Last updated: April 29, 2026
This is an English translation of the original German privacy policy. In case of discrepancies between the language versions, the German version is legally binding. The German original is available at https://karmaboost.com/app/privacy-de.html.
The data controller as defined by the General Data Protection Regulation (GDPR) and other national data protection laws of EU member states is:
Marco Bosse
operating under the business name HIVVEN
Ahornring 69
15749 Mittenwalde
Germany
Phone: +49 30 60530536
Email: email@karmaboost.com
Website: https://karmaboost.com
VAT identification number pursuant to § 27a of the German VAT Act: DE253517403
KarmaBoost is a mobile application for personal reflection on small positive moments in everyday life. The app is designed for maximum data minimization:
Personal data is only processed in the cases described in sections 4 to 6 — and only on the basis of a corresponding legal ground.
This privacy policy uses the terms defined in the GDPR. An explanation of the most important terms (e.g., “personal data,” “processing,” “controller”) can be found in Article 4 GDPR.
When you use the app, KarmaBoost stores the following data exclusively locally on your device in a SQLite database:
This data is not transmitted to us or third parties unless you explicitly activate one of the functions described in sections 5 or 6.
Local storage serves to provide the app’s core functionality. Insofar as processing takes place within the meaning of the GDPR, it is based on Art. 6 (1)(b) GDPR (performance of the user agreement concluded with you).
Local data remains on your device until you remove it via the “Delete all data” function in the app settings or uninstall the app.
Upon first launching the app, we ask you via a consent dialog whether you agree to the data processing described below. You can refuse consent or withdraw it later at any time in the app settings under “Privacy → Analytics & Crash Reports”. Without your consent, no data is transmitted to Firebase — the app does not initialize Firebase services in this case.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Purpose: Anonymous collection of app usage data to improve the app (e.g., recognizing which functions are used how often, where users drop off).
Data processed:
Not processed:
Legal basis: Art. 6 (1)(a) GDPR (consent) and § 25 (1) German TTDSG (Telecommunications-Telemedia Data Protection Act, consent for access to terminal equipment).
Storage period: Up to 14 months from collection. Data is then automatically deleted or aggregated anonymously.
Provider: as in 5.1.
Purpose: Recording app crashes to identify and resolve stability issues.
Data processed:
Not processed:
Legal basis: Art. 6 (1)(a) GDPR (consent) and § 25 (1) German TTDSG.
Storage period: 90 days for detailed data, then aggregated storage.
Google also processes the data mentioned in 5.1 and 5.2 in the USA. Google is certified under the EU-US Data Privacy Framework (DPF) (see https://www.dataprivacyframework.gov/). Additionally, the transfer is based on the EU Standard Contractual Clauses pursuant to Commission Decision (EU) 2021/914.
We have concluded a data processing agreement with Google in the form of the Firebase Data Processing Terms.
In the app settings, you can send us messages via the “Report bug,”
“Suggest idea,” and “Contact” functions. The transmission goes to our
server at karmaboost.com/app/backend/feedback.php.
Processing your inquiry, fixing reported bugs, improving the app.
Art. 6 (1)(f) GDPR (legitimate interest in improving the app and processing user inquiries).
The data is stored on a server of All-Inkl.com – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (processor). We have concluded a data processing agreement with All-Inkl. The data remains on servers in Germany.
We store feedback messages for up to 24 months after receipt to be able to track recurring issues. The data is then deleted or anonymized. Upon request, we will delete your messages earlier (see section 9).
The anonymous device identifier serves exclusively to technically associate multiple messages from the same device (e.g., follow-up reports on a bug). It contains no personal data and is not combined with other data sources. The UUID remains on your device even if you select “Delete all data” in the app settings — you can only remove it by uninstalling the app.
We share your data exclusively with the following processors:
| Recipient | Purpose | Country |
|---|---|---|
| Google Ireland Limited / Google LLC | Firebase Analytics, Firebase Crashlytics (only with consent, see 5) | Ireland / USA |
| All-Inkl.com – Neue Medien Münnich | Hosting of the feedback backend (see 6) | Germany |
No data is shared with any other third parties.
We use technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access. In particular, data transmission to our server (section 6) and to Firebase (section 5) takes place exclusively encrypted via HTTPS/TLS.
As a data subject, you have the following rights under the GDPR:
Die Landesbeauftragte fĂĽr den Datenschutz und fĂĽr das Recht auf Akteneinsicht Brandenburg (State Commissioner for Data Protection and the Right to Access Files of Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany
Phone: +49 33203 356-0
Email: poststelle@lda.brandenburg.de
Website: https://www.lda.brandenburg.de
To exercise your rights, please contact us using the contact details mentioned in section 1. You can remove data stored locally on your device at any time via the “Delete all data” function in the app settings.
For requests regarding deletion of data processed by Google as part of Firebase, you can also contact Google directly: https://support.google.com/firebase/answer/6318039
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
The app is not directed at persons under 16 years of age. We do not knowingly collect personal data from children under 16. Should we discover that such data has been transmitted to us without verifiable consent of legal guardians, we will delete it immediately.
This privacy policy is currently valid and dated April 29, 2026. As a result of the further development of the app or due to changing legal or regulatory requirements, it may become necessary to adjust this privacy policy.
In the event of significant changes affecting your consents (in particular changes to section 5), you will be asked again for your consent the next time you launch the app.
The current version of this privacy policy can be accessed at any time at https://karmaboost.com/app/privacy-en.html.
For questions about data protection, contact:
Marco Bosse (HIVVEN)
Email: email@karmaboost.com
Last updated: April 29, 2026 · Version 1.0