Privacy Policy

1. Controller

The controller responsible for data processing on this website and in the app is:

Schönebergerin UG (haftungsbeschränkt) Akazienstraße 3 10823 Berlin Email: info@schoenebergerin.de Managing Director: Angelica Maar

We have not appointed a data protection officer. Please send questions about data protection to the email address above.

2. General information on data processing

As a rule, we collect and use our users' personal data only to the extent that this is necessary to provide a functioning website and our content and services.

A family calendar also contains data about people who do not have an account themselves: family members, including children who are entered by their parents, and people who appear in forwarded emails or attached files. Where we process such data, we rely on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the shared family calendar that the family uses with us. In weighing this, we take into account the interests of these people, in particular those of children: we use their data only for this family's calendar, show it only where the family itself shows it (in the app, on its family display and in its calendar feed), do not analyse it for advertising, do not build profiles and pass it on only to the service providers listed in section 12.

We do not inform people who appear in forwarded emails or attached files, such as teachers, coaches or other children, individually: their details reach us only as part of what a family sends us, and notifying every person mentioned would be impossible or would involve a disproportionate effort (Art. 14(5)(b) GDPR). This policy is publicly available to everyone.

Events, forwarded emails and attached files may contain information about health, for example a child’s doctor’s, vaccination or check-up appointment; the AI analysis (section 7) also enters such events. Information about health belongs to the special categories of personal data (Art. 9 GDPR). We process it only because you enter it yourself or send it to us specifically for analysis, and only for your family calendar. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), for your children as their parent or guardian: you give it with this deliberate step by entering such information, forwarding an email containing such information to your Familienplaner address or attaching a file containing such information. You can withdraw your consent at any time with effect for the future by deleting such events, pausing or deleting the address or writing to us; we will then delete stored emails that cannot be deleted individually in the app at your request. Please forward information about the health of other people only if they agree.

3. Visiting the website

The website and the app are hosted with Vercel Inc. (USA). Each time the website is accessed, the information that your browser transmits to the server is processed in order to deliver the pages and to keep operation secure:

• IP address of the requesting device
• Date and time of access
• Name and URL of the page or file retrieved
• Website from which access is made
• Browser used and, where applicable, the operating system

Vercel records this information in the server logs, together with the error messages of our servers, and makes it available to us for one day or, depending on the package booked, for at most 30 days. To curb misuse, such as trying out passwords, our servers also count for a short time in their working memory how often certain requests come from an IP address, an account or a family display, for example when signing up and signing in, when pairing a family display or when withdrawing from the contract; this is not stored.

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the stability, security and functionality of our website.

4. Registration and user account

You need an account to use the app. The following data is collected when you register:

• Name
• Email address
• Password; we store it exclusively as a hash (bcrypt), not in plain text

Without this information you cannot use the app. Any other information you provide in the app is voluntary.

If we offer sign-in with Google and you use it, we receive from Google your name, your email address, the address of your profile picture, the identifier of your Google account and the tokens issued by Google for the sign-in. We do not learn your Google password. Google learns that you are signing in to Familienplaner.

If we offer sign-in with Apple and you use it, we receive from Apple the identifier of your Apple Account for Familienplaner, your email address and the tokens issued by Apple for the sign-in, and your name only at the first sign-in and only if you share it. If you choose “Hide My Email”, we receive a forwarding address from Apple instead of your address; Apple forwards our emails sent to it on to you. We do not learn your Apple password. Apple learns that you are signing in to Familienplaner. If you delete your account, we revoke the tokens with Apple.

If you sign in with Google or Apple and we already have an account with the same email address, we only link the sign-in to that account if the provider has confirmed the address and is responsible for it (Google for Gmail addresses and Google Workspace addresses, Apple for iCloud addresses and its forwarding addresses) and if the address of the account is confirmed with us as well or the account has no password. Otherwise you sign in to that account as before, for example with your password. If there is no account with this address yet, we create a new one; the address confirmed by the provider then counts as confirmed.

