Privacy notice

1. Data controller and contact details

Email: [email protected]
Phone: 01608437411

This information covers the achja-app.de website and the Android app “Ach ja! – The family organizer.” For privacy and deletion questions, use the contact details above.

2. Visiting the website

The website is hosted on Cloudflare Pages. When you visit, your IP address and technical connection and request data are processed to deliver content and detect attacks and disruptions. This may include the time, requested URL, browser information and the previously visited page.

Providing and securing the website serves our legitimate interest in operating a functional, secure website under Article 6(1)(f) GDPR.

The browser displays the intro and generates its sound. The website loads the logo and scripts from its own hosting and embeds no external fonts or ad networks. The interactive examples are demonstrations. Tasks clicked there are never sent to the app database.

The website code contains no analytics scripts, cookies or browser storage for visitor profiles. Before finalizing this notice, we will check whether additional Cloudflare analytics or security features are enabled and what retention periods apply. The website code alone does not establish this.

Contact by email

When you email us, we process your email address, message and any other information you provide to handle your request. For requests concerning use of the service, the basis is Article 6(1)(b) GDPR. For other matters it is Article 6(1)(f), and for legal obligations it is Article 6(1)(c). The email provider and specific retention periods will be added before release.

3. Data processing in the app

Account and family membership

Registration, sign-in and account management involve processing your email address, credentials, user ID and profile name. Family identifiers and memberships link you to your family group. Supabase handles account management and synchronization. Sign-in and session settings are also stored on your device.

Shared family content

Calendar entries, tasks with assignments and reminders, shopping lists, notes, recipes and meal plans are processed to provide and synchronize these features. This includes your text, dates, assignments and related creation or modification details. Other family members can see shared content and profile names in the relevant features. Recipes submitted for publication are sent to the provider for review. Approved recipes may become available to other app users.

Processing to provide requested app features is generally based on Article 6(1)(b) GDPR. Only add content about other people when you have the appropriate authorization. Please avoid entering health data or other particularly sensitive information if processing it is unnecessary for organizing family life.

Audio notes and voice input

Audio notes require microphone permission. Audio notes you record and save are uploaded to Supabase Storage and made available through the shared family note. The app may create local files for recording and playback.

Dictation launches the Android speech recognition service available on your device. It may send voice data to its provider for recognition, depending on your device and speech service. The recognized text is returned to the app and processed if saved as a note. The current code does not enforce on-device recognition. Before release, consent and in-app disclosures for optional microphone processing need review. Android permission alone does not replace any required privacy consent.

Shift schedules from PDF

Your selected PDF is read on the device using PDFBox and, if needed, ML Kit for text recognition. In the reviewed import flow, the PDF is never uploaded to our server. The temporary copy is deleted after reading, and your original file is kept.

Once you confirm, the selected shifts are stored in Supabase as calendar entries with a title, start and end times, and user and family associations. Your family can see them. Some recognition profiles and import settings are stored on the device. Although PDF content is processed locally, ML Kit may process technical data. Google describes device, app and usage information used for diagnostics and analytics.

Waste collection

The entered postal code, city, street and house number are sent to a Supabase server function to look up collection dates. Depending on the location, it queries external sources, including AbfallPlus/K4. For address-based lookups, the necessary address details or derived location identifiers are shared with the collection service. The feature uses the address you enter and needs no GPS permission.

Notifications

Firebase Cloud Messaging delivers push notifications. A device or installation identifier or delivery token is processed, and the push token is linked to your user account and family in Supabase. Notification content, such as the title of a task that is due, may be sent to Google for delivery. You can control whether notifications are displayed in Android settings. Turning them off does not automatically remove existing push identifiers.

Collection reminders can also be scheduled locally. Depending on your device settings, notifications may be visible on the lock screen.

