Privacy Policy

Last updated: October 2026 · In accordance with the DSGVO (GDPR)

1. Controller

Olaf Scholtka
c/o POSTFLEX #PFX-521-238
Emsdettener Straße 10
48268 Greven, Germany
Email: ki.gwendrich@gmail.com

2. What data we collect

When you register

• Name (first name, last name)
• Email address
• Phone number (mandatory during registration): People who are connected to you via a senior in the app — relatives and other helpers in the same circle, as well as authorized representatives — see it in the people view and can call you, write to you or open your preferred messenger. When tapped, the app transfers the number to the respective app on their device (phone, SMS, WhatsApp, Telegram, Signal, Viber or LINE); what they do with it depends on their terms. We do not send notifications to the phone number, but as a push notification to your device.
• Country and preferred language
• Role (senior, relative, friend or neighbor, everyday companion, cleaning or household help)

When you use the app (health data, special categories under Art. 9 DSGVO)

• Medication plans and intake times
• Fluid intake and hydration data
• Wellbeing status (green/yellow/red)
• Date of birth and gender (for seniors, optional)
• Notes on your well-being

This data is processed exclusively on the basis of your explicit consent (Art. 9 Abs. 2 lit. a DSGVO). Consent is given actively in the app and can be withdrawn there at any time with effect for the future (Art. 7 Abs. 3 DSGVO). The exception is the emergency call: The people in your sequence will also see it, even if you have not consented.

Who sees what in your circle

You yourself see all your data. For the other people in your circle, the following applies:

• Relatives only see your medications and intake, your well-being, and your fluid intake if you share this area with them. Each area is shared individually; at the beginning, nothing is shared. In addition, you must have consented to the processing of your health data. Only you or your confirmed guardian can grant or withdraw this access.
• Your confirmed guardian sees your medications and intake, your well-being, and your fluid intake even without individual sharing, if you have consented (see "Guardianship").
• Helpers for cleaning, household, or everyday support, as well as friends and neighbors, never see your medications, your well-being, and your fluid intake.
• Supplies and appointments are only seen by the people you share them with (see "Shopping and supplies" and "Appointments").
• Service providers with whom you have an agreement do not see any of your health data.
• People in your sequence for alarms see in the app which alarm was active: an emergency call, a critically reported well-being, or that you did not check in — even if you have not shared your well-being with them. If you have not defined a sequence, this applies to all your relatives. They will also see an emergency call even if you have not consented.
• Anyone with whom you share your well-being or fluid intake also sees whether you have set up this function, whether your reminder is switched on, and whether relatives are notified. They also see this even if you have not yet consented. Values such as your well-being or your fluid intake are not included.

Shopping and supplies

You can enter shopping items in the app: what is needed, in what quantity and in which category, plus the status (open or done), who created the entry and who took it on, each with a timestamp. For supplies there are also the name, category, package size and unit, the current stock, the daily usage, the warning period and a free-text note. These entries are not health data. Shopping and supplies are only seen by the people in your circle with whom you share them — for example, so that someone can go shopping for you. Anyone with whom you share supplies sees all entries, regardless of the category. The entries are machine-translated for display in the respective person's language (see point 5). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Appointments

Appointments (title, time, location, with whom, note) are seen by the people in your circle with whom you share appointments — relatives, helpers, friends, and neighbors. Anyone linked to an appointment, for example as an escort, also sees this appointment without sharing. No consent to the processing of health data is required for this. If you enter a doctor's appointment, they will also see this.

Family feature

Family members can send the senior a photo (with an optional caption) and short messages. This content is stored on servers in the EU (Supabase, Ireland) and deleted automatically (photos after 7 days, messages after 30 days); the senior can delete photos themselves at any time. Legal basis: performance of a contract/consent (Art. 6 Abs. 1 lit. b or lit. a DSGVO, respectively).

Location (only for service provider assignments, voluntary)

At the start or end of an assignment, the app can check whether the service provider is near the stored assignment address. To do this, the current location is determined once on the device and compared there with the address. The location is not transmitted to us and not stored — only the result "nearby: yes / no / unknown" is stored. Sharing your location is voluntary: without it, the result remains "unknown," and the assignment can still be confirmed. The feature must also be enabled in the relevant agreement. Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO), otherwise consent (Art. 6 Abs. 1 lit. a DSGVO); location sharing can be withdrawn at any time via your device's system settings. For the comparison, the device converts the assignment address into coordinates using the geocoding service of its operating system. The app passes only the address to this service, not your location; the service is provided by the provider of the operating system or the device, not by us, and may use an internet connection for this.

