This is a translation for your convenience. The German version is the binding one.
The controller is Walch Enterprises GmbH, Zollernstraße 27, 52070 Aachen, Germany (phone +49 241 565 206 92, info@walch-enterprises.de). This privacy policy covers the Cube Trainer in the browser (cube.walch-enterprises.de) and as an Android app. For our other services see the privacy policy of Walch Enterprises GmbH (in German).
The Cube Trainer uses no advertising, no analytics or tracking services and no AI-based evaluation. It loads no content from third parties; we pass data only to the service providers named below and to Google (purchase through Google Play). No automated decision-making within the meaning of Art. 22 GDPR takes place.
You sign in with a link we send to your e-mail address (valid for 24 hours); if you requested it yourself, the e-mail also contains a six-digit code that only works in that browser. There is no password. For your account we process your e-mail address, an optional display name, the app's language (so that our e-mails reach you in that language), when the account was created and when you last signed in, and your licence or the end of a trial.
For every signed-in session we store the browser identification (user agent) and the time of last use. This lets the app show you under “Signed-in devices” where you are signed in, and enforces the licence term that an account can be used on up to three devices at the same time: a fourth sign-in signs out the device unused for the longest time. For the same purpose we count an account's sign-ins over the last 30 days.
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Log. We log sign-ins, requests for a sign-in link (even if no account exists for that address) and actions on an account with e-mail address, time and kind of action – such as a change of name with the new name, a purchase with the order number, sharing a solve or deleting the account. This serves the security of the service, the prevention of abuse and as proof of a deletion (Art. 6(1)(f) GDPR); the log is deleted after 90 days.
Your practice data – times and moves of your solves, results from “Practice”, statistics, lesson progress, your own algorithms and flash cards, and “My cubes” (the names you give, a cube's Bluetooth name and brand, and which cube belongs to which time) – is stored by the app in your device's browser and synchronised with your account so that it is available on all your devices and survives a change of device (Art. 6(1)(b) GDPR).
If you delete practice data in the app, we delete it in your account at the next sync; only a deletion marker without content remains (kind and identifier of the entry, time) so that your other devices take over the deletion. It is deleted together with the account. When you sign out, the app removes the practice data from the device.
The connection to the smart cube runs over Bluetooth directly between cube and device. What the cube reports – moves, state, motion sensor, battery level, firmware – is evaluated by the app on your device; of this only the moves of a solve are stored (see 2). We store your cube's Bluetooth address (MAC address) and Bluetooth name in your account: the address is needed to decrypt the cube's data and is used on your other devices as well. You can delete it in the app at any time (Menu → More → Cube & connection → My cubes). Legal basis: Art. 6(1)(b) GDPR.
In the Android app, Android asks for the “Nearby devices” permission, up to Android 11 for “Location” – Android requires this for every Bluetooth search. Your location is not determined. The app uses it to search briefly for your cube and read its address; other devices visible during the search are neither stored nor transmitted.
If you scan a cube with the camera, the app processes the camera image exclusively on your device: the colours of the nine facelets are read from each image, the image itself is neither stored nor transmitted to us. The colours can also be entered by hand.
If you connect a timer mat by cable (StackMat and clones), the app reads its signal through the microphone input of your device – exclusively on your device and only while the mat is connected: the displayed time is read from the signal, the sound is neither recorded nor stored nor transmitted to us.
You grant access to camera and microphone yourself in your browser or in Android and can revoke it there at any time.
If you buy the full version in the Android app, Google Play handles the payment; we receive no payment data. We receive a purchase identifier, the order number, the time of purchase and whether it was a test purchase, and ask Google whether the purchase is paid, refunded or cancelled. We store this in your account for as long as it exists, to unlock the full version and to withdraw it after a refund (Art. 6(1)(b) GDPR). At every start the Android app asks Google Play which purchases belong to your Google account and reports them to our server – so a purchase survives a reinstallation. The payment is subject to the terms and privacy policy of Google, which is responsible for it itself.
