Privacy Policy

Last updated: October 6, 2026

H2 Kiosk Lock App

H2 Kiosk Lock ("we", "our", or "the app") is developed by H2-AI GmbH. This privacy policy explains how we handle your data.

Controller

H2-AI GmbH
Amselrain 43
75038 Oberderdingen, Germany
Email: info@h2-ai.de

1. Summary

The kiosk itself runs entirely on your device. Your PIN, your settings and your selected apps never leave it.

Since version 1.1.0, Premium is sold as a license for one device. To manage this license, the app contacts our own license server in Germany: once after installation, to check whether this device already has a license (so a license you bought comes back by itself, for example after reinstalling the app), when you buy a device license, regularly while a license is stored on the device, and when you ask the app to restore a license. It then sends a pseudonymous device ID (a one-way hash, not your Android ID itself) and, after a purchase, the Google Play purchase receipt. If you only use the free demo, the app sends the pseudonymous device ID to us once, for that check after installation, and nothing after that. We do not receive your name, your email address, your Google account or your payment details. We use no analytics, no advertising and no crash reporting.

Since version 1.1.1, you can enter a creator code before buying. To check it, the app sends only the code to our server, without any device ID (section 3.7). Business customers can also obtain device licenses directly from us instead of through Google Play (section 3.8).

If you bought Premium before version 1.1.0, nothing changes for you: that purchase is checked by Google Play on your device, as before, and is not sent to our server. Once the app has recognised that purchase on the device, it also skips the check after installation.

2. Data stored only on your device

• PIN: stored as a salted hash (PBKDF2), never in readable form
• Settings: stored locally using Android DataStore
• Selected apps: stored locally on your device
• If you bought a device license: the license for this device as a file signed by our server, so Premium keeps working offline, and, until the license is confirmed, the Google Play purchase receipt
• If you bought with a creator code: the code, until the purchase has been registered with our server

The app is excluded from Android's cloud backup, so none of this is copied into a Google backup.

3. Device license and our license server

3.1 When the app contacts our server

• Once after the app is installed: when the app starts and no license is stored on the device, it asks our server whether this device has a license, so that a license bought for this device comes back without you having to do anything, for example after reinstalling the app. This check waits until the device is online. Once our server has answered (license found or no license), the app does not repeat this automatic check. If there was no answer, for example because the device was offline or our server could not be reached, the app tries again the next time it starts.
• Right after you buy a device license, to register the purchase. This also applies to a device license you got with a promo code redeemed in the Google Play Store: the app registers it the next time it checks your purchases with Google Play. Such a purchase carries no device ID, so it is assigned to the first device of your Google account that registers it and does not have a license yet.
• About once a day while a license is stored on the device and the device is online, to renew it. Without a connection, Premium keeps working for up to 30 days from the last successful check; after 20 days the app reminds you to connect.
• When you tap "Restore license", for example if the automatic check could not reach our server.
• When you enter a creator code and tap "Apply", to check the code. This request contains only the code and the name of the app, no device ID (section 3.7).

The app does not contact the license server in any other situation. If you never buy a device license, the app sends the pseudonymous device ID to us only for the one automatic check after installation. Showing the device ID in the settings ("Show device ID") works on the device only and sends nothing.

3.2 What is sent

• Device ID: a SHA-256 hash of Android's device ID (ANDROID_ID) combined with a fixed value specific to this app. Our server never receives the Android ID itself. The value stays the same when you reinstall the app and changes after a factory reset.
• Purchase receipt, only when a purchase is registered: the purchase token that Google Play gives the app, and the ID of the product bought.
• The name of the app ("kiosk").
• Creator code, only if you entered one: when the code is checked, and again together with the purchase receipt when the purchase is registered.

When our server receives a purchase token, it asks Google Play to confirm the purchase and receives from Google the order number, the quantity, the purchase state, whether it was a test purchase, the device ID that the app passed to Google Play when you bought (section 4), the time of the purchase and, if you bought at a discount, which discount offer was used. It stores the device ID, the purchase token, the product ID, the order number, the quantity, whether it was a test purchase, whether the purchase has been consumed, and the time of registration. For each license it keeps a license ID, the device it is bound to and when it was bound, withdrawn or moved, and a log of these events. It then marks the purchase as consumed at Google Play. Our server also regularly fetches from Google Play the list of refunded purchases of this app (purchase token, order number, time, quantity, reason) and keeps it, so that a refunded purchase cannot become a license.

