Privacy notice

Controller

Responsible for data processing on this website (Art. 4(7) of the General Data Protection Regulation, GDPR, in German DSGVO):

In brief

This website works without sign-up, cookies or advertising. The mock exam runs entirely in your browser; your answers are not sent to us. We receive only the error reports you send with the form below a question.

Hosting: Vercel

The website is delivered by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you open a page, your browser sends technical data to Vercel's servers: your IP address, the address requested, the date and time, and the type of your browser and operating system. Vercel also derives your approximate location (city and country) from the IP address.

Vercel uses this data to deliver the pages and to protect the website from attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Vercel processes the data on our behalf under Vercel's data processing agreement (Data Processing Addendum, Art. 28 GDPR). Data may be transferred to the USA in the process. Vercel is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

Mock exam

The mock exam runs only in your browser. The state you choose, your answers and your result do not leave your device; the page does not save them, and they are deleted when you close the page.

Error reports

If you report a mistake with the form below a question, we store the question concerned, the type of error you chose, your note and the time. We do not store your name, your e-mail address or your IP address; the form sets no cookies. Vercel's server logs briefly record the IP address of every request, including a report (see ‘Hosting’ above); the report itself is stored without an IP address.

We use this information only to find and correct mistakes in the questions. The legal basis is our legitimate interest in accurate content (Art. 6(1)(f) GDPR).

The reports are stored on our behalf by Supabase Pte. Ltd. (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) on servers in Frankfurt am Main (Germany, EU). Supabase's data processing agreement applies (Data Processing Addendum, Art. 28 GDPR). Where Supabase or its sub-processors need to access the data from outside the EU, this is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Your report reaches Supabase through Vercel, which delivers the website (see ‘Hosting’ above).

We delete a report once we have dealt with it, and after 12 months at the latest.

Please do not write personal data such as your name or e-mail address in the note.

E-mail

The ‘or send an e-mail’ link below each question (on the German pages ‘oder per E-Mail schreiben’, on the Turkish pages ‘ya da e-posta yaz’) opens your e-mail program. If you write to us, we use your e-mail address and your message only to reply and to correct the mistake, and delete them afterwards. The legal basis is our legitimate interest in answering your message (Art. 6(1)(f) GDPR).

Your rights

You can ask for information about the data processed about you (Art. 15 GDPR), ask for it to be corrected (Art. 16) or erased (Art. 17), ask for its processing to be restricted (Art. 18), and object to the processing (Art. 21 GDPR). An e-mail to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

App

The Android app is published on Google Play under the developer name "Mefby".

Your answers and settings stay on your phone; if you use the app in a browser, in that browser's own storage. Android backup is off. On an iPhone, the app's data is included in the phone's iCloud or computer backup, if that backup is on. The app has no analytics, no crash reports and no advertising. It goes online only for sign-in, sync, the paywall and purchases.

Sign-in is optional: with your Google account or through a link sent to your e-mail. When you sign in, your e-mail address and account number are stored for us on Supabase's servers in Frankfurt, under the contract named above. If you sign in with Google, Google checks the sign-in, under Google's own privacy terms. Your session stays on this device: encrypted on a phone, in the browser's own storage in a browser. The legal basis is our contract of use with you (Art. 6(1)(b) GDPR).

Sync belongs to the Pro and Premium plans. Until the plans go on sale, the app opens every Pro feature to everyone, so until then the progress of everyone who signs in is synced. When you are signed in and have a plan, the same place also stores your answers, your mock exam results, your finished days, your settings and the time of your last reset. What was saved on this device before you signed in moves to your account too.

When someone signed in buys a plan, the server keeps the plan, the product, the moment of purchase and the event's number, with or without sync; a refund closes the plan through that record. When you delete your account in the app, all of these are deleted.

Purchases happen only in the Android app, through Google Play, and in the iPhone app, through the App Store. Google or Apple handles the payment and is itself responsible for it; we never see your card details.

To check purchases, RevenueCat, Inc. (1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) works on our behalf, under its data processing addendum (Art. 28 GDPR). The app connects to RevenueCat not only when you buy, but also when a paywall opens, and at every start while you have a plan; that connection carries your IP address, your device's language, the app version and a randomly made number. If you are signed in, your user number in the app takes the place of the random one. RevenueCat also receives the purchase token, your device type and operating system, and the time you last opened the app. If you are signed in and the plan on your phone is not yet known to our server, our server asks RevenueCat with that user number, to write the plan to your account. Deleting your account does not delete the purchase record at RevenueCat. This data is processed on servers in the USA; the transfer rests on the EU's standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is the purchase contract (Art. 6(1)(b) GDPR).