For the naido Android app, the web app at web.naido.app, the page for carers at care.naido.app and the website naido.app. Last updated: 21 October 2026.
This is a translation. The German version at naido.app/privacy/ is authoritative.
The controller is Daniel Pommranz, Untere Haldestraße 7, 72810 Gomaringen, Germany, reachable at info@velmun.com. “Velmun” is a brand name. Further provider details are in the legal notice at velmun.com.
naido stores child profiles (name, date of birth and, if you enter them, sex and due date), your entries and settings on your device. Entries are sleep, meals (breastfeeding, bottle, solids), pumping and milk stock, diapers, medicine and your medication list, temperature, growth, check-ups, vaccinations, new solid-food ingredients (allergens), teeth, milestones, activities, notes, exception periods such as holidays, and your own reminders. You don’t need a naido account.
What this section describes happens only on your device. We do not receive this data and do not process it; we only provide the software. We still describe it so that you know what the app stores, for how long and how to delete it. Data leaves your device only in the ways described in sections 3 (sync, sharing with a carer) and 4 (Premium) and under “Reports, images, exports and sharing”, and in ways you set up yourself (Android device backup, backup files).
The Android app contains no advertising and no analytics or crash-reporting services. The sleep forecast, growth curves and hints are calculated on your device; no data is transmitted for them. naido makes no diagnoses and gives no dosage or treatment recommendations. Which check-up schedule naido shows (German U-Heft, Austrian Eltern-Kind-Pass, Swiss Gesundheitsheft or none) is set in the app; the choice only changes which check-ups the app shows and does not trigger any transmission. There is no automated decision-making within the meaning of Art. 22 GDPR.
You can edit, delete and export entries. Uninstalling removes the local app data including photos, but not backup files, Android device backup, copies on other devices or data in the optional sync.
Backup files created by naido. You can create backup files and, if you wish, automatically keep the seven most recent ones in a folder you choose. They contain your entries (including health entries), medication list, reminders, milk stock, the family’s and each child’s settings, the list of your paired devices, the sync code, the Premium proof and any donor ID. They do not contain photos, Listener data, the reminder history or shares with carers. With a password the files are encrypted. Without a password, anyone with access to the file can read your entries and use the sync code it contains. We do not receive these files. If the folder is in a cloud storage service, its privacy information also applies.
Android device backup. If you have turned on backup in the Android settings, Android may back up naido’s database and settings to your Google account. naido only allows this backup if the device encrypts it end to end (from Android 9; this requires a screen lock); otherwise it does not take place. On Android 8 it is turned off entirely for naido. The backup covers entries, the reminder history, settings and the Listener data kept in the settings. It does not contain the app’s files, so no photos and no copies of U-Heft pages, and no secrets: sync code, Premium proof, shares with carers including their keys, any donor ID and the password for automatic backups. How long Google keeps a backup is up to Google. Google is independently responsible for Google backup: Google privacy policy.
Direct transfer to a new device. If you transfer data directly from your old phone when setting up a new one, the database and settings are transferred, and from Android 12 also the secrets listed above. Photos and copies of U-Heft pages are not transferred this way either. On Android 8 this transfer is also turned off for naido.
naido distinguishes four kinds of images:
Until you save a milestone, the reduced copy is a temporary file in the app’s cache folder; if you cancel, it is deleted, and leftovers after the app was closed unexpectedly are deleted at the latest the next time you choose a photo, once they are older than one day. If you remove the photo from the milestone, naido deletes the copy when you save. If you delete the milestone or the whole child, naido deletes the copy the next time the app starts once the undo period has safely passed: at the earliest ten minutes after deleting, for a deleted child at the earliest one day after the photo was saved.
With “Import from photos” you can take values from the child health record (U-Heft), the attendance card or the vaccination record. To take a photo, naido opens your phone’s camera app; naido itself has no access to the camera. Alternatively, you choose one or more pictures from your gallery; naido only gets access to the pictures you choose. The picture is analysed only on your device, by models included in the app that read digits and recognise the page. It is not sent to us or anyone else and not synced. Only the values you confirm are taken over; they become ordinary entries.