Address data (for agreements with service providers)

For agreeing, carrying out, and documenting assignments, we store the assignment address (street, house number, postal code, city, country). It is visible only to the people involved in the relevant agreement. Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO).

Profile photo (voluntary)

You can take a profile photo with the camera or choose one from your photo library. It is stored on servers in the EU (Supabase, Ireland), is visible to the people connected with you in a senior's circle, and can be changed or removed at any time. If you have invited someone, this person already sees your photo on the invitation page as long as the invitation is open. If you are a service provider, it is also seen by the service providers with whom you are connected as colleagues in the app, and seniors or their guardian who have requested you as a substitute. Legal basis: consent (Art. 6 Abs. 1 lit. a DSGVO). The camera is also used to scan invitation QR codes — no image is created and nothing is transmitted; only the recognized code is evaluated.

Signing in with Google or Apple

As an alternative to email sign-in, you can sign in with your Google account — and, if available on your device, with your Apple account. The respective provider transmits your name and email address to us; we do not receive your password. In turn, the provider learns that a sign-in to Wunderbar Alt has taken place. Google Ireland Ltd. and Apple Distribution International Ltd., respectively, are responsible for this on the providers' side. Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO).

Emergency call and escalation

If you or an automatic trigger trigger an alarm, we send a notification to the people you have chosen in your circle. Automatic triggers include, for example, a condition reported as critical, a missed check-in (no condition is entered at the times you have set), a medication whose intake has not been confirmed for a long time, or an insufficient drinking amount.

If you confirm an intake while your device has no internet connection, the app remembers this on your device and sends the confirmation, with the time at which you confirmed it, as soon as a connection is available again. For this, the device stores only an internal ID number of the medication, the planned intake time and the time of your confirmation — no name and no dose. This information is stored encrypted and is deleted as soon as the confirmation has reached us, when you sign out, but at the latest the first time the app is opened after seven days. If the people you have chosen have already been notified that the intake was not confirmed, exactly these people then receive an all-clear. It, too, contains nothing about your health.

The notification can also be seen on the lock screen of the notified person. Therefore, it does not contain anything about your health — no medication, no drinking amount, no condition, and never your notes. It only contains:

• for emergency calls: your first name and that it is an emergency call,
• if you haven't checked in: your first name and that you haven't checked in today,
• in the event of a critical condition: your first name and that it is urgent,
• for medication or drinking: neither your name nor the reason, only how urgent it is,
• if the first person notified has not responded, additionally to the next people: "The person notified first has not responded." — in the event of an emergency call, a critical well-being, and if you have not checked in,
• for medications or fluid intake to a person with whom you have not shared this area: instead of the request to check in the app, "Please call soon and ask if everything is all right." (for fluid intake "Please call when convenient and ask if everything is all right.").

In addition to this information, the notification to the people in your circle may contain another sentence: If no mobile phone is currently registered for our notifications for your account, in the event of a critical well-being status, a missed check-in, medication or drinking, the notification will also state: "[Your first name]’s phone is currently not reachable for our notifications." For medication and drinking, the sentence is displayed without your name. For this purpose, we only check whether a device is currently registered for notifications for your account; nothing additional is stored for this. This sentence is not included in the case of an emergency call.

The person will only find out more when they open the app. There they see which alarm was active (see "Who sees what in your circle").

Reminders to yourself only go to your own device. They state the topic, for example "Your medication" with the time, "Time to drink" or "How are you?", but no names of medications and not what an appointment is about. They can also be seen on your lock screen.

Guardianship (functional)

The circle can confirm a person as a functional guardian who takes over management of the app on your behalf. To do this, we process the status and consents of those involved. A confirmed guardian sees your medications and intake, your well-being, and your fluid intake, even without you sharing these areas individually. The prerequisite is that you have consented to the processing of your health data. They only see your supplies and your appointments if you share them with them. They can change what the other people in your circle are allowed to see. This is not a legal guardianship.

Service records

When a service provider performs services, a record is created for each assignment (date/time, activity, completion status — no price, no billing).

Logs

We log security-critical actions (e.g. account deletion, permission changes) for traceability. Email addresses are stored in the log only as a hash value. The technical user identifier remains in plain text: after the account has been deleted it no longer points to any existing record, and without it the log would be worthless.

For each reminder that the app is supposed to send, we record the result: to whom it went, which senior it belongs to, what type of reminder it was (for example, medication, drinking, well-being or appointment), whether the push service accepted it or why it was not sent (for example, due to quiet hours or because it would have arrived too late) and how many attempts there were. In the case of alarms for medication or drinking, it can also be recorded for each notified person whether the push service accepted the notification, how many attempts there were and why an attempt failed — so that a notification that did not arrive is sent again and one that did arrive is not sent twice. We do not store the text of the reminder or notification.

