Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how the CritCase app («the App», «we», «us») processes personal data in accordance with:

• The EU General Data Protection Regulation (GDPR)
• The Norwegian Personal Data Act (Personopplysningsloven)
• Apple App Store guidelines
• Google Play privacy guidelines

CritCase is an educational app for healthcare professionals and students who want to practice clinical scenarios, emergency medicine and medical knowledge.

2. Data Controller

Data Controller:

RYDNINGEN MEDICAL (sole proprietorship / enkeltpersonforetak)
Org. no. 937 302 258
Sjarkvegen 72, NO-9017 Tromsø, Norway
Proprietor: Thorbjørn André Rydningen
Privacy inquiries: privacy@critcase.app
General support: support@critcase.app

3. What data do we collect?

3.1 Data we DO NOT collect

3.2 Data stored locally on your device

The following data is stored on your device:

If you use the app without signing in («guest mode» – the default), your progress stays on your device only. Cloud backup happens only if you choose to sign in (see section 3.3). Even in guest mode, the app creates a random, anonymous Firebase user ID that enables the optional cloud features (leaderboard, challenges, purchases); Firebase logs IP address and user agent for security purposes when this ID is issued.

Course positions, completed lesson parts and lesson answers are stored only on this device, even when signed in. They are not restored on a new device. Export includes the active user’s local course data; the app has no import feature.

3.3 User account and cloud backup (optional)

You can choose to sign in with Apple or Google to back up game progress and statistics. Signing in is entirely optional – the app is fully functional without an account. If you sign in, we process:

Purpose: Backing up and restoring game progress and statistics across devices, and account recovery.

Legal basis: Contract (GDPR Art. 6(1)(b)) – you request the backup service yourself by signing in.

Retention: Account data is deleted when you delete your account. During an account switch, Firestore may briefly keep a progress-merge checkpoint containing the current cloud progress needed for a safe retry. It is normally deleted immediately after the switch reaches its durable merge step; if the switch is interrupted or its local recovery marker is corrupt, it may remain until a successful retry or account deletion, which recursively removes the user data tree. Residual copies in backups are purged within approx. 180 days (Firebase).

Recipients: Apple and Google are independent controllers for the sign-in itself. Google (Firebase) and RevenueCat act as our processors. Firebase Authentication stores account data exclusively in US data centers (see section 6).

3.4 Local notifications

The app may send local notifications to remind you about daily challenges. These notifications:

• Are generated and handled locally on your device
• Are not sent via external servers
• Can be disabled in the app settings or the device's system settings

3.5 Push notifications (Firebase Cloud Messaging)

If you enable push notifications, we use Firebase Cloud Messaging (FCM) to send you real-time notifications about challenges (completed challenge, new duel, expiring challenge).

Push notifications require your explicit consent (opt-in, off by default). The device token is linked to your user ID, not to your name or email, and is deleted when you delete your account or disable push notifications.

The token is stored in Google Firestore; notifications are delivered via Google's global infrastructure (see section 6). Legal basis: Consent (GDPR Art. 6(1)(a)).

3.5a Technical configuration and app integrity (Firebase Remote Config and App Check)

At startup, the app uses Firebase Remote Config to retrieve the minimum supported app version, content pointer, and technical feature/security switches. Google then processes a pseudonymous Firebase installation ID together with app ID, package/bundle ID, app and SDK version, operating system, platform, language, country/region, time zone, and technical request data to select and deliver the appropriate configuration. Remote Config processes the country/region code for every installation, including when usage analytics is disabled. Firebase rotates the installation ID when the app is reinstalled/app data is cleared or after 270 days of inactivity. “Delete all my data” deletes the current installation ID; if a Firebase service is used later, a new ID unrelated to the deleted one is created. Once an ID is deleted, associated Firebase service data is removed from live and backup systems within 180 days.

We also use Firebase App Check with Play Integrity on Android and App Attest on iOS. Integrity attestation material from the device is sent to the relevant platform provider for validation, and Firebase issues a time-limited App Check token. The purpose is to verify that requests originate from the authentic, untampered CritCase app and to protect the services against abuse. App Check does not retain the attestation material; ordinary App Check tokens are not retained by Firebase services after validation and may have a lifetime of up to seven days.

The app attempts to activate App Check attestation at startup. Activation can fail without stopping the app. Enforcement is introduced in stages for individual services; App Check therefore does not guarantee that every request without a valid token is rejected. These technical services are used for every app installation, are not advertising or cross-app tracking, and cannot be disabled in the app settings. Legal basis: our legitimate interest in secure and reliable operation (GDPR Art. 6(1)(f)). Google (Firebase) acts as processor; see section 6 for global processing locations and transfer mechanisms.

