Privacy policy

Who is responsible

The controller for your data is Phillip Kracht, the provider of Nexxus Karat. For questions about privacy, write to play@nexxus.group.

Address and phone number in the legal notice

What is stored on your device

Your holdings, meaning the gold and silver you enter, are stored on your device. They are not sent to any Karat server. If you delete the app, they are gone.

This does not apply if your device backs up the app’s data: in iCloud Backup on iPhone, in Google backup on Android. Then your holdings come back with the backup. Whether the app is included depends on your settings.

Your settings are stored on the device too: country, currency, unit, language, appearance and your alerts. If you switch notifications on, your country, currency, language, time zone and alert settings also go to our server, see “Notifications”. Unit, appearance and your holdings always stay on the device.

If you take your device abroad, Karat can let you know. Karat works this out from the device’s time zone alone. It does not ask for your location.

“Take my data with me” creates a text with your holdings, your settings and your alerts. You can share or save this text.

Loading prices

To show you prices, the app and this website ask our server for them. It sits in a data centre run by Hetzner Online GmbH in Germany. With every request the server processes your IP address so that the answer reaches you. The request says what the app should show: metal, currency, unit, purity, time range and whether bars or jewellery are meant. If India is set as your country, the app also asks for prices in Indian cities. This tells the server your country. For an item in your holdings that you bought in another currency, the app also asks for that currency’s rate. The server does not store these details. Which country and currency the website shows follows your browser’s language setting. It does not ask for your location.

We keep no access log for the website or for price requests. Our error logs contain no IP addresses either. IP addresses are not linked to any person. We build no profiles and do not analyse the addresses.

The server gets the prices themselves from a market data provider. It passes on nothing about you in the process.

App updates

Each time it starts and each time you return to it, the app on iPhone and Android checks with Expo (650 Industries, Inc., USA) for updates. That way improvements reach you without a detour through the store.

With this check, Expo receives your IP address and a random identifier for this installation. If you reinstall the app, a new identifier is created. Expo is certified under the EU-US Data Privacy Framework.

Notifications

Karat Plus offers three kinds of notifications: signals, big daily moves and the daily summary. Signals are switched on by default.

Your device registers with our server when you have Karat Plus, open the “Alerts” section in the app and your operating system allows notifications. On iPhone and from Android 13 onwards, the system asks for your permission first. Up to Android 12, notifications are allowed by default.

The server then stores for your device the identifier for notifications (push token), the operating system, country, currency, language and time zone. Your settings are stored as well: whether signals are on, sensitivity, quiet hours, time of the summary and threshold for daily moves. The server also records when your device registered and when it last checked in. It needs all this to send you the right notification at the right time in your language.

For each notification sent, the server logs the device, the kind, the metal, the time and the title and text of the notification. That way you get each kind at most once a day and an unchanged signal at most once every seven days. The app can also show you under “Notifications” what it sent you in the last 30 days. It deletes these log entries after 30 days.

The entry for your device stays as long as you use notifications. If you switch off all three kinds, the app deregisters your device at once. This also applies if you had already withdrawn permission in your system settings. If Karat Plus ends or you withdraw permission in your system settings, the app deregisters your device the next time you open it. When a device is deregistered, the server deletes everything about it.

If Apple or Google reports an identifier as invalid, for example after the app was deleted, the server deletes the entry after 30 days.

Notifications reach your iPhone through the Apple Push Notification service (Apple Inc., USA) and your Android device through Firebase Cloud Messaging (Google LLC, USA). For this, Apple and Google receive the identifier, the text of the notification and technical details about it: currency, metal, kind of notification and date. Both companies are certified under the EU-US Data Privacy Framework.

Feedback

If you use “Send feedback” in the app, the server stores your message along with the category you chose, the app version, the language, the operating system and the time. It stores your email address only if you enter it. We use it only to reply to you.

To prevent mass submissions, the server stores a value it calculates from your IP address. It uses a secret key for this that changes every time the server restarts. The address cannot be worked out from the value. The server deletes the value after one day.

The server deletes your feedback with all its details and your email address after 12 months. If you ask us at play@nexxus.group, we delete it sooner.

Backups

We back up our databases every day, encrypted. Each backup is deleted after 30 days at the latest. Until then, data you have deleted may still be contained in it. We only access backups to restore operation after an outage.

Purchases

You buy Karat Plus through the App Store or Google Play. Apple and Google handle the payment. Karat receives no payment data. On your device, the app keeps which product was bought. For a subscription on iPhone, it also keeps until when it is valid. Every time you open it, it asks the store whether your purchase is still valid. The purchase itself is covered by the privacy policy of Apple or Google.

Website

nexxuskarat.com works without cookies, tracking, analytics or ads. Fonts and all other files come from our own server. When you open a page, it processes your IP address to send you the page. It does not store it. Your settings, such as light or dark, are kept by your browser in its local storage. Which of them go to our server with the price requests is set out under “Loading prices”.

Who receives data

Besides us, these companies receive data: Hetzner Online GmbH for the data centre in Germany, Expo for updates, Apple and Google for notifications. Emails sent to play@nexxus.group are held by united-domains GmbH in Germany. Expo, Apple and Google are based in the USA. We pass data on to no one else. We do not sell data.

Legal bases

We load prices and deliver notifications to provide the features you use in Karat (Art. 6(1)(b) GDPR). Notifications are part of Karat Plus.

We rely on our legitimate interest (Art. 6(1)(f) GDPR) for running and securing the server, for updates, for protection against abuse and for reviewing feedback to improve the app.

You give your email address with feedback voluntarily. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by email to play@nexxus.group. The withdrawal applies from then on. It does not make the processing up to that point unlawful.

Without a connection to our server, Karat cannot show current prices. Notifications and feedback are voluntary. Without them, only the feature in question is unavailable.

Karat makes no automated decisions about you and builds no profiles.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time.

Because Karat has no account, we cannot link data to a name. The quickest way to delete the entry for your device is therefore to do it yourself. If you switch off all notifications in the app, the server deletes it at once.

We delete feedback if you ask us at play@nexxus.group. Tell us roughly when you sent it or what it said. That helps us find it.

You can complain to a data protection authority, for example in your country. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania.