Privacy Policy

This privacy policy applies to the entire Most Voted service, covering both the apps area (Most Voted Apps) and the podcasts area (Most Voted Podcasts). Where “app” is used below, the same applies to a “podcast” where the respective feature exists.

The official German version of the privacy policy is the legally binding document. The English version is provided for information only.

1. Data Controller

2. Accessing the website, hosting and email

This website is hosted by IONOS SE (Elgendorfer Straße 57, 56410 Montabaur, Germany); servers and database are located in Germany. We also send our emails via IONOS (registration confirmation, password reset, replies to enquiries, security notices, notifications under section 6). A data processing agreement under Art. 28 GDPR is in place with IONOS. Beyond that, the connections to providers outside the EU described in sections 10, 12, 13 and 15 occur (explained in the respective sections).

Each time the site is accessed, IONOS records log data: IP address, time, page accessed, HTTP status, amount of data transferred, browser and operating system, and the previously visited page. The purposes are connection setup, system security and error analysis; the legal basis is Art. 6(1)(f) GDPR (to protect the technical infrastructure). IONOS creates these files automatically and keeps them for up to eight weeks. We do not process a copy of this log data ourselves.

Independently of these hosting logs, we keep two security logs of our own. Neither records your ordinary visit; both are triggered only by anomalies.

The first concerns reports from your browser: it checks which sources a page loads content from and tells us when something comes from a source we have not authorised – an indication of injected foreign code. We record the page requested, the resource objected to and the rule violated.

The second concerns requests to our servers: where a request carries a pattern typical of attacks, we log the time, the page requested, the pattern detected and its immediate surroundings (200 characters at most), along with details of your browser and operating system. Anything you enter into name, address or contact fields is excluded, as are passwords.

In both cases we store your IP address solely as a hash that cannot be reversed – we never record it in plain text. It serves only to limit the number of reports per sender. We delete these logs after 14 days. The legal basis is our legitimate interest in protecting the platform against attacks and in being able to meet our notification obligations in the event of a data breach (Art. 6(1)(f) GDPR).

To monitor the load on our servers and to detect misuse, we keep, per browser session, the identifier of the session cookie (section 11), the time of the most recent request, an abbreviated note of your browser, for signed-in users the account, and your IP address as a hash that cannot be reversed. We do not set a separate cookie for this. The overview is visible to administrators only; once a day we derive counts from it that contain no personal data, such as the number of visitors on the previous day. We delete these entries after seven days. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).

For reach statistics, we record for each page view the identifier of the session cookie (section 11), the type of page viewed (without the specific app or other identifiers from the address), the domain of the previously visited page, the country, whether a mobile device is used, and the time. We determine the country using a database stored locally on our server; the IP address is then discarded. We do not record views of account, sign-in or unsubscribe pages, nor automated access. We do not set a separate cookie for this, and no data is transmitted to third parties. Once a day we combine the entries into counts that contain no personal data, such as views per page type and day; we also share these counts with advertising customers. We delete the individual entries after 14 days. The legal basis is our legitimate interest in evaluating the use of our service and in being able to state its reach to advertising customers (Art. 6(1)(f) GDPR).

3. User account

You can browse without an account. Voting, submitting an app or proposing a podcast require one. We collect:

• Username
• Email address
• Password (not in plain text, stored as a bcrypt hash)
• Time of registration and verification

Legal basis: Art. 6(1)(b) GDPR. The data is deleted when you delete your account; for the exception see section 4. On registration we send a confirmation email; the account becomes active only after the link is clicked. We reject addresses from known disposable services. The comparison takes place on our server; nothing is transmitted to third parties.

When you accept our Terms of Service, we store which version you accepted and when. This allows us to demonstrate which terms apply to your account. We delete these details together with your account.

Protection against mass registrations

In addition, we store a pseudonymised comparison value of your IP address at registration – a SHA-256 hash with a server-side key, derived from the full address and from its network range (/24 for IPv4, /64 for IPv6) – and a device identifier placed in your browser at registration; if it is later missing there, we place the same value again when you sign in. We do not store the IP address itself. This lets us limit the number of new accounts per connection in the short term and identify account farms built up over a longer period. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest is protecting our service against misuse). We delete both details no later than 24 months after registration; if you delete your account earlier, they are deleted together with it.

