We open soon.

GENERAL TERMS AND CONDITIONS

1. Provider and scope
These General Terms and Conditions apply to contracts concluded through the online store of:

back to ctrl
Owner: Manuel Schmidt
Mollstraße 13
68165 Mannheim
Germany
Email: hello@backtoctrl.com
VAT ID: DE354757355

The offer is intended for consumers. A consumer is any natural person who enters into a legal transaction for purposes that are predominantly outside their trade, business or profession.

2. Conclusion of the contract
The presentation of products in the online store does not constitute a binding offer to enter into a contract. You can place the product in your shopping cart and review and correct your entries before submitting the order.

By clicking the order button that clearly indicates an obligation to pay, you submit a binding offer to purchase the goods contained in the shopping cart. The contract is concluded when we accept your order by sending an order confirmation by email or confirm the payment. The order details and these terms will be provided to you electronically.

3. Pre-order of the ctrl key
Before the first deliveries begin, the ctrl key is offered as a paid pre-order. Payment is collected in full at checkout.

Dispatch of pre-ordered goods is scheduled to begin on 15 October 2026. Any transit time stated at checkout or on the product page begins when the goods are handed over to the shipping provider. If the planned dispatch date changes significantly, we will notify you using the email address provided with your order.

Until your order is fulfilled, you can request cancellation through your customer account at https://account.backtoctrl.com or by email to hello@backtoctrl.com. If the cancellation is effective, the amount already paid will be refunded to the original payment method. Your statutory right of withdrawal remains unaffected.

The Founder Edition is limited to a total of 1,000 ctrl keys. The available inventory shown in the store is decisive.

4. Prices and shipping costs
All prices stated in the store are total prices in euros and include statutory VAT. Standard shipping within Germany is free of charge. The information displayed at checkout is decisive for the respective order.

5. Payment
The available payment methods are displayed at checkout. Unless otherwise stated for the respective payment method, the full invoice amount is due and collected when the order is completed. Payment processing may be carried out by the payment service providers named at checkout.

6. Delivery
Sales are currently limited to delivery addresses in Germany. Delivery is made to the address entered at checkout. Partial deliveries are permitted where reasonable for you and where they do not result in additional shipping costs.

7. Retention of title
The delivered goods remain our property until payment has been made in full.

8. Right of withdrawal and voluntary return policy
Consumers have a statutory right of withdrawal. Details are provided in our separate cancellation policy.

In addition, we grant a voluntary return period of 30 days from receipt of the goods. Returns after the statutory withdrawal period are subject to the additional requirements set out in the cancellation and returns policy. The voluntary return policy does not limit either the statutory right of withdrawal or statutory warranty rights.

Return and cancellation requests can be submitted electronically at https://account.backtoctrl.com.

9. Rights in the event of defects
The statutory rights relating to defects apply. If a product is defective, please contact us at hello@backtoctrl.com. Statutory claims are not limited by any additional manufacturer's warranty or by the voluntary return policy.

10. Liability
We are liable without limitation for intent and gross negligence and for damage arising from injury to life, limb or health. In the event of a slightly negligent breach of material contractual obligations, liability is limited to the foreseeable damage typical for the contract at the time the contract was concluded. Mandatory statutory liability, in particular under the German Product Liability Act, remains unaffected.

11. Contract language and applicable law
The contract language is German. German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods. If you are a consumer whose habitual residence is in another country, mandatory consumer-protection provisions of that country remain unaffected.

12. Contact
Please send questions about orders, returns or these terms to:

back to ctrl
Owner: Manuel Schmidt
Mollstraße 13
68165 Mannheim
Germany
Email: hello@backtoctrl.com

Last updated: 3 September 2026

1. Controller and scope

back to ctrl · Owner: Manuel Schmidt
Mollstraße 13, 68165 Mannheim, Germany
Email: hello@backtoctrl.com

This notice covers our Shopify online store at backtoctrl.com, our communications with you and, separately in section 7, the ctrl app. Using analytics and advertising technologies in the online store does not mean that these technologies are also used in the iPhone app.

2. Key points and your choices

We process data to provide the store, respond to enquiries and fulfil orders. We use optional analytics and advertising cookies and personalised advertising with your corresponding consent. You can reject them and still shop. Section 6.4 explains Google's consent mode and possible signals without cookies. Newsletter registration is a separate consent.

