Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

Tim Konrath
Straßburger Str. 43
10405 Berlin
Germany
Email: support@re-ember.de

2. Overview and data-minimisation principle

Re:Ember is deliberately designed to process as little personal data as possible. There are no user accounts, no email registration, no advertising SDKs and no cross-app or cross-site tracking. On the website, we use the self-hosted, cookieless analytics software Umami to understand how the site is used, without processing any personal data (see Section 9).

All content you enter into the app primarily stays local on your device. Only if you actively create or join a so-called “Gift Space” are the associated messages transmitted to our servers so that other participants can receive them.

3. What data we process

a) Locally on your device (not transmitted to us): messages (“Embers”), author names, your favourite markers, app settings, and a randomly generated device ID (UUID). This data is stored exclusively in the local database of the app (SwiftData on iOS, Room on Android) and only leaves your device in the cases described under b).

b) In Gift Spaces (stored on our server): when you create or join a Gift Space, the messages placed in that space, the author name you entered, timestamps, the randomly generated space codes (e.g. “C-ABC123” for contributors, “R-XYZ789” for the recipient) and your device ID (UUID) are stored in our database at Supabase (EU region). We do not collect your real name or your email address in this process.

c) Technically necessary data for web contributions: if someone contributes an Ember to a Gift Space via the website (not the app), the sender’s IP address is processed briefly, hashed with a server-side salt using SHA-256, and stored only in that hashed form for a maximum of 48 hours. This serves exclusively to prevent abuse and bulk spam (rate limiting of 10 contributions per space and IP per 24 hours). The original IP address is not stored.

d) Server logs: at the hosting provider Vercel, technical access data (e.g. request time, user agent, HTTP status code) as is customary for the secure operation and troubleshooting of a web application may be recorded briefly. This data is not combined into profiles.

4. Legal bases

Processing takes place on the following legal bases:

Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures) — when you actively use the app’s features, in particular when you create or join Gift Spaces.

Art. 6 (1) (f) GDPR (legitimate interest) — for the technically secure operation of the API, in particular the hashing of IP addresses to protect against abuse.

5. Recipients and processors

We use the following processors, with whom corresponding agreements under Art. 28 GDPR are or will be in place:

• Supabase (database for Gift Spaces): Supabase offers EU regions. The Re:Ember database is operated in an EU region (Frankfurt or Ireland), so that Gift Space data does not leave the EU.
• Vercel (hosting of the website and API): Vercel is a hosting provider that delivers content via a global content delivery network. Static content may be served from edge locations; write operations on Gift Spaces land in the EU database.
• Apple and Google (app store delivery): if you obtain the app from the Apple App Store or Google Play, Apple and Google independently process data under their own responsibility. Please refer to Apple’s and Google’s privacy notices for details.
• RevenueCat, Inc. (USA) – processing of in-app purchases and subscription status. Data processed: anonymous app user ID (device UUID), purchase and subscription status. Transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR).

6. Transfer to third countries

Gift Space data is stored exclusively in the EU. A transfer of personal data to a third country (USA) takes place as part of the use of RevenueCat (in-app purchases). This is based on the EU Standard Contractual Clauses (Art. 46 GDPR).

To the extent that website hosting via Vercel may involve individual technical connections to locations outside the EU, this takes place on the basis of the Standard Contractual Clauses (Art. 46 GDPR) and concerns only technically necessary connection data, not the content of Gift Spaces.

7. Storage period

Data stored locally on your device remains until you delete it or uninstall the app.

Data in Gift Spaces is stored for as long as the respective space is active. You may request deletion of your space or your contributions at any time; we will then delete the data within 30 days.

Hashed IP addresses used for rate limiting are automatically deleted after a maximum of 48 hours.

8. Push notifications

Re:Ember uses only local notifications triggered directly on your device. No push tokens are transmitted to Apple, Google or us, and no push services such as APNs or Firebase Cloud Messaging are used.

9. Website analytics with Umami

The Re:Ember app does not use cookies, analytics tools, or advertising SDKs. There is no tracking within the app.

On the website (re-ember.de), we use Umami, a self-hosted, privacy-friendly analytics tool. Umami does not set cookies and does not store IP addresses; no personal data is processed and no cross-device or cross-site profiles are created. Only aggregated, anonymous usage statistics are collected (e.g. page views, approximate country-level origin, browser used).

Because Umami sets no cookies and processes no personal data, no consent is required for its use. The legal basis is our legitimate interest in privacy-friendly analysis of website usage (Art. 6(1)(f) GDPR).

The Umami instance is hosted by Vercel Inc. (USA); the associated database is located in a data centre in Frankfurt am Main (EU). To the extent that hosting via Vercel involves technical connections to the USA, this is based on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

We do not use any advertising cookies, Facebook Pixel, or similar marketing tools.

10. Minors

Re:Ember is aimed at people aged 16 and older. People under the age of 16 should only use the app with the consent of their legal guardians.

