This privacy policy applies to the app on the tablet and to the CompanionApp as a web application. It describes the processing of personal data within the current range of functions. Where a project owner uses the app and manages content for the person for whom the project is set up (the “Hero”), the owner’s obligations as controller remain unaffected. The website living-in-my-shell.eu has a privacy policy of its own.

§ 1 Controller and contact

The controller for the processing of the data of a member’s account, for the operation of the platform, the security of the systems, the handling of content reports and the logs required for this is:

Felix Schuck
Nelkenstr. 14
D-67691 Hochspeyer
Germany

E-mail: info@living-in-my-shell.eu
Phone: +49 1515 9043929

As a rule, the respective project owner is the controller for the processing of the information about the Hero and of the project content. The operator processes these data on behalf of the project owner insofar as this is necessary to provide, maintain and secure the app. For this, the project owner and the operator conclude an agreement on processing on behalf of a controller pursuant to Art. 28 GDPR. For its own purposes, in particular secure operation, the prevention of misuse and compliance with legal obligations, the operator remains an independent controller.

No data protection officer has been appointed at present. Should there be a legal obligation to appoint one, the contact details will be added here.

§ 2 Subject matter and roles

“Living in My Shell” consists of the app on a tablet and the CompanionApp, through which relatives and other members manage content for a project. A project has a project owner and may have further members who are invited to the project. Among other things it contains a media library, a calendar and greetings, and it is paired with at most one tablet. If a member creates a profile for a project, their name, picture and phone number may be shown on the tablet.

The project owner can appoint members as managers who support the owner in running the project. Managers see the content of the project but do not appear on the tablet.

The tablet app does not require a user account of its own. It shows only the content of the project it is paired with. The Hero can use the tablet without signing in to the CompanionApp.

The project owner decides who is invited in which role and which information and content are added to the project. Before adding them, the owner must in particular clarify whether the necessary rights, consents and other legal requirements are met for information about the Hero and for photos, videos, audio recordings and messages.

§ 3 Categories of personal data

The following are processed insofar as this is necessary for the respective functions:

• account data of the members, in particular e-mail address, hashed password value, confirmation status, time of registration, number of failed sign-in attempts and, where applicable, the end of a lock-out, offset from Coordinated Universal Time, the language last used, as well as version, time and content of the accepted terms of use and privacy policy;
• passkeys, if a member creates them: for each passkey the public key, a name chosen by the member, the time of creation, a signature counter, the transports, whether the member was verified on the device and whether the passkey is backed up, as well as the technical information of the device at creation. The private key and biometric characteristics do not leave the device; if a passkey is stored in a keychain, for example with Apple or Google, this happens with the provider the member has chosen for it;
• profile data of the members per project, in particular name, function, phone number, picture, roles and the consent to the project rules;
• data of invitations: e-mail address of the invited person, intended role, a comment freely entered by the person inviting, time of the invitation and e-mail address of the person inviting. The invited person receives an e-mail with this information and a link to accept or decline; without acceptance no membership comes about;
• information about the Hero, in particular name, birthday, free description and picture, which is regularly entered by members;
• project content, in particular photos, videos, slideshows, file names, descriptions, file types, file sizes, dimensions, calendar entries, messages as well as picture, audio and video greetings;
• operating and pairing data of the tablet, in particular last contact, deviation of the device clock, status of a video call, app version, device identifier, hashed pairing value, identifier of a push operation, time at which greetings were displayed, smiley replies as well as the Hero’s decisions on the legal texts;
• for video calls, whether and for how long a call took place. While it is ringing, the Studio also remembers for a few minutes who is calling; the tablet picks up the call there. The calls run via a Jitsi server of our own (treffpunkt.leben-in-meiner-muschel.de); picture and sound are not recorded;
• server logs with IP address, time, address called, identifier of the browser or the app, technical error messages and, where applicable, account, project or device identifiers. The server for video calls records when who connected with which IP address;
• data of content reports, in particular the reported location or the reported content, the alleged unlawfulness, the handling and decision as well as, voluntarily, name and e-mail address of the reporting person. The report is not linked to the account of the reporting person, and their IP address is not stored with it. For blocked content, the block is recorded with its time and the associated report.