After you sign up with a password, we send you a link with which you confirm your email address; it is valid for 48 hours. If you reset your password, we send a link to your email address. It is valid for one hour. For both links we store your email address and an identifier of the link until they expire; we delete expired links by the following day at the latest.

If you withdraw from the user agreement through the withdrawal function at familienplaner.app/en/widerruf (terms and conditions, section 11), we receive by email your name, the email address you enter there, your message if you write one, the time of receipt and the language of the page, plus the identifier of your account if the address belongs to one. This email goes to the mailbox in which we also receive the daily internal report (sections 11 and 12). If the address belongs to an account, we confirm receipt to you by email to that address, with your name, the address, your message and the time of receipt; if it does not belong to one, we confirm receipt by hand to the address given and ask which account is meant. We do not store anything about this in the app. We keep the declaration as proof for as long as claims under the contract can be asserted. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB).

The data is used to provide Familienplaner and to manage your events and tasks. Processing is carried out in accordance with Art. 6(1)(b) GDPR for the performance of the user agreement.

5. Family, calendar and tasks

In the app we store what you and the members of your family enter there:

• Name of the family, country and federal state or canton, and the selected language
• The place for the weather forecast, if you enter one: country, postal code, place name and region, as well as the coordinates stored for it, rounded to two decimal places (roughly one kilometre)
• Family members with their name, optionally their date of birth, a colour for display in the calendar and whether they are a child
• Which accounts belong to your family, which account created the family (main account), which accounts may manage it (admins) and which family member belongs to which account
• Birthdays of other people that you enter, with name, day and month and, if given, the year of birth
• Events with title, date, time, duration, description, notes, the assignment to family members and checklists; for series of events the rule of the repetition as well as dates that are left out or changed individually
• Tasks with title, notes, due date, the family member responsible, repetition and rotation order, together with which account created them and which completed them, and for a task ticked off on the family display the family member chosen there
• Shopping list entries with name and quantity, which account added them and whether they have been ticked off
• Settings of your account and your family, for example what the calendar starts with, whether school holidays and weather are shown and whether the app asks about forwarded emails, as well as the time at which you confirmed a notice about changed terms
• Your family's knowledge for the AI analysis, if you store any: details about family members (for example school, class, nursery or club), your notes for the AI and the known senders with name, email address, role and associated family member (section 6)

Family members may also be children. Their data is entered by their parents; children do not need an account of their own for this.

Events, tasks, the shopping list and birthdays are visible to and can be changed by all accounts of the family. The family is managed by the main account and the accounts that it or another admin allows to do so (admins): they change the family’s name, region and place, family members, accounts and their roles, invitations, subscribed calendars and family displays. An admin can remove an account’s access to the family, and every account except the main account can leave the family. The account then gets a calendar of its own again; its family member stays in the family with all entries, without a sign-in. What the account set up for the family, such as calendar feeds, addresses for forwarded emails and paired displays, ends at that point.

When a new account is set up, we suggest the country: Austria or Switzerland if your device is set to the time zone of Vienna or Zurich, otherwise Germany. Your browser reads the time zone itself; it is not transmitted to us. If the browser does not provide a time zone, we use the country that Vercel derives from the IP address of the request. The country is only stored once you confirm the step; you can change it beforehand and at any time afterwards. We do not suggest the federal state or canton.

We use the country and federal state or canton to display the public holidays and the school holidays. The app calculates the public holidays itself; the school holidays come from open data (OpenHolidays API, Open Database License) that is stored in the app. No data leaves the app for this purpose.

If you enter a place for the weather forecast in the settings or during setup, we show the weather for that place and suggestions for what to wear in the calendar and on the family display. Entering a place is voluntary; without it there is no weather. We look up the coordinates of the place in a list of places that is stored in the app (GeoNames, licence CC BY 4.0); no data leaves the app for this look-up. They are the coordinates of the place or of the postal code area, not those of your address. We do not query the location of your device.