Support requests in the app

If you send us a request from the app (error report, feedback or suggestion), we store the type of request, subject and text, the link to your account, the app version as well as the operating system, its version and the device model. The technical details help us understand an error. Recipient: Supabase (EU/Ireland). Retention period: 90 days from the last time the request was worked on; if you delete your account, 90 days from the deletion. Legal basis: our legitimate interest in responding to inquiries (Art. 6 Abs. 1 lit. f DSGVO).

Administrative details about your account

We can manually mark an account as an internal account or as a review account (for example our own test accounts or accounts for the review by Google) so that it is not included in our user and revenue figures. If we grant a subscription tier without a purchase (as a goodwill gesture or in a case of hardship), we store the reason and the expiry date. Only we as the operator can see these details, not the people in your circle. They are part of your data export and are deleted together with your account. Legal basis: our legitimate interest in accurate business figures (Art. 6 Abs. 1 lit. f DSGVO); for goodwill and hardship cases, performance of a contract (Art. 6 Abs. 1 lit. b DSGVO).

3. Purpose of processing

• Providing the app's functions (performance of a contract, Art. 6 Abs. 1 lit. b DSGVO)
• Sending notifications and reminders
• Coordination between seniors, relatives, friends and neighbors as well as everyday companions, cleaning and household help
• Operation, security, and improvement of the app

4. Data storage

Your app and account data are stored on servers operated by Supabase in the EU (Ireland region). For certain technical functions, service providers based in the USA are used (see Section 5); the transfers involved are safeguarded in accordance with Chapter V DSGVO.

Retention period

Fixed periods apply to data types that are cleaned up automatically:

• Medication intake and wellbeing histories: 90 days
• Fluid intake histories: 30 days
• Circle notifications (events within the circle): 90 days
• Dispatch logs of push reminders and invitations, including failed reminders: 30 days
• Result per reminder (for each scheduled reminder, including those not sent: to whom, what type, accepted or why not sent): 14 days — deletion is done on a daily basis, so an entry can exist for up to one day longer. The dispatch logs in the entry before are something else: they ensure that a sent reminder is not delivered twice and record failed attempts.
• Delivery log of alarms per notified person: 14 days
• Scheduled reminders (time, recipient and notification text, before they are sent): 14 days — deleted day by day, so an entry may remain up to one day longer
• Invitations that were not accepted (with the invited person's email address, if provided): 30 days after the invitation expires; accepted invitations are deleted together with the account
• Cached translations of list entries (only the term and its translation, without any link to an account): 90 days after last use
• Log of security-critical actions: 365 days
• Family photos: 7 days; family messages: 30 days
• Agreements with service providers, including the associated assignments and service records: 90 days from the deletion of the senior's account
• Support requests: 90 days from the last time they were worked on — if you delete your account, 90 days from the deletion
• Record of the acknowledged usage notice (email address, time, version, role): 3 years from the deletion of your account
• Log of generated history files (which account, which kind of history, when — no content, no recipient): 7 days
• Emergency notifications and emergency cases (trigger, time, who was notified, who confirmed): 3 years
• Technical runs of the reminders (counters per run only, with no link to a person): 30 days
• Protection of the website forms against misuse (only a hash value of the IP address, not the IP address itself): 7 days
• Protection of the invitation codes against guessing (likewise only a hash value of the IP address, not the IP address itself): 1 hour

Agreements that have not yet been confirmed — drafts and requests not yet accepted — do not document any work performed; they are deleted immediately together with the account.

All other data are tied directly to your account and are not kept separately from it. If you delete your account, they go in the same operation. Anything that exceptionally stays longer is named explicitly in this policy.

