Privacy notice Preliminary version
As of: 0.79be-b354
Controller
The controller for the processing is the operator of this application. Name and address are stated in the Imprint.
What data is processed
Only data required to run the inventory or that you enter yourself.
| Category | Examples | Source |
|---|---|---|
| Account | Username, e-mail, password (hashed only), role, registration, last sign-in | your entry |
| Content | Locations, items, custom fields, receipts, images | your input |
| Settings | Language, currency, appearance, views | your choice |
| Location (marketplace only) | Postcode, city, country, coordinates | your entry, voluntary |
| Communication | Chat messages, handovers, invitations | your usage |
| Security | Two-factor secret (encrypted), tokens (hashed only), IP address in server logs | technical |
| Subscription and AI | Tier, credit balance, usage log | your usage |
Who gets to see the data besides us
There is no tracking, there are no analytics tools and no advertising networks. This server also serves libraries and fonts itself — opening the page sends no request to any third-party provider.
| Service | Purpose | When |
|---|---|---|
| OpenAI (USA) | Image and receipt recognition, translation of forum posts | only if you use the AI or read the forum in another language and the operator has set it up. The provider does not retain request or response. In your profile you can decline AI processing entirely; you then read only originals in the forum and cannot write there. Posts written before continue to be translated for others. |
| Stripe (USA) | Payment for credit and subscriptions | only if you buy something. You enter the payment details directly with Stripe, they do not pass through this server; what we transmit is an identifier of your account and what is being bought — not your name and not your e-mail address. |
| Firebase Cloud Messaging (USA) | Push notifications | only with push set up; the message text is not included |
| Nominatim / OpenStreetMap (EU) | Postcode and city to coordinates | only for the marketplace location |
| Product databases (EU) | Barcode lookup | only when scanning a barcode; the number is transmitted, no personal reference |
| E-mail provider | Verification, password reset, invitations | when such e-mails are sent |
How long data is stored
Your data remains until you delete the account. It is then removed across all tables, including the encrypted image files.
There is exactly one exception: if an account was granted the one-time AI credit, a record of that remains. It contains the e-mail address only as a hash, not in plain text, and prevents the same credit from being collected repeatedly by deleting and re-registering. On request this record is removed as well.
Your rights — and where they are in the app
The rights under the GDPR apply: access, rectification, erasure, restriction, data portability, objection and the right to lodge a complaint with a supervisory authority.
| What you want | Where to do it |
|---|---|
| Download all your own data | Profile → Privacy & Account → Export my data; either as JSON or as a ZIP including your own images |
| Delete account and all data | Profile → Privacy & Account → Permanently delete account (with password confirmation) |
| Decline AI processing | Profile → Privacy & Account |
| Correct information | Edit profile; content directly at the location or item |
How the data is protected
Images and particularly sensitive fields are stored encrypted on the server (AES-256-GCM); images are only reachable through an authenticated request, not via an open folder.
Passwords are stored as a hash only, tokens likewise and with rotation. Two-factor sign-in is available; its secret is stored encrypted.
Transmission uses TLS. Rate limits and a strict Content Security Policy guard against misuse.
Server logs
The server records requests, including the IP address, and limits the number of requests in order to prevent misuse. E-mail addresses are masked in the process. Administrative operations are logged separately.
This happens on the server and not on your device. It can therefore be neither enabled nor disabled through a cookie dialog.
Cookies and storage technologies
This website uses only technically necessary storage technologies. There are no analytics, advertising or marketing services and no third-party embeds — so there is nothing to consent to and no cookie dialog.
soord_session-
Keeps the session together: sign-in, protection against form forgery (CSRF) and one-off notices.
What is stored: A signed session identifier. No name, no email address, no behaviour. · Duration: Up to 30 days; the exact value is configurable in the administration (webapp_session_lifetime_days). · soord (first party) soord_consent-
Remembers your decision about this selection so you are not asked again on every visit.
What is stored: The version of the selection, the chosen categories and the time. No identifier that makes you recognisable. · Duration: 182 days · soord (first party)
Controller, address and contact: Imprint