braunetic family · Legal

Privacy policy – braunetic family

1. Controller

braunetic – Valentin Braun
Einzelunternehmen
Turmstraße 35
89194 Schnürpflingen
Deutschland

No data protection officer has been appointed; the legal conditions for a mandatory appointment are not met.

2. What this is about

braunetic family is an app for iPhone and iPad with which a family organises its everyday life: appointments and rides, tasks and lists, messages, meal planning – and, if wanted, events from external calendars that an adult shares with the family. A family's data is visible only to the signed-in members of that family. The app contains no advertising, no tracking, no third-party analytics tools and does not sell any data.

This policy applies to the app and the service that belongs to it. For the website braunetic.de, the privacy policy at braunetic.de/datenschutz/ applies.

3. How the app is built

Family and profiles: Whoever sets up the app creates a family and manages it. The owner creates profiles for the members – first name, role (owner, adult, child) and a colour. A profile does not need its own account; children and other people without a device of their own are planned for as a profile.
Size: A family has at most 10 people, the owner included – with or without an account of their own. Whoever is removed frees up their place.
Account: Whoever wants to use the app on their own device receives an invitation from the owner and signs in with “Sign in with Apple”. The account is linked to the profile. An account belongs to one family. The same family can be used with the same account on several devices; the devices show the same state.
Access: The full range of functions requires access for the family – the free 14-day trial for a newly set-up family, a subscription for the family or free access granted by us (sections 4.12 and 4.13). Without access, everything is kept and remains readable for every member as before.
Hosting: The data is held by our processor Supabase in Frankfurt am Main (section 10).

4. Which data we process, for what purpose and on what basis

Unless stated otherwise, the legal basis is the performance of the user agreement with you (Art. 6(1)(b) GDPR). Where a legitimate interest is named, the basis is Art. 6(1)(f) GDPR. Only the details from “Sign in with Apple” (section 4.1) and, to use a family, a profile with a first name (section 4.2) are required; without them the app cannot be used. You provide all other details only when you use the function concerned.

4.1 Account and sign-in. With “Sign in with Apple” we receive from Apple an identifier of your Apple Account for this app and – if you allow it – your e-mail address or a relay address generated by Apple, as well as your name once. The identifier and the e-mail address are stored (it is not shown in the app and not used for writing); the name serves only as a suggestion for your profile. Purpose: your account, signing in, assigning you to your family. Stored until you delete your account.

4.2 Profiles of the family. First name, role, colour, chosen profile picture (a built-in avatar or a photo) and an indication of whether a profile was removed from the active family. The owner creates profiles, also for children and for people without an account. Visible to the signed-in members of the family. Stored for as long as the family exists; a removed profile remains visible in the past, for example as the sender of earlier messages. For an invitation, we store a checksum of the invitation link (never the link itself), which profile it is for, who created it and when it was created, redeemed or withdrawn. An invitation works once and for seven days; the entry stays stored afterwards too, until the family is deleted.

4.3 Profile picture (optional). You can choose a photo from your photo library or a built-in avatar for yourself – and, as the owner, for members without an account of their own. With a photo, only that one photo is transferred; the app gets no access to your photo library. The photo is reduced on the device to at most 512 × 512 pixels and saved anew without capture data (such as location or time). It is held in non-public storage at our hosting provider and is visible only to signed-in members of your family. You can replace or remove it at any time; on removal the file is deleted.