11. Press and partner enquiries

This section is not addressed to users of our app but to people we contact for press work or a possible collaboration.

For press work on Re:Ember we process contact data of journalists, editorial teams, podcast and newsletter editors, and contacts at potential partners. We did not obtain this data from the individuals themselves but from publicly accessible sources, and we inform you about it under Art. 14 GDPR. The controller is Tim Konrath, Strassburger Str. 43, 10405 Berlin, Germany, email support@re-ember.de. No data protection officer has been appointed because the conditions of Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act) are not met.

What we process: name, role or desk, publication or company, the professional email address, and publicly accessible professional work we refer to. In addition our notes on the course of the contact — date, content and outcome — and an internal assessment of whether and why a topic might match your area of work, including a numeric relevance score and its sources. Finally the technical delivery data: send and delivery timestamps, delivery status and bounce notices.

Where the data comes from (Art. 14(2)(f) GDPR): from publicly accessible sources evidently intended for professional correspondence — imprints, editorial and contact pages, author pages, podcast websites, publicly accessible press portals and public platforms for media enquiries. Also addresses the person or their editorial team gave us directly. We do not buy address lists, do not use commercial address enrichment or email finder services, and do not derive addresses from name patterns. Our first message tells you the exact source.

Purpose and legal basis: an individually written message about our app and the topic of personal memories, answering follow-up questions, and arranging possible coverage or collaboration. The legal basis is Art. 6(1)(f) GDPR. The balancing of interests took into account that we use only professionally published addresses, that every message is written individually and connects to the recipient's own work, that we follow up at most once, and that we neither deliberately collect special categories under Art. 9 GDPR nor use them for selection.

No approach based on personal circumstances: we select contacts solely by professional role and subject area. We do not approach anyone because of a bereavement, a loss, an illness, a disability, or a religious or philosophical belief. This applies expressly even where a person has written about it publicly themselves: a personal text about their own loss is not an occasion for an enquiry. We keep no lists or segments on such characteristics.

Strict separation from product data: we use no data from the use of Re:Ember for these enquiries. Account data and the personal content stored by users feed neither the selection nor the content of an enquiry, and are never used as an example. Nor do press and partner contacts flow into the product.

AI assistance, and no automated decision in individual cases: AI-based tools assist us in evaluating public sources, in the relevance assessment and in drafting. Every message is reviewed and taken responsibility for by Tim Konrath before it is sent. There is no automated decision-making including profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). On request we will tell you the assessment stored about you.

Recipients (Art. 14(1)(e) GDPR) are processors under Art. 28 GDPR:

• Plus Five Five, Inc. (service "Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA — sending and technical logging
• Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 — storage, data centre in Frankfurt am Main
• Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA — AI-assisted evaluation and drafting

We do not pass this data on for other purposes, except for legal obligations and to establish, exercise or defend legal claims.

Transfers to third countries (Art. 14(1)(f) GDPR): data is transferred to the USA or can be accessed from there; this also applies to data stored in Frankfurt, because support and maintenance access can occur from third countries. Plus Five Five, Inc. states that it is certified under the EU-US Data Privacy Framework; to that extent the European Commission adequacy decision of 10 July 2023 applies. Otherwise we rely on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under Art. 46(2)(c) GDPR. You can obtain a copy free of charge via support@re-ember.de.

Retention (Art. 14(2)(a) GDPR): if there is no response we delete the contact at the latest twelve months after the last message. If a collaboration arises we keep the data for its duration and 24 months afterwards. Statutory retention periods, in particular § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code), remain unaffected.

Suppression list after an objection: if you object or decline, we delete your data from our contact database without delay. Only a check value of your email address derived with a secret key remains, together with the date. It serves solely to prevent us from contacting you again and is pseudonymous, not anonymous. The legal basis is Art. 6(1)(c) in conjunction with Art. 21(3) GDPR, in the alternative Art. 6(1)(f) GDPR; keeping it is exempt from erasure under Art. 17(3)(b) GDPR.

No tracking in our messages: our enquiries contain no tracking pixels, no open or click tracking and no rewritten links. Our email provider only logs whether a message could be delivered or bounced. Whether an enquiry actually landed we learn only from your reply.

Your rights: the rights described under "Your rights" apply, in particular access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction (Art. 18 GDPR). There is no right to data portability under Art. 20 GDPR here, because the processing rests on neither consent nor a contract. You may lodge a complaint at any time (Art. 77 GDPR); ours is the Berlin Commissioner for Data Protection and Freedom of Information.

12. Your rights

Under the GDPR you have, in particular, the following rights:

• Access to the personal data we hold about you (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)

An informal message to support@re-ember.de is sufficient to exercise these rights. Please note that without the device ID used in the app or the affected space code, we will usually be unable to assign your data to you.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin, Germany
Email: mailbox@datenschutz-berlin.de

14. Changes to this privacy policy

We will adjust this privacy policy if the legal situation or the way the app works changes. The current version is always available on this page.

15. Contact

For any privacy-related questions, please contact: support@re-ember.de.