Privacy Policy

Controller

The controller responsible for data processing is:

Christoph Bimmer
bsigned.de
Undeostr. 37
85661 Forstinning

E-mail: info@pizzaplan.app

General information on data processing

The protection of your personal data is an important concern to us. We process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This privacy policy informs you about which personal data we collect in connection with the use of the website pizzaplan.app and the PizzaPlan app, and how this data is processed.

Personal data is all information relating to an identified or identifiable natural person, for example your name, your e-mail address or your IP address.

Website pizzaplan.app

The following sections concern the use of the website pizzaplan.app.

Hosting and content delivery

This website is provided via Cloudflare Pages. The license verification of the app is carried out via Cloudflare Workers.

Provider: Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When you access our website and when the app makes requests, your requests are routed via Cloudflare’s global network. In this process, your IP address is processed by Cloudflare for technical reasons. Cloudflare stores temporary access data to ensure operation and to protect against attacks (DDoS protection, Web Application Firewall).

Data processing by Cloudflare is carried out on the basis of a data processing agreement (Data Processing Addendum) and the EU standard contractual clauses.

Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure and efficient provision of our services).

E-mail forwarding and delivery

Incoming e-mails to our contact address are forwarded to our mailbox via Cloudflare Email Routing. In addition, messages submitted via our contact form are processed by a Cloudflare Worker and likewise delivered as outgoing e-mail to our mailbox via Cloudflare Email Routing. In this process, the e-mail metadata (sender, subject, time) and the content are processed by Cloudflare. The e-mails are not stored by Cloudflare beyond the respective forwarding or delivery process.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in being reachable by e-mail).

Contact form and spam protection (Cloudflare Turnstile)

A contact form is available on our website. If you use it, the data you enter (name, e-mail address, subject, message) is transmitted to us via a Cloudflare Worker and delivered by e-mail.

To protect against automated requests (spam), we use Cloudflare Turnstile. When the form is loaded, a security check is carried out by Cloudflare. In this process, Cloudflare processes technical data of your browser as well as your IP address in order to distinguish automated requests from human ones. No cookies are set and no permanent user profiles are created.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in protecting our services against abuse).

Cookies

Our website uses technically necessary cookies that are required for the proper operation of the website. In addition, cookies are used for analysis purposes, provided you have consented to this via our cookie banner (see section “Web analysis”).

The legal basis for technically necessary cookies and comparable storage (e.g. your cookie choice in the browser’s local storage) is Section 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR (legitimate interest in the functional provision of the website). Analysis cookies are only set after your explicit consent (Section 25 (1) TDDDG, Art. 6 (1) lit. a GDPR).

Web analysis (Google Analytics 4)

We use Google Analytics 4, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies to analyze your use of the website. Activation takes place exclusively after your explicit consent via our cookie banner (opt-in). By default, the analysis is disabled.

We use Google Analytics with the “Consent Mode v2” function. This means that without your consent, no analysis cookies are set and no personal data is transmitted to Google.

When consent has been given, the following data is collected:

• Page views and navigation behavior
• Time spent on the pages
• Referrer URL (where you come from)
• Browser type, operating system, screen resolution
• Approximate location (based on the anonymized IP address)
• IP address (automatically truncated by Google)

The data is processed on Google servers, which may also be located in the USA. The transfer of data to the USA is carried out on the basis of the EU standard contractual clauses.

You can withdraw your consent at any time with effect for the future: the “Cookie settings” link at the bottom of every page reopens the cookie banner, where you choose “Only necessary”. Analysis cookies already set are deleted in the process.

Legal basis: Art. 6 (1) lit. a GDPR and Section 25 (1) TDDDG (consent).

Google privacy policy: https://policies.google.com/privacy

Fonts

The fonts “Inter” (body text) and “Fraunces” (headings) are delivered locally from our server. No connection is made to Google Fonts or any other font provider.

