Backprop Lab collects no personal data. There are no accounts, no advertising, no analytics and no crash reporting, and nothing is ever sent to the developer — there is no server of ours anywhere.
The Android app cannot even transmit anything: the package requests no internet permission, and without that permission Android denies all network access. The app for iPhone, iPad and Mac opens no network connection of its own either. Everything is computed on the device.
The app requests no permissions — no internet, no location, camera, microphone, contacts or
storage. The manifest holds nothing but an identifier generated by Android itself
(DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION), which grants access to nothing and only
secures the system's internal broadcasts.
This can be checked on the finished package rather than taken on trust:
apkanalyzer manifest permissions.
On iPhone, iPad and Mac the app asks for no permission either — no location, camera, microphone, contacts, photos or tracking. On the Mac it runs in Apple's sandbox with no entitlement beyond the sandbox itself.
Under About there are links to these pages. Tapping one hands the address to the browser, which then fetches it itself — the app opens no connection and does not learn whether the page was opened.
Feedback by email in the help section opens a draft in your mail app. It already holds the app version, the system version and the device model, because those are what a bug report usually lacks. Nothing is sent until you send it yourself, and you can delete any of it before you do. An email you send reaches the controller like any other and is used only to answer it.
Five values, so the app still knows them after a restart:
None of them says anything about you or about how you use the app beyond that. All five live in the app's private storage on the device (on Android its preferences, on Apple devices its user defaults). They never leave it, cannot be read by other apps, and are removed when the app is uninstalled. The data points the network computes with are generated afresh by a random generator on every start and are stored nowhere.
The simulator at lab.html is a single HTML file. It sets no cookies and
sends no data. In the browser's local storage it leaves a single value, the chosen display language
(backproplab.lang, holding de or en). That value stays in the
browser, is never transmitted, and can be deleted at any time through the browser's site data; if
storage is blocked, the page works unchanged and follows the browser's language.
Its only outward request fetches the fonts from Google Fonts; in doing so Google learns the device's IP address, as it would for any file fetched over the network. Anyone who wants to avoid that can save the file and open it offline; it then works unchanged, only with a different typeface.
Wherever the page is served from, the usual server logs of that provider also arise, over which the controller has no influence.
No data is passed to third parties, because none is collected. The app includes no advertising, analytics or crash-reporting services.
Obtaining the app through Google Play means dealing with Google: the download, account handling and any system-level crash reports run through Google Play and are subject to Google's privacy policy. The provider of this app has no influence over that and receives no personal data from it.
The same holds for the App Store: download, Apple account and any crash reports you have agreed to share with developers run through Apple and are subject to Apple's privacy policy. If you choose to rate the app, the rating dialog comes from the system and is handled by Apple. The App Store page of the app states: Data Not Collected.
The app is not aimed at anyone in particular and is harmless at any age: it collects no data and has no communication feature, no purchases and no advertising.
The General Data Protection Regulation gives you rights to access, rectification, erasure, restriction, data portability and objection, as well as the right to complain to a supervisory authority. Since no data about you exists, a request for access comes to nothing — there is nothing to give access to. For questions about this you can reach the controller at the address above.
Should a later version of the app process data, this policy will be adjusted beforehand. The date above names the current state.