Our servers in Frankfurt am Main retrieve the forecast from the Norwegian Meteorological Institute (MET Norway, Oslo, Norway), several times a day and jointly for all families of the same place. In doing so, the rounded coordinates of the place are transmitted. The Institute also learns the address of our server and the name of our application. It receives no information about your device, your account or your family; your browser and the app do not contact the Institute themselves. We store the forecast per place, without any link to a family.

The app calculates the suggestions for what to wear from the forecast according to fixed rules, without AI. They are suggestions; the weather may turn out differently.

The admins of your family can change or remove the place in the settings at any time. If it is removed, we delete the entry and no longer retrieve a forecast for that place, as long as no other family has entered it. The admins can also switch the weather off without removing the place: the place then remains stored, and we do not retrieve a forecast for it as long as no other family with the weather switched on has entered it. The place is also included in the file with all stored data that you can download in the settings.

If you set up a calendar feed (iCal), we generate an address containing a random token. Other calendar apps can use this address to retrieve your family's events (title, description, date and time) and the birthdays entered (name and day, without the year of birth) without signing in. The address always shows the calendar it was set up for. Anyone who knows the address can read the events; for that reason, pass it on only to people and services that are meant to see these events. We store the name of the feed, the token and the time of the last retrieval. You can delete a feed in the settings at any time; the address will then no longer work.

If you subscribe to an external calendar, for example that of your school or club, we store the calendar address, the name and colour you choose for it, and the events of that calendar (title, description, location, date and time). Our servers in Frankfurt am Main retrieve the address several times a day; if this fails for 30 days, they stop. In doing so, the provider of the calendar learns the address of our server and which calendar address was retrieved; it receives no information about your device. The retrieved events are visible to all members of your family, the calendar address itself only to the family's admins. If you remove the subscription, we delete the address and the events.

Family display: a tablet or another device can be paired with your family as a family display. To do so, it shows a code that an admin of the family confirms within ten minutes; no account signs in on the display. For the display we store its name, the platform, which account paired it, the times of its night view and after how many minutes without a touch it turns black, whether it shows three or seven days, when it was paired and when it last checked in, as well as a check value (hash) of its access. So that a display shows new entries soon without asking our database every time, our servers at Vercel in Frankfurt am Main record which display and which family the check value of its access belongs to, and keep a random marker per family that they set anew when the family’s entries change. The assignment expires one day after the display last fetched data, the marker seven days after it was last set; after that, neither can be retrieved. If the admins remove a display, we delete its assignment straight away. Without a sign-in, the display receives the family’s name, language, country and region, the family members with name, colour and whether they are a child, the events of the next 14 days with title, day, time, duration and person, birthdays with the age the person turns if the year of birth is known, public and school holidays, open tasks and tasks completed in the last 24 hours, the shopping list and the events of subscribed calendars. If a place for the weather forecast is entered, it also receives the weather for the days it shows, at most seven, and the suggestions for what to wear for today and tomorrow, but not the place itself. It does not receive descriptions or notes of events and tasks, emails or email addresses. Anyone standing in front of the display sees what it shows; for that reason, set it up only where that is intended. Tasks can be ticked off on the display; a family member can be chosen in doing so, whom we store as the one who completed the task. If a display has not checked in for 90 days, it loses its access and we delete it; the admins can remove it in the settings at any time. What the display stores in the browser’s storage is set out in section 9.

We keep deleted tasks and shopping list entries for another 90 days, with their title or name, as a deletion note, so that devices that were without a connection for a while learn at the next synchronisation that they have been deleted; after that we delete them permanently.

The legal basis is Art. 6(1)(b) GDPR, for data of people without an account of their own Art. 6(1)(f) GDPR and for information about health Art. 9(2)(a) GDPR (section 2).

6. Forwarded emails

Your account includes one or more personal email addresses under the Familienplaner domain. For each address we store a label, the family member assigned to it, whether it is paused, and the time at which an email was last received. Emails that you forward to such an address, for example from school, nursery or a club, arrive in a mailbox at IONOS SE (Germany) and are imported into the app from there.