Advertising with Google AdMob

The Android app includes a banner on the home screen and a full-screen ad after a waste schedule import requested using the load button succeeds and is saved. The full-screen ad appears at most once per 24 hours and only when ready. The app stores the time the last full-screen ad actually appeared in local settings. This timestamp is independent of any family account and our ad code does not send it to our server or AdMob. It is overwritten by the next full-screen ad and removed when local app data is cleared. Android device backup may include it. No full-screen ad is shown if none is available, an import fails or an update runs automatically. Development builds use Google test ads. Google AdMob is planned for release. All ad requests use child protection settings and a maximum ad content rating of G regardless of age. Personalization and Publisher First-Party ID are disabled. Permissions for Android Advertising ID and Android AdServices are removed. The app asks for a date of birth once before first access to the main area. Only the resulting age group is stored locally per account. The date of birth is discarded and never sent to our server or family members. The local age group is excluded from backup and device transfer and removed when account deletion succeeds. Our ad code does not send your task, shopping list, note or family profile content to AdMob.

Google AdMob funds the app. The Google Mobile Ads SDK may process IP addresses, technical device and app details, diagnostic and performance data, ad interactions and, depending on its configuration, app or device identifiers. IP addresses may be used to estimate location. Processing supports ad delivery, measurement, diagnostics and fraud prevention. Removing Android Advertising ID permission can still leave other technical identifiers in use. Personal data can still be processed under child protection settings. The UMP SDK checks privacy status before requesting ads and treats all users as below the age of consent as a precaution. Ads are skipped if this check fails. If the SDK requires it, ad privacy options can be reopened under Settings and Legal.

Non-personalized ads can also involve access to device storage and processing of personal data. The age check, Android permissions and a successful UMP status check do not replace legally required consent. Before release, the actual ad delivery setup, any required consent and the treatment of minors must be reviewed. The specific legal basis, provider and contract details, international transfers, retention periods and full implementation of the Families policy must be finalized and documented before publication. The G content rating does not guarantee the suitability of each individual ad. More information: Google Mobile Ads SDK data processing and AdMob Families configuration.

Local storage and device backup

The app stores settings, session information and feature-related data on the device. The current development version allows Android backups. Whether and where data is backed up depends on device and account settings. The exact backup scope will be reviewed before release.

4. Recipients, service providers and international processing

• Supabase: Authentication, database, file storage, synchronization and server functions. Data processing information.
• Google/Firebase: Firebase Cloud Messaging and technical processing related to ML Kit. Firebase privacy information and ML Kit data processing.
• Google AdMob and User Messaging Platform (UMP): Banner and full-screen advertising and checks of advertising privacy status. The current app code includes no additional mediation ad networks. The applicable Google contracting entity and its privacy role will be verified against the AdMob account before release. Google Privacy Policy, Google advertising technologies and Ad SDK data processing.
• Cloudflare: Website delivery and security. Cloudflare privacy notice.
• Other recipients: Family members for shared content, the provider of the speech service selected on your device for dictation, and the relevant collection service for address-based waste schedule lookups.

These services may process data outside the EU or EEA. The actual Supabase region, contracted providers, data processing agreements and applicable safeguards for international transfers will be verified before this notice is finalized. We make no commitment to storage exclusively in Germany or the EU.

5. Storage, security and deletion

Accounts and saved family content are retained to provide the relevant features. The app uses HTTPS for its intended cloud connections. Protection also depends on access rules and server configuration, which need review before release.

You can delete individual items in the corresponding app features and request account deletion on this website. Account deletion is also provided in the app settings.

Complete server-side account deletion has yet to be verified. Before publication, handling and retention or deletion periods for shared content, audio files, push identifiers, logs and backups will be finalized and documented here. Uninstalling the app does not automatically delete your account on the server.

6. Your data protection rights

Subject to the relevant legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. You can withdraw your consent at any time with effect for the future.

Right to object: If processing is based on legitimate interests, you may object on grounds relating to your particular situation under Article 21 GDPR. Send requests to [email protected]. If there are reasonable doubts about your identity, we may request additional information necessary to verify it.

You have the right to lodge a complaint with a data protection supervisory authority. For a provider in North Rhine-Westphalia, one contact is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information .