Zerlegt

Privacy Policy

Last updated: 18 October 2026

This privacy policy applies to the website zerlegt-app.com and to the Android app “Zerlegt” (package com.zerlegt.app).

1. In short

2. Controller

The controller for data processing on this website and in the app is:

David Brewing
Tannenstraße 48
40476 Düsseldorf
Germany
Email: support@zerlegt-app.com

We have not appointed a data protection officer.

3. This website

3.1 Hosting and server logs (Cloudflare Pages)

The website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). When you open a page, Cloudflare processes technically necessary connection data:

Purpose: delivering the website, security and stability (defence against attacks and abuse).
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Recipients: Cloudflare, Inc. as processor (Art. 28 GDPR) under Cloudflare’s data processing agreement (Customer DPA). Cloudflare delivers content from data centres worldwide, so processing may also take place outside the EU (section 7).
Retention: We do not store access logs ourselves and have no access to individual log entries. According to Cloudflare, it keeps log data only for a limited period, as far as needed for operating and securing its network.

3.2 No cookies; audience measurement with Cloudflare Web Analytics

The website sets no cookies and stores nothing in your browser (no cookie, no localStorage). There are no advertising or social media embeds, no maps and no embedded videos. Fonts, images and styles come from this website itself. The one exception is the Cloudflare measurement script:

For audience measurement we use Cloudflare Web Analytics (Cloudflare, Inc., USA). When serving the pages, Cloudflare inserts a small piece of JavaScript (“beacon”) that is loaded from static.cloudflareinsights.com. It reads measurements about how the page loaded from your browser (load times and Core Web Vitals) and sends them to Cloudflare.

Purpose: We want to know how many people visit the website, which pages are read and how fast they load, so that we can improve the website. We do not build user profiles.
Data: load times and performance values of the page, the page requested (domain and path, without query string), the referring website (referrer), the country, device type, browser, operating system and the type of page view. For technical reasons Cloudflare also receives your IP address (as in section 3.1). In the Cloudflare dashboard we see only aggregated figures, not individual visitors.
Statements by Cloudflare: Cloudflare Web Analytics does not use client-side state such as cookies or localStorage, does not fingerprint visitors, does not track individual users across its customers’ internet properties and, according to Cloudflare, does not collect visitors’ personal data. These statements come from Cloudflare’s documentation; we cannot verify them ourselves.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to understand and improve the use and loading speed of the website. Because no cookies, identifiers or profiles are involved, the intrusion on your rights is low. In our assessment the measurement does not store information on your device and does not read information stored there; it only evaluates measurements that your browser itself produces while loading the page. We therefore do not obtain consent under section 25 TDDDG (German Telecommunications Digital Services Data Protection Act), and there is no consent banner.
Recipients: Cloudflare, Inc. as processor (Art. 28 GDPR) under the Cloudflare Customer DPA. Processing may also take place in the USA (section 7).
Retention: According to Cloudflare, individual measurement data is kept for 7 days and then aggregated down to about 10 %; the reports remain available for about six months. We do not store individual measurement data ourselves.
Objection: You can object to the measurement under Art. 21 GDPR (section 9). Write to us at support@zerlegt-app.com. You can also prevent the measurement yourself by blocking the script from static.cloudflareinsights.com in your browser or with a content blocker. The website works unchanged without it.

3.3 Contact by email

Emails to support@zerlegt-app.com are received by Cloudflare Email Routing and forwarded to our Gmail mailbox. Your sender address, the content of your message and connection data are processed.

Purpose: answering your request.
Legal basis: Art. 6(1)(f) GDPR (handling enquiries); if your enquiry concerns the use of the app, also Art. 6(1)(b) GDPR.
Recipients: Cloudflare, Inc. as processor for the forwarding. The mailbox itself is provided by Google (Gmail; the provider in the European Economic Area is Google Ireland Limited, Ireland). Google processes the messages under its own terms of service and its privacy policy; data may reach the USA in the process (section 7).
Retention: until your request has been dealt with, then for at most six months for follow-up questions. If the request gives rise to a statutory retention obligation, we keep it for as long as that obligation applies.

Please do not send us photos of people or sensitive data by email.

In some places the website links to pages of other providers (for example Google). Your browser only opens the other page when you click such a link; that provider’s privacy policy then applies.

4. The app: no account, local data

The app stores the following data only locally on your device:

We have no access to it. You delete the data by clearing the app data (Android settings › Apps › Zerlegt › Storage) or by uninstalling the app. If you have switched on device backup in Android, Android may back up app data to your Google account. This is a feature of Android and Google that you control in your Android settings.

5. What data the app processes and why

5.1 AI recognition (camera, photo picker, live finder; Gemini on Google Cloud Vertex AI)

Purpose: The app recognises the object in your image and names its components. For this, an AI (Gemini) analyses the image.

How it works: You take a photo with the camera or pick one and start the recognition. The camera’s live finder evaluates the camera image on your device only at first (section 5.2); nothing is transmitted in the process. An image goes to the AI only when you trigger the recognition yourself. The app sends this image encrypted (HTTPS) to our proxy server, a Cloudflare Worker at api.zerlegt-app.com. The proxy forwards the request to Gemini on Google Cloud Vertex AI, to the EU location (multi-region within the European Union). The result returns to the app through the proxy.

Data:

What the proxy stores: Images and texts are neither stored nor logged, only passed through. For the limits, the proxy stores counters. Installation ID and IP address are not kept in plain text there, only as a salted hash value (for IPv6 addresses formed only from the first 64 bits). These entries are deleted automatically two days after the last request. Error messages of the proxy contain only a status code, no content. The proxy does not pass your IP address or the installation ID on to Google; Google only sees the proxy’s request.

