no later than twelve months after the request has been closed.

9.2 Legal basis: Article 6(1)(b) GDPR if you have an account; Article 6(1)(f) GDPR (legitimate interest in responding to enquiries) if you contact us without an account. Storage: Requests and the associated history remain stored until you delete your account. The same applies to reports of content and AI outputs (Section 10.7 of the Terms of Service) and to conversation excerpts you include with a report (Section 5.11); if you withdraw your consent regarding an excerpt, we delete it earlier. For a report of content in a shared aquarium, we store the location, a reference to the member concerned, and, for texts, a copy of the reported text as at the time of the report; photos are only referenced. We retain the copy even if the content or the account of the person concerned is deleted later, but for no longer than three years after processing has been completed (Legal basis: Article 6(1)(f) GDPR, legitimate interest in being able to demonstrate proper handling under Articles 16 and 17 DSA and to defend legal claims). We do not disclose the identity of the reporting person to the person reported; we retain reports from persons without an account for at most three years after processing has been completed (Section 195 BGB).

9.3 Email contact: If you contact us by email (e.g. at support@turq.app or datenschutz@turq.app), we process your details to handle the request. These emails are received and stored via Migadu-Mail GmbH (Switzerland) as a processor on servers in the EU (France); for administrative access from Switzerland, see Section 11.3. Storage: We delete emails and attachments once the request has been dealt with and retention is no longer required to defend legal claims, and no later than three years after completion (Section 195 BGB). Legal basis: as in Section 9.2.

10. Consents, agreement to the Terms of Service, and marketing

10.1 Terms of Service (contract): Before use, you actively confirm the Terms of Service. As evidence, we store the accepted version and the time; the warranty given at that point that you are at least 18 years old (Section 4.2 of the Terms of Service) forms part of the confirmed version, and we do not store a date of birth or any age information (Section 14.3). If you reject an amended version and continue to use the App under Section 13.3 of the Terms of Service until the end of a paid subscription period, we additionally store the rejected version, the time of the rejection, the end of that period, the store, and the time of the check with RevenueCat (Section 6), but no product, price, or transaction data; we delete this information together with your account, and the evidence itself is treated in the same way as the proof of consent (Section 12.3). Legal basis: Article 6(1)(b) GDPR; for the evidence, Article 6(1)(f) GDPR (legitimate interest in being able to prove the conclusion of the contract and the confirmed version).

10.2 Privacy Policy (information): The Privacy Policy is provided to you for your information. This does not constitute separate "consent"; the processing operations are based on the legal bases stated in each case.

10.3 Marketing/news emails (double opt-in). Only with express, voluntary and separate consent (Article 6(1)(a) GDPR, Section 7 UWG) do we send news, tips, and offers by email. Consent is confirmed via a double opt-in procedure: after the in-app opt-in we send a confirmation email; emails are only sent once you click the confirmation link. Consent can be withdrawn at any time with effect for the future (unsubscribe link in every email or in the app settings). The lawfulness of the processing carried out until withdrawal remains unaffected.

Email service provider: We handle the technical dispatch of our emails (double opt-in confirmation, legal notifications, and, where consent is given, marketing/news emails) via Mailjet (Mailjet GmbH, Berlin; part of the Sinch group) as a processor (Article 28 GDPR). Your email address, the opt-in/confirmation status, and technical dispatch and delivery information (e.g. delivery, bounce) are processed; we redact our own sending logs after 90 days at the latest. Dispatch takes place via data centers in the EU (France); for operation and support, Mailjet may use sub-processors in third countries (Section 11.3).

Proof of consent (double opt-in log): To evidence valid consent, we store the time of the in-app opt-in, the time of the email confirmation, and the consent wording agreed to, including its version. Legal basis: Article 6(1)(f) in conjunction with Article 7(1) GDPR (duty of proof). Retention: until withdrawal and beyond that, to defend legal claims, until the expiry of the regular limitation period (three years, Section 195 BGB); after account deletion in pseudonymized form (Section 12.3).

Unsubscribe/suppression list: If you unsubscribe, or if an email is returned as undeliverable (bounce) or marked as spam, we add your email address to a suppression list in order to reliably prevent future sends. Legal basis: for unsubscribes, Article 6(1)(c) GDPR (honoring your withdrawal, Article 7(3) GDPR, Section 7(3) UWG); for bounces and spam markings, Article 6(1)(f) GDPR (avoiding unwanted messages). The suppression list is kept for as long as necessary to permanently honor your withdrawal.