4. Voting and manipulation protection

For each vote we store: the app or podcast rated, the type of vote (up / down), your account, the time, a hash of your IP address (SHA-256 with a server-side key) and a hash of technical characteristics of your browser and device. The purpose is to detect manipulation – for instance several accounts belonging to the same person, or votes cast automatically. Legal basis: Art. 6(1)(f) GDPR (integrity of the vote).

When you vote, your browser provides characteristics of your device and browser settings. Only a salted hash of these is stored, not the characteristics themselves. They are read only at the moment you vote, not while you browse. Under § 25(2) no. 2 TDDDG this does not require consent, because it is strictly necessary to provide the voting you have requested, with one vote per person.

For votes we do not store the IP address itself but a pseudonymised comparison value. This means no list is created of the IP addresses you have voted from.

If the system detects a suspicious pattern, the affected vote is flagged and not counted towards the award; this step is automatic. If the suspicion is confirmed, we take graduated measures under our Terms of Service, up to blocking the account. We decide on these measures case by case and not solely in an automated manner; no decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

To detect coordinated votes, we evaluate the timing of registrations and votes, pseudonymised IP and device characteristics, matches between accounts and comparisons with public provider information.

To prevent an exclusion from being circumvented by a new account, we store characteristics for recognition in objected cases: the IP hash, a device or browser identifier and details of the objected activity. We use these for that purpose only – not for advertising and not for behavioural analysis.

If you delete your account, your votes are removed. The log entry is retained without any link to a user account (time, app or podcast, IP hash), because otherwise the protection could be circumvented by "delete, re-register, vote again". This entry is also deleted after 24 months.

5. App and podcast submissions, data sources and verified providers

When you submit an app, we store your account, the time and the submitted URL. The app data itself is obtained from Apple's official iTunes Search API and, for Windows apps, from the Microsoft Store; for Android apps the developer enters it. For every app we display the provider's name from the store data – for individual developers this may be a real name, originating from their own public store listing. Legal basis: Art. 6(1)(f) GDPR (we have a legitimate interest in operating a complete app directory and in making clear who offers an app; the name comes from the provider's own publication in the store).

Providers can prove that an app belongs to them and are then activated to edit their data. For this we process the details of the request, the proof (such as an email address on the app's domain), the time and outcome of the review, a verification status and an API token. This data is deleted when the status ends or the account is deleted. Verified providers can additionally supply promotional codes for their apps for future prize draws (we store the code, the app and the account that provided it) and embed an award widget. For the widget we record the domain of the embedding page together with the time and number of requests, in order to detect misuse. We do not store data about visitors to that page.

The podcasts listed are taken from their providers’ public RSS feeds. We decide which podcasts to include using Apple’s podcast charts and search and, optionally, the Podcast Index and fyyd directories. You can also propose a podcast yourself: you search for it in Apple’s directory (our server sends your search term to Apple, but no data about you), and with an account you add it. We then store your account, the time and the feed address; all content (title, description, cover, categories) is read from the feed, not from your input. From the feed we also take the details the provider publishes there: the name of the provider or responsible person and a contact email address from the “itunes:owner” field. We never display this address publicly; we use it so that a provider can, on request, prove that the podcast is theirs (see below). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a complete, discoverable directory and in a secure proof of responsibility). As these details are taken from the feed and not collected from the data subject, we hereby inform you under Art. 14 GDPR; you may object at any time at datenschutz@mostvoted.app.

Whoever is responsible for a podcast can claim it as theirs (verify) and is then enabled to maintain it. You prove this via the contact address in the feed, via an address on the domain of the official website, or via a code you temporarily place in the feed or on the website. For this we process your account, the chosen method, for email proof the address the code was sent to and the code only as a hash (valid for 24 hours), for website or feed proof the code you place publicly anyway, and the time and outcome of the review. Verified owners can send us correction notes about their podcast; we store the account, the field concerned, the text and the processing status. We delete this data when the status ends or the account is deleted. An embeddable podcast award widget also exists; unlike the app widget, we do not log any data about the embedding page for it (neither domain nor request count).

