Privacy Policy

The data controller responsible for the processing of your personal data in connection with Mercy is: Daniel Sogl Email: me@danielsogl.de As we are a small-scale operation (Freiberufler), we are not required to appoint a Data Protection Officer. However, you can contact us directly at the email address above for any data protection inquiries.

We collect and process the following categories of data. 1. On your device (never leaves it unless listed below): - BattleTag (your Overwatch username, if entered) - Searched and followed players - Cached hero, map and player statistics - App settings (theme, language, notification preferences) - Session tracker data and notes you type - The push token of your device, once rank alerts are turned on 2. Sent to our server (Mercy Game Data API, api.mercy-stats.app): - Every request: the BattleTag or player ID you look up, and your IP address, which the server needs to answer and uses for rate limiting. - Rank alerts and weekly recap, only if you turn rank alerts on (off by default) and allow notifications: your device's push token (Apple Push Notification service token on iOS, Firebase Cloud Messaging token on Android), the platform, the app language, the IDs of the players you follow plus your own BattleTag, and, if you turn on the weekly recap, the player ID for the recap and your device's time zone. The app sends this again on every launch and deletes it when you turn rank alerts off, revoke the notification permission or follow nobody. - Player data the server keeps for everyone: when any user looks up a player, the server stores a copy of that player's public Blizzard career profile, snapshots of its statistics over time (for history and change features) and, for rank alerts, the last rank it announced for that player. This is public data about the player, keyed by BattleTag or player ID, and is not linked to a device except through the rank-alert list above. 3. Google Firebase (in the app): - Only after your consent: usage events (screen views, feature interactions), performance metrics (app start time, network latency), crash reports and error logs, and device information (OS version, device model) via Firebase Analytics, Performance Monitoring and Crashlytics. - Mercy Pro only, once the app has to generate an AI note: Firebase Remote Config downloads the AI settings, which involves a Firebase installation ID and basic app and device information, and Firebase App Check confirms that the request comes from the genuine app, using Apple App Attest on iOS and Google Play Integrity on Android. Neither starts at launch. - Mercy Pro only, when an AI note is generated: Firebase AI Logic sends the numbers of a session (mode, games played, wins and losses, win rate, time played, changes in win rate, KDA and rank) or, for the patch briefing, the heroes you play and the patch notes, together with the answer language, to Google's Gemini models. Your BattleTag and anything you typed are never sent. 4. Purchases (Mercy Pro): RevenueCat receives a pseudonymous app user ID, store receipt data and your subscription status. Apple or Google process the payment itself. 5. Website (mercy-stats.app): - Hosting: the website is served by Vercel, whose servers process your IP address and request data to deliver the pages. - Google Tag Manager and Google Analytics only after you consent to measurement. Before that, nothing is loaded from or sent to Google; the website only sets Google Consent Mode to "denied" in your browser. Without JavaScript, Google Tag Manager is never loaded. - Vercel Web Analytics (page views, referrer, device and browser type, without cookies) only after you consent to measurement. - Consent storage in your browser: - c15t-sid: a random subject ID, set as a cookie and in local storage on your first visit, before you make a choice. It holds only the ID and is not a consent decision. It keeps your consent records linked to the same visitor. - c15t: your cookie choice, stored once you make one. - c15t-notice-subject: links the subject ID to your acknowledgement of a notice. It is only set if the website shows a notice that offers only necessary categories. We do NOT collect: - Advertising identifiers (the app shows no ads and does not read the IDFA or Android Advertising ID) - Email addresses or passwords (no account registration required) - Precise location data - Contact lists - Health data - Browsing history outside the App