For each imported email we store the sender, subject and text, for emails that an account of your family forwarded from its email address also the original sender, where the quoted header names it, the time of the import, an identifier of the message by which we recognise duplicate deliveries, the time at which an account of your family first saw it, or the notice about the events entered from it, in the app, as well as the result of the analysis: the events identified, a brief explanation and the processing status. For each event identified we also store when it was entered in the calendar and, if an account has removed it, dismissed it or entered it afterwards, which account did so and when. If an account had moved such an event before removing it, we also store the day and time to which it had last been moved, so that a later email does not enter it again. If an account removes a series of events from an email, entirely or from a certain day on, we also store how it last stood in the calendar, with all its details and its left-out and individually changed dates, and from which day it was removed, so that “Add again” brings it back as it was and a later email does not enter it again. File attachments are not analysed.

We keep the sender of a forwarded email in which the language model identified events in the list of known senders of your family, at most 100 per family: with the email address and name as they appear in the header of the email, the first and last arrival, the number of their emails and the language model's suggestion for their role. If an account of your family forwarded the email from its email address, this is the original sender from the quoted header, otherwise the sender of the email itself; we do not keep the addresses of the accounts of your family or of your personal email addresses there. What an account of your family answers to the app's question about a sender or an admin sets in the settings, that is the sender's role, who the sender's emails belong to, whether the app keeps asking about the sender and whether their emails should no longer be analysed, we store along with it, together with the account that made the assignment and the time. All accounts of your family see the list in the settings; every account can answer the questions and take back its own answer, and the admins can change and delete the entries.

If you attach a photo or a PDF file in “New entry” (section 7), we store it like a forwarded email: the text from the field, the name of your account as the sender or, if it has no name, its email address, the start of the text as the subject, that it comes from “New entry”, and which files were included, for a PDF file with its name. We do not store the photos and PDF files themselves.

Every account that belongs to your family can read the emails stored in the app, with sender, subject and full text, in the app's inbox. They cannot be deleted individually in the app; they are deleted when the account with which the family was created is deleted. If you would like a single email deleted before then, write to us.

If an email comes from the known address with which an email provider has a forwarding confirmed, the app analyses it without AI and shows its confirmation code and the links to the provider’s confirmation pages in the inbox.

Emails that cannot be assigned to an account are ignored: we do not analyse them and do not import them into the app. They are not deleted automatically in the mailbox at IONOS; they remain there until we delete them by hand.

For each email the app fetches from the mailbox at IONOS, it keeps a note without sender, subject, text or account identifier: its number in the mailbox, a check value and the times of the import. This lets the app recognise the email in the mailbox.

Forwarded emails usually also contain data about other people, for example the senders, teachers or other children, and, depending on their content, sensitive information such as medical appointments (section 2). For that reason, forward only emails that you would like to have analysed for your family calendar.

The legal basis is Art. 6(1)(b) GDPR; for information about health, section 2 applies.

7. Analysis by artificial intelligence (AI)

To turn emails and short texts into calendar entries, we have them analysed by an AI language model. This happens in three cases:

• Emails that you have forwarded: the sender, subject and text of the email are transmitted, as well as your family's language and, where you have stored any, your family's knowledge: your details about the family members (for example school, class, nursery or club), the role of the sender of this email and who that sender's emails belong to (a family member or the whole family), and your notes for the AI analysis. We do not transmit entries about other senders.
• Quick entry: the text that you type or speak into the “What would you like to add?” field when adding an entry is transmitted, together with the date if you picked a particular day (the plus on a day or the view of a single day).
• Photos and PDF files that you attach in “New entry”: the files with their file names and the text from the field are transmitted, as well as your family's language, your notes for the AI analysis and your details about the family members, if you have stored any, and the date if you picked a particular day (more on this below).

In all three cases we additionally transmit the names of the family members, in the case of the quick entry together with their internal identifier, so that events can be assigned to the right person, and, for the quick entry, also which family member you are, so that “I” is assigned correctly. We do not add other information from your account, such as the date of birth of the family members, the events in your calendar or earlier emails.

