Privacy Policy

Operator: Zero One Burg Entertainment LLC · Address: 5450 W Sahara Ave, Ste 300, Las Vegas, NV 89146, United States · Contact: support@karmyx.de

1. Introduction

Welcome to KARMYX. Zero One Burg Entertainment LLC (“we”, “us”, “our”) operates the KARMYX mobile application — a personal karma-tracking app that helps users log positive daily actions, earn karma points, and build lasting positive habits.

This Privacy Policy explains what data we collect, why we collect it, and how we handle it. By using KARMYX, you agree to this Privacy Policy.

2. Data We Collect

2.1 Account Data — When you register, we collect your name, email address, and a secured password. You may optionally upload a profile picture.

2.2 Karma Activity Data — We store the positive actions you log: category (e.g. kindness, environment, helpfulness, community, generosity), karma point value, timestamp, optional description, and any photos or proof you upload for Verified Karma submissions.

2.3 Goals & Progress Data — Your daily and weekly karma goals, streaks, progress history, and reports are stored to power the core tracking features of KARMYX.

2.4 Social Feed Data — When you log an action, it can be shown to others in the Social Feed. By default, your profile and actions are visible only to your connections; you can change this to fully private or fully public in your privacy settings. Shared post content includes the deed description, karma points, and any optional image.

2.5 Subscription & Payment Data — KARMYX Plus subscriptions ($4.99/month) are sold on our website and processed by our payment provider Stripe. We do not store your full payment card details — only subscription status and renewal dates.

2.6 Device & Usage Data — We collect device type, OS version, push notification tokens, and anonymized usage analytics (features used, session duration) to operate and improve the app.

2.7 Safety & Moderation Data — If you report content or block another user, we store the report (including the reason you provide) and the block relationship to keep the community safe and to act on violations.

2.8 Service & Usage Telemetry — When you use core features we record technical metrics about server-side events on a pseudonymized basis: AI requests (whether an illustration was served from cache or freshly generated, including which cache layer matched, the request timing, the estimated cost, and your subscription tier), account and subscription lifecycle (registration, trial start, subscription start, renewal, cancellation, and payment failures), and core usage milestones (such as logging an action). These metrics are tied to a pseudonymized identifier — not your name, email, or the action text — and let us measure how the service is used, detect misuse such as repeatedly varying input to bypass the cache and run up costs, and operate our business. No cookie is set for this processing, so it runs independently of the cookie banner. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating, securing, and improving the service and controlling costs). You can object to this processing at any time by contacting us.

3. How We Use Your Data

We use your data to:

• Deliver and maintain all KARMYX features
• Personalize your karma tracking, goals, streaks, and reports
• Send you reminders, challenge notifications, and weekly summaries (KARMYX Plus)
• Verify Verified Karma submissions
• Improve the app and develop new features
• Comply with legal obligations under German and EU law

4. Verified Karma

For Verified Karma actions, you may submit photos, receipts, or confirmation documents as proof. These files are stored securely, used solely for verification, and never shared publicly without your explicit consent.

We retain these proof files for as long as your account exists, so that we can review or revoke a Verified status if its authenticity is later challenged — this protects the integrity of Verified Karma for the whole community. When you delete your account, all proof files are permanently erased (see Section 6).

Verified status increases your credibility score within the app and unlocks special awards and partner programs.

5. Data Sharing

We do not sell your personal data. To run KARMYX, we rely on the following carefully selected processors, each engaged under a GDPR-compliant data processing agreement:

• Supabase (EU, Ireland) — database, authentication, and media storage: holds your account, karma actions, and uploads.
• Vercel (US company, under EU Standard Contractual Clauses) — hosting of the web app via a global CDN and cookieless, privacy-friendly analytics.
• Sentry (EU, Frankfurt) — error and crash reporting: technical diagnostics plus a hashed user ID, no plaintext personal content.
• PostHog (EU) — receives product analytics (only with your consent via the cookie banner) and the service and usage telemetry described in Section 2.8 (pseudonymized, legitimate-interest basis under Art. 6(1)(f) GDPR — no cookies set).
• Stripe (global, under EU Standard Contractual Clauses) — payment processing for KARMYX Plus subscriptions.
• Vercel AI Gateway with the model providers Google and OpenAI (USA, under EU Standard Contractual Clauses) — generates karma illustrations and assists with content checks; processes action descriptions and avatar images. These providers are instructed not to use your data to train their models.
• Resend (USA, under EU Standard Contractual Clauses) — delivery of transactional emails such as sign-up confirmation and password reset.

6. Data Retention

Your data is retained as long as your account is active.

Upon account deletion, personal data is erased within 30 days, except where longer retention is required by law (e.g. billing records for 10 years under US commercial law).

7. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict or object to processing
• Receive your data in a portable format
• Lodge a complaint with a supervisory authority

8. Data Hosting & International Transfers

Your personal data — including your account, karma actions, uploaded media, and profile — is stored on servers located in the European Union. Our database, storage, and authentication provider (Supabase) hosts the KARMYX project in the EU (Ireland region).

The KARMYX web app is delivered through a global content delivery network (Vercel), which may process technical connection data such as your IP address in transient server logs but does not permanently store your personal data.

Some individual features rely on service providers located outside the EU/EEA — for example, AI providers in the United States that generate illustrations or assist with content checks. Where data is transferred to a third country, we ensure adequate safeguards are in place, such as EU Standard Contractual Clauses or an adequacy decision, in accordance with GDPR requirements.

9. Automated Processing & Artificial Intelligence

KARMYX uses artificial intelligence and automated processing in a few clearly defined places. In line with Art. 13(2)(f) GDPR, this section explains what they do and the role that you and our team keep in the process.

• Karma point suggestion — When you log an action, you can ask our AI to suggest a karma point value from the title, description, and category you entered. This is only a suggestion: you can adjust it, and you alone decide whether to save the action.
• Avatar moderation — When you upload a profile picture, it is automatically screened so that prohibited or unsafe content stays off the platform. If an image is rejected, no change is made to your profile and you can upload a different one.
• Karma illustrations — You can have an illustration generated for an action from your description. This only creates an image; it does not evaluate you or your action.
• Grouping & text processing — We process the text of your actions to recognize similar entries and improve suggestions. This produces no decisions about you.

10. Children's Privacy

KARMYX is not intended for users under the age of 16. During account creation, we ask new users to confirm that they meet this minimum age requirement (self-declaration). We do not technically verify a user's age.

If we become aware that a user is under 16, we will delete the account and any associated data promptly. If you believe a child has created an account, please contact us at support@karmyx.de.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or by email.

Continued use of KARMYX after changes constitutes acceptance of the updated policy.

12. Contact

Zero One Burg Entertainment LLC, 5450 W Sahara Ave, Ste 300, Las Vegas, NV 89146, USA

Email: support@karmyx.de

EU representative (Art. 27 GDPR): Riva-Christin Krieg, Lilienstraße 11, 71394 Kernen im Remstal, Deutschland. Email: support@karmyx.de