When you take a photo, the camera app writes it into a temporary file in naido’s cache folder. naido deletes this file as soon as you save, discard the photo or leave the screen; if the app is closed before that, the next time you open “Import from photos”. A picture from your gallery is only read into memory. naido does not make a copy, unless you keep the photo of the page with the check-up (see below). Some camera apps also save their own copy to the gallery; that depends on your camera app and is not covered by naido’s deletion.
Keep the photo of the page with the checkup. For the U-Heft you can turn on “Keep the photo of the page with the checkup”; the setting starts off each time you open the screen. naido then keeps a reduced copy of the page (longest side at most 1600 pixels, without metadata) with that check-up when you save. The copy shows the whole page, including the practice stamp and, for the U1, information about the mother. It stays on this device only: it is not synced and is neither in the backup files created by naido nor in the Android device backup or a direct transfer to a new device. naido deletes it immediately if you remove it under “View health booklet” with “Remove photo”. If you delete the check-up entry, naido deletes the copy the next time the app starts, at the earliest ten minutes after deleting.
Photos you kept with an earlier version (“Kept photos”) stay on your device until you delete them in naido under “Import from photos” or delete the entry they belong to (then as for milestone photos).
naido reads an invitation QR code the same way: the camera app takes the picture into a temporary file of naido, naido reads the code on the device and deletes this file straight afterwards, even if no code was recognised. Copies that your camera app makes itself are not covered by this.
naido delivers reminders (for example for vitamin D or for a medicine after an interval) as notifications on your device. A reminder’s settings are only synced if you have turned on sync; then like your entries, and reminders for health entries via the relay only with consent for health data (section 3). The history of when a reminder fired, followed up or was snoozed stays on the device; it is not synced and is not included in backup files.
Notifications and home-screen widgets show information such as the child’s name, a running sleep, the last meal or the time since the last dose. They may be visible to people who can see your device and, depending on your phone’s settings, on the lock screen.
naido creates the report for the doctor (PDF), the day image, the CSV export, backup files, the “Send to partner” file, the invitation file and the listening journal on your device. They only leave it if you share or save them yourself. The recipients are then the people you choose and the apps or services you use to share or save (for example email, messengers or cloud storage); their privacy information applies to their processing. The “Send to partner” file and the CSV export are not encrypted and contain your entries; the invitation file contains the sync code. Medicine, temperature and notes only appear in the day image if you tick them.
To share, naido keeps the file as a temporary file in the app’s cache folder. naido deletes the report when you leave the report screen; it replaces the other files the next time you share the same kind of file. Android may clear the cache folder at any time.
For the import assistant, naido checks on the device whether certain other baby apps are installed and reads export files you choose. This happens only on the device; the result is not transmitted. If you ask naido to prepare an email to the provider of another app, your mail app only sends it when you send it.
Purpose. The Listener uses the microphone to detect sounds that may indicate your child is awake and turns them into suggestions for entries. It never ends a sleep on its own, and every suggestion waits for your answer.
Switching it on. The Listener is off until you switch it on yourself under Settings → Listener. Next to the switch, the app describes what it does. The first time you switch it on, Android asks for microphone permission; if you do not grant it, the Listener stays off.
When it listens. When it is on, naido uses the microphone while a tracked night sleep is running and, if you choose, also during naps and in the predicted sleep window just before; if you wish, only while the charging cable is plugged in. A persistent notification shows when it is listening.
Sound. The sound is analysed second by second only in your device’s memory, by a sound model included in the app, and discarded straight away. It is never stored, never sent to us or anyone else and never synced. Sounds and voices of other people in the room may also be picked up; they too are analysed only in memory. The test recording under “Check the listener” also runs only in memory.
What is stored. In the app’s settings on your device, naido stores:
Deletion. naido deletes sections and fall-asleep results older than 21 days and journal entries older than 14 days each time the app starts and when new ones are added. Until then an entry may be kept longer, for example if you do not open naido for some time. If you switch the Listener off, naido stops using the microphone and deletes the stored sections together with your answers, the fall-asleep results, the listening journal and the details of the last session. If you only withdraw microphone permission in the Android settings instead, naido can no longer listen; the stored information then remains until its period expires or until you switch the Listener off. You delete the saved thresholds (see below) with “Reset adjustment”; they and your Listener settings are also removed when you clear the app data or uninstall naido. An Android device backup that has already been made only changes with the next backup.
