Privacy policy

This is a translation; the German version prevails in case of discrepancies.

1. Controller

We have not appointed a data protection officer, as there is no legal obligation to do so. For any privacy question, reach us at the email address above.

2. In short

• This website sets no cookies and uses no analytics or tracking tools.
• Fonts are served from our own server. There is no connection to Google.
• We process personal data only to deliver the website and for the waitlist, if you sign up.

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, as our processor. Server functions run in the EU region Frankfurt am Main. Static content is delivered via Vercel's global network.

On every page request, Vercel processes technically necessary data and stores it in logs: IP address, date and time, requested URL, HTTP status, referrer, browser identifier (user agent) and the approximate region derived from it. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free delivery of the website, error analysis, and defence against attacks and abuse.

Vercel deletes these logs automatically, currently after one day on our plan (at most 30 days depending on the plan). Vercel also processes some of this data as a controller for its own purposes, for example billing and abuse prevention, and may keep it longer for that; details are in Vercel's privacy policy.

Vercel also processes data in the USA. The basis for this is the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), which are part of our data processing agreement with Vercel. You can get a copy on request.

4. Waitlist

Purpose and legal basis

If you join the waitlist, we store your email address, the chosen language, the time of sign-up and confirmation, the version of the consent text and, later, the time we sent you the launch message. The purpose is to invite you to the Framura beta test before launch and to tell you about the app's launch in one email. So you get at most two emails, no newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR).

If you signed up under an earlier version of the consent text that covered only the launch email, you will receive only that email and no beta-test invitation. We can tell which version you confirmed from the stored version.

Beta test

The beta-test invitation contains a public link to join: Apple's TestFlight for iPhone and the open test on Google Play for Android. We do not pass your email address to Apple or Google for this. Whether you take part is up to you. Taking part happens with your own Apple or Google account and under their terms; Apple or Google are themselves responsible for the processing there (see Apple's privacy policy and Google's privacy policy). What is processed in the app and during the beta test is explained in the app's privacy policy before you take part.

Double opt-in and proof

We use double opt-in: you receive an email with a confirmation link valid for seven days. The link opens a page on this website where you confirm your sign-up with one click. Only then are you on the list. The confirmation code sits in the link after the “#” character; your browser does not transmit this part when loading the page, so it does not end up in the server logs. We store only a checksum of the code, not the code itself. If you did not sign up yourself, you can delete the entry right away with the link at the end of the email.

We base sending the confirmation email and storing the time of sign-up and confirmation and the version of the consent text on our legitimate interest in being able to prove valid consent (Art. 6(1)(f) in conjunction with Art. 7(1) GDPR).

Retention

Unconfirmed entries are deleted automatically no later than two days after the link expires, i.e. at most nine days after sign-up. Confirmed addresses are deleted automatically 30 days after we send the launch message. Regardless of that, we delete every confirmed address no later than 18 months after your confirmation, even if Framura has not launched by then; you can sign up again. If you unsubscribe earlier, we delete your address immediately (see “Withdrawal and unsubscribing”). If our database provider keeps backups, deleted entries may remain in them for up to seven days before they are overwritten.

Withdrawal and unsubscribing

You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email from us or informally by email to datenschutz@framura.app. The unsubscribe link deletes your address immediately with one click; we handle an email request without delay. We keep no suppression list, so nothing about you remains stored. This does not affect the lawfulness of processing before the withdrawal.

As with the confirmation link, the code in the visible unsubscribe link sits after the “#” character and does not reach the server logs. In addition, every email carries an unsubscribe header (List-Unsubscribe) that lets your email program unsubscribe you with one click. In that case the code is part of the link address and may therefore appear in the server logs (section 3). The code does not contain your email address and can only be used to delete this one entry.

Abuse protection

To protect against automated mass sign-ups, we count sign-up attempts per IP address (at most five in ten minutes). For this, the IP address is held only in the server's memory, evaluated only for a ten-minute window, and discarded at the latest when the server instance shuts down. It is not stored in our database. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the waitlist and other people's email addresses from abuse. Independently of this, the IP address appears in the server logs (see section 3).

Supabase (database)

We store the waitlist in a database of Supabase Pte. Ltd. (Singapore) as our processor. The database server is located in Frankfurt am Main (AWS region eu-central-1). Access from third countries (in particular the USA and Singapore), for example for maintenance and support, cannot be ruled out; for this we have agreed the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) with Supabase as part of the data processing agreement. You can get a copy on request. See Supabase's privacy policy.

Resend (email delivery)

We send the confirmation email, the beta-test invitation and the launch message via Resend, Inc. (USA) as our processor. Your email address and the message content are processed for this. Emails are sent from Resend servers in Ireland (AWS region eu-west-1) or in the USA; Resend stores account, sending and delivery data in the USA. Resend is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); standard contractual clauses apply in addition. We do not track whether you open our emails or click links. See Resend's privacy policy.

5. Recipients

Your data is received only by the processors named above, Vercel, Supabase, Resend and, if you write to us, Google (section 8), which process it solely on our instructions (except for Vercel's own purposes named in section 3). We disclose data to authorities only where we are legally obliged to. We do not sell data and do not share it with third parties for marketing.

6. Fonts

We use the typefaces Instrument Serif, Geist and Geist Mono. They are downloaded when the website is built and served from our own server. Your browser does not connect to Google.

7. Cookies, analytics, tracking

This website sets no cookies, stores nothing in your browser or on your device, and uses no audience measurement, no advertising trackers and no embedded third-party content.

8. Contact by email

If you write to us, we process your details to answer your request (Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR; legitimate interest: answering your request). We delete them once the request is settled and no statutory retention obligations apply.

Our mailbox is operated by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Google Workspace), as our processor. Messages are stored on Google servers. Access by Google LLC in the USA cannot be ruled out; the basis for this is Google LLC's certification under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), with standard contractual clauses in addition. See Google's privacy policy.

9. Your rights

You have the right to:

• access your stored data (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR, see section 10),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Just email us at datenschutz@framura.app. We reply within one month.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

10. Right to object

11. Automated decisions

No automated decision-making, including profiling, takes place.

12. Obligation to provide data

Joining the waitlist is voluntary. Without an email address we cannot invite you to the beta test or tell you about the launch.

As of October 2026. This policy covers the website, not the app.