Mundwerk – Privacy Policy
1. Controller
Oliver Schmidt
Römerstr. 21-1
71404 Korb, Germany
Email: oliver.schmidt86@gmail.com
2. Minimum age
Mundwerk is intended for adults and young people aged 16 and over. Children do not use the app themselves. For a saying, only the age in years, optionally boy/girl, the situation and an optional translation are publicly visible – never a name.
3. What data we process and why
a) Account: email address, display name, password (encrypted) or, when signing in with Google or Apple, the account data required for this, as well as the time and version of your consent to the terms of use, your chosen app language and your notification settings. Purpose: providing your account. Legal basis: Art. 6(1)(b) GDPR.
b) Sayings and community: submitted sayings with age, gender (optional), situation, translation and category, likes, saved items, comments. Published sayings and comments are visible to others with your display name. Legal basis: Art. 6(1)(b) GDPR.
c) Family diary (private): if you add your children, we store their name or nickname, optionally gender and birthday, and the assignment of your sayings to a child, as well as the date, tags and milestones (“first word”) of a saying. This information is only visible to you and the members of your family – not to other users and not in the feed. It is used to organise and search your sayings in your diary, calculate ages automatically, show look-backs and, if you wish, create a PDF book. You can change or delete it at any time. Legal basis: Art. 6(1)(b) GDPR.
Photos and voice recordings (private): you can upload a photo and a voice recording for a saying. They are stored in non-public storage at Supabase (EU) and can only be accessed by you and your family members via time-limited links. Photos and recordings never appear in the feed. Please only upload content that everyone involved or their legal guardians have agreed to. Legal basis: Art. 6(1)(b) GDPR.
Speech input (dictation): when you use dictation, your speech is converted to text by your device’s speech recognition (Android: Google, iOS: Apple). Depending on the device, recognition may run on that provider’s servers; their privacy policies apply. We only receive and store the recognised text, not the audio. Legal basis: Art. 6(1)(b) GDPR.
Family: sayings, children’s details, photos and recordings belong to your family’s shared diary. All members of a family see this content; members with the “can add” permission can add to it. Everyone also sees the display names and permissions of the other members. New members only join via an invite code created by a member (valid for 7 days, single use). You can remove members or leave the family at any time; your previous entries then remain in the family diary until they are deleted or you delete your account.
d) Reports: reason for the report and an optional note. Purpose: moderation. Legal basis: Art. 6(1)(f) GDPR.
e) Push notifications: if you allow them, a Google Firebase Cloud Messaging device token is stored with your account. We notify you about new sayings in your family, comments and replies, and hearts for your sayings. For this we briefly store who is notified about what (including a short text excerpt). You can turn off each type in the app settings or all notifications in the system settings. Legal basis: consent (Art. 6(1)(a) GDPR).
Reminders: daily reminders and memories of earlier sayings (“one year ago today …”) are scheduled exclusively on your device; no data is sent to us for this.
Export: when you export the diary, the ZIP file is created on your device. You decide where to save or share it.
f) Crash reports: in the event of a crash, the app sends technical information (device type, app version, error log) to Google Firebase Crashlytics. Legal basis: Art. 6(1)(f) GDPR (stable app).
g) Advertising: the app uses Google Mobile Ads (AdMob). Google may process device and app information, IP address, advertising IDs and ad interactions. Personalised advertising only takes place with your consent via Google’s consent dialog, which you can change at any time under “Ad privacy settings”. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG; for non-personalised advertising Art. 6(1)(f) GDPR.
Print orders: if you have a sayings book or a wall calendar printed, we store the order (product, quantity, price, status), your shipping address, phone number and email address, and the print files. For payment we redirect you to Stripe; only Stripe processes payment data. We transmit print files, shipping address and phone number for printing and shipping – books to Lulu Press, Inc., wall calendars to Gelato AS (Oslo, Norway), which prints through partner printers as close to you as possible. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We keep order data for up to 10 years due to tax obligations; print files are deleted no later than 90 days after shipping.
In-app purchases and Mundwerk Plus: you buy the Mundwerk Plus subscription and the PDF without watermark via Google Play or the Apple App Store. Payment is handled exclusively by Google or Apple; we receive no payment data. To verify purchases we use RevenueCat, Inc. (USA), which receives your user ID, the store's purchase receipts (product, purchase date, period, store) and technical device data (e.g. app version, operating system, store country). We store for your account until when a subscription runs, which family it is assigned to and which PDFs were bought or created. Members of your family see that the family has Plus and who pays for it (display name). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
4. Recipients
- Supabase Inc. (sign-in, database, storage) as a processor under Art. 28 GDPR; location: data centre in the EU (Frankfurt).
- Google Ireland Ltd. / Google LLC: Firebase Cloud Messaging, Crashlytics, Google sign-in, Google Mobile Ads, speech recognition (Android).
- Apple Inc.: Sign in with Apple, push delivery and speech recognition on iOS.
- For print orders: Stripe Payments Europe Ltd. (payment), Lulu Press, Inc. (printing and shipping of books; printers in the EU, the UK and the USA, among others) and Gelato AS, Norway (printing and shipping of wall calendars; partner printers in the EU, among others).
- For in-app purchases: Google Ireland Ltd. (Google Play) or Apple Distribution International Ltd. (App Store), and RevenueCat, Inc., USA (purchase verification).
- Other users, insofar as content is visible to them.
5. Transfers to third countries
Supabase Inc., Google LLC, Apple Inc. and RevenueCat, Inc. are based in the USA. Transfers take place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 46(2)(c) GDPR).
6. Storage period
We store your account, sayings, children’s details, photos, voice recordings, tags, family connections, comments, likes and saved items until you delete them or your account. Rejected sayings are deleted after 90 days at the latest. Push tokens until you sign out or delete your account; notification entries after 90 days at the latest.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to withdraw consent. You can create a copy of your family diary directly in the app under “Settings” (gear icon, top right) → “Export diary”. You can delete your account directly in the app under “Settings” (gear icon, top right) → “Delete account”; this deletes all your data. Alternatively, an email to oliver.schmidt86@gmail.com is sufficient. You can also lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
8. Obligation to provide data
Reading works without an account. To add, like and comment, an email address and display name are required. There is no automated decision-making under Art. 22 GDPR.