You can accept or reject optional cookies or adjust your choices in the cookie banner. Use “Cookie settings” at the bottom of the page to change or withdraw consent at any time for the future. Withdrawal does not affect the lawfulness of earlier processing. Alternatively, contact hello@backtoctrl.com.

Section 25(1) of the German TDDDG applies to non-essential storage of information on, or access to information on, your device; Article 6(1)(a) GDPR applies to the subsequent processing of personal data. Strictly necessary functions, such as the shopping cart, security and storing your privacy choices, rely on section 25(2) TDDDG and, depending on the purpose, Article 6(1)(b), (c) or (f) GDPR. Placing an order or simply using this website does not constitute advertising consent.

3. Shopify, store operation and technical data

Our online store runs on Shopify. Our service provider is Shopify International Limited, Ireland. Shopify processes information such as IP addresses, browser and device data, pages visited, timestamps, cart, account and order data to deliver the store, enable payments and orders and prevent abuse. The legal bases are performance of a contract or pre-contractual steps and our legitimate interest in a secure, reliable store (Article 6(1)(b) and (f) GDPR).

Shopify acts in part as our processor. The enabled Shopify Network Intelligence feature can also combine interactions with our store, other stores and Shopify to improve services, personalisation and advertising. Where Shopify acts for its own purposes, Shopify is independently responsible. Required consent for optional purposes is collected through the privacy choices. Details, recipients and your rights with Shopify are described in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Our store lists the EU as its data hosting location. This does not mean all processing takes place exclusively in the EU. Shopify and its service providers may also process data in other countries; see section 6.5.

3.1 Form protection with hCaptcha

To protect our shop forms from automated sign-ups and spam, we use Shopify's integrated hCaptcha service from Intuition Machines, Inc., USA. The service evaluates technical connection data and form interactions to distinguish human use from automated access. This can include IP addresses, browser and device information, and mouse, keyboard or touch interactions. Processing in the USA is possible. Form protection does not constitute consent to advertising. Further information about the provider and its transfer safeguards is available in the hCaptcha privacy notice. This security processing is separate from the optional analytics and advertising described in section 6.

4. Newsletter and launch updates

If you register for updates using a store form, we process your email address and evidence of registration to send the requested messages. Registration is collected through Shopify and confirmed by double opt-in. The legal basis is consent (Article 6(1)(a) GDPR). You can unsubscribe using the link in the messages or by emailing us. After unsubscribing, we stop using the address for this marketing; necessary evidence and a suppression record may be retained to meet legal requirements or respect your objection.

We use Shopify Messaging to send and analyse these messages. In particular, it provides delivery, click and unsubscribe statistics. Additional email-open measurement is configured so that Shopify asks for separate consent through the email footer. Newsletter consent does not automatically constitute consent to open measurement; delivery and click statistics are separate functions. Sections 3 and 6.5 explain processing by Shopify and international transfers.

5. Contact, customer accounts, orders and payment

For enquiries, we process your contact details and message to respond. For orders, including paid pre-orders, we process your name, email, billing and delivery addresses, items, quantities, prices, payment status and, where relevant, phone number and return or cancellation information. An optional customer account provides access to orders and account features. Required order information must be supplied so we can perform the contract; an account and advertising consent are not generally necessary.

The legal bases are Article 6(1)(b) GDPR for contract performance, (c) for legal obligations and (f) for general enquiries, security and establishing or defending claims. We do not store full payment card details ourselves. Depending on the selected payment method, Shopify Payments and its payment partners or PayPal process payment data. Their privacy information also applies: Shopify, Stripe and PayPal.

For warehousing, shipping and returns, we share necessary order and delivery information with our fulfilment provider HIVE and the appointed carriers. Data may also be shared with technical providers, bookkeeping and tax advisers or authorities where necessary for the relevant purpose or to meet legal obligations.

We retain contract and communication data only for as long as needed for these purposes. Invoices, accounting and business records are subject to statutory retention periods depending on the document. Outstanding claims or legal obligations may require continued retention.

6. Analytics, advertising measurement and international transfers

6.1 Google Analytics 4

With your analytics consent, we use Google Analytics 4 through Shopify's Google & YouTube app. The provider is Google Ireland Limited, Ireland. Events can include page and product views, cart and checkout actions and purchases with items, value and currency. Data also includes pseudonymous identifiers, device and browser information, technical connection data and information about how you reached our store. We use reports to understand visits and sales and improve the store.

