rotblock Privacy Policy

Last updated: 7 October 2026

This policy explains what personal data the rotblock iPhone app and the website https://rotblock.org process, why, and what your rights are. It is also published at https://rotblock.org/privacy.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

WMB GmbH
Beethovengasse 4-6/2/7
2500 Baden, Austria
Managing director: Murat Bock
Company register: FN 659861i
Register court: Landesgericht Wiener Neustadt
VAT ID: ATU82399879
Email: me@muratbock.com
Phone: +43 660 4041942

We have not appointed a data protection officer because we are not required to.

2. The short version

rotblock works without an account. Without one, your progress, settings and locks stay on your iPhone.
The apps and websites you lock stay on your device. Apple's Screen Time gives rotblock only anonymous tokens. We never learn which apps or websites they are, and nothing about your app usage leaves the device.
No ads, no tracking, no third-party analytics, advertising or crash-reporting SDKs, no selling of data.
An account is optional (Sign in with Apple). It is used for the cloud backup, leaderboards, friends and multiplayer, gift packs and redeem codes, and the AI Tutor. Account data is stored on our own server in an Oracle data centre in Frankfurt, Germany. You can delete your account in the app at any time.
If you use the AI Tutor, the topic you type is sent from our server to OpenAI and Google to create your course. Your name and account ID are not sent to them.
Purchases are handled by Apple. We never see your payment details.

3. Data stored only on your device

The following stays in the app's storage on your iPhone (the app and its extensions share it through an App Group). We do not receive it unless you create an account and the cloud backup (section 4) sends it.

Screen Time selections. The apps, app categories and websites you choose with Apple's Screen Time picker. rotblock receives opaque tokens, not app names or browsing history. The tokens, your lock rules (challenge type, number of questions, unlock minutes, daily open limits, timer mode), schedules and the adult-website filter setting are used to apply shields on your device through Apple's Screen Time frameworks. These tokens, lock rules and schedules never leave your device and are not part of the cloud backup.
Your progress. XP, streak, levels and ratings per challenge type, learning progress (for example vocabulary memory, chess, coding and history progress), daily statistics (challenges solved, unlocks resisted), Brain Shop items, gift packs and booster pulls, onboarding answers (role, chosen skills, starting level).
Content you create. Custom flashcard decks and the optional text you enter in the priming routine.
IQ test results. Your task scores and the estimated IQ from the Quick check and Full test.
Settings. Answer method, reminder preferences, IQ retest interval.
AI Tutor courses you created (a copy of what our server stores, so they work offline).

You can delete all of this by deleting the app.

4. Optional account

If you sign in with Apple, we process the following on our own server. The server software is self-hosted Supabase, operated by us on Oracle Cloud Infrastructure in Frankfurt, Germany.

Data	Source	Purpose
Account ID (a random identifier) and the Apple user identifier from Sign in with Apple	Apple, at sign-in	Sign you in and keep you signed in
Sign-in records: time of sign-in, IP address and device type (user agent)	Your device	Keeping your session secure
Display name: your first name if Apple shares it at your first sign-in, otherwise "Brain" plus 4 characters of your account ID	Apple / generated	Shown to other users if you have not picked a username (section 5)
XP (total, per game and per week), streak, number of games played, days on which you solved at least one challenge	Your device	Leaderboards, friends features, gift pack milestones
Cloud backup: a copy of the progress, content, IQ results and settings listed in section 3, excluding the Screen Time tokens, lock rules and schedules	Your device	Restore your progress on a new or reset device
Your Pro status and its end date, verified from Apple's signed purchase data (section 8)	Your device / Apple	Unlock Pro features that run on our server
Technical connection data (IP address, time and target of each request)	Your device	Delivering the service and protecting it against abuse (server logs)

We request only your name from Apple, not your email address. Apple processes your Apple Account data under its own privacy policy.
Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR) for the account and the features you use with it; our legitimate interest in secure operation and in preventing cheating and misuse (Art. 6(1)(f) GDPR) for sign-in records, server logs and the XP rate limits on our server.

5. Friends, leaderboards and multiplayer (Pro)

Friends and multiplayer features need an account and an active Pro subscription. They include a profile, friend requests, leaderboards, item trades, duels and streak buddies.

