Privacy Policy

Covers the Bimbloom app (iOS, Android, web) and the website bimbloom.app. Last updated: November 2026. The German version is legally binding; this is a translation.

In short

• The app collects no personal data unless a parent writes to us through the support form. The child's name and picture never leave the device.
• No accounts, no ads, no third-party SDKs that collect data.
• Optional, off until a parent allows it: anonymous play statistics (which games and levels are played) sent to our own server in Germany. Without that yes the app makes no network requests, except when a parent sends the support form.
• The app needs no internet connection to play.
• The website sets no cookies and uses no analytics.

Controller

Ivan Chabanenko, Lutherstraße 12, 39112 Magdeburg, Germany. Email: support-bimbloom@chbnk.one.
No data protection officer is appointed; none is legally required.

The app

What is stored on the device

So the game can remember progress, the app stores only locally on the device:

• the player name or nickname a parent types in (any nickname works; a real first name is not needed), the chosen animal picture and the age band (3–4, 5–6, 7–8 or 9–10) — used only to open suitable starting levels;
• progress: finished levels, stars, mistake and play-time counters per game, collected stickers and garden plants;
• settings: volume, language, break reminder.

This data is never transmitted — not to us and not to anyone else. We have no access to it.

Where the law applies to this at all, the legal basis is Art. 6(1)(b) GDPR (providing the app) and § 25(2) no. 2 TDDDG (storage strictly necessary for the service the user asked for).

Anonymous play statistics (optional)

On the first start the app asks a parent whether it may send anonymous play statistics. "Allow" is behind the parental gate; "No, thanks" sends nothing, ever. The choice can be changed at any time in the parents' area.

If a parent allows it, the app sends to our own analytics service OpenFrog (openfrog.chbnk.one, our server in Germany): which game and level was started, won or left, stars, mistake count, time spent, whether a hint or the guided tutorial was used, the age band of a new profile, opening the garden and new stickers, plus a random device id that the app creates and stores on the device. The connection also carries the IP address and browser/app details; the IP address is used only to recognise the country and is not stored. The child's name, the picture and anything typed are never sent. The data is not shared with anyone and is used only to see where children get stuck and to improve the games.

Legal basis is consent (Art. 6(1)(a) and Art. 8 GDPR, given by a parent; § 25(1) TDDDG for the device id). Turning it off in the parents' area stops all sending immediately (withdrawal, Art. 7(3) GDPR); to have data already sent deleted, write to us.

Deleting

A player profile can be deleted in the parents' area. Uninstalling the app removes all of its data. Device backups (iCloud, Google) may include it; you control that in your device settings.

Permissions

The app asks for no permissions: no camera, microphone, location, contacts or notifications. On phones it only uses vibration for short haptic feedback.

Purchases

The one optional purchase runs entirely through Apple or Google under your store account. We receive no payment details and no name. The app only asks the store whether this purchase was made, and remembers the answer on the device. If a parent allowed the anonymous statistics, they also count that the purchase page was opened and how the purchase ended, without any personal data.

Children

Bimbloom is made for children aged 3 to 10. The only data that can leave the device is the optional anonymous statistics above, after a parent allowed it behind the parental gate, and a message a parent sends through the support form behind the same gate. There are no ads, no in-app purchases aimed at children, no chat and no links leaving the app. Settings and the parents' area are behind a parental gate.

Offline

All pictures, sounds and voices ship inside the app. It downloads nothing and sends nothing, except the optional statistics once a parent allowed them and a support message a parent sends. The web version lets the browser cache its files for offline use (service worker, local storage); nothing is sent to us.

The website

The website runs on a server we rent from Hetzner Online GmbH in Germany and is delivered through Cloudflare, Inc., which protects it from attacks and serves it quickly. Cloudflare necessarily processes your IP address and request data (time, page, browser) for this; legal basis is Art. 6(1)(f) GDPR. We have a data processing agreement with Cloudflare, which is certified under the EU-US Data Privacy Framework. Our web server keeps no access logs for this site.

The website sets no cookies, uses no local storage, no analytics or advertising services, and embeds nothing from third parties. Fonts and images come from our own server.

If you email us, we use your address and message to reply (Art. 6(1)(b) or (f) GDPR). Mail to @chbnk.one is forwarded through Cloudflare Email Routing to our Google (Gmail) inbox. We delete correspondence once it is settled, unless the law requires us to keep it.

Support form

The website and the parents' area of the app (behind the parental gate) have a support form. Using it is voluntary; the app sends nothing until you press Send. We receive the email address and message you enter, the language and, from the app, its version number. It goes to our server in Germany and is delivered as an email through Resend, Inc. (USA) to our Google (Gmail) inbox. Our server does not save the message. It keeps the sender's IP address in memory for up to one hour, only to limit abuse. Legal basis is Art. 6(1)(b) or (f) GDPR. We delete correspondence once it is settled, unless the law requires us to keep it.

Your rights

You may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests (GDPR Art. 15–21) by writing to support-bimbloom@chbnk.one. You may also complain to a data protection authority, for example the Landesbeauftragte für den Datenschutz Sachsen-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany.

Changes

If the app changes, we will update this policy first. The current version is always on this page.