Privacy policy

The short version

• Locations and walk-home destinations are end-to-end encrypted. Only the phones in your group can read them; I, the operator, cannot.
• Your phone number and name are stored encrypted on my server in Germany. The server only decrypts them when it needs them, for example for a text message.
• The website sets no cookies and uses no analytics or advertising services. Neither does the app.
• You can delete your account in the app at any time and export your data there.

1. Controller

The controller is Rene Schnitzler, Altengai 13, 77933 Lahr/Schwarzwald, Germany.

Email: support@clypa.app. Please use this address for all data protection requests.

2. Visiting this website

So that your browser can load the page, the server has to process your IP address, the date and time and the requested address. This is used for delivery only and is not stored in access logs. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is operating the website securely.

The website sets no cookies. Fonts, videos and animations come from this server; nothing is loaded from third parties such as Google Fonts. If you close the "Join the beta" notice on your phone, your browser remembers that in session storage for the current session. This happens only because you expressly ask for it (§ 25(2) no. 2 TDDDG) and ends when you close the browser.

The web demo of the app uses sample data only. For its map, your browser loads map images from OpenFreeMap (see section 6).

3. Beta sign-up

When you sign up for the beta, I store your email address, your platform (iPhone or Android), your language and the time and version of your consent. You receive an email with a confirmation link; you are only signed up once you confirm. Unconfirmed sign-ups are deleted 7 days after the link expires (48 hours).

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email.

4. Contact by email

If you write to me, I process your address and your message to reply (Art. 6(1)(b) or (f) GDPR). Emails are kept on my own mail server in Germany. I delete them once the request is settled, unless statutory retention periods apply (§ 147 AO, § 257 HGB).

5. The Clypa app

The legal basis for everything the app needs to work is the contract of use (Art. 6(1)(b) GDPR). Where I ask for your consent, Art. 6(1)(a) GDPR applies. Abuse prevention and operational security rest on Art. 6(1)(f) GDPR.

Account: phone number, display name, date of birth (for the age check), language, consents, settings and a random account and device identifier. Sign-in uses a six-digit SMS code that is stored only as a check value. The number and documents are encrypted on the server with AES-256-GCM; the number can also only be found through a keyed lookup value.

Groups: who is in which group, roles, plan, invitations. The server sees these, because it could not deliver messages otherwise.

Location and places: locations, saved places and walk-home destinations are encrypted on your phone before they reach the server. It stores encrypted data only and sees when something is delivered, not what it says. Location is only shared after your consent, and in the background only during an alarm or a sharing session you started. There is no permanent location history.

Alarm: when you trigger an alarm, the server processes the time, the trigger, the status, the recipients and their response so that your group is alerted. Your location goes along encrypted if you agreed to that. If nobody responds, your priority contacts get a text message after 120 seconds (Family plan). It contains no name, no place and no link. An alarm can allow conclusions about your health. Where that is the case, processing rests on your explicit consent (Art. 9(2)(a) GDPR) and, if you cannot consent yourself, on the protection of vital interests (Art. 6(1)(d), Art. 9(2)(c) GDPR).

Priority contacts: if you add someone, I process their name and phone number to invite them by text message. They only become a priority contact after confirming (Art. 6(1)(a) GDPR) and can withdraw at any time. Until then the invitation rests on Art. 6(1)(f) GDPR. Please only add people who expect it.

Crash detection: while the app is open it evaluates motion sensors. This happens only on your phone. Only an alarm resulting from it reaches the server.

Address book: the app reads it only when you pick someone from it, and only on the phone. Only the contact you pick reaches the server.

Profile photo: it stays on your device and is not uploaded.

Lock screen: so that you can raise an alarm without unlocking, your phone creates its own key in the security chip. The server stores only the public part.

Purchases: subscriptions run through the App Store or Google Play. I receive no payment details. I receive the product, term, status and a purchase ID to match the purchase to your account.

Push notifications: so that your phone can be woken, the server stores a device address (push token). Push messages contain none of your data in plain text. Without notification permission, receiving alarms does not work reliably.

Data stored on the device: the app stores only what it needs to work, such as the session and keys in the device's protected storage (§ 25(2) no. 2 TDDDG).

For children and teenagers

Clypa helps you get help when you need it. I store as little as possible to do that. Only the people in your group can see your location. I sell nothing about you and show you no ads. If you have questions, talk to your parents or write to me.

You can have your own account from age 16. For younger children a parent creates the profile and consents for them (Art. 8 GDPR); I store who did that and when. Parents can withdraw consent and delete the profile at any time. Teenagers can withdraw themselves.

6. Recipients

I do not sell data. The only recipients are:

• netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany: hosting of website, API, database and mail server as a processor (Art. 28 GDPR).
• seven communications GmbH & Co. KG, Willestr. 4-6, 24103 Kiel, Germany: sending text messages as a processor. The provider receives the phone number and the text. According to its terms it stores traffic data for up to 60 days after billing.
• Google (Firebase Cloud Messaging) as a processor: delivery of wake-up messages. It processes the Firebase installation ID and push token.
• Apple (Apple Push Notification Service): delivery of wake-up messages to iPhones.
• Apple and Google as app stores: they process downloads and purchases under their own responsibility and privacy policies.
• OpenFreeMap (Hyperknot Software Kft., Hungary): supplies the map images. Your device fetches them directly, which transmits your IP address. The provider states that it logs access without IP addresses, deletes error logs after 7 days and may use Cloudflare as a network. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a map without an account at a large map provider.
• Members of your group and your priority contacts, where you share content with them or trigger an alarm.
• Authorities, where I am legally obliged.

7. Transfers to third countries

I process the data in section 5 on my server in Germany. Google and Apple may also process push data in the USA or other countries. Google LLC is certified under the EU-US Data Privacy Framework, which is covered by the European Commission's adequacy decision (Art. 45 GDPR). Otherwise the contractual safeguards of the providers apply (Art. 46 GDPR).

8. How long data is kept

Data is deleted once its purpose ends. In detail:

• Account: until you delete it. You start deletion in the app.
• Sign-in code: valid for 5 minutes, record deleted after 24 hours.
• Session: expires after 60 days without use and is removed 30 days later.
• Child device that was never paired: after 7 days.
• Last encrypted location: 14 days at most.
• Alarm: 90 days. The alarm location is deleted when the alarm ends, otherwise one day after the 60-minute alarm window.
• Invitations: 30 days.
• Push token: after 60 days without an update.
• Revoked lock-screen keys: 30 days.

Statutory retention duties remain unaffected.

9. Security

Connections use TLS. Locations are end-to-end encrypted, numbers and documents are encrypted on the server. The database and internal services cannot be reached from the internet. Nobody can guarantee complete protection; what the server can see is stated openly in section 5.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). Much of this works directly in the app; otherwise an email is enough.

Withdrawal: you can withdraw consent at any time with effect for the future (Art. 7(3) GDPR), in the app or by email. Processing up to that point remains lawful.

Objection: where I process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Complaint: you can complain to a supervisory authority. Mine is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, poststelle@lfdi.bwl.de.

11. Duty to provide data, automated decisions

You are not obliged to provide data. Without a phone number and date of birth, however, no account can be created, and without location consent no location goes along with an alarm. There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling.

12. Changes

If processing changes, I update this policy. The version published here applies.