Privacy Policy

Last updated: 16 September 2026

1. Controller

The controller within the meaning of the GDPR and national data protection laws is:

Patrick Schlesinger Parkstraße 19 80339 Munich Germany

Email: kontakt@niven.io

2. What data we process

2.1 When visiting the web app

When you open niven.io, technically necessary server logs are stored (IP address, date, browser, language). These logs are processed by our hosting provider Google Firebase and deleted automatically after 30 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

2.2 When registering and using the app

To provide the Niven app we process:

• Email address and password hash for sign-in
• Name (freely chosen), language setting and time zone
• Buddy data: your buddy’s name and species, fullness (last feeding), affection (last petting)
• Treat balance (earned through completed focus sessions)
• Focus and pause sessions (duration, category, time, optional quality rating), your self-named categories, work days and the streak derived from them
• Tasks (text, done yes/no)
• Weekly plans (AI-generated suggestions based on your sessions, see 2.3)
• Chat history with your buddy (see 2.3) and the daily message count
• Invite code and friend list (see 2.5)
• Pro status and purchase records (product ID, store and time only, see 2.6)
• Push device token (only if you allow push, see 2.4)

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Storage location: Google Firestore, region europe-west3 (Frankfurt am Main, Germany).

Important regarding fullness, affection and streak: These are game values, not health data within the meaning of Art. 9 GDPR. They are calculated solely from your voluntary actions in the app (sessions, feeding, petting) and do not constitute a medical or psychological assessment.

2.3 When chatting with your buddy and for the weekly plan (AI)

Your buddy answers in the chat through an AI language model. When you send a message, the following data is transmitted to our LLM provider:

• Your chat message and up to 24 previous chat entries
• Your name, your buddy’s name and species, language
• Game context: fullness, treats, weekday, hour, streak, focus minutes today and over the last 7 days, Pro status
• Your sessions of the last few days (duration, category, time), open tasks and the current weekly plan
• On the model’s request: older sessions (up to 300) or a keyword search in your chat history

For the weekly plan (automatically on Sundays, with Pro also on demand with an optional free-text note), your sessions of the last weeks, your categories, work days and the buddy name are transmitted. The short buddy lines that appear without your input – the reflection after a session and the daily greeting (both Pro) as well as the push notice when your streak is at risk – are generated by the model with the same context (including the last 24 chat entries).

LLM provider: OpenAI Ireland Ltd / OpenAI LLC (USA), model gpt-5-mini.

Transfer to third countries (USA): The transfer to the USA is based on the EU Standard Contractual Clauses pursuant to Art. 46(2) GDPR and the EU-US Data Privacy Framework. OpenAI is listed as a certified participant in the DPF.

Important: Your messages are processed via the OpenAI API with training use disabled – they are NOT used to train models. OpenAI deletes API data after 30 days by default.

Legal basis: Art. 6(1)(b) GDPR (the chat and the weekly plan are core features of the app). You decide yourself whether and what you write in the chat; the AI features are not required to use the timer and your buddy.

Chat history: The history remains stored in your account until you delete your account. There is currently no per-message deletion; on request to kontakt@niven.io we delete your chat history manually.

2.4 Push notifications

If you enable push notifications, an FCM device token is transmitted to Google Firebase Cloud Messaging. We use it to notify you when your buddy is hungry, your streak is at risk, a timer has ended or a friend has fed your buddy. You can disable push at any time via your operating system settings or in the app under Settings → Notifications.

Legal basis: Art. 6(1)(a) GDPR (consent via the system prompt).

2.5 Friends

You can add friends via an invite link. Friends see: your name, your buddy’s name and species, its fullness and affection, and when you were last active. They can feed your buddy with their own treats. You can end a friendship at any time in the app; afterwards the other person no longer sees this data.

Legal basis: Art. 6(1)(b) GDPR (feature actively used by you).

2.6 In-app purchases (Niven Pro and boost packs)

Purchases are billed exclusively through the app stores (Apple App Store, Google Play); purchase processing is handled by our service provider RevenueCat. We only receive product ID, store, time and subscription status (active/inactive) – no payment data. Payment data is processed exclusively by the respective store provider. The web version has no purchases.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

2.7 Necessity of data provision (Art. 13(2)(e) GDPR)

2.8 Automated evaluations (Art. 13(2)(f), Art. 22 GDPR)

Niven evaluates your game data automatically:

• Fullness and affection of your buddy decrease over time and increase through feeding or petting – pure game mechanics.
• Streak: number of consecutive work days with at least one focus session.
• Weekly plan and buddy lines: an AI (OpenAI gpt-5-mini) generates a weekly suggestion and short reactions from your session history.

These evaluations are not profiling within the meaning of Art. 22 GDPR – they have no legal or similarly significant effect on you. You can follow or ignore them at any time without any disadvantage.

3. Processors and recipients

We use the following processors:

Data processing agreements pursuant to Art. 28 GDPR have been concluded with all processors.

4. Cookies and local storage

The web version uses:

• Firebase auth token (LocalStorage / IndexedDB, technically necessary)
• Language setting, volume, running timer (LocalStorage, technically necessary)

We use no marketing cookies, no trackers, no analytics tools. No cookie banner with opt-in is required (all storage is technically necessary under Section 25(2) TDDDG).

5. Your rights under the GDPR

You have the following rights:

• Access to the data processed about you (Art. 15)
• Rectification of inaccurate data (Art. 16) – name, buddy name, categories and work days can be changed directly in Settings
• Erasure (“right to be forgotten”, Art. 17) – in the app via Settings → Account → Delete account
• Restriction of processing (Art. 18)
• Data portability (Art. 20) – on request we provide your data as a JSON export
• Objection to processing (Art. 21)
• Withdrawal of consent given (Art. 7(3), with effect for the future)
• Complaint to the competent supervisory authority (Art. 77)

Supervisory authority for Munich: Bavarian State Office for Data Protection Supervision (BayLDA), https://www.lda.bayern.de.

Contact for all requests: kontakt@niven.io. We respond within 30 days.

6. Data security

• TLS 1.3 for all transfers
• Encryption at rest in Firestore (AES-256)
• Password hashing by Firebase Authentication (scrypt)
• Firestore Security Rules strictly limit access per user; game values are written server-side only
• Cloud Functions with service account authentication

7. Retention period

• Account data including sessions, tasks, plans and chat history: until account deletion
• Server logs: 30 days
• Delivered push notifications: deleted after sending
• On account deletion, the login and all data (including the buddy mirror, invite code and entries in friend lists) are removed immediately. Purchase receipts from the app stores remain with the respective store; statutory retention obligations for invoices (10 years under Section 147 AO) remain unaffected.

8. AI notice (EU AI Act)

Your buddy answers through an AI system (OpenAI gpt-5-mini). You are chatting with an AI, not a human. The AI can make mistakes and does not replace a therapist, doctor or professional coach. The buddy is a game character with a coaching flavour – you can ignore its suggestions or close the chat at any time.

Under the EU AI Act classification, the AI system is not a high-risk system (no use in education, employment, law enforcement, etc.).

9. Changes to this policy

We reserve the right to adapt this privacy policy to changes in the legal situation or to changes in the app’s features. The current version is always available in the app under Settings → About → Privacy.

This policy is valid from 16 September 2026.