6. Contact details and communication with app providers and podcast operators

A listed app may have contact details of a contact person on file: name, business email address, telephone number (voluntary), preferred language, an internal note on communication and the status of any consent to promotional contact. They originate from the submission form, from the verified provider's own entries, or – following an express declaration through another channel – from an entry made by us. They are never displayed publicly. Legal basis: Art. 6(1)(b) GDPR, otherwise (f) or your consent under (a). Every change to the consent status is logged with time, origin and text version.

When an app receives an award, we notify the contact person by email at the address provided in the developer form. Legal basis: Art. 6(1)(f) GDPR (information about their own listing). Where the message additionally contains an offer regarding advertising or cooperation, this happens only with separate consent (Art. 6(1)(a) GDPR). We store the recipient address, the app and award, the time of dispatch, the delivery status, the reason for any non-delivery and a timestamp if you click the link in the email. The sole purpose is to see whether our messages arrive; no interest profile is created. We delete this data after 24 months.

For podcast awards we notify the verified owner of the podcast by email at the address of their user account. We store the competition, the podcast and the award, the recipient address, the time of dispatch and the delivery status (the error text in case of failure). We do not record whether a link was clicked. We skip unsubscribed addresses; every email contains an unsubscribe link. Legal basis: Art. 6(1)(f) GDPR (information about one’s own listing). We delete this data after 24 months, or immediately when the account is deleted.

Every email to a contact person contains an unsubscribe link; after opening it, a single click on the confirmation is enough. It applies to promotional contact: the unsubscribe is recorded permanently, so we will not approach the provider about advertising or cooperation again, neither on future occasions nor personally. Purely informative notices concerning the listing and awards remain unaffected. Where a message also contains an offer regarding advertising or cooperation, our advertising sales receives a copy in order to handle replies. This role is performed by an independent sales partner who receives the contact details as a separate recipient and is contractually bound to us to confidentiality and purpose limitation; there is no access to accounts or data of our platform users.

7. Contact addresses from publicly accessible sources

For listed apps from providers based in the United States for which we have no contact person, we obtain a business contact address from the provider's website (such as its contact, press or support page). We store the address, its type, the source URL and the time of retrieval. We use only one address per provider and never one intended for data protection or legal enquiries. We do not use contact addresses of providers outside the United States for this purpose.

The purpose is a one-time email informing the provider that its app is listed with us, how it can manage the listing itself and which services we offer. The email is labelled as advertising and contains an unsubscribe link. If the provider does not respond, we will not contact it again.

As this data was not collected from the data subject, we inform you in accordance with Art. 14 GDPR: the controller is movo media GmbH as named above. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in informing providers about the listing of their apps and in making our platform known. The only recipient is ourselves. You may object to this processing at any time – via the unsubscribe link in the email or by writing to datenschutz@mostvoted.app. We will then add the address to a suppression list, which serves solely to ensure that we do not contact you again, and otherwise delete it without undue delay. Absent an objection, we delete an address obtained in this way no later than 24 months after it was collected.

Podcasts: For podcasts we do not look for addresses on websites. The only contact address we process for a podcast is the one the provider publishes themselves in the publicly available RSS feed (the “itunes:owner” field); section 5 explains where it comes from and how long we keep it. It serves solely to enable a provider to prove that the podcast is theirs. We do not use it for outreach as described in the preceding paragraph and send no advertising or invitation emails to it. Your right to object applies in the same way: a message to datenschutz@mostvoted.app is sufficient.

8. Jury

For jury recommendations we publish the name, photo, short profile and recommendation texts of jury members. These details are provided by the members themselves and published with their consent (Art. 6(1)(a) GDPR) or on the basis of the agreement on their participation (b). Withdrawal with effect for the future is possible at any time.

9. Contact form

Via the contact form you transmit your name, email address and message. We store this data to process your enquiry and delete it once the correspondence has concluded, unless retention obligations apply. Depending on the nature of your enquiry, the legal basis is Art. 6(1)(b) or 6(1)(f) GDPR (legitimate interest in handling your enquiry).

Press distribution list

Journalists can sign up on our press page to receive our press releases. The email address is required; name, publication and the type of announcements you are interested in are optional. We also store the language of the page used for the entry, along with your IP address as a hash that cannot be reversed – the latter solely in order to limit the number of sign-ups per sender.

An entry only takes effect once you confirm it: we send you an email containing a confirmation link valid for seven days. Until then you receive no press releases. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time with effect for the future – via the unsubscribe link in every email, or informally to info@movo.media. The lawfulness of processing carried out up to that point remains unaffected.