4.4 Contents of the family. Appointments (title, times, place, notes, who is taking part, ride there and pick-up), tasks (title, notes, one or more responsible people, repetition, reminder, status per person), lists and entries with the chosen visibility (family, adults, selected people or only you), messages in the family channel with read status, meal planning (dinners, dishes with a recipe link entered for them, ingredients, ideas, who cooks), favourites from the recipe catalogue and the chosen weather location (section 4.7). Purpose: what the app is there for. Visible only to the members of your family, lists according to their visibility. Stored for as long as the family exists or until the entry is deleted. Deleted or cancelled appointments, deleted tasks and task series, deleted lists and deleted dinners, dishes and ideas disappear from the app; on the server they remain, with their content, marked as deleted so that all devices learn of the deletion, and are removed for good at the latest when the family is deleted. There is currently no automatic deletion after a fixed period; if we introduce one, we will state the period here beforehand. Individual list entries – including those of a deleted list –, ingredients and recipe favourites, by contrast, are deleted for good at once. You can delete a message of your own for everyone (section 8); other messages are not deleted automatically, they belong to the family's shared record and end with it. If the trial, the subscription or free access ends (sections 4.12 and 4.13), nothing is deleted because of that.

Rides with people outside the family. Where the app offers it, whoever manages an appointment can assign a ride-there or pick-up slot to a person outside the family instead of a member, for example a neighbour. Only the name entered (at most 60 characters) is then stored with the appointment – no contact details. The person receives no account, no invitation and no notification from us. All members of the family see the name, including children; it does not appear in notifications or in the calendar link (section 4.14). It is deleted when the slot is assigned to a member or to nobody, or when the slot is deleted. If the appointment is deleted or cancelled, the name stays stored, like the appointment's other details, until the family is deleted. Legal basis towards the person named: the legitimate interest of the family and our legitimate interest in planning rides together. Only enter the name if the person agrees or it is otherwise permitted (terms of use, section 5).

4.5 Suggestions while typing. To make entering things faster, the app remembers per family which task titles and entries on family lists have been typed before – only the text and how often. Entries of private or restricted lists are not included. Stored for as long as the family exists.

4.6 Notifications (push). If you allow notifications, we store the device identifier that Apple issues for this (device token) together with your account – one per device. A notification names who did something (first name) and what kind of event it is – never the content of a message, an appointment or a list; the reminder for a task of your own names its title on your own device. Delivery runs through Apple's push service (section 10). The device identifier is removed when you sign out, when the session expires and when the account is deleted; delivery records without content are removed at the latest when the family is deleted. The legal basis is your consent in the system settings (Art. 6(1)(a) GDPR), revocable there at any time.

4.7 Weather and weather location. The owner or an adult can choose a place for which “Today” shows the weather. The place is found through Apple's map search – places and addresses can be searched for; the search you type goes to Apple. The exact, unrounded coordinate and the name of the chosen suggestion are stored with the family; for an address, the name can contain the street and house number. Visible to all members of the family. A newly chosen place replaces the previous one at once, a removed place is deleted at once; otherwise it stays stored until the family is deleted. Your device requests the weather directly from Apple (WeatherKit); Apple receives the coordinate of the chosen place in the process. Your own location is not collected; the app does not ask for your device's location. Legal basis: the agreement with you.

4.8 Your own calendars – on the device only. If you wish, the app shows your own calendars (the calendar accounts of your device) next to the family plan. To do so, it reads your calendars through the system with your permission. This data stays on your device and is transferred neither to us nor to other members. If you take an event from your calendar into the family plan, a normal family appointment is created with the details you took over.

4.9 Recipe catalogue and recipe links. The catalogue contains recipes from the Wikibooks cookbooks with images from Wikimedia Commons (licence CC BY-SA; source and licence are shown). This is not personal data. When loading an image, your device fetches the file from the Wikimedia Foundation; in doing so it receives your IP address, as with any retrieval on the internet. A recipe search is run on our server and not stored. For a dish, the family can enter a link to a recipe on the internet; it is stored with the dish (section 4.4). When a member opens a dish with a recipe link, their device automatically loads a preview directly from the linked website; in doing so, its operator receives the IP address and the usual technical details of the device, as when visiting a website. This retrieval does not go through our servers; what the operator does with this data is governed by its own rules. Legitimate interest: showing the linked recipe recognisably.

