Privacy Policy for pumlet
1. Controller and principle
This policy applies to the pumlet app, the website pumlet-site.jom1337.workers.dev and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: [email protected].
pumlet works without an account. The app contains no ads and no third-party analytics, tracking or crash reporting services. We store no names, accounts, IP addresses or device identifiers from the app, because it does not send any data to a server of ours (section 6). We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. pumlet is not specifically directed at children under 13.
2. What is stored on your device
The app stores everything you create and achieve in pumlet only on your device: your companions with the names you give them, their look, growth and memories, as well as sunshine, eggs, treats, furniture, outfits and your room. It also stores your daily budget, your lock times, the list of apps you picked as distracting, your focus sessions with duration, breaks and outcome, the daily usage minutes or budget levels (section 3), your phone time estimate from setup, your settings (language, sound, haptics, display, notifications) and your Pro status with product and expiry date (section 7).
So that locking also works while pumlet is closed, the app additionally keeps part of this in the system storage of its lock feature. On Android these are the package names of the chosen apps (e.g. com.instagram.android), start, end and breaks of the current focus session, your lock times, your companion's name and form and the language for the lock screen. On iOS, storage shared by the app and its Screen Time extensions holds Apple's identifiers (tokens) of the chosen apps, app categories and websites, from which pumlet cannot read their names. It also holds start, end, breaks, outcome and unlock attempts of the focus session, your lock times, your daily budget, the budget levels reached in the last 14 days, a log of the last 30 levels reached with their time, your companion's name and form and the language.
This storage is necessary for the features you want to use (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR).
Deleting: Profile › Account & data › “Delete all data” deletes your progress with companions, stats, settings and the Pro status in the app. It also clears the system storage of the lock feature, ends a running lock and removes your lock times. Your language setting is kept. Permissions such as Screen Time, usage access or notifications stay until you revoke them in system settings. When you uninstall pumlet, the operating system removes all of the app's data, on iOS including the shared storage of the Screen Time extensions. Existing operating system backups are not affected. A Pro purchase stays with your store account and can be restored.
Backups: Depending on your device settings, operating system backups may contain a copy of this data: on Android the automatic backup to your Google account, on iOS your iCloud or computer backup. These backups are managed by Google or Apple, not by us.
Export: Profile › Account & data › “Export data” creates a JSON file with your progress and opens your device's share menu. You decide where you save or send the file. For export and sharing (section 5) the app briefly places the file or image in its cache. It deletes this copy two minutes after sharing, otherwise the next time you share, start the app or delete all data. If the share menu does not work, the app only shows a notice.
3. Screen time and app locking
pumlet shows how much time you spent in the chosen apps today and locks them during a focus session or your lock times. For this the app asks the operating system for permission. Without it, measuring and locking do not work.
- iOS: pumlet uses Apple's Screen Time API (Family Controls, Device Activity, Managed Settings). You pick the apps, app categories or websites in a selection screen provided by Apple. pumlet does not learn which ones they are; it only receives identifiers (tokens) and their number. iOS tells the app when your usage reaches certain levels of your daily budget (25, 50, 75, 100 and 150 percent). The app stores the highest level reached per day. During a focus session and in your lock times iOS places a lock screen over the chosen apps.
- Android: With usage access, pumlet reads the system's usage events. From them the app calculates how many minutes the chosen apps were in the foreground and stores these minutes per day. If you have not chosen any apps yet, the app calculates nothing. So that you can pick apps, it shows the list of installed apps with name and icon; of these, only the package names of the chosen apps are stored. During a focus session or lock time, a background service checks which app is in the foreground and shows a lock screen over locked apps. This needs the “Display over other apps” permission. While the service is running, Android shows an ongoing notification. After a restart the app starts the service again so that lock times keep applying.
This evaluation takes place only on your device. pumlet does not send usage data, app lists or identifiers to us or to third parties. pumlet cannot see what you do inside other apps. The legal basis is Art. 6(1)(b) GDPR, because measuring and locking is the feature you want to use. You can revoke the permissions at any time in your system settings.
4. Notifications
If you allow it, the app schedules local notifications on your device: at the end of a focus session, in the evening at 8:30 pm and, if you switch it on, in the morning at 8:30 am. You choose in the app which of these you get. We do not run a push service and receive no device identifier. You can revoke the permission at any time in your system settings. The legal basis is Art. 6(1)(b) GDPR and your permission in the operating system.
5. Sharing
If you share a success, the app creates an image on your device with your companion, its name and your focus minutes or good days, and opens your device's share menu with it, together with a short text. Nothing is sent until you choose a destination. You decide what you send and to whom.
6. Internet connection
pumlet does not connect to any server of ours. There is no account and no cloud backup. Graphics, music and sounds are included in the app. The app only uses a network connection for purchases and prices through the store (section 7) and when you open a link, for example to support or to these legal pages. Such links open in your browser.
7. App Store, Google Play and purchases
You get pumlet from Apple's App Store or Google Play. Apple and Google process account, download and, where applicable, payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be available, which we only use to handle purchase and support questions. Depending on your permissions and settings, the platforms may provide technical crash reports. This does not give us full card or bank details.
You buy pumlet Pro directly in the respective store, as a monthly or yearly subscription or as a one-time purchase. The app loads the prices from the store and, after a purchase, receives the product, purchase status, purchase time and, where the store provides them, expiry date and transaction ID. At startup, when you return to the app and when you tap “Restore purchases”, it asks the store which purchases belong to your store account. Based on this it unlocks Pro, confirms the purchase with the store and stores the product and an expiry date of the unlock on your device. If the store provides no expiry date, as with Google Play on the device, the unlock lasts three days at a time and is extended with each check as long as the store still reports the purchase. If no valid purchase belongs to your store account any more, for example because a subscription expired or was refunded, the app removes Pro again. Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.
8. Website
The website pumlet-site.jom1337.workers.dev consists of static pages and is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Workers, Static Assets). With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. Cloudflare also processes technical operating data under its privacy policy.
The website pumlet-site.jom1337.workers.dev sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and images are served from our own server. If you open an external link, the privacy policy of that provider applies there.
These legal pages are hosted on punktdev.com, which is also delivered via Cloudflare. There the page reads any light/dark preference (pdev-theme) stored in your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.
9. Contact by email
If you email us, for example at [email protected], the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.
10. Recipients and processing outside the EU
We use these service providers for the purposes described:
- Cloudflare, Inc. (USA): hosting of the website pumlet-site.jom1337.workers.dev and of these legal pages as our processor under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Details are in the Cloudflare DPA.
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365, our email mailbox, as our processor under a data processing agreement (Art. 28 GDPR). Data is generally stored in the EU; transfers to Microsoft Corporation (USA) are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Apple and Google are independently responsible for the App Store and Google Play (section 7). You can request a copy of the safeguards at [email protected].
11. Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future.
Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.
You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Because your pumlet data is stored only on your device, we cannot view it, delete it for you or hand it over. You can export and delete it yourself in the app or on your device (section 2).
12. Changes and language versions
We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.