Privacy Notice

Last updated: 3 November 2026

This notice explains which personal data we process when you visit this website, use the AppsDisplay web app (the admin area) or run the AppsDisplay player on a screen, why we do it, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

We are not required to appoint a data protection officer.

2. Hosting with Firebase Hosting

This website, the web app and the player are hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). When you open a page, your browser automatically sends data that is stored in server log files:

• IP address
• date and time of the request
• requested page or file, referrer URL
• browser type and version, operating system

We need this data to deliver the pages and to keep the service secure and stable. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and reliable provision of our website and service. Firebase Hosting delivers content through a global content delivery network.

3. This website

This website does not use cookies, analytics or tracking. Fonts are loaded from our own server, so no connection to third-party font providers is made.

4. Your account (Google Sign-In)

To use the admin area you sign in with your Google account through Firebase Authentication. We receive and store:

• your name, email address and profile picture as provided by Google
• a unique user ID, the sign-in provider and the dates of account creation and last sign-in

We use this data to create and secure your account and to show who is signed in. Firebase Authentication stores a sign-in token in your browser so that you stay signed in; this is strictly necessary to provide the service you requested (§ 25 (2) no. 2 TDDDG). The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

5. Your content (Cloud Firestore and Cloud Storage)

The content you create in AppsDisplay is stored with Cloud Firestore and Cloud Storage for Firebase:

• displays: name, settings, the assigned playlist and when the display was last active
• playlists, playlist items, layouts and the settings of each app (for example texts, menus, opening hours, Wi-Fi details, links)
• images you upload

Only you can read and change your own data; a paired screen can only read the published playlist assigned to it. The legal basis is Art. 6 (1) (b) GDPR. Firestore data is stored in the European Union (multi-region “eur3”). Uploaded images are also stored in the European Union.

If your content contains personal data of other people (for example photos of staff or guests), you are responsible for having a legal basis for showing it, and we process that data on your behalf.

6. Pairing and running a display

When the AppsDisplay player runs on a screen, it processes:

• a random 8-digit pairing code, which expires after about 11 minutes if it is not used
• technical device information: screen resolution, orientation, browser name and whether the screen supports touch
• a regular “last active” timestamp, so you can see in the dashboard whether the display is online

After pairing, the player stores the IDs of the account and display in the browser's local storage so that it keeps playing after a restart. This is strictly necessary for the function the display owner requested (§ 25 (2) no. 2 TDDDG). The legal basis is Art. 6 (1) (b) GDPR towards our customer and Art. 6 (1) (f) GDPR for the operation of the display.

7. Protection against abuse (Firebase App Check with reCAPTCHA v3)

The web app and the player use Firebase App Check with Google reCAPTCHA v3 to make sure requests to our database come from our real app and not from bots or scripts. For this, reCAPTCHA evaluates information about your browser and device (such as IP address, browser settings, interactions with the page) and sends it to Google.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting our service and your data against abuse. Storing and reading information on your device for this purpose is strictly necessary to provide the service securely (§ 25 (2) no. 2 TDDDG). More information: Google Privacy Policy.

8. Usage analytics (Google Analytics for Firebase)

With your consent, the web app uses Google Analytics for Firebase to understand how AppsDisplay is used, for example which pages are opened and how often. Google Analytics processes a pseudonymous app instance ID, pages and screens viewed, the time and duration of visits, approximate location derived from your IP address, and device and browser information. Google Analytics stores identifiers on your device.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future. Google Analytics keeps event data for 2 months and user-level data for 14 months; after that it is deleted automatically.

9. Performance Monitoring (Firebase Performance Monitoring)

With your consent, we use Firebase Performance Monitoring to measure how fast the web app loads and responds. It collects technical data such as page load times, network request durations, device and browser type, country derived from the IP address and a pseudonymous installation ID. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

10. Content from third parties on displays

Some apps load content from other providers when they are shown in the editor or on a screen:

• Image app: the default sample image is loaded from Unsplash (Unsplash Inc., Canada).
• Website app: shows a website you choose. That website's own privacy policy applies.
• Social media and QR code apps: only show links or codes; no data is sent to the linked services until someone opens them.

When such content loads, the provider receives the IP address of the device. The legal basis is Art. 6 (1) (b) GDPR, as the content is shown at the display owner's request.

11. Recipients and transfers outside the EU

We use Google (Firebase) as our processor under a data processing agreement (Art. 28 GDPR). Google may process data on servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply. More information: Privacy and Security in Firebase.

We do not sell your data or pass it on to other third parties unless we are legally required to.

12. How long we keep data

• Account and content data: as long as your account exists. To delete your account, email us at info@MyActivities.com. We then delete your account and everything you created in AppsDisplay — displays, playlists, app settings and uploaded images — without undue delay.
• Analytics data: event data after 2 months, user-level data after 14 months.
• Pairing codes: they expire after about 11 minutes.
• Server log files: according to Google's retention periods for Firebase Hosting.
• Data we must keep for tax or commercial law reasons: for the statutory periods (up to 10 years).

13. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)
• object to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, email us at info@MyActivities.com.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

14. Is providing data required?

You need a Google account to use the admin area, and a paired screen needs the data described in section 6 to work. Without this data we cannot provide the service. Consent to analytics and performance monitoring is voluntary.

15. Changes to this notice

We update this notice when our service or the law changes. The current version is always available on this page.