The GA4 property currently retains event data for two months and user data for 14 months. New activity can reset the user-data retention period; aggregated reports are not necessarily subject to the same periods. Google Signals is disabled. For details, see How Google uses data from partner sites and the Google Privacy Policy.

6.2 Google Ads

Google Ads is connected to our store through the Google & YouTube app. With your marketing consent, Google can use advertising click identifiers and store events to determine whether an ad led to a cart, checkout or purchase. This can include an order identifier, value and currency. Enhanced conversion matching through transmission of hashed email addresses or phone numbers and Customer Match are disabled in the setup described here.

6.3 Meta Pixel, advanced matching and Conversions API for Facebook and Instagram

To measure and improve our Facebook and Instagram advertising, we use the official Shopify “Facebook & Instagram” channel with the “Maximum” data-sharing level. This includes the browser-based Meta Pixel, advanced matching and the Conversions API for server-side transmission by Shopify. The provider is Meta Platforms Ireland Limited, Ireland.

With your marketing consent, page and product views, searches, cart, checkout and purchase events may be sent to Meta. The data may include visited and referring URLs, timestamps and event identifiers, product identifiers and quantities, order or event references, purchase value and currency, as well as advertising click, cookie and browser identifiers, IP address and browser or device information. For orders or other interactions supported by the integration, available contact details may also be used for matching: name, email address, phone number and address. We do not require additional information solely for advertising purposes.

Contact details for which Meta specifies hashed transmission for advanced matching are converted into hash values before transmission. Hashing is pseudonymisation, not anonymisation: Meta can match corresponding hashes to its user records. Technical data such as IP addresses and browser information are not automatically anonymised by this process. The Conversions API sends the relevant event and matching data directly between Shopify and Meta; it does not permit us to bypass rejected or withdrawn marketing consent.

We use this data to attribute purchases to ads, measure reach and performance, optimise advertising campaigns, reach interested visitors again and create relevant or similar audiences. Meta may link the information to your Facebook or Instagram account and other information it holds, and use it for advertising measurement and personalisation. Processing and transmission for these optional marketing purposes are based on your consent (Article 6(1)(a) GDPR); non-essential storage or access on your device additionally relies on section 25(1) of the German TDDDG.

Joint controllership applies to the collection and transmission of event data within the scope of the Meta Controller Addendum. Meta's subsequent processing follows its own purposes and terms. Details of responsibilities, retention, international transfers and your rights are in the Meta Privacy Policy and Meta Cookies Policy; section 6.5 also explains transfers outside the EEA.

You can reject marketing or withdraw your consent for the future through “Cookie settings” at the bottom of the page, and additionally manage your activity off Meta technologies. Withdrawal does not automatically erase data already transmitted; you can contact us or Meta to exercise your privacy rights. Shopify and Meta may technically develop the “Maximum” level further; new purposes or data uses require the relevant information and, where necessary, fresh consent.

This integration concerns only the online store. Screen Time, health and other usage data from the ctrl app, passwords and full payment card details are not provided for Meta advertising through this setup. This does not set up a separate upload of existing customer lists or independent tracking within the ctrl app.

6.4 Consent and retention

The Google & YouTube app uses Google Consent Mode to communicate your consent choices to Google and adapt how Google tags behave. Rejecting optional cookies does not necessarily prevent every connection to Google: in advanced consent mode, so-called cookieless signals can be transmitted without analytics or advertising cookies, such as consent status, page or event signals, timestamps, browser information and the referring page. Google may use these signals for statistical modelling. “Without cookies” does not automatically mean “anonymous”. Google provides further details in About consent mode.

Shopify manages your choices through its Customer Privacy API and passes them to connected services. Analytics and marketing consent can be selected separately. Missing or withdrawn consent must not be bypassed by manually installed trackers. Depending on the technology, cookies last for the session or for a limited period or until removed in your browser. Provider information on durations is available here: Shopify cookies, Google cookies and Meta cookies. Deleting browser cookies does not automatically delete information already stored by a provider.

6.5 Recipients outside the EEA

Shopify, Google and Meta may transfer data to affiliates and service providers outside the European Economic Area, particularly the USA. Where applicable, transfers rely on European Commission adequacy decisions or standard contractual clauses with supplementary safeguards. The EU-US Data Privacy Framework applies only to certified recipients and covered processing. The provider information linked above explains the relevant safeguards. You can contact us for further information or a copy of applicable safeguards.

7. The ctrl app (iPhone)

This section applies to our iOS app “ctrl”. It is built so that as little as possible leaves the device.