Independently of CritCase product analytics through Firebase Analytics and crash reporting through Crashlytics, the essential Firebase SDKs process unlinked technical operational diagnostics such as app, SDK, OS, and device information and service-request status/error metadata. These data are used for app functionality, security, reliability, and version adoption; they are not CritCase user-behavior analytics. Some Firebase SDK privacy manifests declare an “Analytics” purpose for parts of this technical processing. That does not mean CritCase enables Firebase Analytics: CritCase product analytics and Crashlytics remain off by default and are activated only with consent. Withholding or withdrawing that consent stops those two services but does not turn off every essential Firebase SDK operation. Legal basis for the essential technical processing: our legitimate interest in secure and reliable operation (GDPR Art. 6(1)(f)).

3.6 Usage analytics (Firebase Analytics)

If you consent to usage analytics (off by default), we use Google Firebase Analytics to understand how the app is used:

Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time in settings.

3.7 Crash reporting (Firebase Crashlytics)

We use Firebase Crashlytics to identify and fix errors in the app (crash logs, app version, device type and OS version). Crashlytics is disabled by default and is only activated if you consent to usage analytics. Data is processed by Google in the USA (see section 6). Legal basis: Consent (GDPR Art. 6(1)(a)).

3.8 Leaderboard (Optional – Requires consent)

The app offers an optional global leaderboard. If you choose to participate:

When you leave the leaderboard, a server-managed opt-out marker is first stored under the pseudonymous user ID with the opt-out time. It prevents delayed client writes from recreating the entry. The leaderboard entry and every nested moderation flag are then deleted. The marker is kept only while you remain opted out and is deleted if you opt in again or delete your account.

3.9 Subscription and purchases (CritCase Pro)

The app offers an optional premium service (CritCase Pro). When a production key is configured, RevenueCat is initialized at startup for all app users, including users who never purchase anything. The SDK first creates a random RevenueCat anonymous ID, after which we identify the subscriber with the pseudonymous Firebase user ID; those IDs may be recorded as aliases in the same RevenueCat customer profile. This is necessary to read the correct entitlement status, restore purchases, and prevent premium access from being mixed between accounts.

RevenueCat processes the pseudonymous user ID/alias, first and last contact, app version, platform, device/OS type, locale/country setting and currency code, and entitlement status. Purchase history and the store receipt/token are processed only when the store reports a purchase or restore. We do not send a name, email address, or advertising ID to RevenueCat.

Purchase information is handled as follows:

• Purchase status – verify active subscription (RevenueCat)
• Pseudonymous Firebase user ID and RevenueCat anonymous ID/alias – keep entitlement status on the correct app account (RevenueCat)
• Purchase history – restore purchases on a new device (App Store / Google Play)

We do not have access to payment information; purchases are handled exclusively by App Store / Google Play. RevenueCat Inc. (USA) operates as a data processor in accordance with GDPR (see section 6 on transfers). Legal basis before a purchase: our legitimate interest in secure and correct entitlement management (GDPR Art. 6(1)(f)). For delivery/restoration of a purchase: Contract (GDPR Art. 6(1)(b)).

Erasure safety fence: When “Delete all my data” is initiated, we store a short-lived fence in Google Firestore: a SHA-256 hash of the Firebase user ID together with the controller timestamps createdAt and purgeAfter. The hash is pseudonymous personal data because we can recompute it from a known user ID. The fence contains no raw user ID, purchase data, or user content. While the fence exists, new client writes owned by that user ID are blocked, and server functions check it before writing. Its purpose is to prevent delayed, authenticated client calls or RevenueCat webhooks from automatically recreating account, progress, challenge, leaderboard, or subscription data after erasure. Legal basis: compliance with our secure-erasure obligation (GDPR Art. 6(1)(c), cf. Art. 17) and our legitimate interest in preventing automated recreation (Art. 6(1)(f)). Google (Firestore) acts as processor.

The fence receives its first purge date seven days after creation. Cleanup runs daily, and retries after failures can cause operational delay beyond that date. If a linked Firebase account still exists, account deletion is treated as incomplete and can be retried; the fence deadline is renewed, and cleanup never automatically deletes such an account. An anonymous Firebase account still matching the deletion guard may be deleted before the fence is removed.

3.10 Challenges (Optional – Requires consent)

The app offers an optional challenge feature where you can challenge friends to quiz duels:

3.11 In-app content feedback

If you submit feedback on content in the app, we store your message, selected category and content reference together with your user ID, submission time, handling status, app version and platform in Google Firestore, so we can correct content errors. For courses, we also store any source reference you provide and the course version, lesson or overview, language and part your report concerns. This includes technical content IDs and versions, block IDs and the lesson content hash. The course context does not include your reflection answers or learning progress. Do not enter patient information or other sensitive personal information in the message or source reference. Feedback is deleted when you delete all your data in settings. Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).

3.12 Server functions and operational logs

When the app calls Firebase Cloud Functions, Google Cloud may record the function name, time, caller IP address, authenticated Firebase user ID, and technical request/error data in operational logs. On iOS and Android, the Functions client may also process an FCM registration token during function calls independently of the app's push toggle; CritCase does not store or use the token for notifications without your consent. This includes server calls for challenges, the leaderboard, data export and erasure, and premium content. The purpose is secure operation, troubleshooting, and abuse prevention. Legal basis: our legitimate interest in secure and reliable operation (GDPR Art. 6(1)(f)). Google acts as processor.

