Privacy policy

This policy describes which personal data DettingenConnect processes, why this happens and what rights you have. It applies to the web app at dettingenconnect.de and to the apps for iPhone, iPad and Android. What lies behind it technically (cookies, servers, outgoing connections) is shown on the Transparency page.

1. Controller

Bürgerforum Buchhalde Dettingen gUG, Pfitznerweg 2, 72581 Dettingen an der Erms. Email: info@buefobude.de.

Data protection contact: info@buefobude.de.

2. Principles

We do not sell data and do not show advertising.
We do not use any tracking or analytics services, not even our own: there are no visitor statistics.
The app loads nothing from third-party servers: no fonts, no scripts, no maps. Even map images are fetched by our own server (section 5).
The server: CMO Internet Dienstleistungen GmbH, Rechenzentrum Reutlingen (Deutschland).
Others only see your full name if you set this; otherwise you appear with your first name and initial.

3. Which data we process

3.1 Account

First name and surname, email address, password (only as a hash, never in plain text), date of birth, how your name is displayed, the time you agreed to the terms of use and the time of your last sign-in. We need your date of birth for the age limits (section 3.2). If you do not confirm your email address, we remind you once after 23 days and delete the account after 30 days. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

DettingenConnect is available from the age of 14. If you are younger than 16, we ask for the email address of a parent when you register and send a consent link there. If consent does not arrive, we remind your parents once after seven days; after 30 days without consent we delete the account. Until consent is given, you can read but not take part. We store your parent’s email address and the times of the request, reminder and consent. Legal basis: legal obligation and consent (Art. 6(1)(c) and (a), Art. 8 GDPR).

Passkeys: we store the public key and an identifier; your fingerprint or face recognition stays on your device. Two-factor authentication: an encrypted secret and recovery codes. When security-relevant changes are made (new password, new passkey, two-factor on or off), we send you an email. You can only enter a new email address with your password; the previous address then receives a notice, even if the administration changed the address. For “Forgot password”, we do not reveal whether an account exists for an address.

For your sign-in, the server maintains a session. To protect against misuse, the server briefly counts sign-in, registration and “Forgot password” attempts per IP address and slows things down if there are too many attempts. Legal basis: performance of a contract and legitimate interest in secure operation (Art. 6(1)(b) and (f) GDPR).

We record important actions in the administration in a log with the person and time, such as changed settings, suspensions, deleted accounts and every look by moderation into a reported chat. If an error occurs in the app, the server writes it, together with the technical circumstances, to an error log.

3.4 Profile and “People”

You can voluntarily provide a profile picture, a short text, your district, hobbies with level, languages, characteristics, answers to questions (“You can … with me”), what you are looking for and when you have time, as well as a status such as “Up for a coffee” with an expiry time. You decide yourself how your age appears (exactly, as a decade or not at all); by default it is your exact age with your generation, for example “55 years · Gen X”. From your date of birth we also calculate your star sign and show it in your profile; you can switch this off under Settings › Privacy. Only those who show their age appear under “People” in the “Similar age” filter.

In the “People” area you can be found with your account (on by default), because the app exists so that people from the local area can find each other. You can switch this off at any time under Settings › Privacy with “Can be found in ‘People’”; you are then invisible there but can still see the others. Guests and search engines never see “People”. When you are visible, all other signed-in users see you, and we suggest you to people with shared hobbies, organisations or events (“For you”). For these suggestions we only compare what you have in common; we do not build a profile of you from this. Others only see whether you are currently online as long as you do not switch this off. Get-to-know requests (with a message of up to 300 characters) expire after 30 days without a reply; we delete the message 90 days after the reply. An expired status is deleted. If you say “Who’s coming along?” for an event, others with matching hobbies see this in “People”. Your profile also shows which organisations you are a member of, work in or take part in (never hidden organisations), and others can filter “People” by organisation; you can switch this off under Settings › Privacy with “Show affiliations in profile” (on by default). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). If someone founds a group for a hobby you have listed, we let you know; for this we only use your hobbies, and the new group learns nothing about you.