Legal basis: For the recognition, Art. 6(1)(b) GDPR: you call up the feature yourself, and it is not possible without the transfer. Where no valid user agreement exists (for example with minors), we base the processing on Art. 6(1)(f) GDPR; our legitimate interest is to provide the feature you expressly call up. For limiting requests, Art. 6(1)(f) GDPR (protection against abuse and costs, availability of the service). Storing and reading the installation ID on your device is permitted under section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary for the service you requested.

Recipients:

No training: According to the Google Cloud documentation, Google does not use customer data to train or fine-tune AI models without the customer’s prior permission or instruction. We have not given such permission.

Retention: The proxy does not store images (see above). According to its documentation, Google may cache inputs and outputs in memory for up to 24 hours, within the selected EU location. To detect violations of its usage policies, Google may also log requests for a limited period. The app stores the recognition result locally (section 4).

Note for you: Please do not photograph people or private documents. The recognition is a suggestion and may be wrong.

5.2 On-device recognition (Google ML Kit)

Purpose: Parts of the image recognition run directly on your device (Google ML Kit), for example finding and cutting out an object in the camera image and the pre-selection in the live finder. The live finder’s camera image is evaluated only here on the device and is not transmitted.
Data: The image content stays on your device. Android downloads the required recognition models via Google Play services on first use; your IP address is transmitted to Google in the process. According to Google, ML Kit also sends technical information to Google: device information (manufacturer, model, Android version), package name and version of the app, performance metrics, recognition settings (for example image format and resolution) and a per-installation identifier. Google uses it for diagnostics and usage statistics of ML Kit.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is fast on-device recognition that works without transferring your images.
Recipients: Google (Google LLC, USA, and affiliates), section 7.
Retention: We do not receive or store any of this. Google’s terms apply to the information held by Google.

5.3 World map (Google Maps SDK)

Purpose: The app’s world map is loaded and displayed with Google’s Maps SDK as soon as you open it.
Data: When the map loads, Google processes, according to its own information, among other things your IP address, device information and the coordinates of the map section.
Legal basis: Art. 6(1)(b) GDPR, alternatively (f): you open the map yourself.
Recipients: Google processes this data as an independent controller (Google Maps Platform Controller-Controller Data Protection Terms), including for its own purposes under the Google Privacy Policy. The Google Maps/Google Earth Additional Terms of Service also apply to the map feature.
Third country: USA (section 7).
Retention: as stated by Google in its privacy policy.

5.4 Location

Purpose: saving a find location or a post with a location, and showing your position on the map.
Data: The app may request your precise location (GPS) for this. In the Android dialog you can grant only your approximate location instead, or refuse.
How: The app requests your location only when you use one of these features, not in the background. You can use the app without location and revoke the permission at any time in the Android settings.
Where it goes: The location is stored only locally on your device. It is not sent to us, to the proxy or to the AI. If you show the map, Google processes the coordinates of the map section (section 5.3).
Legal basis: Art. 6(1)(b) GDPR, alternatively (f) (a feature you call up yourself). Access to your device’s location is permitted under section 25(2) no. 2 TDDDG because you expressly request the feature; in addition, you decide in the Android dialog.
Retention: locally, until you delete the entry or the app data.

5.5 Loading the 3D models (catalogue service)

Purpose: The app downloads 3D models and catalogue data from the internet.
Data: For each request, Cloudflare processes your IP address and the technical details of the request (for example time, requested file, identifier of the app software in the user agent).
Operation: Cloudflare Worker with Cloudflare R2 (files) and Workers KV (catalogue data). Cloudflare, Inc. (USA) is the processor.
Legal basis: Art. 6(1)(b) GDPR (providing the models), alternatively and for the security and stability of the service (f).
Third country: USA (section 7).
Retention: We do not store IP addresses. According to Cloudflare, it keeps log data only for a limited period.

5.6 Download via Google Play

You download the app via Google Play. Google processes data in the process (for example account, device, time) under its own responsibility. We have no influence on this. At most, we receive aggregated statistics from Google. More information is in Google’s privacy policy.

6. App permissions

7. Transfers to third countries (USA)

Google and Cloudflare belong to companies based in the USA. Data may reach the USA or be accessible from there, even though Google Cloud processes the AI requests in the EU. We base such transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on the Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which Google and Cloudflare have included in their data processing agreements.

The list of certified companies is at dataprivacyframework.gov. You can request a copy of the standard contractual clauses from us.

8. Children and young people

The app is intended for people aged 13 and over.

We do not need consent for the app’s features; they are based on the legal grounds in section 5. Features that would only be permitted with consent (for example advertising, tracking or crash reports) do not exist in the app.

If you are under 16: please talk to your parents before using the app, especially before you send images to the recognition. Do not photograph people. Parents can contact us with questions at any time.

9. Your rights

You have the following rights towards us:

Write to us at support@zerlegt-app.com.

Important: We have no account and do not know who you are. Our servers hold only the short-lived hash values from section 5.1; they are deleted after two days. As a rule, we therefore cannot attribute any data to you (Art. 11 GDPR). You can view and delete the data on your device yourself at any time.

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing that we base on Art. 6(1)(f) GDPR. We will then no longer process the data unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Without the request limits we cannot offer the AI recognition; you can then simply stop using it.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Postal address: Postfach 20 04 44, 40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

11. Obligation to provide data, automated decisions

You do not have to provide any data to use the app. Without sending an image, the AI recognition does not work. There is no automated decision with legal effect within the meaning of Art. 22 GDPR.

12. Changes

We change this policy when the app or the website changes. The current version is at zerlegt-app.com/en/privacy and in the app.