The data is sent via the Vercel AI Gateway (Vercel Inc., USA) to a language model from Anthropic, currently a model from the “Claude” series, which Amazon Web Services operates in a data centre in the EU. If this model cannot be reached, a language model from OpenAI takes over, likewise in a data centre in the EU. For this purpose, we permit only providers that do not store the transmitted content after processing and do not use it to train their models. The Vercel AI Gateway, which passes the request on, is not tied to a region. The model returns the events or tasks it has identified.

Photos and PDF files: if you attach a photo or a PDF file in “New entry”, for example a letter from school, the language model analyses it like a forwarded email, and the app enters identified events in your family's calendar without prior confirmation, as with such an email. Photos and PDF files are read only by the language model from Anthropic; the fallback model from OpenAI does not receive them. If the model cannot be reached, reading fails; we then store nothing of it, and you can try again. Your browser redraws photos in a smaller size before sending them. We do not store photos and PDF files; they go to the model only for the analysis. As with a forwarded email, we store the text, the name of the account that attached them (without a name, its email address), the result of the analysis and which files were included, for a PDF file with its name; every account of your family sees this in the inbox. If the text names a day only as “tomorrow” or as a weekday, the app marks the event with “Check the date”, because it is not certain when the text was written; the same applies to an event without a named day that it gives the day you picked.

Events that the model identifies in a forwarded email are entered by the app in your family's calendar without prior confirmation; if the analysis classes a day, a time or a repetition as uncertain, that detail is flagged. As a result, the events also appear on a paired family display and in a calendar feed you have set up. For each of these events the app shows the email it comes from, and every account that belongs to your family can change or remove it. Identified events that the app does not enter because they are already in the calendar, were removed earlier or are waiting for a decision, for example because an upper limit has been reached, are shown in the app's inbox. Events whose day has already passed when the email is analysed are not entered, and the app takes at most 20 entries from one email; a series of events counts as one. With the quick entry, the app saves the event or task only once you confirm the suggestion. A calendar entry has no legal effect on you and does not similarly significantly affect you; automated decision-making within the meaning of Art. 22 GDPR therefore does not take place.

Per family and day, the app has the AI read at most 200 quick entries and carry out at most 50 analyses of photos or PDF files from “New entry”; beyond that, it accepts nothing more of this kind until the next day. The count is kept in the key figures for the AI analyses (section 11).

Voice input: if you tap “Speak” when adding an entry, your browser’s speech recognition turns what you say into text. It is part of the browser or operating system, not of the app. In Safari it is Apple’s speech recognition, which is only available with Siri turned on; depending on the device it works on the device itself or at Apple, and Apple’s privacy policy applies. In Chrome we only offer voice input when recognition runs on the device itself. Recognition only starts when you tap “Speak”, and your browser first asks whether the page may use the microphone. We receive no audio recording, only the recognised text, which is treated like typed text. The same applies when you speak using the dictation function of the on-screen keyboard. If recognition fails, we note this in the error log with the error code, the duration and the language of the recognition, never with what was said (see section 11).

The legal basis is Art. 6(1)(b) GDPR: the automatic analysis is part of the service that you use with the app. For information about health, section 2 applies.

8. Invitations and emails from us

If you invite a person to your family, we create an invitation link that you pass on yourself, for example as a QR code or via a messenger; we do not send an email for this. For this purpose we store a check value of the link, the family member the invitation is intended for, the intended role and the expiry after seven days. Anyone who opens the link sees the name of the family, your name and, where applicable, the name of that member. The link is valid for one person and can be revoked at any time. If someone accepts the invitation, we connect that person’s account to your family; a calendar of their own that the person had before remains stored under their account. We delete the information about the invitation together with the family.

Beyond this, we send emails that are part of operating the account, currently the request to confirm your email address after registration, after an account is created the confirmation of the contract with the terms and conditions including the instructions on withdrawal and the model withdrawal form, the link for resetting the password and the confirmation of a withdrawal (section 4). There is no regular newsletter. Emails are sent via IONOS SE (Germany).