3.4b Place of residence

For your profile we need your place of residence: the country and, in Germany, Austria and Switzerland, the postcode, otherwise the town. Other signed-in users only see the town from this and how many kilometres apart the centres of your towns are, never the postcode; “Nearby” can also be used as a filter in “People” on this basis. Postcodes and town centres come from GeoNames (geonames.org, CC BY 4.0). For every place where someone lives, our server fetches a short description from Wikipedia (CC BY-SA 4.0) and the population figure from Wikidata at night; only the place is sent to Wikimedia, never anything about you. We take over your postcode from the old app if you had entered one. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.4a Handshake and home

If you say “I know them personally” about someone, we store who offered whom the handshake, and whether and when it was confirmed or silently declined – without location and without text. Once confirmed, only the two of you see it; others see at most the words “known personally” in your profile, if at least two people have confirmed this, never a number or a list. You can switch this off under Settings › Privacy. Nobody learns of a no. Blocking deletes the handshake. You can also voluntarily state your connection to the place: born here, grew up here, work here, and in which years you lived here. We take over your “known personally” markers from the old app as handshakes, together with your details on your place of residence. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.5 Stance (special category)

In your profile, under “Stance”, you can state where you stand in society and what matters to you, including religion. These are special categories of data under Art. 9 GDPR. This area is only available from the age of 18 and only after your explicit consent (Art. 9(2)(a) GDPR); we store the details in encrypted form. We record the granting and withdrawal of consent with the time in the log as proof (365 days). The details are never a search filter and are never used for suggestions. If you withdraw your consent, we delete the details immediately.

3.5a Activity feed “Happening now”

As long as you do not switch off “Appear in the feed” under Settings › Privacy (on by default), we record when you are new, join a public organisation, accept a public event, reach a new best score in a game, set a new profile picture or show a gallery to everyone with access to your profile. For this we store the type, the subject and the time. All signed-in users can see this. We group acceptances for the same event on the start page under “Happening now”, with the title, day, time and venue of the event, as on the event page under “Who’s going”; if someone taps “I’ll come along”, they accept the event and you receive a notification of who is coming along. Anyone who has blocked you or whom you have blocked sees nothing. We delete entries after 30 days, and immediately when you switch the feature off. Legal basis: our legitimate interest in a lively local community (Art. 6(1)(f) GDPR); you can object at any time with the switch (Art. 21 GDPR).

3.5b Check-in “I’m here right now”

If you check in at a meeting place in the app, we store the meeting place, your sentence about it, who can see it (everyone in “People”, people with the same hobbies or only your contacts) and until when – for at most three hours. We do not use GPS or your device’s location for this, only the place you select yourself. Those allowed to see it find you on the start page and on the place’s page and can tap “Come by”; you then receive a notification. Only people who can be found in “People” can check in; anyone who has blocked you or whom you have blocked sees nothing. When it expires or when you check out, we delete the entry.

3.5c Marital status and partner

You can voluntarily state your marital status under Edit profile › Family and link yourself to your partner if they also have an account. The linked person receives a request; only once they confirm does “Partner” appear with a link on both your profiles. If they decline, we store this so that the same request is not sent again, and we tell nobody. Marital status and partner are visible to everyone allowed to see your profile; you can switch both off under Settings › Privacy (for the partner, it is enough for one of you to switch it off). The legal basis is your consent (Art. 6(1)(a) GDPR). Unlinking or blocking deletes the link, as does deleting an account.

3.5d Children in the profile

You can voluntarily enter your children with first name and date of birth under Edit profile › Family. Only you can see these details; they never appear in your profile, in “People” or in search. We only use them to show you suitable events (“For Maik (10)”) and to show you events with an age range in “Happening now”. If you register a child via “Register Maik”, we store “with Maik (10)” with your registration; only the leader of that event can see this. About other families we only show a number without names, and only from three families upwards. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the entries; the details are included in your data copy and are deleted with your account. Registrations keep the note until they are deleted.

3.6 Organisations, events and meeting places

If you join or follow an organisation, we store the membership, role and times, and for organisations with rules also your agreement to them. The leaders only see followers as a number. Posts in an organisation bear your name.

If you register for an event, we store the registration, any guests you bring along with their names if you wish, a ticket code, the on-site check-in and a note to the leaders. At most twelve people appear under “Who’s going”, and only those who are visible in “People”. For your personal calendar link we store a random identifier; anyone who knows the link can see your events, and you can generate a new one at any time.