We process your data based on the following legal grounds under GDPR Article 6 and the German TDDDG: Contract Performance (Art. 6(1)(b) GDPR): - Answering your requests to the Mercy Game Data API (player statistics, hero and map information) - Rank alerts and the weekly recap, once you turn them on - Mercy Pro purchases (RevenueCat, App Store, Google Play) - AI notes for Mercy Pro subscribers (Firebase AI Logic, Gemini) - Local data storage for app functionality Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): - Analytics, performance monitoring and crash reporting in the app (Firebase) - Google Tag Manager, Google Analytics and Vercel Web Analytics on the website Legitimate Interests (Art. 6(1)(f) GDPR): - Server logs and rate limiting to keep the API available and secure - Firebase App Check, to block AI requests that do not come from the genuine app - Firebase Remote Config, to change and switch off the AI features without a release - Keeping public profile copies and statistics snapshots of players, to provide history and change features - Delivering the website (Vercel) Storing and accessing information on your device (§ 25 TDDDG, formerly TTDSG): Under German law, storing or accessing information on your device requires your prior consent unless it is strictly necessary for a service you explicitly requested. With your consent (§ 25(1) TDDDG): - Firebase Analytics, Performance Monitoring and Crashlytics in the app. In the EEA the app asks before switching them on; outside the EEA it switches them on without asking. - Google Tag Manager, Google Analytics and Vercel Web Analytics on the website, through the consent banner. Strictly necessary for a service you requested (§ 25(2) no. 2 TDDDG): - The push token of your device, which the app reads only after you turn on rank alerts. - The consent storage of the website (c15t, c15t-notice-subject and c15t-sid), which records the choice you make in the banner. - Firebase Remote Config and Firebase App Check, which store a Firebase installation ID and an App Check token on your device. They start only when a Mercy Pro subscriber's app has to generate an AI note, and are needed to deliver it. On iOS, Apple's App Tracking Transparency prompt is shown as well. The App shows no advertisements, never reads your advertising identifier and does not track you across other companies' apps or websites, so whichever answer you give to that prompt, nothing additional is collected about you.

We use your data for the following purposes: Service Provision: - Displaying Overwatch player statistics and their history - Tracking your favorite players - Sending rank alerts and the weekly recap you turned on - Providing hero and map information - Generating AI notes for Mercy Pro subscribers - Processing Mercy Pro purchases - Storing your app preferences Security and Operation: - Rate limiting and protecting the API against abuse - Confirming that requests come from the genuine app (App Check) Service Improvement (with consent): - Understanding how users interact with the app and the website - Identifying and fixing technical issues

App Data (on your device): - Retained while the app is installed - Deleted immediately upon app uninstallation Cached Data (on your device): - Automatically refreshed based on API cache policies - Can be manually cleared via "Clear Cache" in Settings Our server (Mercy Game Data API): - Rank alert registration: until you turn rank alerts off, revoke the notification permission or follow nobody (the app then deletes it), or 60 days after your device last refreshed it - Copies of public player profiles: deleted once they have not been updated for 7 days - Statistics snapshots of players: 365 days - Last announced rank per player (rank alerts): no fixed deletion period; you can request deletion at any time (see section 8) - Server logs: our front web server keeps access logs for at most 7 days. They contain your IP address and the address of each request, which includes the BattleTag or player ID you look up. Requests to the push endpoints are not written to this log - Internal service logs are size-limited and overwritten continuously; application log files are deleted after 14 days at the latest. Neither contains push tokens - Firewall and security logs containing IP addresses are kept for about 4 weeks Service providers: - Firebase Analytics, Crashlytics and Performance Monitoring: according to Google's retention settings for Firebase - Firebase AI Logic (Gemini) requests: according to Google's terms for Firebase AI Logic - RevenueCat: according to RevenueCat's privacy policy - Vercel and Google Analytics on the website: according to the providers' retention settings Website Consent Storage: - c15t-sid, c15t and c15t-notice-subject cookies: 365 days - Revoking consent or clearing your choices does not remove c15t-sid - You can delete all of them at any time in your browser settings

We use the following service providers, who may process your data: Mercy Game Data API - Operator: Daniel Sogl (not a third party), at https://api.mercy-stats.app - Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on a server in Germany - We have concluded a data processing agreement with Hetzner under Art. 28 GDPR. - Software: OverFast API (https://github.com/TeKrop/overfast-api) - Purpose: Player statistics, hero information, game data, rank alerts and weekly recaps - Data processed: See section 2, "Sent to our server" - It forwards lookups to Blizzard Entertainment's public profile pages - Rate limits: 30 requests per second per IP Firebase (Analytics, Performance Monitoring, Crashlytics, Remote Config, App Check, AI Logic) - Provider: Google Ireland Limited (for EEA users) - Purpose: App analytics, performance monitoring, crash reporting (with consent); feature configuration, app attestation and AI notes for Mercy Pro (see section 2) - Privacy Policy: https://firebase.google.com/support/privacy - DPA: https://firebase.google.com/terms/data-processing-terms Push delivery - Apple Push Notification service (Apple Inc.) on iOS and Firebase Cloud Messaging (Google) on Android - Purpose: Delivering rank alerts and the weekly recap to your device - Data processed: The push token and the notification content Apple App Attest and Google Play Integrity - Purpose: Confirming that requests come from the genuine app (Firebase App Check) RevenueCat (Subscription Management) - Provider: RevenueCat, Inc., USA - Purpose: Validating and restoring Mercy Pro purchases - Data processed: A pseudonymous app user ID, store receipt data, subscription status - Privacy Policy: https://www.revenuecat.com/privacy Vercel (website hosting and Web Analytics) - Provider: Vercel Inc., USA - Purpose: Delivering the website; page statistics (with consent) - Privacy Policy: https://vercel.com/legal/privacy-policy Google Tag Manager and Google Analytics (website) - Provider: Google Ireland Limited - Purpose: Usage statistics (with consent) - Privacy Policy: https://policies.google.com/privacy