The Android app shows the Cube Trainer in Google Chrome (or another browser on your device); that browser's own data processing is subject to its provider's privacy policy.
If you pass on a solve as a link via “Share”, we store that one solve – move sequence, times, scramble, starting position, date of the solve and whether it was done with a smart cube or the simulator – together with your display name at the time of sharing. The page can be read by anyone who knows the link; it contains neither your e-mail address nor details of your cube. “Revoke sharing” deletes it at any time (caches may still deliver it for up to five minutes), and it is deleted together with your account. Legal basis: Art. 6(1)(b) GDPR.
If you write to us via “Support” in the app, we store your message with your account's e-mail address, the app version and the browser identification. If “Attach the connection log” is ticked (preset, you can untick it), we also receive: whether you use the Android app or a browser and the screen size, name, kind, Bluetooth address and firmware of the connected cube, the connection steps, motion-sensor messages, error messages and the steps of a purchase through Google Play – no other devices. The legal basis is Art. 6(1)(b) GDPR (handling your request).
The message is deleted after 90 days. We only receive a notice of it by e-mail, without your message and without your address. We answer by e-mail; e-mails we exchange with you are kept as business letters for up to six years (§ 257 HGB, § 147 AO).
Sign-in, reminder and notice e-mails are sent via Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). If that service is disrupted, delivery falls back to our hosting provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Both process the data solely on our behalf (Art. 28 GDPR). Access by Microsoft from the USA cannot be ruled out; Microsoft is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), and the European Commission's standard contractual clauses apply in addition. Our e-mails load the app icon from our server; if you open an e-mail, this request is logged as described under 9.
The Cube Trainer runs on our server at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in a data centre in Germany; Hetzner processes the data solely on our behalf (Art. 28 GDPR).
With every request the server automatically stores access data in a log file: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page and the browser identification. It serves to ensure trouble-free and secure operation (Art. 6(1)(f) GDPR), is not evaluated to recognise visitors and is deleted after 14 days. To prevent abuse we also limit the number of sign-in attempts per IP address; for this the IP address is kept in memory for at most one hour.
We back up the Cube Trainer's data daily: on the server and encrypted in cloud storage (Microsoft OneDrive, provider as under 8); only we hold the key. In addition, the hosting provider backs up the entire server. Deleted data remains in these backups for up to twelve months and is then deleted; we restore it from a backup only after an outage (Art. 6(1)(f), Art. 32 GDPR).
After sign-in we set a session cookie (one year from last use). When you request a sign-in link, we also set a cookie holding a random identifier (one year): if you open the link in the same browser, it signs you in without asking again, and the code from the e-mail only works there. In your browser's storage the app keeps the program files for starting without a network, your settings, a working copy of your practice data, the addresses of your cubes and your account details for use without a connection (14 days). Both are technically required for the service (§ 25(2) no. 2 TDDDG). When you sign out, the app removes account details, practice data and cube addresses from the device; you can also delete everything at any time via your browser settings (the data in your account is not affected).
You can delete your account yourself at any time (in the app under Menu → More → Danger zone → “Delete account …”) or request its deletion by e-mail to info@walch-enterprises.de. Details: Delete account and Delete data, keep the account.
The Cube Trainer is intended for users aged 13 and over. Anyone under 16 (in Austria: 14) needs their parents' consent.
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction (Art. 18 GDPR), data portability (Art. 20 GDPR) and to lodge a complaint with a supervisory authority, for example the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. If you have questions, contact info@walch-enterprises.de.
Right to object: where we process data to protect legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time with effect for the future on grounds relating to your particular situation (Art. 21 GDPR).
Providing your data is neither a legal nor a contractual requirement. Without an e-mail address you cannot create an account and cannot use the Cube Trainer.
Last updated: 9 October 2026
Imprint (German) · Licence terms