What other signed-in users can see:

On leaderboards and when they look up your friend code: your username (if you picked one, otherwise your display name), your XP for the board shown (all time, this week or per game), your brain's level and the Brain Shop items your brain wears. Any signed-in account with XP can appear on the global leaderboard.
Your friends also see your streak and number of games played.
In a trade: the items your friend may pick from (only your tradeable items) and the items offered.
In a duel: the game, and after both have played, the number of correct answers and the time taken.
Streak buddies see your shared streak, which is based on the days you both solved a challenge, and can send you a nudge.

What we store for these features: your username and the date you last changed it, your friend code, friend requests and friendships, users you blocked, reports you send (reason and the reported account), the cosmetic items your account owns and where each came from (for example gift pack, milestone, redeem code, shop purchase), trades, duels with their results, streak buddy pairings and nudges.

Usernames are checked against a list of offensive words. If you block someone, you are hidden from each other on leaderboards and friend codes, and open trades, duels and buddy pairings between you end. Reports are read only by us to moderate the service.

New friend requests, trades, duels and nudges are shown as notifications created on your device when you open the app. We do not send push notifications for them.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Moderation of reports and blocking: legitimate interest in a safe service (Art. 6(1)(f) GDPR).

6. Gift packs, redeem codes and cosmetics

Gift packs you earn (for example for your first challenge, streaks or new levels) are opened on our server when you are signed in, so the items can be traded fairly. We store which packs you opened, their contents, and your pity counters and shards.
Redeem codes: the code you enter is checked on our server. We store that your account redeemed a code of a campaign, and failed attempts (time and error), so we can limit attempts to 10 per hour and stop guessing. Codes themselves are stored only as a hash.
Brain Shop purchases are one-time App Store purchases. When you are signed in and use the friends features, the items you own are registered with your account so we know which ones can be traded.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

7. AI Tutor

The AI Tutor (a paid add-on that requires Pro and an account) writes a course on a topic you choose.

What you send to our server: the topic you type (up to 120 characters), which concepts of a tier you have mastered (to unlock the next tier), your Apple signed purchase data (section 8), and, if you use the "Report" button, the reported text excerpt and a reason.

What our server sends to the AI providers: only the topic and course material derived from it (the course outline, research notes and the concepts to cover). We do not send your account ID, name, email, device data or progress to them.

OpenAI checks the topic and the finished course for harmful content (moderation) and writes the course outline, lessons, questions, readings and flashcards. We send requests with OpenAI's storage option turned off.
Google (Gemini API) researches the topic using Google Search and returns the sources it used, which we store with your course and show to you.

Please do not enter personal data about yourself or others as a topic. Topics that target a private person are refused.

What we store: your topics, the generated courses and their sources, generation jobs (status, time, token use and cost), when you completed each tier, reports you send, and the record of your purchase (section 8). Courses are visible only to you.

Push notifications: when you start a course, the app asks whether you want one notification when it is ready. If you allow it, the app sends your device's push token to our server, linked to your account. Our server uses Apple's Push Notification service to send "Your course is ready" with the course title. Tokens that Apple reports as no longer valid are deleted. You can turn notifications off in iOS Settings at any time.

Transfers outside the EU: OpenAI and Google process this data in the USA. According to the providers, these transfers are covered by the EU-US Data Privacy Framework, under which they are certified, and by the Standard Contractual Clauses in their data processing terms. According to their API terms, they do not use data sent through their paid APIs to train their models, and they may keep it for a limited time to detect abuse.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Reports: legitimate interest in correct and safe content (Art. 6(1)(f) GDPR).

8. Purchases (rotblock Pro, AI Tutor, Brain Shop)

Subscriptions and in-app purchases are sold and billed by Apple through the App Store. Apple processes your payment data under its own privacy policy. We do not receive your name, payment details or Apple Account email from Apple.

The app checks your purchases on your device with Apple's StoreKit. For features that run on our server (friends and multiplayer, AI Tutor), the app also sends Apple's signed transaction data for your Pro subscription and the AI Tutor add-on to our server. This data is signed by Apple and contains the product, transaction IDs, purchase and expiry dates and the App Store environment. Our server checks Apple's signature and stores the original transaction ID, product, expiry date and environment, linked to your account. A purchase can be linked to only one rotblock account, so one purchase cannot unlock many accounts.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing misuse of purchases (Art. 6(1)(f) GDPR).

Apple provides us with aggregated, non-identifying sales reports.

9. Content downloads

The app downloads learning content (for example reading passages and other exercises) and Brain Shop and booster pack catalogue updates from our server. These requests do not contain your account or progress. Our server necessarily receives your IP address and the time of the request (server logs, section 13).