In addition, we maintain an editorially compiled press list containing contact details that we have taken from publicly accessible sources or received in the course of professional exchange. These addresses do not come from a sign-up on our site; the legal basis is our legitimate interest in press relations (Art. 6(1)(f) GDPR). Here too, every email contains an unsubscribe link, and you may object to further contact at any time.

If you unsubscribe, we add your address to a suppression list. It serves solely to ensure that we do not contact you again and is excluded from any further processing.

10. Bot and abuse protection (Cloudflare Turnstile)

For registration, login, password reset and resending the confirmation email we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). The verification module is only loaded once you open one of these dialogs – as long as you are merely browsing, no connection to Cloudflare is established.

When you open a sign-in dialog, your browser transmits in particular your IP address, information about your browser and operating system and technical characteristics of your interaction; Cloudflare may store or read information in your browser for this purpose. The purpose is protection against automated misuse (Art. 6(1)(f) GDPR). A transfer to the USA may take place; Cloudflare relies on standard contractual clauses and its certification under the EU-US Data Privacy Framework.

11. Cookies and local storage

We use strictly necessary cookies: a session cookie (12 hours or until the browser is closed), a remember-me cookie (30 days, only with "stay signed in"), a CSRF token cookie against cross-site request forgery, and the device identifier placed at registration (section 3), a random value protecting against mass registrations, which we place again when you sign in if it is missing from your browser. In addition, three cookies remember your settings: mv_filter_platforms (which platforms you want to see in the lists), mv_filter_lang (which app languages you filter by) and mv_locale (chosen interface language), all valid for one year. These entries are exempt from consent under § 25(2) no. 2 TDDDG because they are necessary to operate the site or to provide a function you have requested.

To be distinguished from these is FCCDCF: this cookie is set by Google's consent dialog (section 13) and records your decision. It is set before you decide, because the dialog could not be displayed otherwise.

Not a cookie, but related: when voting, your browser reads out device characteristics (section 4) rather than us storing a value. This access does not require consent; details are given in section 4.

If you object to loading app screenshots (section 12), we store this locally in your browser (local storage entry mv_consent_media); this entry is not transmitted to our server. The bot protection in section 10 and the advertising in section 13 may set entries of their own. We do not set advertising or tracking cookies of our own.

12. Images from third-party servers: app screenshots and podcast covers

App icons are downloaded once to our own server and delivered from there, so that your IP address is not transmitted to the store operators when you view an app page; only in a few individual cases is an icon loaded directly from the store. Screenshots, by contrast, are always loaded directly from the store operators' servers – in particular from is1-ssl.mzstatic.com (Apple Inc., USA), play-lh.googleusercontent.com (Google Ireland Limited, Ireland, with servers also outside the EU) as well as store-images.s-microsoft.com, store-images.microsoft.com and images-eds-ssl.xboxlive.com (Microsoft Corporation, USA).

Your browser establishes a direct connection to these providers and transmits your IP address as well as information about your browser and operating system. Which page you opened on our site is not transmitted; however, the respective store can tell from the requested image which app it belongs to. A transfer to the USA is possible; Apple, Google and Microsoft are certified under the EU-US Data Privacy Framework. We have no influence on the further processing. The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in showing you an app's screenshots and cannot simply copy them to our own server, because the rights to the screenshots lie with the providers. You can object to the loading of screenshots at the end of this page at any time. We then show placeholders; your IP address is not transmitted and the site remains fully usable.

We treat podcast covers like app icons: we download them once to our own server and deliver a scaled-down copy from there, so that your IP address is not transmitted to the feed host when viewing. Only while a cover has not yet been mirrored is it loaded, transitionally, directly from the address given in the feed. The objection to screenshots further below concerns the app stores only.

To demonstrate consents (Art. 7(1) GDPR) and objections, we log each decision with data minimisation in mind: the decision itself, the category concerned, the occasion, the date and a hash of your IP address (SHA-256 with a server-side key), which serves only to consolidate multiple entries by the same visitor on the same day. If the screenshots load without you making a decision, no log entry is created. We use the same log for decisions about promotional contact (section 6). We keep it for three years. Legal basis: Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 7(1) GDPR.