Thresholds. naido uses your answers and the wake-ups you enter yourself to set the thresholds for your child. When you switch the Listener off, naido first saves only these adjusted thresholds for each child (four numbers, without times and without answers) in the app’s settings on your device, so they do not have to be learned again when you switch it back on; they are not synced and not included in backup files. “Reset adjustment” under “Check the listener” deletes these values, forgets your previous answers for this child, and wake-ups you enter yourself only count from that point.
Sharing. This information is not synced and not included in backup files; the Android device backup may include it with end-to-end encryption (see “Backup files and switching devices”). You can share the listening journal (times only) yourself. If you accept a suggestion, it becomes an ordinary entry that is treated like your other entries.
Legal basis. Processing takes place only on your device. The Listener only runs with your consent, which you give by switching it on (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching the Listener off.
If you also install naido on a Wear OS watch, your phone and watch exchange data through Google Play services. The watch app itself does not connect to the internet.
From phone to watch: your children's first names (at most nine) with a random identifier per child, the start of an ongoing sleep or the end of the last one, the next sleep window and the expected wake-up, time and short form of the last feed, an ongoing breastfeed with its side, and a confirmation for each entry received from the watch (random identifiers). From watch to phone: only new entries, that is their type (sleep, breastfeeding side, bottle amount, diaper type), which child they are for, the time of the tap and how long it waited on the watch, plus a random identifier of the entry. Health entries (e.g. temperature, medication) are not sent to or from the watch.
The transfer is handled by Google through Google Play services on phone and watch. Usually it runs directly over Bluetooth. If Bluetooth is not available, Google may route the data end-to-end encrypted through its own servers. naido only sends entries from the watch to a phone nearby. If none is reachable, the watch keeps the entry (at most 50, at most 12 hours) and sends it once the phone is nearby again; an entry that waited longer than 12 hours is no longer recorded by the phone. naido only publishes the status if the app is installed on a paired watch.
Velmun does not receive or store any of this data. The watch keeps only the most recently received status and entries the phone does not show yet, until you uninstall the watch app. Android device backup is switched off for the watch app.
Legal basis. You use the watch as part of naido on your own devices; the processing serves to provide this feature (Art. 6(1)(b) GDPR). Google is independently responsible for Google Play services: Google Privacy Policy.
With Premium, paired devices on the same Wi-Fi exchange data directly and encrypted. No data reaches our relay in this case. Other participants in the local network can see the device announcement and the mailbox address used for matching, but cannot decrypt the entries.
With Premium you can also turn on sync via our relay. It stores your entries as an end-to-end encrypted package in a “mailbox”. Only your paired devices can decrypt the content. For this we process the mailbox address, a proof of write permission, version and time information, the size of the encrypted packages and, where applicable, the Premium proof. While sync is running on a device, it keeps a connection to the relay open; over it the relay only reports that a new version is available, no content. Through personally issued unlock codes we can link individual mailboxes to persons; the contents remain unreadable to us.
Photos, Listener data, the reminder history and your choice on health data, which applies per device, are not synced. For health entries, see “Health data in sync”.
The entries may contain health data about your child. We therefore need the explicit consent of a person with parental responsibility for the child profiles named in the dialog before syncing via the relay. The legal bases are Art. 6(1)(a) and Art. 9(2)(a) GDPR. For additional children the app asks again. The consent applies to syncing via all paired devices.
You can withdraw it in the sync settings. The app stops syncing immediately; as soon as the withdrawal reaches the relay, the relay deletes the mailbox and blocks further uploads without new consent. Without a connection, the app shows the pending withdrawal. Alternatively, you can contact us by email with the mailbox address and the withdrawal code shown in the app. This does not cancel your Premium subscription; you do that separately in Google Play.
To provide the service, we process the administrative information on the basis of Art. 6(1)(b) GDPR. We document the consent with the mailbox address, a hash of the write proof, time and text version, the times of the last upload or deletion, where applicable the time of withdrawal, and the number of previous withdrawals.
Medicine, your medication list, temperature, growth, check-ups, vaccinations and new solid-food ingredients (allergens) are health data, as are reminders for these entries. Before the Android app syncs them via the relay, it asks separately for your explicit consent, as soon as sync via the relay is on and there are such entries. The dialog names which entries are meant, the recipient (our relay at Cloudflare), the storage location (EU), the storage period (until 30 days after the last change), that only your devices can read the data, and where you can change your choice.