If you look after a meeting place, we store your role there. Room requests contain the purpose, a note and who made the request; they are seen by the caretakers of the meeting place and the leaders of the requesting organisation. Contact details of organisations and meeting places appear publicly or only for members, as the leaders set it. If you show “Meeting places near you”, the app only asks for your location when you tap and calculates the distances on your device; the location is not sent to our server. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.7 Images

Our server re-encodes images you upload as WebP; in the process, embedded details such as the location and camera are removed. Profile pictures and images of organisations, meeting places and events can be retrieved via their address by anyone who knows it. Photos at events and images in the chat are kept outside the public area and are only delivered to authorised persons. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.8 Chat

We store messages, voice messages, images, PDFs and reactions on our server so that you can read them on all your devices. The text of direct messages is stored there in encrypted form; messages in group chats are not. Images, voice messages and PDFs are stored unencrypted in a protected area that only the participants can access. There is no end-to-end encryption. Images in direct messages only arrive once the other person allows this for your chat. We store how far you have read; the other person sees this as a read receipt. So that people in a direct chat can see whether you are around, we store at most once per minute when you last used the app (“Active now”, “last active yesterday 21:14”). If you switch on “Hide my online status”, we delete this time immediately and no longer store it; in return, you cannot see it for others either.

Moderation only sees a chat if a message from it is reported, and then only the reported message together with the ten before and after it; every such look is logged. If a message to you remains unread for two days and again for seven days, we remind you by email. Emails about the chat only state who wrote in which chat, never the text. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.9 Notifications and emails

You decide under Settings which notices you receive and how (in the app, as push, by email, collected or not at all), your quiet hours and whether the lock screen shows content; we store these settings. We delete notices in the bell after 90 days, and notices waiting because of your quiet hours after seven days. We send a summary daily, weekly or not at all, as you set it (weekly by default), with titles, never with message texts.

For push we store the push address and keys that your browser or the app generates for this. We delete devices we have not reached for 90 days. Our emails contain no tracking pixels and no click tracking; we do not find out whether you open an email. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.10 Payments

If an event or a room costs something, you pay the organisation or the meeting place, not us. We store the payer, amount, purpose, status and receipt. For bank transfers we show you the organisation’s bank details. If you pay with PayPal, we redirect you to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; PayPal receives the payment number, description and amount and processes your payment data under its own responsibility. We only receive the confirmation. Legal basis: performance of a contract and statutory retention obligations (Art. 6(1)(b) and (c) GDPR).

3.11 Search

Search runs on our own server. People can only be found in it if they are visible in “People”, and only by name, hobbies and district. Chat messages are never searchable.

3.12 Reports, moderation and blocking

If you report a message, a profile, a post or a photo, we store you, the reported person, the content, the reason, your note and the decision. The reported person does not learn who reported them. If moderation suspends an account, we store the duration and reason, inform you of both by email and sign the account out on all devices. If you block someone, we only store whom and since when; you can then no longer write to each other and do not see each other in lists. Legal basis: legal obligation under the Digital Services Act and legitimate interest in protecting members (Art. 6(1)(c) and (f) GDPR).

3.12a Help & contact

If you write to us via “Help & contact”, we store the subject, text, the page you came from, your browser identifier and, if you send one, a screenshot, as well as the history with our replies. Without an account, we store your email address for the reply. Only the team sees the screenshot. We delete the request one year after the last message, or immediately with your account. Legal basis: performance of a contract or legitimate interest in answering your request (Art. 6(1)(b) and (f) GDPR).

3.13 News and info pages

News and info pages bear the name of the person who wrote them. If you follow an organisation, you receive its news as a notice.

Points

You receive points for helping out. For each entry we store the occasion, points and time. You only appear in the ranking if you switch this on.

Games

For games we store your results and best scores. Your name appears in leaderboards unless you switch this off under Settings › Privacy.

My Shelf

On your shelf we store the works you select (catalogue identifier, title, creator, year) and what you say about them (“read”, “fan” …). Others only see your shelf if you show it in your profile; shared works count as a reason for suggestions in “People”. We do not take over cover images.

Keys

If a meeting place issues keys or transponders, the caretakers of the meeting place store who has which key, for which rooms and times it is valid, when it was issued, whether the conditions have been signed, and a note. The caretakers of the place and you yourself can see this. Legal basis: performance of a contract and legitimate interest in protecting the rooms (Art. 6(1)(b) and (f) GDPR).

Weather

For the weather at the meeting place and at events, our server queries Bright Sky (brightsky.dev, data from the Deutscher Wetterdienst, the German Meteorological Service) with the coordinates of the meeting place or event. No data about you is sent in the process.

Radio

If you play a station, your device fetches the stream directly from the station’s server, just as when listening on its website. The station sees your IP address and your device in the process; the station list also points this out. Our server queries the station for the track currently playing without passing on anything about you. We do not store what you listen to.

Transfer from the previous app

If you had an account in the previous app, we have taken over your account: name, email address, password (as a hash), date of birth, profile picture, memberships, chats and the events of the last twelve months. Legal basis: continuation of the existing user agreement (Art. 6(1)(b) GDPR). You agree to the new terms of use when you first sign in; only then can you be found in “People”. If your profile in the old app was not public or you had hidden your online status, this continues to apply here.