10.4 Usage analytics (proof of consent): If you give or withdraw consent to usage analytics (Section 7.5), we record this in your account as evidence: the time, whether it was a grant or a withdrawal, the language version and version of the notice shown to you, and where the decision was made (first start of the App or settings). This record serves solely our accountability obligation; it is not transmitted to Google and does not feed into the usage analytics. Legal basis: Article 6(1)(c) or (f) in conjunction with Article 7(1) GDPR (duty of proof). Retention: until withdrawal and beyond that, to defend legal claims, until the expiry of the regular limitation period (three years, Section 195 BGB); after account deletion in pseudonymized form (Section 12.3).

11. Recipients, third-country transfer, and data security

11.1 We use carefully selected service providers as processors (Article 28 GDPR): Google/Firebase (authentication, app integrity, push delivery, and, where consent is given, usage analytics), Google (Gemini API) and OpenAI (AI-based functions), RevenueCat, Inc. (purchase management), Functional Software, Inc. (Sentry, error diagnosis), 650 Industries, Inc. (Expo, push and app updates), Hetzner Online GmbH (hosting/database), Cloudflare (object storage, website delivery and reach measurement), Mailjet (email dispatch), and Migadu (email mailbox). The following receive data under their own responsibility: Apple and Google as operators of the app stores, the sign-in services, the Apple Push Notification service, and the integrity checks (Section 3.6), as well as Discord Inc. (metadata of new requests only, Section 9.1).

11.2 Hosting/database: The application data, including the database, is processed at Hetzner Online GmbH, Gunzenhausen, in the Falkenstein data center (Germany); there is no third-country transfer for hosting. Object storage (photos, import uploads, backups): Photos you upload, the files provided for the AI-based import (Sections 5.6 and 5.9), and the encrypted database backups are stored in Cloudflare's "R2" object storage (Cloudflare Germany GmbH, Munich; parent company Cloudflare, Inc., USA). The storage buckets used for this are assigned to the EU jurisdiction, so storage takes place in the European Union; possible administrative access by the US parent company is safeguarded in accordance with Section 11.3. Connection when uploading and downloading: The App transfers photos and import files via short-lived, signed URLs directly between your device and the object storage. In doing so, Cloudflare processes your device's IP address and technical connection data at the network node closest to your location, which may also be outside the EU; the files are stored exclusively in the EU. Section 11.3 applies to this connection data.

11.3 Third-country transfer: Hosting and the database are located in Germany, the object storage in the EU, email dispatch and the email mailbox in France, and error diagnosis in Sentry's EU data region. Insofar as service providers process data outside the EU/EEA, in particular in the USA (Google/Firebase, Google Gemini, OpenAI, RevenueCat, Expo, Apple, Discord, possible operator access at Sentry and Cloudflare, and sub-processors used by Mailjet for operation and support), this is done on the basis of suitable safeguards. We have EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in place with our processors, in the module appropriate in each case; where the recipients are certified under the EU-US Data Privacy Framework (including Google, Sentry, Cloudflare, and Expo), the transfer is additionally based on the EU Commission's adequacy decision for this framework (Article 45 GDPR). For OpenAI and RevenueCat, the transfer is based solely on Standard Contractual Clauses. For the sub-processors used by Mailjet in the USA, Standard Contractual Clauses apply and, where the recipients are certified, the Data Privacy Framework. Apple and Google as operators of the app stores, sign-in services, and integrity checks, as well as Discord, receive data under their own responsibility (Section 11.1); transfers to them in the USA are based on their certification under the Data Privacy Framework. For administrative access by the Switzerland-based operator of the email mailbox (Migadu), the EU Commission's adequacy decision for Switzerland applies (Article 45 GDPR). You can obtain a copy of the Standard Contractual Clauses agreed in each case on request to datenschutz@turq.app; the model text is published in the Official Journal of the EU (Implementing Decision (EU) 2021/914).

11.4 Overview of the countries in which your data is processed:

11.5 Data security: We protect your data through technical and organizational measures pursuant to Article 32 GDPR, in particular encrypted transmission, encrypted backups, access protection per account, and hosting in the European Union. No one can guarantee absolute security for transmission over the internet.

12. Storage period

12.1 We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention obligations exist.

12.2 Deletion of the account: You can delete your account yourself at any time, directly in the App under Settings → Delete account or by message to support@turq.app. Upon account deletion, the personal data associated with you is permanently and irreversibly deleted: profile and login data, aquariums with all their content (Section 4), Qualy conversations and analyses, feedback/support requests, and API keys. Aquariums you own and have shared with others are deleted as well; your contributions to others' aquariums shared with you remain with the respective owners (Section 4.3).