Amazon affiliate links on the “Accessories” page

On our website, we offer at pizzaplan.app/zubehoer/ (as well as the corresponding language variants /en/accessories/, /es/accesorios/, /it/accessori/, /nl/accessoires/) a curated overview of pizza accessories with references to the Amazon online shop. We participate in the partner program “Amazon Partnernet” (EU).

Partner program provider: Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg.

If you click on such an affiliate link, you are redirected to the Amazon website in a new browser tab. In this process, Amazon receives our partner tag as well as the usual browser and connection data (IP address, User-Agent, Referrer). In the event of a subsequent purchase, we receive a commission. No additional costs are incurred for you.

The partner tags used differ by language version:

• German and Dutch: p1265423-21 (amazon.de)
• English: p126542304-21 (amazon.co.uk)
• Spanish: p12654230e-21 (amazon.es)
• Italian: p126542300-21 (amazon.it)

The affiliate links are marked with rel="sponsored nofollow noopener" in order to make their advertising nature transparent.

In addition, we load the product images of the listed articles directly from Amazon servers (m.media-amazon.com). In this process, your IP address is transmitted to Amazon for technical reasons. We use the attribute referrerpolicy="no-referrer" so that Amazon does not receive any information about the exact page on pizzaplan.app from which the image is loaded.

After redirection to amazon.de (or the respective country page), the Amazon privacy policy applies there: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in refinancing our content through affiliate revenue).

PizzaPlan app

The following sections concern the use of the PizzaPlan app.

No advertising

The PizzaPlan app does not display any advertising and does not use any advertising trackers or advertising networks. No data is transmitted to advertising service providers.

Local data storage

The app stores your data exclusively on your local device. There is no user account and no cloud sync; the data listed below is not transmitted to our servers or to third parties.

The following data is stored locally:

• Settings (language, appearance, default values, warnings, notifications, your choice regarding crash reports)
• Current recipe values and calculation parameters of the calculator
• Favorites (saved recipes with a name you choose)
• Logbook: entries with title, notes, rating, tags, evaluation, recipe values and steps, each entry as a separate JSON file in the app storage, plus the photos you take or select
• Planner: schedule, the related recipe and scheduled reminders
• Shopping list
• Sourdough starter: starter plan, maintenance and starter profiles
• Custom flours
• Technical helper values (e.g. whether a hint or the release notes have already been shown, time of the last rating request)
• Cached images, backup and export files (cache)

Data is stored using AsyncStorage and as files in the app’s private storage area (unencrypted, not accessible to other apps). Photos are resized, compressed and stored as a copy in the app storage when you add them. The Pro license status and the associated purchase token are additionally stored in encrypted form using SecureStore (Android Keystore or iOS Keychain).

Device backup: If your operating system’s backup is enabled on your device (Android backup to your Google account or iCloud Backup), the locally stored app data may be included in that backup. This depends on your device settings and the terms of Google or Apple; we have no access to it. The encrypted proof of purchase is excluded from the Android backup.

Data backup: Under Settings -> “Data backup” you can save favorites, logbook with photos, shopping list, sourdough starter and maintenance, starter profiles, custom flours and settings as a ZIP file (JSON, photos as JPEG) and restore them from it. The file is created on your device; you decide where to store it and with whom to share it. The running schedule and the current calculator state are not included.

Storage period and deletion: The data remains on the device until you delete it in the app, uninstall the app or use “Delete all data” in the settings. This function removes favorites, logbook with photos, planner and reminders, shopping list, starter and starter profiles, custom flours, settings, cached backups and exports, and the calendar appointments created by the app. Please delete appointments you exported as a calendar file and files you have shared or saved yourself. A Pro purchase remains with the store and is restored automatically.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. f GDPR (legitimate interest in the functionality of the app). Access to your device is based on Section 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) insofar as it is strictly necessary for the functions you use.

Device features and permissions

The app only requests a permission when you use the related feature. You can revoke permissions at any time in your device settings; the other features of the app remain available.