5. Recipients / processors

• Supabase (database, authentication, file/image storage; the authentication emails are generated by Supabase and delivered via Resend) — servers EU/Ireland
• Firebase Cloud Messaging / Google LLC (push notifications) — transfer to the USA based on the EU-US Data Privacy Framework (Google LLC is certified under the DPF)
• Resend (Sending of all emails from the app. First, the purchase confirmation to the buyer, required under § 356(5) of the German Civil Code as a durable medium and only for paid subscriptions. Second, the authentication emails generated by Supabase: confirmation of the registration, its re-sending on request, the password reset and the confirmation of a changed email address. Resend sees the recipient address and the content of the email) — based in the USA; transfer based on the EU-US Data Privacy Framework where the recipient is certified, otherwise based on Standard Contractual Clauses (Art. 46 DSGVO)
• Netlify (hosting of this website) — based in the USA; safeguarded as above (DPF where certified, otherwise Standard Contractual Clauses)
• Cloudflare (protecting the website's forms against abuse/bots, "Turnstile") — processes the IP address in doing so; legal basis: legitimate interest (Art. 6 Abs. 1 lit. f DSGVO). Any transfer to the USA is safeguarded as above (DPF/Standard Contractual Clauses)
• Google (Gemini API) / Google Ireland Ltd. or Google LLC (machine translation of content — in particular the list entries you enter yourself (shopping, supplies, custom-worded services in agreements and visits) into the language of the person viewing them, as well as static guide and website content) — translation takes place via a paid API access under which the transmitted content is not used to train AI models. Any transfer to the USA that occurs in this context is safeguarded on the basis of the EU-US Data Privacy Framework (Google LLC is certified under the DPF), otherwise on the basis of standard contractual clauses (Art. 46 DSGVO). Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO).
• Expo / 650 Industries, Inc. (delivery of app updates, “EAS Update”: when it starts, the app asks Expo whether a new version is available. In doing so, Expo technically receives the device’s IP address, the operating system, the identifier of our app project and a random identifier that tells Expo whether this installation has already fetched an update — no account, contact or health data) — based in the USA; transfer on the basis of the EU-US Data Privacy Framework (Expo is certified under the DPF), otherwise on the basis of standard contractual clauses (Art. 46 DSGVO)
• Google Play / Google Ireland Ltd. (billing of paid subscriptions) — only for paid subscriptions
• RevenueCat, Inc. (managing and validating app subscriptions) — based in the USA; only for paid subscriptions. RevenueCat receives only two pseudonymous identifiers (random IDs, no real name, contact, or health data) — that of the purchasing account and that of the senior the subscription is for, so that we can assign it to them — as well as purchase metadata (product purchased, purchase/expiry date, subscription status). Transfer to the USA based on the EU-US Data Privacy Framework where the recipient is certified, otherwise based on Standard Contractual Clauses (Art. 46 DSGVO)

Note: The EU-US Data Privacy Framework is currently a valid basis for transfers; should it cease to apply in the future, we will base transfers instead on Standard Contractual Clauses together with a transfer impact assessment.

Sharing invitations: You can send invitations via an app of your choice on your device (e.g. SMS, WhatsApp, email). This happens exclusively through the app you choose on your device; no transmission of this content to us or to a service we have engaged takes place in the process.

6. Forms on this website

You can register on this website via forms. The data provided in doing so is stored via our service provider Supabase in a database on servers in the EU (Ireland region). No transfer to third countries outside the EU takes place in the process. The forms are protected against abuse by Cloudflare Turnstile (see Section 5).

Newsletter and waitlist form

• Data processed: email address, time of consent. In addition, the time of the entry and a "test user" marker, which the website sets to "no" throughout.
• Purpose: We will notify you once when the app launches on the Google Play Store.
• Legal basis: your consent (Art. 6 Abs. 1 lit. a DSGVO).
• Recipient: Supabase (database hosting, EU/Ireland).
• Retention period: until you withdraw your consent or unsubscribe. We then delete your email address.
• Withdrawal: You can withdraw your consent at any time without giving reasons — informally by email to ki.gwendrich@gmail.com. The lawfulness of processing carried out until withdrawal remains unaffected.

The newsletter entry is not part of the data export in the app. It hangs on an email address that we have not verified, and on no account — so the app could not reliably assign it to anyone. If you want to know whether an entry exists for your address, write to us from exactly that address at ki.gwendrich@gmail.com; the reply goes back to the same address. If you delete your account in the app, the entry is deleted along with it via your email address.

Contact form

• Data processed: name, email address, content of your message, and the time of submission.
• Purpose: processing and responding to your inquiry.
• Legal basis: your consent (Art. 6 Abs. 1 lit. a DSGVO) as well as our legitimate interest in responding to inquiries (Art. 6 Abs. 1 lit. f DSGVO).
• Recipient: Supabase (database hosting, EU/Ireland).
• Retention period: we keep contact inquiries in full and delete them 90 days after they were last worked on; if you delete your account, 90 days from the deletion.

7. Cookies and local storage

This website does not use cookies for analytics or advertising purposes and does not embed any tracking services. Only technically necessary information is stored locally in your browser:

• Language setting (wa_lang): Stores the display language you have chosen locally in your browser. If it differs from the language of a page you open, the website shows you a notice with a link to the matching language version.

This local storage is technically necessary or is carried out on the basis of our legitimate interest in a user-friendly website (Art. 6 Abs. 1 lit. f DSGVO; § 25 Abs. 2 Nr. 2 TDDDG). You can delete the stored information at any time via your browser settings.