12.3 Exception – proof of consent: We retain evidence of agreements/consents given (e.g. to the Terms of Service, marketing, or usage analytics) even after account deletion in pseudonymized form until the expiry of the regular limitation period (three years, Section 195 BGB) to defend against legal claims (Article 17(3)(e), Article 6(1)(f) GDPR); after that, it is deleted automatically. We store the document type, version, type of declaration, language, and time and, instead of your email address (for guest accounts, instead of your account identifier), a check value that we generate from it using a secret key. The address or identifier cannot be derived from the check value; the evidence can only be attributed to a person if this information is available to us again, for example because the person asserts a claim. When a guest account is deleted automatically under Section 12.9, we do not retain such evidence.

12.4 Backups: Deleted data is removed from encrypted backups upon their scheduled rotation (overwriting), generally within a few days and after 30 days at the latest. Until then, the data is still contained in the backups (with EU data residency, Section 11.2) but is no longer actively processed.

12.5 Content already transmitted to AI service providers: Content transmitted to the AI service providers used (Section 5) is subject to their own time-limited storage (Section 5.3, currently at most 55 days at Google and at most 30 days at OpenAI). These copies held by the service provider cannot be retroactively removed by deleting your account with us.

12.6 Paid subscriptions: When you delete your account, we also remove the identifier stored at RevenueCat (Section 6) to manage your purchase entitlement. An ongoing paid subscription is not cancelled by deleting your account; subscriptions can only be cancelled via the subscription management of the respective app store (Apple/Google).

12.7 Uploaded import files: The original file uploaded for the AI-based import (Section 5.6) is stored only temporarily in our object storage (Section 11.2) in order to carry out the extraction, and is deleted automatically immediately after the extraction process is completed, regardless of its success; uploads that are not, or not fully, processed are additionally cleaned up automatically after a short time. Only the extracted values you adopt are stored permanently (Section 4).

12.8 Accounts with an unconfirmed email address: If you do not confirm an email address that you provided when registering with an email address and password or when securing a guest account, the following applies 30 days after registration or, if later, after the first confirmation email to that address: an account without content of its own is deleted automatically, including the associated data; if the account contains content of its own, we only remove the email address together with the password login, and the account remains as a guest account (Section 12.9). An address corrected before confirmation (Section 3.5) restarts the period. Accounts linked to a purchase or another service (Section 12.9) are not changed or deleted automatically; they can be deleted at any time on request. Accounts with a Google or Apple login are not affected by this (Section 12.10).

12.9 Guest accounts: We automatically delete an anonymously used account (Section 3.1) that has not been secured with a sign-in, including all associated data, if it has not been used online for 90 days (without content of your own) or 180 days (with content of your own). What counts as use and as content of your own is governed by Section 14.5 of the Terms of Service. The period starts with the last online use, and no earlier than the entry into force of the version of this policy dated 4 October 2026, which introduced these periods. Deletion generally takes place within a few days after the period has expired and covers the same data as an account deletion under Section 12.2, including the identifiers at Firebase Authentication and RevenueCat; Section 12.4 applies to backups. Guest accounts linked to a purchase or another service are not deleted automatically, for example accounts with a purchase (including an expired or refunded one), an unlocked feature or trial period, an API key, a credit, a support request (reports under Section 10.7 of the Terms of Service do not count), or an aquarium shared with others; they remain in place until you delete them yourself. If you secure your guest account with a sign-in, this Section no longer applies; if the added email address remains unconfirmed, Section 12.8 applies. Legal basis: Article 6(1)(b) GDPR (termination of the contract under Section 14.5 of the Terms of Service) and Article 6(1)(f) GDPR.

12.10 Secured accounts not used for a long time: We delete an account secured with a sign-in (email address and password, Google or Apple login) that has not been used online for 24 months, including all associated data. Beforehand, we write to you at the email address on file; if you use the App with an internet connection before then, the deletion does not take place. As with guest accounts, any use of the App with an internet connection counts as use; the period starts no earlier than the entry into force of the version of this policy dated 4 October 2026, which introduced this rule. Accounts with an ongoing paid subscription and accounts of owners of shared aquariums in which other members have used the App during this period are not deleted automatically. The deletion covers the same data as an account deletion under Section 12.2; Section 12.3 applies to the proof of consent and Section 12.4 to backups. An ongoing subscription is not cancelled by the deletion (Section 12.6). Legal basis: Article 6(1)(b) GDPR (termination of the contract under Section 14.6 of the Terms of Service, notification emails) and Article 6(1)(f) GDPR.

13. Your rights

13.1 You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) under the GDPR. You can withdraw consents given at any time with effect for the future (Art. 7(3)).

