Last updated: October 10, 2026
The controller responsible for processing your personal data (Art. 4(7) GDPR) is:
Finn Strehl (Strehl Digital)We have not appointed a data protection officer, as we are not legally required to.
Your email address, and either a password (stored only as a hash by our hosting provider Supabase) or, if you sign in with Google, your Google account ID, email address and name. We use your first name to greet you in the app.
Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).
For each challenge: your goal, schedule, duration, time zone, reminder time, amount per miss, chosen charity and proof method, any description you write of how you will prove it, and, for GPS check-ins, the place you picked (its name, coordinates and radius). We also store the state of each required occurrence (done, waiting for review, missed).
Legal basis: Art. 6(1)(b) GDPR (performance of the challenge agreement).
Who sees your proofs. Photo and screenshot proofs are reviewed by people we have authorised to do so, who are bound to confidentiality. GPS check-ins and your own confirmations are accepted automatically and not reviewed. Please do not submit images showing other people or sensitive information.
AI-assisted review. In future we may use automated tools, including AI-based image analysis, to help review photo and screenshot proofs. Before we start, we will update this policy with the provider and the details of that processing and tell you in the app.
Legal basis: Art. 6(1)(b) GDPR.
For each miss: the amount, the dates, its status, the charity, and the payment status. For disputes: the reason you give and our decision. For payment: your Stripe customer ID and the ID of your saved payment method. We never see or store your full card number.
Legal basis: Art. 6(1)(b) GDPR; and Art. 6(1)(c) GDPR for the records we are required to keep under German commercial and tax law (§ 257 HGB, § 147 AO).
Messages we show you in the app (for example that a proof was reviewed or a miss was confirmed), and whether you have read them. If you allow push notifications, a device push token and your device platform, used to send you notifications about your challenges.
Legal basis: Art. 6(1)(b) GDPR. You can turn push notifications off at any time in your device settings.
The app asks for camera access (photo proofs), location access while the app is in use (GPS check-ins and picking a place), access to images you select (screenshot proofs), and permission to send notifications. Each is requested only when you use the feature, and you can revoke it in your device settings.
The app keeps your login session and any unfinished challenge setup on your device. Unfinished setups are removed after 7 days. This is strictly necessary to provide the app (§ 25(2) TDDDG).
When the app talks to our servers, our hosting provider records technical data such as IP address, time and the request made, to keep the Service secure and working. These logs are kept for a short period only (no longer than 90 days).
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable service).
We do not use analytics, advertising or tracking tools in the app or on the website.
Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit it, Netlify processes your IP address, the page requested, the time and your browser's technical information in order to deliver the page, and keeps server logs for a short period. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering the website securely).
The website uses no cookies and loads no external fonts or scripts.
Waitlist. If you enter your email address to be told when the app is available on the App Store or Google Play, we store it with the time and platform. We use it only for that one message and delete it afterwards, or earlier if you ask us to. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by email.
| Recipient | What for | Data |
|---|---|---|
| Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992), processor | Database, login, file storage and server functions. Our data is stored in the EU (Ireland). | All data described in section 2 |
| Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland) | Saving your card and processing charges | Email address, user ID, card data you enter with Stripe, payment details |
| The charity you chose | Receives the payment for each charged miss as merchant of record, through its own Stripe account. The charity is a separate controller for its payment records. | Payment amount and date, card details as provided by Stripe (e.g. card brand, last four digits, expiry, country) |
| Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) | Sign in with Google, only if you choose it | Sign-in data between you and Google |
| Expo (650 Industries, Inc., USA), processor | Delivering push notifications, only if you allow them | Push token, notification content |
| Mapbox (Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA) | Showing maps when you pick a place and when you check in | IP address, the map area displayed, device information |
| OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) | Searching for places and showing a place's address (Nominatim) | IP address, the search text, or the coordinates of the place you picked (not your own position) |
| Netlify (see section 3) | Hosting the website | Website access data |
We use the map and place services on the basis of Art. 6(1)(b) GDPR (they are needed for the GPS check-in feature you chose) and Art. 6(1)(f) GDPR. If you use photo, screenshot or your-word proofs, no data is sent to Mapbox or OpenStreetMap.
Some recipients are located in, or may access data from, the USA or other countries outside the EU. Such transfers take place on the basis of the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). The United Kingdom has an adequacy decision (Art. 45 GDPR).
Some decisions are made automatically and can lead to a charge:
Photo and screenshot proofs are decided by a person (in future possibly assisted by AI, see section 2). You agreed to this mechanism when starting a challenge, so it is necessary for the contract (Art. 22(2)(a) GDPR). To protect you, every miss has a dispute window of at least three days before anything is charged. A person decides every dispute, and you can present your point of view (Art. 22(3) GDPR).
| Data | Retention |
|---|---|
| Account and challenge data | As long as your account exists |
| Proof images | Deleted 30 days after the challenge ends. Kept longer only while a proof is still under review, a miss is still being disputed or a payment for it is still outstanding, and deleted once that is resolved. |
| Proof records (date, decision, reason — without the image) | As long as your account exists |
| Records of charged misses, including the terms of the challenge they belong to | 10 years (§ 257 HGB, § 147 AO), even after account deletion |
| Push tokens | Until you delete your account or the token is replaced |
| Technical logs | No longer than 90 days |
| Waitlist email | Until we have sent the launch message, or until you withdraw your consent |
When you delete your account, we delete all of your data except the records we are required to keep by law. Those are kept for the statutory period and then deleted.
You have the right to:
To exercise these rights, email strehldevs@gmail.com. We respond within one month.
You also have the right to lodge a complaint with a supervisory authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, ldi.nrw.de.
You need an email address to create an account, and a payment card to start a challenge. Without these we cannot provide the Service. Everything else — Google sign-in, push notifications, location — is optional and only needed for the feature concerned.
We update this policy when the Service or the law changes. We will tell you about material changes in the app or by email. Where a change requires your consent, we will ask for it first.
Privacy questions: strehldevs@gmail.com