Privacy policy

As of 21.10.2026

This is a translation. The German version, the Datenschutzerklärung, is the binding one.

This privacy policy covers the app “Passweg” for Android and iOS and this website. It tells you which personal data is processed, for what, on which legal basis, and what your rights are.

In short

• You need no account. We have no server that stores data about you.
• Your Bundesland, your exam date, your settings and your progress stay on your device.
• The free app shows ads from Google. Whether Google may use data to tailor them to you is your choice, in Google’s consent dialog. You can change it at any time in the app under Settings → Privacy options.
• If you buy “Remove ads”, the app loads no more ads. Google Play or the App Store handle the purchase; we receive no payment data.
• If the app crashes, it sends a crash report to Google’s Firebase Crashlytics, without your name and without your answers, so that we can fix the fault. You can turn this off in the app under Settings → Send crash reports.

1. Who is responsible

More in the imprint. We have no data protection officer; we are not required to have one.

2. Data stored only on your device

For the app to work, it stores on your device:

• your Bundesland and your exam date, if you enter them,
• your settings (language, theme, whether translations are shown),
• your answers to the questions, your progress and the results of your mock exams,
• the questions you bookmarked,
• a practice run or mock exam in progress,
• whether you bought “Remove ads”, and when the last full-screen ad came,
• the questions themselves and their updates.

This data is not sent to us. We cannot see it. As far as we are responsible at all, the legal basis is Art. 6 (1) (b) GDPR (using the app as you chose to). Storing it on your device is strictly necessary for the app (§ 25 (2) no. 2 TDDDG).

Deleting it: Settings → Reset progress deletes your progress and your mock exams. Your bookmarks stay; Bookmarks → Remove all deletes them. Deleting the app deletes all of its data on the device.

Backups: If you have turned on backups on your device (Android backup with Google, iCloud Backup with Apple), they include the app’s data, so that your progress comes back on a new device. These backups are in your account with Google or Apple, not with us. If you restore an older backup, progress you deleted may come back. The questions themselves are not backed up; the app downloads them again.

3. New questions (updates of the question catalog)

When it starts, the app asks our server whether there is a newer version of the question catalog, and downloads it if there is. This transmits what the connection technically needs: your IP address, the date and time, the requested file and general technical details of the connection. The app sends no identifier that makes you or your device recognisable. Without internet, the app works with the questions it already has.

The server is a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), which runs it for us (processing on our behalf, Art. 28 GDPR, under Cloudflare’s data processing addendum). Cloudflare processes the requests to deliver the files and to protect the server from attacks, also in the USA. Cloudflare is certified under the EU-US Data Privacy Framework and also uses standard contractual clauses. We keep no logs of the requests ourselves; Cloudflare keeps them for as long as these purposes require and names no fixed period. More from Cloudflare: cloudflare.com/privacypolicy. The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest is that you have the current questions and that the server can be run securely.

4. Ads (Google AdMob)

The free app is financed by ads. They come from Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The app shows a banner below practice questions and now and then a full-screen ad after you finish a practice run or a mock exam. There are no ads during a mock exam, during the first setup, on Progress, in your bookmarks or in Settings.

The consent dialog

Before any ad is loaded, the app shows Google’s consent dialog (the “User Messaging Platform”) in the EU, the European Economic Area, the United Kingdom and Switzerland. It follows IAB Europe’s Transparency & Consent Framework. There you decide whether Google and its advertising partners may store and read information on your device and use your data to tailor ads to you and measure them. The dialog also shows you who these partners are. Your choice is stored on your device.

What data Google processes

• your IP address, from which Google estimates roughly where you are (such as the city),
• details of the device and the app, such as the device model, operating system, language and app version,
• your device’s advertising ID (Android’s advertising ID, on iOS the IDFA, only if you allow it; see below),
• how you interact with the ads, such as which ads you saw or tapped,
• technical diagnostic data of Google’s ad software, such as its performance and crashes.

Google uses this data to deliver and measure ads, to limit how often you see the same ad, to prevent fraud and, if you consent, to tailor ads to you.

Legal bases

Storing and reading information on your device and personalised ads are based on your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). If you do not consent, Google shows only ads that are not tailored to you; the processing this needs, such as of the IP address to deliver the ad and to prevent fraud, is based on Art. 6 (1) (f) GDPR. Our legitimate interest is being able to offer the app for free. Some partners rely on their legitimate interest for certain purposes; you can object to that in the dialog.

Changing your choice

You can withdraw or change your consent at any time: in the app under Settings → Privacy options. Withdrawing applies from then on.

iOS: Before the app may read the IDFA, iOS asks you whether the app may track your activity across other companies’ apps and websites (“App Tracking Transparency”). If you decline, Google does not get the IDFA. You can change this in iOS Settings under Privacy & Security → Tracking.

Android: You can reset or delete the advertising ID in Android’s settings (depending on the device under Privacy → Ads or Google → Ads).