• Camera and photos: only for photos in the logbook. The app only receives the pictures you take or select yourself. They are stored exclusively in the app storage and are not uploaded.
• Notifications: Reminders from the planner and the sourdough starter as well as the optional “Inactivity Reminder” (after 14 days without opening the app) are scheduled as local notifications on the device. There are no push notifications via a server.
• Calendar: If you export a schedule to the calendar and allow access, the app adds the baking appointments to a calendar on your device and remembers their identifiers so that it can update or remove them later. Without access, the app creates a calendar file that you open or share yourself. Whether appointments are synced with an online calendar depends on your calendar account.
• Widget (Android): A home screen widget can show the next step of your schedule. The information required for this is stored locally on the device.

Legal basis: Art. 6 (1) lit. b GDPR (provision of the features you use).

Crash reports and error analysis (Sentry)

To improve the stability of the app, you can have crash and error reports sent to the Sentry service.

Provider: Functional Software Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.

Transmission only occurs with your explicit consent (opt-in); the feature is turned off by default. Without consent, Sentry is not started. You can grant or revoke consent at any time in the settings under “Privacy” -> “Send crash reports”. When you revoke consent, error reporting stops immediately.

With your consent, the following data is transmitted:

• Crash and error reports of the app, including crashes of the native part (error type, error location, stack trace)
• Technical device data such as device model, operating system and version, and app version
• Technical logs of the events before an error (breadcrumbs, e.g. app start, network requests of the app, purchase verification), without tap logs and without text input or other content
• Session statistics (start, end, duration and whether a session ended without errors), used to calculate the crash rate
• A randomly generated installation identifier used to group reports from the same device; it contains no information about you and is not an advertising ID

Recipes, favorites, logbook entries, notes, photos, text input and screenshots are not transmitted. No performance measurement (performance tracing) takes place. Your IP address is processed for technical reasons during transmission, but it is neither stored nor used to determine your location: user information is removed before sending, and storing IP addresses is turned off in the Sentry project.

The data is processed and stored in the EU (Sentry region Germany, ingest.de.sentry.io). As the provider is based in the USA, access from the USA cannot be ruled out; the basis is the EU Standard Contractual Clauses.

Retention period: 90 days (Sentry default).

Legal basis: Art. 6 (1) lit. a GDPR and Section 25 (1) TDDDG (consent). Consent can be revoked at any time with effect for the future.

Sentry privacy policy: https://sentry.io/privacy/

In-app purchases and license verification

The app offers a paid Pro version as a one-time in-app purchase. The purchase is handled exclusively via the Google Play Store (Google Ireland Ltd.) or the Apple App Store (Apple Distribution International Ltd.). The app itself does not process or store any payment data.

To verify the Pro status, the app communicates with the server api.pizzaplan.app after a purchase, when you tap “Restore purchase”, and otherwise at most once within 24 hours. The following data is transmitted:

• Purchase token and order ID (Google Play) or transaction ID (Apple)
• Platform (Android/iOS)
• Package name of the app
• Product ID

The server verifies the purchase directly with Google or Apple and only reports the result back to the app. It stores neither the purchase token nor the order or transaction ID. Your IP address is processed for technical reasons and used briefly to limit mass requests.

The communication is encrypted (TLS) and signed by means of HMAC-SHA256. The processing is carried out via Cloudflare Workers (see section “Hosting and content delivery”). No personal data such as name or e-mail address is transmitted.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract).

Updates and Delivery

Updates to the app are delivered in two ways: via regular app updates from the Google Play Store or Apple App Store, and via so-called over-the-air (OTA) updates, in which updated program files are loaded directly from the update server eas.bsigned.de.

This update server is operated by us and hosted by Hetzner Online GmbH in Germany. When the app starts and when you return to it after a longer break, the app checks whether an update is available. For technical reasons, your IP address and the following technical information are transmitted: platform (Android/iOS), version and runtime of the app, update channel and a randomly generated installation identifier (EAS-Client-ID) that the update module creates on first launch.