8. Your rights

Under the DSGVO, you have the following rights:

• Access (Art. 15 DSGVO): What data we have stored about you — you can retrieve this yourself in the app at any time (see below) or ask us
• Rectification (Art. 16 DSGVO): Correction of inaccurate data
• Erasure (Art. 17 DSGVO): Complete deletion of all your data
• Restriction (Art. 18 DSGVO): Restriction of processing
• Data portability (Art. 20 DSGVO): Export of your data
• Objection (Art. 21 DSGVO): Objection to processing
• Withdrawal of consent given (Art. 7 Abs. 3 DSGVO): at any time with effect for the future

To exercise your rights, contact us at: ki.gwendrich@gmail.com

You can delete your account and all data directly in the app: Gear icon → “My Settings” → “Help & account” → “Delete account”; if you do not use the app as a senior: Gear icon → “Settings”, section “Account” → “Delete account”. The app also offers a complete data export: Gear icon → “Privacy” → “Export my data” or Gear icon → “My Settings” → “Help & account” → “Export my data”. If you do not use the app as a senior, the same button is in the “Account” section.

The export consists of two files. “my-data.pdf” is the access report under Art. 15 DSGVO: what kinds of data we hold about you, how many entries from which period, what we use them for, who receives them and how long we keep them. “my-data.json” contains the data itself, machine-readable, so that you can pass it on to another service (Art. 20 DSGVO). Both files are created on your device; they are only passed on to wherever you send them via your device’s share menu. Images are included as links that can be opened for one hour — after that, a new export is all it takes.

9. Account and data deletion

When you delete your account, your personal data — in particular all health data (medications, intake, wellbeing, and fluid intake histories), appointments, errands, and family photos and messages — is deleted immediately and irrevocably.

Three things remain for a limited time after that. How long is set out above under “Retention period” — the periods are kept in one single place so that they cannot drift apart in two.

• Service records: if a service provider performed and documented services for you, they can still retrieve their own record of the work. The link to your account is severed in the process; your name stays on the record, because otherwise it could no longer be attributed to anyone. Your health data are not part of it — they are deleted immediately and completely. After that the record is deleted as well.
• Support requests: a request you sent us stays fully intact so that an open matter can still be seen through. After that it is deleted together with its text.
• Record of the usage notice: When setting up, you acknowledged a notice explaining when a reminder cannot reach you. This acknowledgement is retained together with your email address, the time and the version, so that in a dispute we can show you were informed (Art. 6(1)(f) in conjunction with Art. 17(3)(e) GDPR). After that this entry is deleted too.

Backups may lag behind by up to 30 days for technical reasons.

10. Data security

• Encrypted transmission (HTTPS/TLS)
• Access rules in the database (Row Level Security): Each person only sees their own data and what a senior has shared with them (see "Who sees what in your circle")
• Passwords are stored encrypted (bcrypt)
• Access credentials are stored in secure device storage (Android Keystore)

For operation and support, we can technically access all stored data via an administration program, including health data. Only a single account that we have explicitly enabled for this purpose has access, and only with a second confirmation during login (one-time code). In everyday operations, the program only shows us from your health data whether an alarm could not be delivered — with the type of alarm and an identification number of the senior, without names.

11. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Alt-Moabit 59–61, 10555 Berlin

12. International use / country-specific notices

The controller and the processing of data are governed by the DSGVO (we are based in Germany). Regardless of your place of residence, your data is processed on servers in the European Union (Ireland) (see Sections 4 and 5). Additional notices apply for users outside Germany, as set out below.

Users in Switzerland

The Swiss Data Protection Act (revDSG) applies to you in addition. The transfer of your data to the EU (Ireland) is permitted because Switzerland and the EU mutually recognize each other's data protection as adequate. You have the rights under the revDSG (in particular access, rectification, and erasure). The competent supervisory authority is the Federal Data Protection and Information Commissioner (EDÖB), www.edoeb.admin.ch.

Users in Japan

The Japanese Act on the Protection of Personal Information (APPI) applies to you in addition. We process your data for the purposes stated in this policy (providing the app's functions, reminders, coordination within the circle, operation, and security). Your health data, which is considered particularly sensitive ("special care-required") under the APPI, is processed by us only with your explicit prior consent. Storage and processing take place on servers in the European Union (Ireland); the EU and Japan mutually recognize each other's data protection as adequate. The controller and contact point for your rights (access, rectification, erasure, or cessation of use) is the controller named in Section 1, based in Germany. The competent supervisory authority in Japan is the Personal Information Protection Commission (PPC).

Last updated: October 2026