4.10 Technical logs. Our hosting provider logs technical data of the requests (among other things IP address, time, address requested, status and what the app states about its software library and the operating system version of the device) for operation and security. Contents of requests are not logged; our server-side functions log only counts and status codes. When a calendar link (section 4.14) is retrieved, its secret part is in the address requested and therefore also in these logs. Legitimate interest in a secure, working service. The logs are deleted according to the provider's retention periods.

4.11 Security and evidence records. We record when ownership of a family was transferred (which family, from which profile to which, by which account), when an account or a family was deleted (identifiers, times, counts) and when access was granted, extended, revoked or assigned to a family and when a trial began (identifiers, type, time). No contents, no names. Purpose: proof that a deletion took place, security of family management and traceable operation. Legitimate interest. There is currently no automatic deletion of these records: they remain, with their identifiers, even after an account or a family is deleted; the records about access are technically locked against changes and deletion. If we introduce a period, we will state it here beforehand.

4.12 Subscription. After the trial (section 4.13), braunetic family is offered as an auto-renewing subscription through Apple's App Store, one subscription per family. Apple handles the purchase, payment, renewal, cancellation and refund; we receive no payment data, no price, no name and no address from your Apple Account. From Apple we receive about a subscription: an identifier of the subscription issued by Apple (the original transaction number) and the number of the latest transaction, the product (month or year) and the product of the next renewal, the state (active, payment pending, expired, refunded or revoked, with the reason and time of a refund), the end of the current period, whether it renews, the App Store country, whether it is a real purchase or a test purchase, and the time at which Apple confirmed these details, as well as Apple's notifications about the subscription (type, time, transaction number – not their further content). In addition, our service regularly asks Apple for the state of the subscriptions and passes the transaction number to Apple for this. So that the purchase is assigned to the right family, our service generates a random identifier before the purchase, which your device passes to Apple and which Apple confirms to us with the purchase; it links the subscription to your account and your family, and we record when the assignment took place. Purpose: determining whether your family has access, and being able to trace purchases and their assignment. Legal basis: for the access check, the agreement on use with you; for Apple's notifications and the evidence records, our legitimate interest in being able to trace purchases, assignments and misuse. The other members see that a subscription exists and until when – not who took it out. If you delete your account, we remove the link between subscription and account; if the family is deleted, the link to the family. The details of the subscription itself, Apple's notifications and the evidence records of a subscription's assignment and transfer (section 4.11, with your account's identifier, without names) remain; there is currently no automatic deletion for them. If we introduce a period – including where retention obligations under commercial and tax law require retention –, we will state it here beforehand. Without access, everything remains readable; nothing is deleted because of that.

4.13 Trial and free access. A newly set-up family can use the app free of charge with the full range of functions for 14 days. The trial begins when the family is set up and ends by itself 14 days later; all members see the end date in the app. It runs on our server alone: there is no purchase for it, Apple learns nothing about it, and we receive no payment data. For this we store the family, start and end and an evidence record under section 4.11, as well as a note that your account received a trial when setting up the family (your account's identifier, family, time). Purpose: your family's access, and ensuring that every account that sets up a family, and every family, receives the trial only once. Legal basis: for the access, the agreement on use with you; for the note, our legitimate interest in preventing repeated use of the trial. A family's trial ends when the family is deleted; the note on your account then remains, so that the same account does not receive another trial for a new family, and is deleted with your account. If we grant a family free access beyond that (for example the families of the pre-release version), we store for this the family, the type of access, start and end, who at our end granted it and what this is based on, as well as a later revocation. No details about individual members. Legitimate interest in traceable operation. The trial and free access are deleted with the family; the evidence record of them remains under section 4.11.