We also send tips on using the app: if, in the first days after registration, you have not yet added an event of your own, we remind you once by email and include a few tips for getting started. When important new features are added to the app, we occasionally present them in an email to all accounts with a confirmed address; each account receives each of these emails only once. Each of these emails contains a link with which you can unsubscribe from tips by email; unsubscribing applies to all future tips, not to emails that are part of operating the account. In each of these emails and, since this version of the privacy policy, already when you register, we point out that you can object to the tips at any time without incurring any costs other than the transmission costs at the basic rates. For this purpose we store which of these emails we sent you, when, and whether sending succeeded, a random identifier for your unsubscribe link and, where applicable, the time at which you unsubscribed. We delete this information together with your account.

Anyone who does not wish to receive emails from us can block their address on the page familienplaner.app/optout. We then store the address, together with the time and a reason if one is given voluntarily, in a block list and no longer send any emails to it, not even to confirm the address or the contract. We continue to send the link for resetting the password if the address belongs to an account and has been confirmed there; otherwise a third party could lock you out of your account by blocking the address. Likewise, we continue to confirm the receipt of a withdrawal submitted for an account with this address.

The legal basis is Art. 6(1)(b) GDPR, for the confirmation of the contract Art. 6(1)(c) GDPR in conjunction with § 312f(2) of the German Civil Code (BGB) and, for the invitation, the block list and the tips, Art. 6(1)(f) GDPR. Our legitimate interest in the tips is to make it easier for new users to get started with the app and to inform all users about new features of the app; you can object to them at any time, most easily via the unsubscribe link.

9. Cookies and browser storage

We use only cookies, and store only information in your browser’s storage, that are technically necessary for operating the app. We set these cookies:

• Sign-in (Auth.js): a session cookie that keeps you signed in after you have signed in. It expires if you do not open the app for 30 days or if you sign out. In addition, there are the auxiliary cookies needed for a secure sign-in process: one against forged requests and one with the page to go to after signing in, both of which end when the browser is closed, and, when signing in with Google or Apple, check values that expire after 15 minutes or when the browser is closed.
• Language when signing in with Google or Apple: a cookie with the language of the page on which you start the sign-in, so that a new account is created in that language. It is sent only to the sign-in addresses and expires after ten minutes.
• Language: a cookie that stores the selected language. It is set when you change the language, when you move from a page in English, French or Italian to a page without its own language address, for example to sign up, when a family display is paired, with the family’s language, after you sign in, with the language of your account if no language has been chosen in this browser yet, and with the language of one of our emails if you open a link from it before signing in and no language has been chosen in this browser yet. It is valid for one year.
• Family display: a cookie with the display’s access (section 5). Scripts on the page cannot read it, it is sent only to the display’s interface and is valid for 400 days; whenever the display checks in, the period starts again.

We no longer set a cookie for the calendar view; where one still exists from earlier, the app deletes it the next time the calendar is opened. What the calendar starts with is a setting of your account (section 5).

In your browser’s storage (Web Storage), the app keeps:

• only for the session of the tab concerned (sessionStorage): the email address you entered when signing in, if you move from there to “Forgot password”, until that page takes it over; whether the “Speak” button does not work in this browser and is therefore hidden, and which language speech recognition uses instead; when this tab last asked for forwarded emails; on the page for the first email in the set-up, for which calendar address and since when it has been waiting for an email, whether you opened the test email there and which emails it has already shown; notes so that the same error is not reported several times and the page is not reloaded again and again after a loading error; on the family display, the ongoing attempt to pair it and notes that it has just been paired or reloaded
• permanently (localStorage), only on the family display: the most recently loaded state with the information from section 5, so that the display shows something even without a connection. Every retrieval replaces it; once it is older than seven days, the display no longer shows it and deletes it, as it also does if the display has been removed. In addition, a note that the hint about keeping the screen awake has already been shown.

We do not use advertising or tracking cookies. No consent is required for the cookies and information mentioned (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

10. No audience measurement, no advertising

We do not use any services for audience or performance measurement, advertising or tracking on the website; its pages load no scripts from such services. What we know about how the app is used comes only from the server logs (section 3) and from our usage statistics (section 11).