The update service itself does not evaluate or store the installation identifier and does not log IP addresses; the IP address is only kept briefly in memory to limit mass requests. However, the hosting provider’s web server in front of it keeps an access log with the IP address, time, requested address, status code and the identifier of the requesting program (e.g. app name, build number and operating system). This log serves security and troubleshooting purposes, is not analysed and is automatically deleted after 31 days. No user profiles are created and no content from the app is transmitted.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in providing bug fixes and updates).

Sharing, support and ratings

Sharing and exporting: The app only passes on recipes, shopping lists, schedules, logbook entries (as text, PDF or with photos) and data backups at your request via the share dialog of your device. You choose the recipient and storage location yourself; the app you choose or its provider is responsible for any further processing.

Recipe links: A shared recipe link (pizzaplan.app/r/) contains the recipe values including the recipe name and, if applicable, a custom flour in encoded, unencrypted form, but no further information about you. If the recipient opens the link in a browser, the sections on the website apply.

Support: Via “Contact Support”, the app opens your e-mail program with a prepared message to info@pizzaplan.app and an attached technical report (app and system version, screen size, Pro status, language, appearance, calculator settings, number of favorites). Nothing is transmitted until you send the e-mail yourself; you can remove the attachment beforehand. For further processing, the sections “E-mail forwarding and delivery” and “Contacting us” apply.

Ratings: The app occasionally asks you for a rating. If you agree, it shows the rating dialog of Google Play or the App Store or opens the app’s store page. The rating takes place exclusively between you and Google or Apple; the app does not learn whether or how you rated it. Locally, it only remembers when it last asked.

Amazon affiliate links and product images

The app contains recommendations for products in the “Accessories” area that are linked via Amazon affiliate links. Product images are loaded directly from Amazon servers (m.media-amazon.com). In this process, your IP address is transmitted to Amazon for technical reasons. When you open an affiliate link, your external browser is started. Amazon then receives the usual browser data.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in refinancing the app through affiliate revenue).

General provisions

The following sections apply both to the website and to the app.

Contacting us

If you contact us by e-mail or via the contact form on our website, the data you provide (name, e-mail address, subject, message content) is stored by us in order to process your request and to keep it on file in the event of follow-up questions. The data transmitted via the contact form is transmitted in encrypted form (TLS) and processed by a Cloudflare Worker (see section “Contact form and spam protection”).

The legal basis is Art. 6 (1) lit. b GDPR (pre-contractual measures or performance of a contract) as well as Art. 6 (1) lit. f GDPR (legitimate interest in answering your request).

We delete the data collected in this context once storage is no longer necessary, or we restrict the processing if statutory retention obligations exist.

Storage period

Unless a different storage period is specified in this privacy policy, your personal data remains with us until the purpose of the data processing ceases to apply. If you assert a legitimate request for deletion or revoke a consent to data processing, your data will be deleted, provided we do not have any other legally permissible reasons for storage (e.g. retention periods under tax or commercial law). In the latter case, deletion takes place after these reasons cease to apply.

Your rights

Within the framework of the applicable statutory provisions, you have the following rights at any time regarding your personal data:

1. Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed, and to obtain information about this data.

2. Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data as well as the completion of incomplete data.

3. Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data, provided one of the grounds mentioned in Art. 17 GDPR applies.

4. Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.

5. Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.

6. Right to object (Art. 21 GDPR): You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data.

7. Right to withdraw consent (Art. 7 (3) GDPR): Insofar as you have given consent to data processing, you can revoke it at any time with effect for the future.

To exercise your rights, you can contact us at any time at: info@pizzaplan.app

Supervisory authority

If you are of the opinion that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Telephone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de/de/index.html

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this website and the communication of the app use SSL or TLS encryption.

Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or in order to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

Last updated: 26 October 2026