Effective Date: October 28, 2025
Last Updated: October 28, 2025
The controller for data processing is the operator of wohnli. Contact details can be found in our Impressum.
For GDPR inquiries: If you have questions about your data or wish to exercise your rights, please contact us through the application support features.
We process your data based on the following legal grounds under GDPR Article 6:
When you create an account, we collect:
We automatically collect information about how you use the Service:
Analytics Note: Usage analytics are collected without cookies or persistent storage. Data is processed anonymously and cleared on page refresh.
We use your information to:
When you join a household, the following information becomes visible to other household members:
Important: Your email address and account settings remain private and are not shared with other household members.
We use the following third-party services as data processors under GDPR Article 28:
Purpose: User authentication, secure login
Data shared: Email address, authentication tokens
Location: EU/US (Google Cloud Platform)
Legal basis: Contract performance (Art. 6(1)(b))
Safeguards: Google's EU Standard Contractual Clauses
Privacy Policy: Google Privacy Policy
Purpose: Usage analytics, performance monitoring
Data storage: Memory only - no cookies or persistent storage
Location: EU (Frankfurt, Germany)
Legal basis: Legitimate interest (Art. 6(1)(f)) - minimal processing
Safeguards: EU-based, cookieless, session-only data
Privacy Policy: PostHog Privacy Policy
Cookieless Implementation: No persistent tracking, no session recordings, data cleared on page refresh.
Purpose: Application hosting, data storage
Data shared: All application data (encrypted)
Location: EU datacenter
Legal basis: Contract performance (Art. 6(1)(b))
Safeguards: EU-based hosting, encryption at rest
Contract: Data Processing Agreement in place
When data is transferred outside the EU (Google Firebase), we ensure adequate protection through:
We implement appropriate security measures to protect your information:
Your data is stored securely and is only accessible by you and authorized household members.
System administrators ("authorized personnel") have limited access to user account data, including email addresses, for specific legitimate purposes only:
Legal Basis: Contract performance (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR)
Safeguards: All administrative access is logged and audited. Access logs are retained for 90 days for accountability and security purposes.
We retain your information for as long as your account is active or as needed to provide the Service. Specifically:
Under GDPR, you have comprehensive rights regarding your personal data:
Request information about your data and processing activities
Correct inaccurate personal data
"Right to be forgotten" - delete your data
Export your data in machine-readable format
Limit how we process your data
Object to processing based on legitimate interest
You can exercise most rights directly in the application settings, or contact us through the support features.
Response Time: We will respond to your request within 30 days (GDPR Art. 12).
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in your EU country of residence.
Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your privacy rights in accordance with applicable data protection laws.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the application. Changes will be effective immediately upon posting.
We use minimal essential cookies and cookieless analytics:
Authentication Session: Login security and CSRF protection
Theme Preference: Remember dark/light mode choice
Duration: Session (auth) / 1 year (theme)
Legal basis: Necessary for service operation
PostHog Analytics: Usage patterns, performance monitoring
Storage: Memory only - no persistent tracking
Duration: Page session only (cleared on refresh)
Legal basis: Legitimate interest (minimal processing)
Cookie Management: Only essential cookies are used. You can disable them in browser settings, but this may affect functionality. No consent required for cookieless analytics.
If you have any questions about this Privacy Policy or our data practices, please contact us:
For GDPR-specific inquiries: Please clearly indicate that your inquiry relates to data protection rights under GDPR when contacting us.