4. Legal basis for processing

We base our data processing on the following legal grounds under GDPR Article 6:

5. Data sharing

5.1 Local data

Data stored only locally is never shared.

5.2 Leaderboard data (optional)

If you choose to participate in the leaderboard, other signed-in users can read your display name, score, level/title, cases completed, best quiz streak, duel wins/total duels, prestige level, self-selected professional role, and Pro status via Google Firestore.

5.3 Challenge data (optional)

If you create or participate in a challenge, your display name, score, number of correct answers, time spent, and question IDs are shared with your opponent via Google Firestore. Only the participants can read the challenge document. Before acceptance, a signed-in user with the valid share code can retrieve the limited data set described in section 3.10.

5.4 Analytics data

If you have consented, we share pseudonymised usage data with Google Firebase Analytics to improve the app. This data is not used for advertising and is not sold to third parties.

5.5 Sign-in providers (Apple / Google)

When you sign in with Apple or Google, the provider processes the sign-in itself as an independent controller, under its own privacy policy. We only receive your email address, optionally your name, and a technical ID – never your password.

5.6 What we DO NOT share

6. International transfers (outside the EEA)

Parts of the processing take place in the USA:

Transfers to Google LLC are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (GDPR Art. 45). For processors that are not DPF-certified, we rely on the European Commission's Standard Contractual Clauses (SCCs, GDPR Art. 46).

You can obtain a copy of the safeguards (the Standard Contractual Clauses) by contacting us at privacy@critcase.app. DPF certifications can be verified at www.dataprivacyframework.gov.

7. Data storage and deletion

7.1 Storage period

Local data is stored on your device for as long as the app is installed. If you are signed in, your account data and the cloud backup of your progress are stored until you delete them or delete your account.

7.2 Data deletion

You can delete all stored data by:

1. Delete everything (recommended): Go to Settings → Privacy & data → «Delete all my data». This starts deletion of local data, the current Firebase installation ID, active cloud data (account, cloud backup, leaderboard, challenges, feedback) and your account in one step. The limited exceptions in section 7.2 apply.
2. Reset game progress: Go to Settings → Privacy & data → «Reset game progress». This requires sign-in and an internet connection and resets points, level, achievements and game history for your account across devices. Course notes, lesson progress and previous duels are kept. It does not delete your account or subscription.
3. Uninstalling: Uninstall the app to delete all local data. Note: if you are signed in, the cloud backup and account remain until you delete them.
4. Without the app installed: Use the deletion page at critcase.app/delete-account-en.html to request deletion without reinstalling the app.

When erasure completes, the active app, subscription, and leaderboard data linked to the account is removed. The pseudonymous erasure safety fence described in section 3.9 is retained with an initial purge date after seven days; daily cleanup and retries after failures can add operational delay. Its deadline is renewed while a linked Firebase account still exists, so we do not automatically delete an account that may still be in use. Residual copies in backups are purged within 180 days (Firebase).

Minimized moderation marker (banned users only): If an account is already subject to a moderation ban when erasure is requested, we delete the moderation reason, nickname and all other user content from the ban record, but retain the controller timestamps bannedAt and purgeAfter under the pseudonymous Firebase user ID. This prevents erasure from acting as a self-service unban while the same user ID can still access the service. Legal basis: our legitimate interest in abuse prevention and preserving an existing moderation decision (GDPR Art. 6(1)(f)). purgeAfter is set to bannedAt + 180 days, so retention after erasure is at most 180 days from the ban and may be shorter. Daily cleanup deletes the minimized marker after that deadline. This exception applies only to banned users.

8. Your rights

Under GDPR, you have the following rights:

9. Children's privacy

CritCase is an educational app aimed at healthcare professionals and students over 18 years of age. We do not knowingly collect data from children under 18.

10. Security

Your data is protected by:

• Your device's built-in security features
• Encrypted local storage (via the operating system's standard mechanisms)
• Secure HTTPS/TLS transmission of network data to the listed service providers
• Cloud access control (Firebase security rules – your account data and progress backup are restricted to your account; data for the shared features (leaderboard, challenges) is visible as described in sections 3.8 and 3.10)

11. Changes to this Privacy Policy

We may update this Privacy Policy. For significant changes, we will:

• Update the «Last updated» date at the top
• Notify via app update where relevant

12. Contact

Do you have questions about privacy or wish to exercise your rights?

Privacy and rights: privacy@critcase.app

General support: support@critcase.app

Norwegian Data Protection Authority (Supervisory Authority):
P.O. Box 458 Sentrum
0105 Oslo, Norway
www.datatilsynet.no

This Privacy Policy applies to the CritCase app distributed via Apple App Store and Google Play Store.