BITBUILDER / PRIVACY

Privacy Policy

Effective date: 1 January 2027

This policy explains what information the BitBuilder iPad app collects, why, who handles it, and the choices and rights you have. In this policy, "we", "us" and "our" mean William Lumley, New South Wales, Australia, the developer of BitBuilder and the controller of your personal information.

At a glance

• There is no advertising in BitBuilder, no advertising SDKs, and no tracking across other companies' apps or websites.
• The app does not access your device's advertising identifier (IDFA) and never shows the App Tracking Transparency prompt.
• We do not sell or share your personal information, as the California Consumer Privacy Act (CCPA/CPRA) defines those terms.
• Your circuits and chips stay on your device or in the storage you choose. We never receive them.
• An account is optional. You only need one to carry a BitBuilder Pro purchase across your devices.

1. What we collect and why

1.1 Circuits and chips you create

Your circuits and custom chips are saved as documents on your iPad, in whatever location you pick in the Files app. That may be on your device or in iCloud Drive, which Apple operates under its own privacy policy (https://www.apple.com/legal/privacy/). We never receive these documents.

1.2 Usage analytics (Google Firebase Analytics)

BitBuilder uses Google Firebase Analytics to learn which features people use, so we can improve the app. Analytics is always on; there is currently no setting in the app to turn it off.

The app records in-app events about how features are used, for example: components added, simulations run, tours started or skipped, the paywall being shown, the outcome of a purchase, and which sign-in method was used. These events don't include the contents of your circuits, your name, or your email address.

Firebase also gathers some information automatically: an app-instance identifier (a random ID for your installation of the app), your device model, iPadOS version, app version, language, and your approximate location (country or region), which Google works out from your IP address.

Google processes this data under its privacy policy (https://policies.google.com/privacy). You can read how Google uses information from apps that use its services at https://policies.google.com/technologies/partner-sites.

1.3 Crash reports (Google Firebase Crashlytics)

If BitBuilder crashes, Firebase Crashlytics sends us a crash report so we can find and fix the problem. A report contains a stack trace (a technical record of what the app was doing when it crashed), your device model, iPadOS version, app version, and a crash-report identifier. Crash reporting is always on.

1.4 Optional account (Google Firebase Authentication)

You don't need an account to use BitBuilder. An account exists only so that a BitBuilder Pro purchase can be carried across your devices. We use Google Firebase Authentication to run accounts. You can sign in with:

• Sign in with Apple. Apple lets you hide your real email address behind a private relay address, and we'll only see that relay address.
• Google Sign-In.
• Email and password. Firebase stores your password in hashed form, and we never see it. Firebase sends the emails for verifying your address and resetting your password.

For each account, Firebase holds your email address (if you provided one), the sign-in method you used, a Firebase user ID, and the times your account was created and last signed in. The app doesn't collect a display name or profile photo.

1.5 Purchases (Apple and RevenueCat)

BitBuilder Pro is a one-time in-app purchase. Apple processes the payment through the App Store, and we never see your payment card details.

We use RevenueCat to keep track of who has Pro. RevenueCat receives your purchase and transaction records, an anonymous app user ID, and, if you're signed in, your Firebase user ID. We don't send your email address to RevenueCat. RevenueCat processes this data under its privacy policy (https://www.revenuecat.com/privacy).

1.6 When you contact us

When you email us at support@getbitbuilder.com, we receive your email address and your message. We use them only to reply to you, and we delete them when the matter is resolved.

1.7 Data Apple shares with developers

If you choose to share crash logs and usage statistics with app developers through Apple, they reach us in aggregated or de-identified form, under Apple's privacy policy.

2. Our legal bases (EEA and UK)

If you're in the European Economic Area or the UK, the GDPR and UK GDPR require us to have a legal basis for each use of your personal data:

• Usage analytics and crash reporting: our legitimate interests in understanding how the app is used, improving it, and keeping it stable. We've limited this data to what we need, and it doesn't include your circuits, name or email address.
• Your account: performance of a contract, meaning we need this data to provide the account you asked for.
• Purchases: performance of a contract, meaning we need this data to deliver and restore the Pro features you bought.
• Support emails: our legitimate interests in answering your questions.

We do not rely on your consent for analytics. You have the right to object to processing based on legitimate interests; section 7 explains how objections to analytics work.

3. Who we share data with

We don't sell your personal information, and we don't share it for advertising. We only pass data to the service providers that run parts of the app for us:

• Google (Firebase Analytics, Crashlytics and Authentication)
• RevenueCat (purchase and entitlement management)
• Apple (App Store payments, Sign in with Apple, and iCloud Drive if you store your files there)

We may also disclose information if the law requires it, for example in response to a valid legal request.