11. Error log and usage statistics

If a technical error occurs in the app, we record it so that we can fix it. We operate the error log ourselves; it is kept in the app's database. We do not use an external error-tracking service. The following is stored:

• Error message and technical stack trace
• Path of the page on which the error occurred, without identifiers and secrets from the address
• Date and time of the first and last occurrence and how often the error occurred
• Browser identifier (user agent)
• technical additional information, for example the place in the structure of the page; if the page in the browser differs from that of the server, the affected place with its content made unrecognisable
• Your user ID, if you are signed in

In order to operate and further develop the app, we also keep simple usage statistics, likewise in the app's database. They contain the time at which you last accessed the app, for each event an indication of whether it was created by hand, by quick entry or from an email, and for each AI analysis the task, the model used, the volume of the texts processed, the duration, the cost, whether it succeeded and the family for which it ran. We also use these key figures to count the daily limits for quick entries and for photos and PDF files (section 7). The content of emails and events is not included in these statistics.

We delete entries in the error log as soon as we no longer need them for fixing errors, at the latest 90 days after the error last occurred. For the key figures of the AI analyses, we remove the link to the family after 30 days and delete them after one year. We store the time of your last access for as long as your account exists, and the origin of an event for as long as the event exists.

From this information we produce a daily internal report with aggregated key figures. It also lists the latest entries of the error log, new registrations with name, email address, sign-in method, language and region, as well as the most active families with their family name and the email address of the account, and it is sent by email exclusively to us as the operator. We keep these reports for as long as we need them to monitor operation.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the error-free, secure and economical operation of the app.

12. Recipients and transfers abroad

We use the following service providers to operate the app:

• Vercel Inc. (USA): operation of the website and the app including the server functions (region Frankfurt am Main) and routing of the AI requests (Vercel AI Gateway)
• Neon Inc. (USA): database (Neon Postgres) in which the app's data is stored. The database runs in the AWS region eu-central-1 in Frankfurt am Main.
• IONOS SE (Germany): mailbox for forwarded emails and sending of our emails
• Amazon Web Services, Inc. (USA; data centre in the EU): operation of the AI language model from Anthropic for the analysis of emails, quick entries and photos and PDF files from “New entry”
• OpenAI, L.L.C. (USA; data centre in the EU): fallback language model for the analysis of texts, such as emails and quick entries, if the first model cannot be reached; it does not receive photos and PDF files
• Google (Google Ireland Limited, Ireland): handling of the sign-in, if we offer sign-in with Google and you use it; in addition, the mailbox in which we receive the daily internal report and declarations of withdrawal
• Apple (Apple Distribution International Ltd., Ireland): handling of the sign-in, if we offer sign-in with Apple and you use it, and forwarding our emails if you hide your address when doing so

For the weather forecast, our servers retrieve data from the Norwegian Meteorological Institute (Meteorologisk institutt, Oslo, Norway). The Institute does not process any data on our behalf; it receives the rounded coordinates of the place entered, the address of our server and the name of our application (see section 5). Norway belongs to the European Economic Area; the GDPR applies there.

The app’s data is stored in data centres in the EU, and the AI analysis also takes place there. Because several of the service providers named have their registered office in the USA, access from there or processing there cannot be ruled out, for example when the website is delivered, when the AI requests are routed and during maintenance. Such transfers are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), to the extent that the recipient concerned is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

For persons in Switzerland: your data is disclosed to Germany, for the AI analysis to the EU member state in which the data centre concerned is located, for sign-in via a provider, for the daily internal report and for declarations of withdrawal to Ireland and, to the extent that the service providers named access it from the USA, to the USA. If a place for the weather forecast is entered for your family, its rounded coordinates are additionally sent to Norway (see section 5). For the member states of the EU and for Norway, the Swiss Federal Council has determined that the level of data protection is adequate. For the USA, the disclosure is based on the Swiss-US Data Privacy Framework, to the extent that the recipient concerned is certified under it, and otherwise on standard data protection clauses (Art. 16 FADP).

