Privacy Policy

Last updated: June 2026

1. General Information

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (specifically the European General Data Protection Regulation, GDPR) and this Privacy Policy.

2. Controller (Responsible Party)

Cortify is operated as a non-commercial project under the trade name "NeoCor6" by Dr. Olaf Schmidt, Am Rebengärtchen 56, 69190 Walldorf, Germany. Contact: neocor6@gmail.com.

3. Hosting and Infrastructure

Our website and web application are hosted using Google Firebase. Google Firebase is a platform provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We host our application resources and data in European server regions (e.g., europe-west3 in Frankfurt, Germany) to ensure compliance with the GDPR.

4. Data Collection in the Web App

If you choose to log in and use our web application, the following personal data is collected and processed:

• Authentication Data: Email address, Display Name, and Profile Photo URL (provided by Google Sign-In or your email provider). This is processed via Firebase Authentication to identify you and keep your session secure.
• Game Progress Data: Game scores, active play history, and training statistics. This is stored in Firebase Firestore to calculate your self-comparison metrics, dashboard charts, and leaderboards.

This processing is based on your consent (Art. 6(1)(a) GDPR) when you create an account, and is necessary for the performance of our contract/service to you (Art. 6(1)(b) GDPR).

5. Cookies and Local Storage

This website does not use third-party tracking, profiling, or advertising cookies. We do operate our own privacy-friendly, cookieless analytics service (see section 6).

We use browser Local Storage and Session Storage for the following functional purposes:

• To persist your login session (handled automatically by the Firebase Auth SDK).
• To store your language preferences (i18next).
• To store your preference regarding the cookie consent banner.

These technologies are strictly necessary for the technical operation of the website and the provision of the requested service (Art. 6(1)(f) GDPR / § 25(2) TTDSG).

6. Web Analytics (Self-Hosted Umami)

To understand which pages of our site are popular and how visitors interact with Cortify, we use Umami, an open-source, privacy-friendly analytics tool that we operate ourselves on Google Cloud Run servers in Frankfurt, Germany (europe-west3). Both the tracker script and the analytics dashboard are served from the same subdomain of our own domain: analytics.neocor6.com.

Umami does not use cookies and does not collect personally identifiable information. It records:

• Page URL and page title.
• Referrer (the previous page you came from).
• Browser, operating system, device type and screen size.
• Country (derived from your IP address, which is then immediately discarded; we do not store full IP addresses).
• A daily-rotating, anonymous hash used solely to estimate unique visitors. The hash is regenerated every day and cannot be linked back to an individual.
• Aggregated custom events that we trigger ourselves (e.g. "started a game"), with no personal payload.

Legal basis: our legitimate interest in measuring and improving our service (Art. 6(1)(f) GDPR). Because Umami is cookieless and stores no personal identifiers, no separate consent under § 25 TTDSG is required.

Sub-processors:

• Google Ireland Limited (compute infrastructure via Cloud Run, region europe-west3 in Frankfurt, Germany).
• Neon Inc. (managed PostgreSQL database used by Umami, hosted in AWS region eu-central-1 in Frankfurt, Germany).

Your browser's Global Privacy Control or Do Not Track signal is respected: when either is enabled, no analytics events will be sent at all.

7. Leaderboard Public Sharing

If you register an account, your display name, profile photo, and high scores will be visible on the public leaderboard inside the web application. If you prefer to be anonymous, you can edit your profile display name in the settings or use the application without registering.

8. Feedback Submissions

If you use the contact form, we collect the message you write and (optionally) your email address. We also automatically attach the page URL, browser user-agent, app version, and selected language to help us reproduce issues. For signed-in users, your user ID is included. Submissions are stored in Google Firestore (Firebase) and forwarded to the developer's email via SMTP. Data is retained for up to 12 months and then deleted. Legal basis: legitimate interest in maintaining and improving the service. You can request deletion at any time by writing to the same contact channel.

9. Your Rights

As a user, you have the following rights under the GDPR:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restrict processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

You can request the deletion of your account and all associated data at any time by contacting us at neocor6@gmail.com or by using any self-service options provided within the web app.