If you choose “I have parental responsibility and consent”, these entries are synced with end-to-end encryption like your other entries. If you choose “Only on this device”, this device does not send them at all, not via Wi-Fi either and not in the “Send to partner” file; they remain in your own backup files. As long as you have not decided, they do not go via the relay, but still go via Wi-Fi to your paired devices as before.
The choice applies to each device and determines what that device sends; health entries that another of your devices syncs with consent still arrive here. The choice, time and text version are documented on the device, not at the relay. You can change your choice at any time under Settings → Health. If you turn off syncing health data, this device writes its state without health data to the mailbox at the next sync. If another of your devices or the web app keeps syncing them, they remain in the mailbox; they are reliably removed by withdrawing consent to relay sync, which deletes the mailbox. The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR).
The web app does not ask this separate question. Entries you create there, including medicine and temperature, are stored by the web app in the mailbox on the basis of your consent to relay sync.
The mailbox is deleted 30 days after the last upload or on your command. Without a withdrawal, devices that are still syncing can create it again.
After a withdrawal we keep, with the mailbox, a note with the running number of the withdrawal and the time the withdrawn consent record was created. It ensures that a transfer started before the withdrawal cannot re-create the mailbox, and it also serves as proof of consent. The note stays even after the mailbox is deleted and is deleted three years after the last withdrawal.
After a mailbox is deleted or expires, we keep only a hash of its write proof for three years, so that nobody else can create a new mailbox under the same address. We keep no contents, times or counters. If your devices create the mailbox again, this note is removed.
We keep the consent record during use and afterwards generally for three years from deletion of the mailbox or from withdrawal. It serves as proof of consent and to enforce a withdrawal. The legal bases are Art. 6(1)(c) in conjunction with Art. 7(1) and Art. 6(1)(f) GDPR. We review requests for earlier deletion case by case, taking the statutory exceptions into account.
When you sign in to the web app via QR code, we store the sync code only in encrypted form in a one-time mailbox. It is deleted when retrieved, at the latest after ten minutes.
With Premium you can invite a carer for a child, for example grandparents, a babysitter or a nursery, for set times. This requires sync via the relay for that child. The carer opens a link on care.naido.app in the browser, without an app or account, and enters what you allow during the shared times: sleep, bottle, solids or diaper, no breastfeeding.
What is kept at the relay. For each share your devices create two compartments at the relay, stored in the EU: one from you to the carer and one from the carer to you, each at most 96 KiB and only end-to-end encrypted. Your device generates the key at random. It is in the link after the # sign, which the browser does not send to the server, and travels to your other devices only within the encrypted sync; we cannot read the contents. For each share the relay also stores hashes of two access keys (your devices’ and the carer’s), the time it was created, the end of the share, the end of your family’s Premium entitlement and the time its proof was issued (without the mailbox address) and, for each compartment, a version number and the time of the last upload. To check whether Premium is still valid, the relay reads your mailbox’s Premium state on requests from your devices; for this it briefly processes the mailbox address but does not store it with the share. While the carer’s page or one of your devices has a share open, the relay keeps a live connection open. Over it, the relay only reports that a compartment has changed (version number), no contents. Only the connection data described in section 5 arises.
What the carer sees. Only during the shared times: the child’s name and age in months, the forecast of the next sleeps with usual wake times and sleep durations (figures, no history), whether a sleep you started is running and when waking is expected, your sleep times of the current day and, if they are no more than 24 hours ago, since when the child has been awake and the last feed (type, time and, where applicable, amount, side, bottle contents or food), and the carer’s own entries of the last 7 days with a note whether you accepted, changed or did not accept them. No other entries, no notes, no health information of yours. Outside the times the carer only sees the child’s name, the name of the share, what they may enter, and the times.
What reaches you. One of your devices collects the carer’s entries (type, times, amount where applicable; for diapers also amount, consistency and colour of the stool, for bottles the contents, for solids the food and amount), checks them and adds them to your log with the name of the share. From then on they are treated like your other entries.
