Privacy policy

Who is responsible

Sebastian Blanke, address in the legal notice, email hello@companda.app. Companda is a private, free project without ads. There is no data protection officer, as none is required.

What data we store

Companda works in open groups without an account. For protected groups you create an account with your email address, which you confirm with a code. If you set a password, we only store it encrypted. If someone invites you by email, we store your address for that. On your first visit, your device gets a random, anonymous ID. When you take part in a group, we store the name you enter and what you add, for example chat messages, votes, expenses or lists. Private conversations in the chat are only visible to the people in them, not to admins either. If someone reports a chat message, including a private one, we see its text so we can review the report. If you report a message, we receive it by email together with the group name, your name, the name of the reported person and up to four messages before and after it, so we can review the report in context. The email stays in our inbox. We keep the report and our decision so we can spot repeated violations. If an account is blocked, we store its sign-in ID and email address so the block also applies on a new device. If you block someone, we store that together with the name the person had at the time, so it applies in every group. The person isn’t told. Information about what you eat and don’t eat, a wish list or contact details for a carpool are only added if you enter them yourself. Most things are visible to everyone in the same group. A wish list is only visible to the person who drew you, and contact details only to the people in the same car. We don’t ask for health data such as allergies or illnesses.

You can’t take part in a group without a name, and you can’t write in the chat without a confirmed email address. Everything else is optional.

What for and on what basis

Services we use

The database, sign-in and files are stored at Supabase (Supabase Inc., USA) on servers in Frankfurt am Main, Germany. Supabase also stores IP addresses in its logs when you sign in. Companda is delivered through Vercel (Vercel Inc., USA), which keeps server logs with IP addresses. We send emails such as codes, invitations and notices through Resend (Resend Inc., USA) with servers in Ireland, so the address and the content of the email go there. Emails to hello@companda.app are forwarded by Cloudflare (Cloudflare Inc., USA) to a Gmail inbox (Google). What you enter in the feedback form ends up there too. We also store it in the database so we can reply to you.

We have data processing agreements with Supabase, Vercel, Resend and Cloudflare. Some of these companies are based in the USA. Transfers rely on the EU adequacy decision for the USA (EU-US Data Privacy Framework) where the company is certified under it, such as Vercel and Resend, and otherwise on the European Commission’s standard contractual clauses, as with Supabase.

If you join a group’s chat, the admins of that group see your email address, the others don’t.

Suggestions for places and addresses in carpools come from Photon (komoot GmbH, Germany, with OpenStreetMap data) through our server. If we show a weather forecast, we get it from Open-Meteo through our server in the same way. Only the text you are typing or the place goes there, without your name and without your IP address.

If someone calculates the detour for a carpool, we send the places entered through our server to Google (Google Maps Platform): the start and end of the ride and the places of the people looking for a ride. We don’t send any names, and we don’t store the result. Google may also process the request outside the EU. You can read more in the Google Privacy Policy.

A map of the ride only loads once you tap “Show map”, and then comes directly from Google. Google then learns your IP address and the places of the ride and may set its own cookies. Your browser remembers this choice on this device.

GIFs in the chat come from Giphy (Giphy, Inc., USA). When you search for a GIF, only your search term goes to Giphy through our server, without your name and without your IP address. The images also load through our server, so your browser never connects to Giphy. For a GIF that was sent, we only store its Giphy ID and its size. You can read more in the Giphy Privacy Policy.

If you share your location in the chat, your browser asks for permission first. Only that one spot is stored, as coordinates in the message, and it’s visible to everyone who can see the message. We don’t track your location any further.

Export for admins

Admins can export a group to print it, as a PDF, for Excel or for a calendar. The export contains what is in the group’s apps with the names, plus the email addresses of members with an account, contact details from carpools and food information. Private entries and private conversations are not included. The file then stays with the person who exported it.

The app

Companda is also available as an app for iPhone and Android. It shows the same pages as companda.app, and everything on this page applies. The app only accesses the camera, photos and files when you take or pick something yourself and have allowed it first. It doesn’t read your phone’s contacts, calendar or microphone.

Notifications

If you allow notifications in the app, we store an identifier for your phone (push token) that lets a notification reach your device, together with whether it’s an iPhone or Android and your language. The identifier is linked to your sign-in and is deleted with your account. Notifications are delivered through Google’s Firebase Cloud Messaging and, on iPhone, on through Apple’s push service (Apple Push Notification service). The identifier and the text of the notification go there, for example who wrote something in which group. Apple and Google may also process this outside the EU. You can turn notifications off at any time in your phone’s settings.

Photos and documents

Photos and files you upload to a group are stored at Supabase in Frankfurt am Main, Germany. Everyone who can see the entry can see them; in a private conversation, only the people in it. What you keep in your private storage only you can see, even after you leave the group. We shrink photos on your device before uploading and remove all extra data such as location (GPS), camera and the time the photo was taken. You can delete your own files at any time, and the group’s admins can also delete shared files. The entry is gone right away, the file itself by the next day at the latest.

Error log

If something goes wrong in Companda, the page sends us a short error report: the error text, the page it happened on, your browser and operating system version, and a random identifier that only applies to this one page visit and isn’t stored on your device. Names, messages and group content aren’t included, and the report isn’t linked to your account. We only use it to find and fix bugs.

Visitor numbers

To see which pages are used, we use Vercel Web Analytics. It doesn’t set cookies. It records the page visited, where the visit came from and rough information about country, device and browser. According to Vercel, visits are only told apart by a value that changes every day, and they can’t be followed across several days or websites. Group content is not included, and for group pages we send neither the group’s name nor the invite link.

Cookies and browser storage

We set two kinds of cookies: one for your anonymous session or your sign-in and, if you choose it or we detect it, one for your language (“sprache”). In your browser’s storage Companda also remembers what you set or started yourself: your last group, the name you last joined with, chat drafts, what you’ve already read in the chat, whether you want to be shown as online, which maps app you use, whether a Google map may load, whether you’ve already been asked about notifications, and which notices you dismissed. All of this stays on your device and is needed for the features you use (Section 25(2) no. 2 TDDDG). If you clear the website data or delete the app, it’s gone.

How long

A group stays as long as someone uses it, also after the event. 24 months after the last activity we anonymise it. Activity means a member opens the group or changes something in it; just opening the link doesn’t count. When we anonymise a group, the names become “Person 1”, “Person 2” and so on, and we delete the chat, invitations and email addresses, the group’s photos and files, places, rides, the day plan, decisions, wish lists and notes on expenses. What remains, such as amounts, things, occasion and template, can no longer be linked to anyone. From it we learn, for example, which amounts suit a group. Admins with an account get an email four weeks before. If someone opens the group by then, the period starts again.

Your private storage and your account stay until you delete them. You can delete your account yourself under Menu → Account → Delete account, in the app and in the browser. How it works and what stays afterwards is explained on Delete account. For feedback we remove the name and email address after 24 months, and in the error log the identifier after 90 days. Supabase and Vercel delete their server logs after their own short periods. If you’d like us to delete a group or your information sooner, just send us an email.

What we don’t do

No tracking across websites, no advertising cookies, no sharing with third parties other than the services named above, no selling of data. We don’t make automated decisions about you.

Age

Companda is for people aged 16 and over. Anyone younger needs their parents’ permission.

Your rights

You have the right to access, correction, deletion, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time for the future (Art. 7(3) GDPR). Where we rely on a legitimate interest, you can object (Art. 21 GDPR). Write to hello@companda.app, and we’ll reply within a month.

You can also complain to a supervisory authority. The responsible one is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.