13. Advertising

We display directly sold advertising and sponsored placements; no user-based retargeting takes place for these. In addition we embed the ad network Google AdSense operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Ads are delivered from Google servers once AdSense is activated; Google may use cookies and similar technologies for this purpose, process your IP address and transfer data to third countries – in particular the USA. For transfers to the USA, Google relies on the EU standard contractual clauses and on its certification under the EU-US Data Privacy Framework.

Whether you see personalised advertising is your decision in the consent dialog. If you agree to personalisation, Google may serve you ads based on an interest profile derived from your behaviour on this and other websites in the Google advertising network. If you decline only personalisation, ads are based on the content of the page and a coarse location. If you decline advertising altogether, we show no Google ads. You can change your decision at any time via the privacy settings at the end of this page.

Ads may be served by Google and its advertising partners; you can view the current list in the consent dialog under "List of partners".

Consent for advertising is obtained through Google's certified consent management platform (under the IAB Transparency & Consent Framework). Without your consent, no Google advertising scripts are loaded and no advertising cookies are set. Your decision is passed on to Google services via Google Consent Mode.

One limitation we disclose: The consent dialog comes from Google and is therefore loaded from a Google server (fundingchoicesmessages.google.com). This single request occurs before you have decided and transmits your IP address – without it we could not show you the dialog. In doing so, Google sets a cookie (FCCDCF) recording your consent decision; the actual advertising code (pagead2.googlesyndication.com) is loaded only after your consent. The FCCDCF cookie serves solely to store your decision and is therefore permitted without consent (§ 25(2) no. 2 TDDDG). The transmission of your IP address when the dialog loads is based on our legitimate interest in being able to ask you at all (Art. 6(1)(f) GDPR).

Which cookies Google sets in detail, and for how long they remain valid, changes continuously. Google maintains an up-to-date overview at business.safety.google/adscookies.

In doing so, Google and its advertising partners may place and read cookies in your browser and use web beacons and your IP address to store data they receive from serving ads on this website. Google explains how it processes data from sites and apps that use its services at google.com/policies/privacy/partners.

Reach measurement for our own advertising

For directly sold advertising we record the banner ID, type of event (impression or click), timestamp, a hash of IP address and user agent, the visibility duration, a bot marker as well as language and country. The country is determined using a database stored locally on our server (DB-IP Country Lite) – no third party is queried, and the IP address is discarded after the lookup. If you click an ad, we append parameters to the target address identifying the click as coming from Most Voted (currently utm_source=mostvoted.app); we do not transmit any personal data in doing so. Advertising customers receive a report via a personal access link (valid for one year) that contains aggregated figures only. Legal basis: Art. 6(1)(f) GDPR.

14. Advertising customer management (CRM)

To support our advertising customers we use an internal system in which we process the business contact details of their contact persons, the related correspondence and the documents belonging to each booking. The purpose is initiating, performing and invoicing advertising bookings; the legal basis is Art. 6(1)(b) or (f) GDPR. Data of our platform users is not affected. Access is limited to administrators and our independent sales partner (section 6). Data is deleted once the business relationship has ended and no commercial or tax retention periods apply any longer (§§ 257 HGB, 147 AO).

15. Other service providers and third-country transfers

Apple and Microsoft: For app data we call Apple's official iTunes Search API (Apple Inc., Cupertino, USA) and retrieve data from the Microsoft Store (Microsoft Corporation, Redmond, USA). These requests are made server-side; no personal data of our users is transmitted.

Podcast directories: To select podcasts and for the search when proposing one, we use the public podcast charts and search of Apple Inc. (USA) and, optionally, the Podcast Index (USA) and fyyd (Germany) services. The podcast content itself we load server-side from the providers’ RSS feeds. At most search terms are transmitted, no personal data of our users.

Anthropic: The short summaries below app names are generated automatically using a language model provided by Anthropic PBC (San Francisco, USA). Only the public store description of the respective app or, for podcasts, the public description from the RSS feed is transmitted; it may contain the provider's name where they name themselves there. No data from our user accounts is transmitted. Under the provider's terms the texts are not used to train its models; processing is governed by its data processing addendum.