In the carer’s browser. The page runs at its own address (care.naido.app) and shares no browser storage with the web app. The page stores the key from the link, the last retrieved state and the carer’s own entries of the last 14 days in the browser’s storage (localStorage), plus files for offline use, without cookies and without an account. This remains after the share has ended, until the carer removes the share in the page or deletes the website data. The information in section 5 applies to the connections. Anyone who has the link can make entries during the shared times; give it only to the carer.
End and withdrawal. Every share has an end; a one-off share lasts at most 14 days, a weekly one at most a year. At the end, the relay deletes everything stored for the share. If you withdraw a share in the app, the relay deletes both compartments immediately and the link stops working. A note (hash of your access key, planned end, time of withdrawal) remains until the planned end, at least one day, so that a device that has not synced yet does not create the share again. If the relay cannot be reached when you withdraw, the app retries. If you delete the child, naido also withdraws its shares. What the carer has already seen or stored in their browser cannot be taken back; accepted entries stay in your log. If your family’s Premium has expired, the relay accepts no new content for the share until Premium is active again. On your devices, ended or withdrawn shares disappear from the list 90 days later. Checking the Premium entitlement serves to perform the subscription (Art. 6(1)(b) GDPR) and to prevent misuse (Art. 6(1)(f) GDPR).
Recipients and legal basis. The recipients are the carer you give the link to and our relay at Cloudflare as processor. The legal basis for disclosure to the carer you choose is your consent, which you give by creating and sharing the share (Art. 6(1)(a) and, where health data is concerned, Art. 9(2)(a) GDPR); you withdraw it by withdrawing the share. We process the carer’s connection data to provide the page on the basis of Art. 6(1)(f) GDPR.
Premium is activated through a Google Play subscription or an unlock code. With a subscription, our relay receives the purchase token and the mailbox address and checks the subscription status with Google. We store a hash of the purchase token, the link to the mailbox, plan, end of entitlement and time of the last check. We do not receive card or account numbers.
If an entitlement ends early or is shortened, for example after a refund, a cancellation or when a purchase token is assigned to another family, we additionally store with the mailbox the time from which issued proofs remain valid, so that an older proof cannot be used again. This note stays even after the mailbox is deleted, until the previous entitlement would have ended anyway, at least 24 hours, and 400 days if no previous entitlement was stored. A longer period of an earlier note is kept. If a purchase token moves to another mailbox, the previous mailbox keeps an assignment number together with a short identifier of the purchase token (part of its hash) until the end of the term reported by Google, at least 24 hours and at most 400 days, so that a subscription applies to one mailbox only and another purchase of the same family stays valid.
Google informs us of subscription changes via Google Cloud Pub/Sub. The messages contain purchase and event identifiers, and for certain refunds also an order number. They are stored for up to seven days, and in case of delivery problems possibly another seven days in an error queue. To avoid duplicate processing, we store message identifiers for seven days.
For unlock codes we store the code identifier, mailbox address, time of redemption and end of entitlement. For personally issued codes we additionally record the recipient and the date of issue. The resulting entitlement is stored as a signed proof on your devices and at the relay. Anyone who knows the mailbox address can retrieve the plan and validity information there.
To prevent mass guessing, the relay counts code redemption attempts and purchase token checks per sender while they run and, if they fail, for one minute. For this it derives a keyed hash from the IP address (for IPv6 from the network range of the connection). The counters are kept only in volatile memory, are never stored permanently and are discarded shortly after the minute has passed.
Legal basis for these notes and counters and for the notes in section 3: Art. 6(1)(f) GDPR; our interest is to enforce the withdrawal of consent, to keep a family’s mailbox from being taken over by others, to grant Premium only to the extent paid for and to prevent guessing of codes. For the withdrawal note additionally Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof), as for the consent record.
We delete purchase and code links 90 days after the end of the entitlement. At that point we also remove the recipient from the issue list; for codes that were never redeemed, after twelve months. The identifier of redeemed codes is kept to prevent them being redeemed again.
In the Play Console we can view order data including price, taxes and regional buyer information, and search for orders by the account email address. We use this information for support, refunds and accounting, without linking it to the mailbox. Google’s time limits apply to availability in the Play Console; we keep downloaded accounting records in line with tax retention obligations.
The legal bases are Art. 6(1)(b) GDPR for performance of the contract, point (c) for tax obligations and point (f) for preventing abuse and duplicate issuing.