Your personal data is not transferred to third parties for purposes other than those listed in this policy. Beyond that, we pass your personal data on to third parties only if:

• you have given your explicit consent (Art. 6(1)(a) GDPR)
• passing the data on is necessary for the performance of a contract (Art. 6(1)(b) GDPR)
• there is a legal obligation to pass the data on (Art. 6(1)(c) GDPR)

13. Storage period and deletion

Your personal data is deleted as soon as it is no longer required for the purposes for which it was collected. We store the data of your account and your family for as long as the account exists. You can delete events, tasks, family members, personal email addresses, calendar feeds and the place for the weather forecast yourself in the app. You can likewise delete shopping list entries and birthdays; subscribed calendars, family displays and your family's knowledge (details about family members, known senders, notes for the AI) are removed by the family's admins.

You can delete your account yourself in the settings at any time, or send us a message to info@schoenebergerin.de for this purpose. There you can also download your events as a calendar file or spreadsheet and all stored data as a file. If the account with which the family was created is deleted, we delete all of that family's data at the same time, that is, everything entered there or forwarded to it, including family members, events, tasks, the shopping list, birthdays, stored emails together with their analysis, personal email addresses, calendar feeds, subscribed calendars, invitations, family displays and your family's knowledge. If an invited member deletes their account, the family's data is retained, including what that member entered or forwarded to the family.

Entries in the block list for emails remain in place, because we could not otherwise honour the block, as do entries in the error log and the key figures for the AI analyses. After deletion, the user ID stored there can no longer be linked to an account; these entries are deleted after the periods set out in section 11. The note about fetched emails from section 6, which contains no information about you, also remains.

After their import into the app, forwarded emails remain in the mailbox at IONOS SE in which they arrived (section 6). They are not deleted there with the account, but only when we clean up the mailbox. In addition, deleted data remains in the database backups for a limited time, at most 30 days, until they expire.

The following periods apply to individual items:

• Link for confirming the email address: 48 hours; link for resetting the password: one hour; we delete expired links by the following day at the latest (section 4)
• Invitation links: seven days (section 8)
• Family display: pairing code ten minutes; access and information about the display 90 days after the last contact (section 5)
• Deletion notes for tasks and shopping list entries: 90 days (section 5)
• Session cookie: 30 days without a visit; language cookie: one year; cookie of a family display: 400 days; state on the family display: seven days (section 9)
• Error log: 90 days after the last occurrence; key figures of the AI analyses: link to the family 30 days, otherwise one year (section 11)
• Server logs at Vercel: at most 30 days (section 3)
• Cache for family displays at Vercel: assignment of an access to display and family until one day after the last fetch, change marker until seven days after it was last set, after which they expire (section 5)
• Stored emails: until the account with which the family was created is deleted, or until we delete an email at your request (section 6)

14. Security

The connection to the website and to the app is encrypted (SSL/TLS). We store passwords only as a hash (bcrypt). In addition, we take technical and organisational security measures to protect your data against manipulation, loss, destruction or unauthorised access.

15. Your rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR); processing until the withdrawal remains lawful

Right to object: where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this at any time on grounds relating to your particular situation. We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). You can object to the tips by email (section 8) at any time without giving reasons, most easily via the unsubscribe link in each of these emails; we will then send you no more (Art. 21(2) and (3) GDPR).

If you live in Switzerland, you have the corresponding rights under the FADP, in particular the right to information (Art. 25 FADP), the right to have your data handed over or transferred (Art. 28 FADP) and the right to rectification and deletion (Art. 32 FADP).

Parents may also exercise these rights on behalf of their minor children.

To exercise your rights, please contact: info@schoenebergerin.de

16. Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data, in particular in the member state of your habitual residence or place of work. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de); in Austria it is the Data Protection Authority (Datenschutzbehörde, www.dsb.gv.at). Persons in Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC).

17. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to reflect changes to our services. The new privacy policy will then apply to your next visit.