7.1 Local data and optional account sync

Your screen time data from Apple's Screen Time (which app and for how long), your selection of blocked apps and websites, health data from Apple Health (heart rate, heart rate variability, steps) and an optional profile picture are processed locally on your iPhone and are not transferred to us. Modes, schedules and lock settings are also used locally; when account sync is enabled, the settings and totals described in section 7.3 are additionally synced with your account. Your selection of specific apps and the underlying screen time and health data are excluded from this sync.

7.2 Account (voluntary)

The app's lock function works without an account. You can create an account for friend functions (“Connect”), family and to secure your successes. Depending on the method you choose, we process: email address and password (as a hash value), telephone number, your display name and an identifier from Apple or Google if you use it to log in. The legal basis is the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR).

When you register with your phone number, we will send you an SMS with a confirmation code via the service provider seven.io (seven communications GmbH & Co. KG, Germany) as the processor. When you register with Google, registration codes are exchanged with Google; No usage data is transferred. When you use “Sign in with Apple,” Apple’s privacy policy applies.

7.3 What is transferred with account

With an active account, the app transmits to our server: your locked status (whether it is currently locked or not) for the display of "how many are currently in ctrl" and for the time spent with friends, as well as a device identification token from Apple if you have allowed notifications.

When "Sync with account" is enabled, the following data is also transferred: your streak, your wins, your ctrl time for today and this week as well as a weekly score calculated from this (a value between 0 and 100). Also your settings so that a new device picks up where you left off: your modes (name, icon, strictness, time window), schedules, sleep mode, alarm times and display settings. The underlying screen time and health data as well as the selection of which specific apps a mode blocks are not transferred: This selection is only stored on your device as an anonymous Apple token; We also cannot tell from this which apps you have chosen.

Further transfers only take place if you actively use the respective function: progress in challenges that you have joined; your visibility settings per friend; a self-selected pseudonym when you join the public list; the locked state for the device network if you pair several of your own devices.

7.4 Find friends from contacts (voluntary)

If you use this function, the phone numbers from your address book will be converted on your device into non-recalculable check values (SHA-256 hashes). Only these test values ​​are transferred and compared with the test values ​​of other users. Your contacts' names and phone numbers don't leave your device; Non-hits are not saved. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR); you can skip this step and switch off the function at any time.

7.5 Family and children's devices

If you set up a family, we process the membership of the members, their role (parent or child) and the management status of a paired child device so that agreed blocking times can take effect. A child’s device is specifically set up by a legal guardian. The legal basis is the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR) and the consent of the legal guardian (Art. 8 GDPR).

7.6 Purchases in the app

The "ctrl club" subscription is processed exclusively via Apple's in-app purchase. Apple processes your payment data; we don't receive them. We only store whether there is an active subscription.

7.7 Where the data is located

Our app servers are located in Germany (Hetzner Online GmbH, Nuremberg data center). There is no transfer to third countries, with the exception of the above-mentioned registration services from Apple and Google and Apple's purchase processing.

7.8 Delete

You can delete your account at any time directly in the app (System → Account → Delete account). This will remove your account and synchronization information from our servers. Your local settings remain on the device and disappear when you delete the app.

7.9 No tracking, no advertising

The app contains no advertising networks, no third-party analysis services and no cross-device tracking. No advertising identifier (IDFA) is used; therefore no tracking query appears.

8. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing at any time. You may withdraw consent at any time for the future.

Contact hello@backtoctrl.com to exercise your rights. You may also complain to a data protection supervisory authority, particularly where you live or work or where an alleged infringement occurred. In Baden-Württemberg, the responsible authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

9. Automated decisions

We do not make solely automated decisions within the meaning of Article 22 GDPR that have legal or similarly significant effects on you. The advertising measurement and personalisation described in section 6 may nevertheless involve providers automatically evaluating interests. This is not the same as a decision under Article 22 GDPR.

10. Updates

We update this notice when services, processing or legal requirements change. Changes to optional purposes do not replace required consent. The website, checkout and English version use the same Shopify privacy-policy resource.

Information pursuant to Section 5 of the German Digital Services Act (DDG)

back to ctrl
Owner: Manuel Schmidt
Mollstraße 13
68165 Mannheim
Germany

Contact
Email: hello@backtoctrl.com
Phone: +49 176 72867250

VAT identification number pursuant to Section 27a of the German VAT Act:
DE354757355