Some of our service providers are located outside the European Economic Area (EEA): Google (Firebase, Firebase Cloud Messaging, Google Play Integrity, Google Tag Manager, Google Analytics): - Google LLC is certified under the EU-U.S. Data Privacy Framework; transfers to the US rely on this certification - Google Ireland Limited acts as data processor for EEA users - AI notes are processed with the region setting "global", so Google may process them in any of its regions, including outside the EEA Vercel: - The website is served by Vercel Inc., USA, which is certified under the EU-U.S. Data Privacy Framework; transfers to the US rely on this certification Apple (Apple Push Notification service, App Attest): - Notifications and app attestation on iOS go through Apple's infrastructure, which may be located outside the EEA; transfers rely on standard contractual clauses RevenueCat: - Transfers to the US rely on standard contractual clauses Mercy Game Data API: - Hosted by Hetzner Online GmbH in Germany; lookups are forwarded to Blizzard Entertainment servers, which may be located outside the EEA - Only BattleTags and player IDs are forwarded to Blizzard

Under the General Data Protection Regulation (GDPR), you have the following rights: Right of Access (Art. 15): Data on your device is directly accessible in the app. For data on our server or at our service providers, contact us. Because there are no accounts, we can only find a rank-alert registration if you tell us which players it lists or send us your device's push token. Right to Rectification (Art. 16): You can edit your BattleTag and followed players directly in the app. The app sends the changed list to our server on its next launch. Right to Erasure (Art. 17): You can delete your data by: - Turning rank alerts off, which deletes your registration on our server - Using "Clear Cache" in Settings - Uninstalling the app (a remaining registration on our server is deleted after 60 days) - Contacting us for anything else Right to Restriction (Art. 18): You can restrict data processing by not using specific features. Right to Data Portability (Art. 20): Your locally stored data is on your device and can be transferred via the platform backup features (iCloud Backup, Android Backup). Right to Object (Art. 21): You can object to processing based on legitimate interests at any time by contacting us, or by uninstalling the app or not using specific features. Right to Withdraw Consent (Art. 7): You can withdraw your consent at any time in the app under Settings > Privacy, and on the website through "Cookie settings" in the footer of every page. For questions, contact us at: me@danielsogl.de

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority. For Germany, the relevant authority depends on your state (Bundesland). The lead authority is: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) Graurheindorfer Str. 153 53117 Bonn Germany Email: poststelle@bfdi.bund.de Website: https://www.bfdi.bund.de You also have the right to lodge a complaint with the supervisory authority in your EU member state of residence.

We implement appropriate technical measures to protect your data: Technical Measures: - App data is stored on your device and protected by the platform's security features (iOS Data Protection, Android app sandbox) - All requests to our server and to service providers use encrypted HTTPS connections - Push tokens are never written to our logs, and no API response returns them - Our server stores no accounts, names, email addresses or passwords Third-Party Security: - Firebase follows Google's comprehensive security standards - Requests for AI notes must pass Firebase App Check

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. How we notify you: - Significant changes will be announced via app update - The "Last Updated" date will be revised - Continued use after changes constitutes acceptance We recommend reviewing this policy periodically.

For any questions about this Privacy Policy or our data practices, please contact us: Daniel Sogl Email: me@danielsogl.de We aim to respond to all inquiries within 5 business days. For GDPR-related requests, we will respond within the legally required timeframe of one month. This Privacy Policy is governed by German law and the General Data Protection Regulation (GDPR).