The app does not use location data, contacts, usage statistics or advertising identifiers. Camera and microphone are used only during a video call that was accepted on the tablet, and when pairing the tablet if the pairing code is read with the camera. This step is carried out by the Google Play services on the device; the app receives only the code read. There is no tracking, no profiling and no automated decision-making within the meaning of Art. 22 GDPR. The app is not an emergency call, not an alarm and not a medical device, and it does not serve medical monitoring.

§ 4 Purposes and legal bases

The members’ data are processed to set up and manage the account, to invite and manage project members, to provide the app, for communication — including notices about operation such as planned maintenance or disruptions —, for authentication and to document legally relevant declarations. The legal basis is generally Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of the user agreement.

The e-mail to an invited person who does not yet have an account is based on the legitimate interest of the project owner and of the person inviting in bringing relatives and other people into the project (Art. 6(1)(f) GDPR). It contains only the information listed in § 3 and a link to this privacy policy.

The project content and information about the Hero are processed so that the project owner can show them to the Hero on the paired tablet and enable communication with the members. In relation to the operator, the project owner’s instructions are decisive for this. The project owner must base the processing vis-à-vis the Hero on a suitable legal basis and inform the Hero pursuant to Art. 14 GDPR insofar as the data are not collected from the Hero.

Operating, security and log data are processed to ensure security, stability and functionality, to analyse errors, to prevent and investigate misuse and to fend off unauthorised access. The legal basis is Art. 6(1)(f) GDPR. The legitimate interests lie in the secure and reliable operation of the app and in protecting users, projects and systems.

The Hero’s consent on the tablet to the terms of use and to this privacy policy is the acceptance of the contractual terms and documents that the texts were shown to the Hero. It is not automatically consent under Art. 6(1)(a) or Art. 9(2)(a) GDPR and does not replace any legal basis of the project owner or of the operator.

Content reports are processed to comply with legal obligations, in particular under Art. 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 on a Single Market For Digital Services, insofar as it applies. In addition, there is a legitimate interest in not allowing unlawful content to be distributed via the service. On the same bases, blocked content remains stored until the period stated in § 7 has expired.

§ 5 Recipients and processors

The following recipients or processors are used to provide the app:

• Hetzner Online GmbH for servers, database, object storage, e-mail delivery, the server on which the Jitsi server runs, and encrypted backups; place of processing as things stand: Germany, for the backups Finland;
• a Jitsi server of our own for video calls; picture and sound data are not recorded;
• Google LLC or affiliated companies for Firebase Cloud Messaging. Via Firebase, the device identifier or push token and a nudge without content are transmitted. The actual message is then fetched directly from the Studio;
• Google LLC or affiliated companies for the code scanner of the Google Play services when the tablet reads the pairing code with the camera. Reading happens on the device; Google may receive information about the use and performance of the service.

A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner Online GmbH; it covers all of Hetzner’s services listed above. Further processors may only be engaged in the procedure permitted by contract. Authorities and other third parties receive data only if a legal obligation or another legal basis permits this. If there is a concrete suspicion of a criminal offence, necessary data may be transmitted to law enforcement authorities. Name and e-mail address of a reporting person are, as a rule, not disclosed to the person whose content was reported. Data are not passed on for advertising purposes.

§ 6 Transfers to third countries

Google may process data in data centres outside the European Union. A transfer takes place only under the conditions of Art. 44 et seq. GDPR. Insofar as the recipient is certified under an applicable adequacy decision, in particular the EU-U.S. Data Privacy Framework, the transfer is based on Art. 45 GDPR. Where necessary, standard data protection clauses pursuant to Art. 46(2)(c) GDPR and supplementary technical and organisational measures are used in addition.