Social media: We maintain profiles on Instagram, Facebook, TikTok, YouTube and X. If you follow us, comment or message us, we process your profile name and your message in order to reply and to remove abuse (Art. 6(1)(f) GDPR). To the extent we receive statistics from the providers on the use of our profiles, we are joint controllers with them (Art. 26 GDPR); for Facebook and Instagram this is set out in an arrangement with Meta Platforms Ireland Limited (facebook.com/legal/terms/page_controller_addendum), and you may also exercise your rights directly against the respective provider. Otherwise, the provider is responsible under its own privacy policy; it also transfers data to third countries such as the United States. The share buttons on app pages are simple links: a service receives data only when you click on one.

Payment processing (Stripe): To process paid bookings we use the payment service provider Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland). When you pay for a booking, the data required for this is transmitted to Stripe, in particular your name, email address, billing address, booking amount and the payment details you choose. Your full payment details – such as the card number – are entered directly with Stripe; we do not receive them. The legal basis is Art. 6(1)(b) GDPR (performance of the contract). Stripe also processes the data as a controller in its own right in order to meet legal obligations relating to fraud prevention, anti-money-laundering and tax controls (Art. 6(1)(c) and (f) GDPR); details are set out in Stripe's privacy policy. A transfer to the USA to Stripe, Inc. is possible and is safeguarded by the European Commission's standard contractual clauses. We retain invoice and booking data in line with commercial and tax-law retention periods, generally ten years.

16. Retention periods at a glance

• Server log files: up to eight weeks at the hosting provider; no copy of our own
• User account: until you delete it
• Registration IP hashes and device identifier: 24 months, or together with the account if deleted earlier
• Votes and manipulation hashes: 24 months; the log entry without account reference likewise
• Details recorded with a warning: 24 months from the warning
• Consent log: 3 years, to demonstrate consent given or withdrawn and your objection
• App and podcast submissions, app widget embeds: as long as the entry is listed; the link to your account ends when it is deleted
• Verification data and correction notes of app and podcast providers: until the verification status ends or the account is deleted
• Contact address taken from RSS feeds: until the podcast is rejected or its feed has not been fetched for 24 months; immediately upon objection
• Contact details of app providers: as long as the app is listed; without undue delay upon objection
• Contact addresses obtained from public sources (US providers only): 24 months; without undue delay upon objection, after which only a suppression entry remains
• Dispatch data of notifications (click data for apps): 24 months; afterwards only a record without personal reference remains, stating that an award was communicated for an app
• Enquiries: until finally processed
• Messages and comments via social media: until finally dealt with; on the platforms themselves according to their rules
• Advertising measurement data (impressions and clicks): 24 months after collection, then deleted · Access links to reports: one year
• Advertising customer CRM: duration of the business relationship plus statutory retention periods
• Session cookie: 12 hours or until the browser is closed · Remember-me cookie: 30 days
• Security logs (blocked content, suspicious requests): 14 days
• Session statistics (server load): 7 days
• Reach statistics (page views): 14 days; afterwards only counts without personal data
• Press distribution list: until withdrawal, afterwards only a suppression entry

17. Your rights, right to complain and changes

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent with effect for the future (Art. 7(3) GDPR). In your account settings you can at any time download a copy of your data as a JSON file and delete your account. For security reasons the copy contains no passwords, no session or security tokens and no salted IP or device hashes; without the key those values would be unreadable for you anyway. For all other matters please contact datenschutz@mostvoted.app.

Promotional contact with app providers: Where a contact address is stored for a provider’s contact person, the processing for direct marketing purposes may be objected to at any time and without giving reasons – via the unsubscribe link in any email or informally to the address above. After that we will not contact the provider about advertising or cooperation again, neither by email nor by telephone. Purely informative notices concerning the listing and awards remain unaffected.

You may also lodge a complaint with a supervisory authority. The competent authority at our registered office is:

We adapt this privacy policy where legal requirements or technical changes make it necessary. The version published here at any given time applies; the date of the last change is stated at the end. There is no separate notification.

As of 12 November 2026

Objection: app screenshots

On app detail pages we load screenshots directly from the app stores' servers (Apple, Google, Microsoft). Your IP address is transmitted to the respective store (section 12). You can object to this here at any time; we will then show placeholders. You can lift your objection just as easily.

Current status: …

Consent: advertising

For displaying advertising we obtain your consent via Google's consent dialog. You can change or withdraw your decision there at any time.