4. International transfers

Google and RevenueCat process data in the United States, and may process it in other countries. Where data about people in the EEA, UK or Switzerland is transferred to the United States, it is protected by safeguards the law recognises, such as the European Commission's Standard Contractual Clauses (and their UK equivalent) or the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

5. How long we keep data

• Circuits and chips: we never hold these. They stay wherever you save them, until you delete them.
• Usage analytics: kept for the retention period set in Google's Firebase Analytics settings.
• Crash reports: kept for the retention period Google sets for Firebase Crashlytics.
• Account details: kept until you delete your account.
• Support emails: deleted when the matter is resolved.
• Purchase records: kept after you delete your account, as explained in section 6.

Signing out doesn't delete anything. Your account and your Pro purchase stay together, ready for when you sign in again.

6. Deleting your account

You can delete your account in the app at Settings → Account → Delete Account. When you do, we revoke your Sign in with Apple tokens (if you used Sign in with Apple) and permanently delete your Firebase account, including your email address.

Your purchase record is kept after you delete your account. RevenueCat keeps the record of your Pro purchase, but it's no longer linked to any account. We keep it so that your purchase can still be restored. App Store purchases can be restored with Restore Purchases.

7. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct information that's wrong;
• delete your information;
• receive a copy of your information in a portable format;
• object to our use of your information based on legitimate interests (this covers analytics and crash reporting); and
• complain to a data protection authority.

To use any of these rights, email us at support@getbitbuilder.com. We may need to confirm your identity first, for example by asking you to write from the email address on your account. We'll reply within the time the law in your area requires, for example within one month under the GDPR.

Objecting to analytics. There's no setting in the app to turn analytics off. If you object to analytics, go to Settings → Legal in the app. From there you can send us a pre-filled email that includes your app-instance identifier, or copy the identifier and email it to us at support@getbitbuilder.com yourself. We'll delete the analytics data tied to that identifier. Analytics collection on that device continues while you keep using the app, so new analytics data will be recorded after the deletion.

If you're in the EEA, you can complain to the data protection authority in your country. In the UK, that's the Information Commissioner's Office (https://ico.org.uk). We'd appreciate the chance to sort out your concern first, so please contact us.

8. California residents (CCPA/CPRA)

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. This section uses the categories the law defines.

What we collect. In the past 12 months, we have collected:

• Identifiers: email address (if you create an account or email us), Firebase user ID, RevenueCat app user ID, app-instance identifier, and crash-report identifier.
• Commercial information: records of your BitBuilder Pro purchase.
• Internet or other electronic network activity information: in-app usage events and crash reports.
• Geolocation data: approximate location (country or region) derived from your IP address. We do not collect precise geolocation.
• Sensitive personal information: if you create an email-and-password account, your account login details. We use them only to sign you in, and not to infer anything about you.

We collect this information from you and from your device, for the purposes described in section 1. We disclose it for business purposes only to the service providers listed in section 3.

No selling or sharing. We do not sell your personal information or share it for cross-context behavioural advertising, and we haven't done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your rights. You have the right to:

• know what personal information we collect, use and disclose, and to get a copy of it;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (we don't sell or share it, so there's nothing to opt out of);
• limit the use of your sensitive personal information (we already use it only to sign you in); and
• not be discriminated against for using any of these rights.

To make a request, email us at support@getbitbuilder.com. We'll verify your identity by matching details you give us against the information we hold, such as your account email address. You can use an authorised agent to make a request for you; we may ask for proof that the agent is authorised, and ask you to confirm your identity with us directly. We'll respond within 45 days, as the law requires.

9. Australian residents

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

• Access and correction. You can ask to access the personal information we hold about you, or to correct it, by emailing support@getbitbuilder.com.
• Overseas disclosure. As described in sections 3 and 4, some of your information is held by Google and RevenueCat, mainly in the United States.
• Complaints. If you have a privacy complaint, please contact us first at support@getbitbuilder.com, and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au or on 1300 363 992.

10. Children

BitBuilder is for adults and students. It is not directed at children under 13, or under 16 in the EEA and UK, and it is not in the App Store Kids category. We don't knowingly collect personal information from children under these ages.

If you believe a child has given us personal information, please contact us at support@getbitbuilder.com and we'll delete it.

11. Security

Data sent between the app and our service providers is encrypted in transit. Google, RevenueCat and Apple apply their own security safeguards to the data they hold, and account passwords are stored only in hashed form. No system is perfectly secure, so we can't guarantee absolute security, but we take reasonable steps to protect your information.

12. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date, and for material changes we'll give notice through the app's release notes or the App Store listing.

13. Contact us

For any question or request about your privacy, contact:

William Lumley
New South Wales, Australia
support@getbitbuilder.com