Cookie and tracking statement
German version: docs/legal/de/cookie-hinweis.md.
Summary
- kidova.com (website): no cookies, no third-party trackers, no advertising pixels, no Google Fonts or other third-party font services. We count page views with a self-hosted, cookieless statistics tool (
[Umami or Plausible]) on our own server in Germany. - app.kidova.com (parent dashboard): only strictly necessary cookies for login and security.
- Kidova apps: no advertising or analytics SDKs. Aggregated product events only (for example "setup completed"), self-hosted in Germany. Child mode sends no product analytics
[confirm with KIDOVA.md §11.11: "no ad or analytics SDKs in Child mode"].
Details
| Where | Name | Purpose | Duration | Basis |
|---|---|---|---|---|
| app.kidova.com | session cookie (httpOnly, Secure, SameSite=Strict, path /api) | Keeps you logged in | Sliding 7 days, max. 30 days | Strictly necessary (§25(2) No. 2 TDDDG) |
| app.kidova.com | CSRF token (fetched per session, sent as header) | Protects against cross-site request forgery | Session | Strictly necessary |
| app.kidova.com / kidova.com | local storage: language, theme (light/dark) [confirm implementation] | Remembers your display choices | Until you clear it | [Counsel: strictly necessary for a requested function?] |
| kidova.com | none | — | — | — |
Website statistics
The statistics tool stores no cookies and no full IP addresses [verify tool configuration: Umami/Plausible create a daily rotating hash from IP + user agent + salt; confirm exact method for the chosen tool]. We see aggregated numbers such as page views, referrers, country, device type.
Legal basis for the processing: Art. 6(1)(f) GDPR (legitimate interest in understanding the use of our website).
Open question for counsel (KIDOVA.md §11.8): whether the script's access to information on the terminal equipment (e.g. screen size, language) falls under §25(1) TDDDG and therefore needs consent, or under an exception. Until counsel confirms, [option A: no banner; option B: minimal opt-in].
Payments
The checkout is hosted by our payment provider ([Stripe]), which sets its own cookies for fraud prevention and payment processing on its pages. [Link to provider notice.]
Apple Pay domain verification
kidova.com hosts /.well-known/apple-developer-merchantid-domain-association for Apple Pay on the web. This file sets no cookies.
Also available in German: Deutsche Fassung