§ 7 Storage period and deletion

Personal data are deleted as soon as the respective purpose no longer applies, unless there is a legal retention obligation or a legitimate interest in storing them further for a limited time. For the current range of functions, the following storage rules apply in particular:

• project log: at most 90 days;
• the Hero’s smiley replies: at most 30 days;
• time at which the Hero first saw a greeting: as long as the greeting itself;
• operating data of the tablet: only the latest state in each case; deleted when the tablet is unpaired;
• consents of the members: as long as the account exists, project-related consents as long as the person belongs to the project;
• profiles in a project: until the person leaves or is removed from the project;
• greetings not yet seen by the Hero of a member who leaves the project or who keeps only the role of manager: deleted at that time;
• appointments of a member who leaves or is removed from a project: remain in the project’s shared calendar; the assignment to the person is deleted;
• the Hero’s decisions on the legal texts: as long as the project exists;
• accounts whose e-mail address was not confirmed: seven days after registration;
• accounts whose holder never accepted the terms of use and the privacy policy: 30 days after registration;
• unanswered invitations: 30 days after the invitation was created;
• passkeys: with the account; a single passkey as soon as the member removes it;
• backups of a project that the project owner downloads or uploads for restoring: until the download is complete or until restoring is finished, at most 24 hours;
• content reports: twelve months after handling has been completed, open reports until completion;
• blocked content: as long as the block is in place, at most twelve months after the report has been completed. This also applies if the account or the project is deleted earlier; the content is then deleted when the block ends;
• logs of the Studio server: at most 31 days;
• logs of the video call server: at most 14 days;
• e-mail delivery logs: according to the periods of the e-mail service provider used;
• backups: database and media files are backed up daily in encrypted form at a second location; whatever is deleted is also deleted there at the latest 30 days later.

When an account is deleted, the account and the owner’s own projects including the associated content, media files, profiles and tablet pairings are deleted, unless legal retention obligations or legitimate reasons stand in the way. Blocked content is excepted; the period above applies to it. Restoring individual accounts or projects is not provided for. In the operator’s encrypted backups, the deleted data remain for at most 30 more days. The backups serve only to restore the app as a whole after a technical failure, not to retrieve individual accounts or projects. Data subject rights and legal obligations to provide evidence remain unaffected.

§ 8 Rights of data subjects

Data subjects can request access, rectification, erasure, restriction of processing and data portability and, under the legal conditions, object to processing based on Art. 6(1)(e) or (f) GDPR. Consent can be withdrawn at any time with effect for the future; the lawfulness of the processing carried out so far remains unaffected. In addition, there is a right to lodge a complaint with a data protection supervisory authority. Responsible for the operator is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz.

Requests can be sent to the contact address given in § 1. To avoid unauthorised disclosure, the operator may request suitable proof of identity. For data for which the project owner is the controller, the operator may forward the request to the project owner or refer the data subject to the owner.

§ 9 Security and division of responsibility

The operator takes appropriate technical and organisational measures pursuant to Art. 32 GDPR, in particular for access control, transmission security, data backup, logging and the separation of roles and projects. However, absolute security of data transmission and operation cannot be guaranteed.

The project owner is responsible for adding only lawfully collected content that is necessary for the project, for limiting the circle of members appropriately, for informing the Hero in an understandable way and for obtaining any necessary consents or other legal bases. The app must not be used as a substitute for medical, nursing, technical or other emergency measures.

§ 10 Changes to this privacy policy

Changes are made when functions, legal requirements, recipients or purposes of processing change or an adjustment is necessary for security reasons. In the case of significant changes, the updated version is provided in the app and in the CompanionApp. The Hero’s acknowledgement does not replace the information required by law and is not deemed to be consent.

In the event of discrepancies between the German version and a translation, the German version prevails.

Privacy policy for the website living-in-my-shell.eu