Privacy Notice — 8tribute App

This privacy notice describes the processing of personal data in the 8tribute mobile application (iOS and Android). The marketing website at 8tribute.com is covered by a separate website privacy notice.

Data controller

digual GmbH
Am Sonnenhang 6, 4074 Stroheim, Austria
Email: hallo@8tribute.com
Phone: +43 699 111 23863

Full company information is in our Imprint.

Eligibility

The app is intended exclusively for employees of customer organisations who have received an organisation-specific invite code. Self-registration without an invite is not possible.

Data we process

Authentication data

When you register with an invite code or sign in, we process:

  • Email address
  • Password (stored only as a cryptographic hash via Firebase Authentication)
  • Display name (optional, set during initial profile setup)
  • Unique user ID (generated by Firebase Authentication)

You may alternatively use „Sign in with Apple". Apple may, at your option, supply an anonymised relay email (@privaterelay.appleid.com) instead of your real address.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract).

Profile and preference data

  • Language (de / en)
  • Role within the organisation (e.g. employee, admin)
  • View-mode preference (tiles / list / document / onboarding)
  • „Push notifications enabled" setting
  • Membership in the organisation and selected business area

Legal basis: Art. 6(1)(b) GDPR.

Push notifications

If you enable push notifications, we store your device's push token (Expo Push Token). It is used exclusively to deliver app-related notifications (e.g. new content alerts). You can disable push notifications at any time in the app settings or device settings — the stored token is then deleted.

Technical delivery uses the Apple Push Notification Service (APNS, Apple Inc.) or Firebase Cloud Messaging (Google LLC) and the routing service of Expo Inc. (USA). Only the token and the message content are transmitted, no other personal data.

Legal basis: Art. 6(1)(a) GDPR (your consent when enabling).

Usage data inside the app

For onboarding processes and learning paths we store your progress:

  • Which process steps you have confirmed
  • Current step of an in-progress process
  • Answers to self-check questions in learning paths
  • Timestamps of activity

This data is used solely to persist your progress and let you resume at the correct step. It is not used for advertising, profiling, or third-party sharing.

Legal basis: Art. 6(1)(b) GDPR.

No tracking or analytics services

The app uses no analytics SDKs (no Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude), no Crashlytics and no advertising trackers. There is no cross-device identification and no data sharing with advertising networks.

Processors

  • Google Cloud / Firebase (Google Cloud EMEA Ltd., Dublin, Ireland) — authentication, database (Firestore), functions, storage. Region europe-west3 (Frankfurt). Google is EU-US Data Privacy Framework certified.
  • Apple Push Notification Service (Apple Distribution International Ltd., Cork, Ireland) — delivery of push notifications to iOS devices.
  • Expo Inc. (Palo Alto, USA) — technical routing of push tokens. Transfer limited to push token + message content. Expo meets EU-US Data Privacy Framework requirements.

Storage location and retention

All master and usage data are stored primarily within the European Union (Firestore region europe-west3, Frankfurt am Main). Push-token delivery is technically routed via the USA (Expo routing), but contains no content data.

Data is stored for as long as your account exists. Upon account deletion, all data directly linked to your person is irrevocably removed; organisation-owned aggregate data (e.g. knowledge-map content) remains the property of the organisation.

Your rights

Under GDPR and the Austrian DSG you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and not to be subject to automated decisions (Art. 22). You may withdraw consent at any time — an informal email to hallo@8tribute.com is sufficient. Account deletion is processed on request to the same address within 30 days.

Right to complain

You have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at/en.

Contact

Privacy questions: hallo@8tribute.com

Last updated: April 2026