Last updated: July 6, 2026
This Privacy Policy outlines our policies on collecting, using, and disclosing your information when you use the service provided by acubemy. It also explains your privacy rights and how you can exercise them.
Interpretation and Definitions
- Service: The acubemy website accessible at https://acubemy.com and the acubemy mobile applications for iOS and Android.
- Personal Data: Information that relates to an identifiable person.
- Usage Data: Data collected automatically from the use of our Service.
- We/Us/Our: Refers to acubemy GmbH, Roonstraße 23 a, 76137 Karlsruhe, Germany, the controller responsible for the processing of your personal data.
- You: The user of our Service.
Personal Data We Collect
When creating an account, we collect:
- A username (does not need to be your real name).
- Email address (provided through third-party authentication such as Google or email/password). We store your email address in our database to enable account-related communications.
- Authentication provider information (e.g., whether you signed up with Google or email/password).
- Email communication preferences (which types of emails you consent to receive).
Usage Data and Cookies
We automatically collect certain data when you use our Service, including your IP address, browser type, operating system, and diagnostic data.
We use the following categories of cookies:
- Essential cookies: Required for authentication and session management. No consent needed.
- Analytics & tracking cookies: Used by PostHog, Google Analytics, Meta Pixel, and Reddit Pixel to analyze usage and measure ad performance. These are only placed with your explicit consent via our cookie banner.
You may withdraw your consent at any time via the cookie settings on our website.
Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service, manage your account, and associate solve data with your profile.
- Legitimate interests (Art. 6(1)(f) GDPR): Error monitoring, security, fraud prevention, and statistical analysis based on aggregated or anonymized data.
- Consent (Art. 6(1)(a) GDPR): Marketing communications as well as analytics and tracking cookies (PostHog, Google Analytics, Meta Pixel, Reddit Pixel). You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c) GDPR): Retention of billing and transaction records as required by law.
Use of Your Data
We use your data for:
- Providing and improving the Service.
- Associating Rubik's Cube solve data with your account.
- Offering personalized training and statistics based on your solves.
- Sending you important account-related communications (e.g., welcome emails).
- With your consent, sending marketing communications such as product updates, tournament announcements, and general news.
We store your solve data associated with your account to provide personalized training and statistics. For broader statistical analysis and service improvement, we use only aggregated and/or anonymized solve data that does not personally identify you. You can manage your email preferences at any time in your account settings.
Payments and Subscriptions
If you purchase a Premium subscription or products through our Service, payment processing is handled by external payment providers. We do not store your full payment card details on our servers.
- Web: Payments on our website are processed by Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.). If you select PayPal as your payment method in Stripe's checkout, PayPal also processes your payment data as the provider of that payment method under its own privacy policy.
- Mobile apps: Purchases in our iOS and Android apps are processed by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We use RevenueCat (RevenueCat, Inc.) to manage and validate mobile subscriptions.
In connection with payments, we and our payment providers process data such as your email address, selected payment method, transaction amount, subscription status, billing country, and tax-related information. We receive confirmation of payment and subscription status from these providers but no full card numbers.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR), in particular statutory retention periods under German commercial and tax law, which require us to retain billing records for up to ten years.
Third-Party Services & International Data Transfers
We use the following third-party services which may transfer data to the United States:
- PostHog – Product analytics (posthog.com)
- Meta Pixel (Facebook) – Conversion tracking via Meta Platforms, Inc.
- Reddit Pixel – Conversion tracking via Reddit, Inc.
- Google Tag / Google Analytics – Analytics and tag management via Google LLC
- Firebase Authentication – User authentication and account management via Google LLC (may process your email address, authentication identifiers, and related technical data).
- Sentry – Error monitoring and performance diagnostics via Sentry, Inc. (may process pseudonymous identifiers, error details, and technical information about your device and browser).
- Stripe – Payment processing via Stripe Payments Europe, Ltd. and Stripe, Inc. (may process payment, transaction, and billing data).
- RevenueCat – Mobile subscription management via RevenueCat, Inc. (may process purchase and subscription status data).
- Resend – Transactional and marketing email delivery via Resend, Inc. (may process your email address and email content).
- Vercel – Website hosting via Vercel Inc. (may process IP addresses and technical request data).
These transfers are primarily carried out on the basis of the EU-US Data Privacy Framework (adequacy decision by the European Commission). Where this framework does not apply, transfers are safeguarded by Standard Contractual Clauses (SCCs). For more information, refer to each provider's privacy policy.
Children Under 16
acubemy does not knowingly collect personal data from children under 16 without verifiable parental consent, in accordance with Art. 8 GDPR. If you are under 16, a parent or guardian must supervise or create your account. If we become aware of personal data collected from a child under 16 without parental consent, we will delete it promptly.
Parents or guardians may contact us at support@acubemy.com to review or request deletion of their child's data.
Sharing of Data
We share personal data with third-party service providers acting as processors to operate, analyze, secure, and improve our services. This includes the providers listed under Third-Party Services above and our hosting/infrastructure providers (such as Vercel). These third parties are contractually obligated to process your data only on our behalf and in accordance with applicable data protection laws.
We do not share personal data with third parties, except as described under Third-Party Services above.
Delete Your Account
You can permanently delete your account at any time using either of the following methods:
- In the app: Go to Settings → Profile → Delete Account and confirm the deletion.
- On the website: Log in at acubemy.com, navigate to Settings → Profile → Delete Account, and confirm the deletion.
Upon confirming account deletion, the following data will be permanently removed within 14 days:
- Your profile information (username, email address, authentication data).
- All solve data and training history associated with your account.
- Your email communication preferences and any other account settings.
Aggregated or fully anonymized data that cannot be linked back to you (e.g., anonymous usage statistics) is not considered personal data and may be retained for service improvement purposes.
Retention of Data
Your data is retained for as long as your account is active. Upon account deletion, all personal data associated with your account will be deleted within 14 days. Certain data may be retained beyond this period solely where required by statutory obligations (e.g., tax, fraud prevention, or legal proceedings). In such cases, the affected data will be restricted from further processing and retained only for the legally mandated period, after which it will be deleted.
Data Security
We follow industry-standard practices to protect your data, including HTTPS encryption and secure hosting. However, no method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Data Storage Location
Your data is stored on Google Cloud Services infrastructure located within Europe. We have signed a Data Processing Agreement (DPA) with Google to ensure your data is handled securely and in compliance with GDPR.
Your Rights
Under GDPR you have the right to:
- Access, correct, or delete your personal data.
- Data portability (Art. 20 GDPR).
- Restriction of processing.
- Withdraw consent at any time without affecting prior processing.
- Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests. Where your personal data is processed for direct marketing purposes, you have the right to object at any time, in which case we will no longer process your data for such purposes.
- Right to lodge a complaint with a supervisory authority: If you believe that our processing of your personal data violates data protection laws, you have the right to lodge a complaint with a competent supervisory authority. The supervisory authority responsible for acubemy is:
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)Website: https://www.baden-wuerttemberg.datenschutz.de/
To exercise your rights, contact us at: support@acubemy.com
Contact Information
If you have questions or requests concerning your privacy, please contact us:
acubemy GmbH
Roonstraße 23 a
76137 Karlsruhe, Germany
Email: support@acubemy.com