10. Microphone and speech recognition

If you answer by voice (for example flashcards, languages or AI Tutor answers), rotblock uses the microphone only while you are answering, and Apple's speech recognition turns your speech into text. Where your device supports on-device recognition for the language, rotblock requires it, so the audio does not leave your device. If your device or language does not support on-device recognition, Apple may process the audio on its servers under Apple's privacy policy. We never receive or store audio recordings. You can always type instead and you can turn off microphone and speech access in iOS Settings.

Spoken words, sentences and guidance played to you are generated on your device by Apple's text-to-speech or come with the app.

11. Handwriting

Handwritten answers are recognized on your device using Apple's Vision framework. Drawings are not stored and not sent anywhere.

12. Notifications and widgets

Reminders (weekly summary, IQ retest reminder, trial-ending reminder), the "Feed your brain" notification from the Screen Time shield and friends notifications (section 5) are local notifications created on your device.
The only push notification is the AI Tutor "course ready" message (section 7), and only if you allow it.
You can turn notifications off in iOS Settings or reminders off in the app.
Home Screen widgets read your progress from the app's on-device storage. Nothing is sent anywhere.

13. Hosting, server logs and backups

Our server runs on Oracle Cloud Infrastructure in Oracle's data centre in Frankfurt, Germany (region eu-frankfurt-1). The website https://rotblock.org is served from the same server.
Server logs record the IP address, time and target of requests. They are kept only until they are rotated out by size, usually after a few days.
Database backups are made daily and kept for 14 days, then deleted. Data you delete therefore disappears from backups within 14 days.

14. Website

The website https://rotblock.org uses no cookies, no analytics, no tracking and no third-party content. When you visit it, our server processes your IP address and the requested page in its server logs (section 13), based on our legitimate interest in delivering and securing the website (Art. 6(1)(f) GDPR).

15. No tracking, no ads, no analytics

rotblock does not track you across apps or websites, does not show ads, and contains no third-party analytics, advertising or crash-reporting SDKs. If you have agreed to share analytics with app developers in iOS Settings, Apple may provide us with crash reports and aggregated usage statistics. These are anonymous to us.

16. Recipients and transfers

Oracle Corporation / Oracle Cloud Infrastructure (Frankfurt, Germany) hosts our server and processes data on our behalf under a data processing agreement (Art. 28 GDPR).
OpenAI and Google (Gemini API) process AI Tutor topics and course material as our processors, in the USA (section 7).
Apple Inc. / Apple Distribution International Ltd. (Ireland) for the App Store, purchases, Sign in with Apple, push notification delivery and server-based speech recognition (if used, see section 10).
Other users see the data described in section 5.
Apart from the AI Tutor providers, we do not transfer your personal data to countries outside the EU/EEA ourselves.

17. How long we keep data

Account data, backup, friends and multiplayer data, AI Tutor courses, purchase records and push tokens: until you delete your account. Open trades expire after 48 hours and open duels after 24 hours.
Server logs: until rotated out, usually a few days.
Database backups: 14 days.

Deleting your account: in the app, open the Blocks tab, go to Account and tap Delete account. This deletes your account and everything linked to it on our server immediately: profile, leaderboard entries, cloud backup, friends, trades, duels, items, AI Tutor courses, purchase records and push tokens. Copies in backups disappear within 14 days. Progress on your phone stays until you delete the app. You can also email us to request deletion.

18. Children

rotblock is not directed at children under 14. In Austria, the age of consent for information society services under Art. 8 GDPR is 14. You need to be at least 14 to create an account, or have the consent of a parent or guardian. Using the app without an account does not send personal data to us.

19. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, email me@muratbock.com. Because we only know your account ID, please tell us your username, display name or friend code so we can find your account. We may ask for information to verify the request.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
dsb@dsb.gv.at, https://www.dsb.gv.at

20. Security

Connections to our server use HTTPS. Access to cloud data is restricted per user by database rules: only you can read your backup and your AI Tutor courses. XP, leaderboards, trades, duels and Pro status can only be changed through checks on our server. Purchase data is verified against Apple's signature.

21. Changes

We will update this policy when the app's data processing changes and show the date at the top. For material changes we will inform you in the app.

22. Contact

WMB GmbH, Beethovengasse 4-6/2/7, 2500 Baden, Austria
me@muratbock.com, +43 660 4041942