The license the server sends back contains the device ID, the license ID and how long it is valid, and is signed by our server. It is stored on your device (section 2).

3.3 Why, and on which legal basis

• To confirm that a purchase is genuine and bind it to the device it was bought on, and to renew and restore the license (performance of the contract, Art. 6(1)(b) GDPR).
• To give a license back to the device it was bought for without you having to ask, through the automatic check after installation (section 3.1). If the device has a license, this serves the contract (Art. 6(1)(b) GDPR). If it has none, the check is based on our legitimate interest in returning licenses to our customers automatically and in not offering a second purchase for a device that is already licensed (Art. 6(1)(f) GDPR). The answer "no license" is not stored on our server (section 3.5).
• To stop misuse: a purchase can only be registered once and only for the device it was bought on, and a license is withdrawn when Google Play reports that the purchase was refunded (legitimate interest in preventing fraud, Art. 6(1)(f) GDPR).
• To move a license to the same device after a factory reset, if you ask us to (Art. 6(1)(b) GDPR).
• To check a creator code and to count a purchase made with it for the creator who handed out the code, so that we can pay the creator for the purchases made with their code (legitimate interest in working with creators and settling their commission, Art. 6(1)(f) GDPR; section 3.7).
• Reading the Android device ID on your device is only done in the situations listed in 3.1, and when you tap "Show device ID" in the settings. The device license is bound to the device, and in our view recognising the device, including restoring a license bought for it after a reinstallation, is strictly necessary to provide the licensed kiosk service you use (Section 25(2) no. 2 of the German TDDDG). The device ID is used for nothing else.

3.4 Server logs

Our license server receives your device's IP address with each request. The web server writes it to its access log together with the time, the requested address, the response code and the technical identification that Android sends with each request (Android version, device model and build number). The access log is deleted after at most 15 days. This also applies to the automatic check after installation; the access log does not contain the device ID. We use it only to operate the server and to fend off attacks; we do not use it to determine your location and do not combine it with the license data. To limit abuse, the server also counts requests per IP address for one minute, in memory only. The license service itself writes no access log and never logs device IDs, purchase tokens or order numbers.

3.5 How long we keep it

• Records of a license that can still be used are kept as long as the license exists.
• Records of refunded or withdrawn licenses are deleted 12 months after the last withdrawal; they are kept that long so that the same purchase cannot be registered again.
• Entries in the event log, and refunds reported by Google for purchases that were never registered, are deleted after 12 months.
• A check that finds no license, such as the automatic check on a device without a license, is not stored in our database; only the access log entry remains (section 3.4).
• The link between a purchase and the creator code it was made with is kept as long as the purchase record and deleted together with it.
• Checking a creator code is not stored in our database; only the access log entry remains (section 3.4).
• Licenses we grant directly to business customers (section 3.8) are kept and deleted like licenses bought through Google Play.
• Encrypted backups of the license database are kept for 30 days, server access logs for at most 15 days.

Deletion runs automatically once a day.

3.6 Where

The license server runs on a server rented from Hetzner Online GmbH in Germany, which processes the data on our behalf under a data processing agreement. Encrypted backups (GPG) are made every night and stored on our own file server, operated by H2-AI GmbH in Germany. All connections between the app and the license server use HTTPS.

3.7 Creator codes

Creators (for example video makers who present the app) can hand out a code that unlocks a discount at Google Play. Entering a code is optional. When you tap "Apply", the app sends the code and the name of the app to our server; our server only answers whether the code can be used and which discount offer belongs to it. This check sends no device ID and is not stored in our database. If you then buy, Google Play processes the purchase with that discount offer, and the app sends the code to our server together with the purchase receipt (section 3.2). Our server counts the purchase for the creator only if Google Play confirms that it was made with the creator's discount offer. It stores which purchase was made with which code. You get your license whether or not the purchase is counted.

We use this only to settle the creator's commission. The creator receives from us only the number of purchases made with their code (including how many were refunded); never your device ID, order number or other information about you.

3.8 Licenses bought directly from us (business customers)

Business customers can obtain device licenses directly from H2-AI GmbH instead of through Google Play. The customer sends us the device ID of each device (shown in the app's settings) and, if they wish, a name for each device. On our license server we then store, for each device, the device ID, a license bound to it, our invoice or order reference and the device name as a note. The device then receives its license in the usual way (section 3.1); no purchase in the app is needed. We use these data to provide the licenses and to move them to another device on request (performance of the contract, Art. 6(1)(b) GDPR).