13.2 A message to support@turq.app is sufficient to exercise these rights. In addition, you can exercise your right to erasure (Art. 17 GDPR) at any time directly in the App, under Settings → Delete account. For the scope of and exceptions to deletion, see Section 12.

13.3 You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for us: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI), Alt-Moabit 59–61, 10555 Berlin.

13.4 Right to object (Article 21 GDPR): Insofar as we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR, in particular error diagnosis, server logs, internal usage statistics, the purchase event log under Section 6.3, app integrity checks, and prevention of abuse), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons. A message to datenschutz@turq.app is sufficient to object.

13.5 No automated decision-making: We do not make any decision based solely on automated processing, including profiling (Article 22 GDPR), that produces legal effects concerning you or similarly significantly affects you. The results of the AI-based functions (Section 5) are suggestions and analyses; you yourself decide how to use them.

14. International use and non-European users

14.1 Data location and uniform level of protection: The App is operated by a provider established in Germany; the application data is stored in the EU (Germany) (Section 11). We apply the GDPR level of protection uniformly to all users, regardless of their location. The App is offered only in the countries in which it is available in the respective app store. The following information supplements this policy for users in individual countries; you can exercise your rights in each case via datenschutz@turq.app. We respond to your request within the applicable statutory period, under the GDPR within one month.

14.2 Users in the USA: We do not sell personal data and do not share it for the purpose of cross-context behavioral advertising ("Do Not Sell or Share"). To the extent that you are entitled to rights of access, deletion, correction, or objection under the law of your state (e.g. California, CCPA/CPRA), you can exercise these via datenschutz@turq.app; you will not be discriminated against for exercising your rights. Do Not Track signals: Because we do not track users across third-party websites or apps, the App does not respond separately to "Do Not Track" signals. The categories of data processed and their recipients are set out in Sections 3 to 11; we inform you of changes to this policy in accordance with Section 15, and the effective date is stated at the beginning of this policy.

14.3 Minimum age and minors: The App is directed exclusively at adults; under the Terms of Service (Section 4), it may only be used by persons who are at least 18 years old and have full legal capacity. We do not knowingly collect personal data from minors, and in particular not from children under 13 within the meaning of the US COPPA. If we become aware that an account belongs to a minor, we block it, delete the data concerned, and terminate the account.

No proof of age, no age data: We do not ask for a date of birth or an age, and we do not store any age information; we rely on the warranty under Section 4.2 of the Terms of Service. Age information from the app stores: Where this is required by law or where you have allowed it in the app store's settings, the app store passes the age range stored for your store account (e.g. Apple's "Declared Age Range", Google's "Play Age Signals") to the App, not a date of birth; we do not determine your location for this purpose. The check takes place exclusively on your device; the age range is neither transmitted to our servers nor stored. If it identifies you as a minor, the App is not available on that device; you can still delete an existing account there. Without an age range, the App remains usable. Legal basis: Article 6(1)(b) GDPR (enforcement of the contractual age limit) and Article 6(1)(f) GDPR (legitimate interest in complying with the statutory obligations applicable in individual states).

14.4 Users in Switzerland: The Swiss Federal Act on Data Protection (FADP) applies additionally. The countries to which we disclose personal data and the respective safeguards are named in Sections 11.3 and 11.4. You can address complaints to the Federal Data Protection and Information Commissioner (FDPIC).

14.5 Users in Australia, New Zealand, and Singapore: The contact person for data protection (Privacy Officer or Data Protection Officer) is the proprietor named in Section 1. In particular, you have the right to access your data and to have it corrected. You can address complaints to the competent authority in each case: in Australia to the Office of the Australian Information Commissioner, in New Zealand to the Privacy Commissioner, and in Singapore to the Personal Data Protection Commission.

14.6 Users in Latin America: You have the right to access, rectification, erasure, and objection (in Mexico, "ARCO rights"). The transfer to our service providers (Section 11) serves solely to provide our services on our behalf. Colombia: By confirming the Terms of Service and taking note of this policy, you give the prior, express, and informed authorization required under Law 1581 of 2012 for the processing described here; it can be revoked at any time unless a statutory or contractual obligation to retain the data precludes this. Argentina: The Agencia de Acceso a la Información Pública, as the control authority under Law 25,326, is responsible for handling complaints and reports concerning violations of the data protection rules. Otherwise, you can address complaints to the competent supervisory authority in your country.

15. Changes to this Privacy Policy

We adjust this Privacy Policy when the processing changes. We will inform you of material changes before they take effect, in the App and, where we know your email address, by email. The version provided in the App at the time applies; the date and version are stated at the beginning of this policy.

Contact: support@turq.app · See also our Terms of Service.