Responsibility, other countries, how long

Google processes this data on its own responsibility, under Google’s privacy policy: policies.google.com/privacy. How Google uses data from apps that use its services is explained at policies.google.com/technologies/partner-sites. Google may transfer data to Google LLC in the USA. For the USA there is an adequacy decision of the European Commission (the EU-US Data Privacy Framework), under which Google LLC is certified; Google also uses standard contractual clauses. How long Google keeps data is up to Google. Your choice in the consent dialog stays on your device until you change it or delete the app.

Without ads

If you bought “Remove ads”, the app no longer starts Google’s ad software, no longer shows the consent dialog and loads no ads.

5. Buying “Remove ads”

The purchase is handled by the store you got the app from: Google Play (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or the App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). The stores process your payment and account data on their own responsibility, under their own privacy policies.

We receive no payment data. At every start the app asks the store whether your account owns the purchase, and stores on your device only whether it does. What the stores show us about a purchase in our developer account, such as the order number, date, country and price, we use for accounting and keep for as long as tax and commercial law require. The legal bases are Art. 6 (1) (b) GDPR (the purchase) and Art. 6 (1) (c) GDPR (legal retention duties).

6. Reminders of your exam date

If you enter an exam date and allow notifications, the app reminds you the evening before and on the morning of the exam. Your device plans these reminders itself; no data is transmitted for them. You can take the permission back in your device’s settings.

7. Crash reports (Firebase Crashlytics)

If the app crashes, it sends a crash report to Firebase Crashlytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It also sends such a report when it notices a fault that it handles itself, such as a file it cannot read. This is how we find and fix faults.

A report contains:

• where in the program the fault happened (the “stack trace”), with the date and time,
• details of the device, such as its model, the operating system and its version, free storage, whether the device is rooted or jailbroken, and whether the app was in the foreground,
• the app’s version, the version of the question catalog, your Bundesland, whether you bought “Remove ads”, and the app’s language,
• the app’s last technical messages before the fault, such as that updating the questions did not work; your answers are not among them,
• a random identifier of this installation of the app, so that we can see how many devices a fault affects. It is not the advertising ID, and it does not tell us who you are.

The app also tells Crashlytics when it was started, with the same identifier and the details of the device, so that we can see how often it runs without crashing.

Google processes this data on our behalf (as our processor under Art. 28 GDPR, on the basis of Firebase’s data processing terms) and may process it in its data centres worldwide, including in the US. For the US there is an adequacy decision of the European Commission (EU-US Data Privacy Framework), under which Google LLC is certified; Google also uses standard contractual clauses. Crashlytics deletes the reports and the identifiers after 90 days. More from Google: firebase.google.com/support/privacy.

The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest is an app that works reliably.

Turning it off: in the app under Settings → Send crash reports. The app then sends no more reports, from its next start at the latest, and deletes the reports it had not sent yet. You can change this again at any time.

8. When you write to us

If you send us an email, for example through “Report a problem” below a question (which opens your email app with the question’s number) or “Send feedback” in Settings (which puts the version of the app and of your phone’s system into the message; you can delete it before sending), we process your email address, your name if you give it, and your message, to answer you. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is answering your request. We delete the message when the request is dealt with, unless tax or commercial law requires us to keep it.

Our email address (see section 1) is at Cloudflare (see section 3): Cloudflare forwards the emails sent to it to our Gmail mailbox (Cloudflare Email Routing). By its own account, Cloudflare does not store the content of your email; it keeps delivery details such as your address and the time in a log. The mailbox is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your email stays there until we delete it. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

9. This website

Cloudflare also runs this website for us, as described in section 3. When you visit it, Cloudflare processes your IP address, the date and time, the page visited and details of your browser, to deliver the page and to protect it from attacks. We keep no logs ourselves. The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest is delivering the website securely. The website sets no cookies, uses no analytics and loads nothing from other servers.

10. What the app does not do

The app has no accounts and no analytics. It does not read your precise location, your contacts, photos, files or microphone.

11. The app’s permissions

On Android the app uses these permissions:

• Internet and network state: for new questions, ads and the purchase.
• Notifications: for the reminders of your exam date. The app asks only when you enter a date.
• Run at startup: so that the reminders are planned again after the device restarts.
• In-app purchases (Google Play): for “Remove ads”.
• Advertising ID: for the ads (see section 4).
• Google’s ad software also brings: background work (keeping the device awake briefly, foreground services) and basic phone state (such as the type of mobile network; no phone numbers and no calls).

On iOS the app asks for permission to send notifications (for the reminders), and iOS asks whether the app may “track” (see section 4).

12. Children

The app is for people preparing for the Einbürgerungstest, not for children under 16. The ads are not directed at children.

13. Your rights

You have the right of access to the data we process about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7 (3)).

Right to object: You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

Since we have no data about you apart from emails you send us, in practice: what is on your device you manage yourself in the app. Crash reports carry only a random identifier; we cannot link them to you, and they are deleted after 90 days. For the data Google processes for the ads, contact Google or use the app’s privacy options. For anything else, write to us at info@passweg.app.

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

14. Changes

When the app changes, we update this privacy policy. The version on this page applies; its date is at the top.