The order itself (contact details, invoice and payment data) is not stored on the license server but in our accounting records. We keep these records as long as German commercial and tax law requires (Section 257 HGB, Section 147 AO; currently up to 10 years, for invoices 8 years) (legal obligation, Art. 6(1)(c) GDPR).

3.9 Support requests by email

If you tap "Email support" in the app (for example to move a license after a factory reset), the app opens your email app with a prepared message to info@h2-ai.de that contains the app name, the package name, the app version and the device ID of this device. Nothing is sent by the app itself: you decide whether to send the email and can change it before sending. If you write to us, we use your email address, your message and the details it contains (such as device ID and order number) to answer your request and, where requested, to move your license (Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR). We delete the email once the request is settled, unless we have to keep it under commercial or tax law.

4. In-app purchases

Purchases are processed by Google Play. We never see your payment details, your name or your Google account. When you buy a device license, the app passes the pseudonymous device ID from section 3.2 to Google Play as part of the purchase, so the purchase can be linked to this device; Google Play may also use this value to detect irregular purchase activity. Google handles purchase and payment data under its own privacy policy: https://policies.google.com/privacy

5. Who receives data

• Hetzner Online GmbH, Germany: hosting of the license server, as our processor.
• Google (Google Play): processes your purchase as the payment service and confirms purchases and refunds to our server.
• Creators: only the number of purchases made with their code, no personal data (section 3.7).
• Business customers who buy directly from us: a tax advisor (if we engage one) and our accounting software provider receive the order and invoice data as far as needed for accounting; the payment service you choose processes your payment under its own privacy policy (section 3.8).
• Nobody else. We do not sell data and do not share it for advertising.

6. Your rights and how to delete your data

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15-18, 20, 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

To request deletion or a copy of the license data we hold, email info@h2-ai.de. Please give the Google Play order number (it starts with "GPA." and is in the receipt email from Google Play), the device ID, or both; for a license bought directly from us, our invoice or order reference. The app shows the device ID in its settings under "Device ID (for license support)": tap "Show device ID", then "Copy". We answer within one month.

• With the order number (or our invoice or order reference), we delete the purchase with all its licenses, refunds, log entries and its link to a creator code. The license ends and cannot be restored.
• With the device ID only, we end the license on that device and remove the device ID from all our records. The purchase itself stays recorded without the device ID, so that the same purchase cannot be registered again.

Copies in encrypted backups disappear within 30 days. Google Play keeps its own records of the purchase.

To remove everything stored on the device, uninstall the app or clear its storage in Android's app settings.

7. Permissions

H2 Kiosk Lock requires certain permissions to function:

• Accessibility Service: used only to keep the kiosk locked while kiosk mode is running. It detects which app or system window comes to the front and puts the kiosk back, blocks the Home, Back and Recents keys, counts Volume Up presses for the exit gesture, and closes the power menu if that option is switched on. To recognise the power menu and other system windows, it looks at the titles and button labels of these system windows at the moment they open. Of other apps it only uses which app is in front. It does not collect, store or transmit any screen content.
• Display Over Other Apps: required to show the kiosk overlay
• Usage Access: used to check which app is in the foreground, to keep the kiosk locked
• List of installed apps: so you can choose which apps are allowed in the kiosk. The list stays on the device.
• Boot Completed: optional, to auto-start kiosk mode after device restart
• Internet: for Google Play purchases and the license server described above

These permissions are used solely for kiosk functionality and the license, not for data collection.

8. Third-party services

The app uses two Google Play components: Google Play Billing for in-app purchases, and the Google Play In-App Review API, which lets Google Play show its own rating dialog. Both are operated by Google under Google's privacy policy. Our license server uses the Google Play Developer API to confirm purchases and refunds (section 3.2). No other third-party services are integrated. There is no advertising, analytics or crash reporting SDK in the app.

9. Children's Privacy

H2 Kiosk Lock is not directed at children under 13. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.

11. Contact

If you have questions about this privacy policy, contact us at:

H2-AI GmbH
Amselrain 43
75038 Oberderdingen, Germany
Email: info@h2-ai.de