Our website, the web app and the page for carers are provided via Cloudflare. When pages are accessed and relay connections are made, Cloudflare processes technical information such as IP address, time, requested address, browser identifier, status code and, where applicable, referrer. The legal basis is Art. 6(1)(f) GDPR; our interest is secure and reliable provision.
Our own application logs are turned off. Cloudflare stores security events for up to 24 hours on our plan. In addition, aggregated statistics and infrastructure or billing data arise, including mailbox identifiers. For these other connection and infrastructure data, the retention period follows Cloudflare’s specifications; Cloudflare does not state a fixed period for them.
Cloudflare processes data on our behalf and certain connection data under its own responsibility for network security. For the latter, Cloudflare describes retention depending on purpose and obligations: Cloudflare privacy policy.
The website contains no analytics tools or external embeds. During security checks, Cloudflare may run a script and set the technically necessary cookie cf_clearance with a configured lifetime of 30 minutes. This is strictly necessary for secure provision (Section 25(2) No. 2 TDDDG).
The web app stores in the browser the sync code, decrypted entries, pending changes, Premium proof, version status, device ID, the selected child profile, display and language settings, the status of your consent and the time and result of the last sync, as well as app files for offline use. What the page for carers stores in the browser is described in section 3 under “Share with caregivers”. This storage is necessary for the requested function (Section 25(2) No. 2 TDDDG). The data remains until you delete the website data; the browser may remove it earlier. On shared devices, other people with access to the browser can access it. Deleting in the browser does not remove copies in the mailbox or on other devices.
| Provider | Task and role | Processing outside the EU |
|---|---|---|
| Cloudflare, Inc. | Hosting and relay (mailboxes, sharing with a carer) as processor; own responsibility for certain security processing | Mailboxes, shares with carers and consent records in the EU; infrastructure and connection data also outside, in particular the USA |
| Google Cloud | Pub/Sub as processor | Worldwide processing, including the USA |
| Play, purchase verification and Android backup under its own responsibility | Including the USA | |
| IT service provider for email | Mail server as processor | Servers in Germany |
For covered transfers to the certified US companies Cloudflare and Google LLC, the EU-US Data Privacy Framework is used (Art. 45 GDPR). For Cloudflare and Google Cloud, standard contractual clauses additionally or alternatively apply (Art. 46 GDPR).
For messages to info@velmun.com, info@naido.app or info@alama.school we process the sender address, the name where given, subject, content and time in order to handle them. The mailboxes are on a mail server in Germany operated on our behalf by an IT service provider. Emails are not end-to-end encrypted. Technical logs of the mail server (delivery, spam checks) are deleted automatically as soon as they are no longer needed for secure operation.
The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, point (f) for other enquiries and point (c) in conjunction with Art. 12 to 22 for data subject requests. Our legitimate interest is handling your requests.
We delete correspondence once it has been dealt with, at the latest twelve months after the last contact. We keep data subject requests and our replies as proof for three years after the end of the year in which they were dealt with. Statutory retention obligations remain unaffected.
naido is intended for parents and carers. Share the sync code, invitations, unencrypted backup files and exports only with authorised persons, and the link of a share only with the carer; paired devices have access to the entries.
The prepared data donation is deactivated. No donations are transmitted or stored at the relay. Any donor ID that may exist from testing is stored, backed up and synced in encrypted form like the other entries. Before any activation, we will inform you separately and obtain the required explicit consent.
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction and data portability, and the right to withdraw consent. Withdrawal does not affect the lawfulness of processing carried out before it.
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.
Write to info@velmun.com. To identify you we may need, for example, your mailbox address or an unlock code. Where there are reasonable doubts, we verify your entitlement; we will not ask for your sync code. We do not have data that is stored only on your device; you can view, export and delete it in the app.
Providing data is voluntary. Without technically necessary connection data we cannot provide the online services, without proof of purchase or a code there is no Premium, and without consent there is no relay sync and no sharing with a carer. Local use of the Android app remains possible, and with Premium also Wi-Fi sync.
You can lodge a complaint with a data protection supervisory authority, in particular the LfDI Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, contact and complaints.
If processing changes, we update this policy before an app version with the changed processing is distributed, including test versions used with real data, and, where necessary, inform you in the app in advance. We obtain any required consent before the processing begins.