4. Cookies and storage on your device

We only set technically necessary cookies: the session, a protective token against forged requests, a sign-in token for 400 days if you choose “Stay signed in” and, only if you set light or dark permanently, a cookie for that. On your device, the app stores drafts (for example of an event), messages not yet sent and the text size in the chat; this only reaches our server when you send it. No consent is required for this (Section 25(2) TDDDG, the German Telecommunications Digital Services Data Protection Act). Names and lifetimes are listed on the Transparency page.

5. Recipients

Within DettingenConnect, only the people who need your data for their task can see it: leaders their organisation, caretakers their meeting place, moderation reported content, admins the administration.

Outside:

Server: CMO Internet Dienstleistungen GmbH, Rechenzentrum Reutlingen (Deutschland), as our processor.
Push: If you have switched on push, a notification goes via the push service of your browser or device (Apple for iPhone and iPad). It receives your device’s push address and the text of the notification, which you can limit to a neutral notice in the settings.
PayPal: only if you pay with PayPal (section 3.10).
Wikidata and Wikipedia (Wikimedia Foundation): Our server fetches short descriptions of places of residence at night; only the place is sent there, no data about you (section 3.4b).
Catalogues for My Shelf: If you search for a work, our server queries Wikidata (Wikimedia Foundation), MusicBrainz (MetaBrainz Foundation) or Open Library (Internet Archive). Only the search term is sent there, never your IP address or anything from your account. We answer identical searches from our cache for a week, without recording who searched.
Radio stations: only if you play a station; your device then connects directly to it (section Radio).
Map images: Our server fetches missing map images from tile.openstreetmap.org and stores them itself. Your browser only asks our server; tile.openstreetmap.org learns nothing about you.

Push services and Wikimedia may be located outside the EU, as may the catalogues for My Shelf (search terms only, no personal data). Apple (Apple Inc.) and Google (Google LLC) transmit push notifications to the USA; both are certified under the EU-US Data Privacy Framework, for which the European Commission has determined an adequate level of protection (Art. 45 GDPR). No other transfers to third countries take place.

6. Storage period

Account, profile, images, memberships: until you remove them or delete your account.
Pause: If you pause your account, everything remains stored; you are merely invisible and only receive emails about security and payments until you sign in again.
Deleting your account: After your request, the account is immediately invisible and is permanently deleted after 14 days; until then you can cancel the deletion by signing in again or with the link in our email. We only store a reason for leaving if you give one, and without any link to your account. Your profile, images, memberships, acceptances, requests to us and your data copy disappear. The following remain without your name (“Former member”), so that the conversations and processes of others remain understandable: your messages in group chats and, for the other person, in direct chats, photos at events, posts in organisations, room requests and reports. If you are the last person leading an organisation, you hand it over beforehand.
Account without parental consent: 30 days after the request.
Email address never confirmed: 30 days after registration, following a reminder with the exact date.
Chat: until you or the other side deletes the message or the chat is deleted.
Get-to-know requests: expire after 30 days without a reply; we delete the message 90 days after the reply.
Status: when it expires. Parent’s email and consent: as proof, as long as the account exists.
Reports: one year after the decision. Requests via Help & contact: one year after the last message.
Failed background jobs (may contain the content of notifications): 30 days.
Activity feed: 30 days, immediately when you switch it off.
Check-in: until it expires (at most three hours) or until you check out.
Bell: 90 days. Push devices: 90 days after the last contact.
Data copy: 7 days after it was created.
Deleted organisations: permanently after 90 days.
Payments and receipts: for as long as tax and commercial law requires.
Stance: until you withdraw your consent.
Administration log: 365 days. Error log: 14 days.
Backup copies: We back up the database regularly; the copies remain on the server for about 2 days. What you delete therefore only disappears completely with the last copy.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. You can create a copy of your data yourself under Settings › My data; you can also delete your account there. Otherwise, contact info@buefobude.de. You can lodge a complaint with a data protection supervisory authority.

8. Security

Encrypted transmission (TLS), passkeys and two-factor authentication, encrypted text of direct messages and encrypted stance details, private files only via verified links and never in third-party caches, login credentials stored in encrypted form in the administration, role-based permissions and a log of moderation interventions.

9. Changes

We adapt this policy when functions or the legal situation change. The date is shown at the top. Changes to the app are listed under “What’s new”.