Privacy policy

1. Controller

The controller for data processing on www.androidhit.de is the provider named in the legal notice, where you also find the full contact details.

2. Hosting and server log files

When you open a page, the server automatically collects data transmitted by your browser: IP address, date and time, requested file, amount of data transferred, referrer and user agent. This data is used to operate the site securely and to analyse errors. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure, error-free operation). Log files are deleted as soon as they are no longer needed for these purposes, at the latest after 30 days.

3. Cookies and local storage

We only use technically necessary cookies:

  • ahsid – session cookie, keeps you logged in during a visit and protects forms against cross-site request forgery. Deleted when you close the browser.
  • ah_lang – stores your language choice (lifetime 1 year).
  • ah_rm – only with “stay logged in”: login token (lifetime 30 days).

The legal basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. No consent is required, which is why there is no cookie banner.

4. User accounts

For an account we process your display name, email address, password (as a hash only), registration date and the IP address used for registration, plus any profile and legal information you enter. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). The data is deleted when you have your account removed, unless statutory retention periods apply.

5. Google Sign-In

You can alternatively log in with a Google account. This loads Google's sign-in library (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which may receive your IP address and device information. After a successful sign-in your browser sends us a signed token that we verify with Google; from it we store your email address, your name, the Google account id and, if available, your profile picture URL. The legal basis is Art. 6 (1) (b) GDPR (sign-in performed at your request) and Art. 6 (1) (a) GDPR. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Further information: Google privacy policy.

6. Image delivery via wsrv.nl

Icons and screenshots are not embedded directly but loaded through the image service wsrv.nl (provider: Weserv, Netherlands) in an optimised size and in WebP format. Your browser connects to wsrv.nl and transmits your IP address and user agent. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in fast loading times and low data usage).

7. Downloads

App downloads always run through www.androidhit.de: for apps from the F-Droid catalogue our server fetches the file from the F-Droid servers and passes it on to you. F-Droid therefore does not learn your IP address, our server does (see log files). We count downloads per app without linking that count to a person.

8. Uploaded apps and virus scanning

When you publish an app, the file is submitted to VirusTotal (Google Cloud / Chronicle, USA) to be checked for malware. VirusTotal processes the file and may make it available to security researchers – so please do not upload files containing personal or confidential content. The legal basis is Art. 6 (1) (b) and (f) GDPR (performance of a contract and legitimate interest in protecting all users from malware).

9. Contact form and removal requests

Through our contact form we process your name, email address, subject, message, the reference you provide and your IP address. We use this data solely to handle your request. The legal basis is Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR for contract-related requests. Requests are deleted once they have been dealt with, at the latest after 30 days; statutory retention periods remain unaffected.

10. Emails

We send emails for account activation, password resets and status updates about your apps via the mail server of our hosting provider. The legal basis is Art. 6 (1) (b) GDPR.

Comments

You can leave comments below app and magazine pages. The comment system runs on our own infrastructure at comments.merq.org; the controller is the same provider as for this website (see legal notice). No data is passed on to third parties.

When a page with comments loads, your browser transmits your IP address, date and time as well as browser and device information to that service. When you submit a comment, the comment text, the time and – if provided – your name and email address are stored in addition and displayed publicly next to the article; email addresses are not shown publicly. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a discussion below the articles) and, when you post a comment, Art. 6 (1) (a) GDPR.

Comments are kept until you or we delete them. We are happy to remove your comment on request – just contact us through the contact form.

Google AdSense

This website uses Google AdSense, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. AdSense uses cookies and comparable technologies to serve ads, to measure their delivery and – depending on your consent – to display personalised advertising. Data such as your IP address, device and browser information and your interaction with ads is processed and may be transferred to Google in the USA; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, which you give through the consent dialogue and can withdraw at any time. Further information is available in Google's advertising notice; you can manage your ad settings at myadcenter.google.com.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time. Please use our contact form or the contact details in the legal notice.

SSL/TLS encryption

For security reasons this site uses TLS encryption. You can recognise an encrypted connection by the “https://” in your browser's address bar.