4.14 Family calendar in other apps. An adult of the family can share the family calendar as a subscription for other calendar apps, for example for Apple Calendar, Outlook or a PC. For this, the app generates a secret link. Whoever has this link can read the family's appointments: the family's name as the name of the calendar and the titles, times and places of the appointments, but not notes, participants or who is taking care of something; your own calendars (4.8) and the family's external calendars (4.15) are never included. We store the link in our database only as a checksum; on every retrieval it appears in the technical logs of our hosting provider (section 4.10). The family can withdraw the link at any time, also after the trial or without a subscription; creating or replacing a link requires access, but an existing link keeps delivering without access. It expires when the family is deleted, and likewise as soon as any adult leaves the family, including by deleting their account. By default, no link is active. Other apps only read the calendar and cannot change anything; on retrieval, our service receives the usual connection data of the retrieving app (section 4.10). To whom the family passes on the link is in its hands. Legal basis: the agreement with you.

4.15 External calendars in the family. An adult of the family can add an external calendar that exists as a calendar link (ICS or webcal) – for example the published calendar of a school or a club, or a shared calendar from another calendar service. When adding it, the person expressly confirms that this calendar may be shared with the whole family. After that, our service fetches the link and reads in the events; the original calendar is never changed in the process, nothing is written back. We store the name given by the person, the colour, whether the calendar is shown, the internet name of the provider (the part of the link before the first slash), who added it, how the last fetch went and the time zone of the device with which it was added (only to convert events without their own time zone correctly; it is not shown to any member) – and, per event, title, place, start and end or the day for all-day events, and a technical identifier of the event. Descriptions, participants, organisers, reminders and attachments of the external calendar are not taken over. Events of the last 30 days and the next 400 days are read in, at most 3000 per calendar. The link itself is a secret: it is held encrypted in a protected area of our hosting provider, is not shown to any member – only the internet name is visible – and is not written to logs; our function logs only counts and the type of a problem. Our service fetches the calendar only via public internet addresses, immediately after adding and then roughly every 30 minutes; if a fetch fails, we wait longer, up to twelve hours. On retrieval, the provider of the calendar receives the connection data of our service, not yours. The events read in are visible to all members of the family, including children; only adults can add, change, hide and show, reload and remove. If an adult removes the calendar or hides it, the events read in are deleted immediately, on removal also the link; a technical record without link and without events remains for seven days so that all devices learn of the deletion. If the person who added a calendar leaves the family or deletes their account, their external calendars are removed likewise; when the family is deleted, all are removed. Removal is always possible, also after the trial or without a subscription; a calendar that has been added keeps being fetched without access until it is removed. Up to ten external calendars are possible per family. Legal basis: the agreement with you. For the contents of the external calendar – for example names in event titles of a school or a club – the provider of that calendar remains responsible; whoever brings it into the family thereby decides that the family sees these contents.

External calendars with a username and password. If the provider of a calendar link requires a sign-in, the person adding the calendar can also enter a username and a password under “Authentication” – for HTTP Basic sign-in over https, for example for the export link of a Nextcloud calendar with an app password; CalDAV is not supported. We store both only so that our service can fetch the calendar for the family. Like the link, the username and password are held encrypted in our hosting provider's secret store (Supabase Vault) and are never shown again after saving, not even to the person who entered them; the app only shows that a sign-in is stored for the calendar. Only the person who added the calendar can replace them. Our service sends them only to the server the link belongs to; if that server redirects to another server, they are not sent there. Our function does not write them to logs, and they are not included in the data export (section 9). They are deleted together with the link: when the calendar is removed, when the person who added it leaves the family or deletes their account, and with the family. Encrypted copies remain in our hosting provider's database backups (section 8) until those backups expire. Before adding, the person can check with “Test Connection” whether the link and the sign-in work; their device then sends the link, username and password once, itself, directly to the calendar server, whose provider receives the connection data of that device, and stores none of it. The app advises using an app password for services such as Nextcloud when one is available. Legal basis: the agreement with you.

4.16 Contact with us. If you write to us (info@braunetic.de), we process your details in order to answer your enquiry. We delete the enquiry once it is no longer needed for handling it and no statutory retention obligations stand in the way; there is no fixed period and no automatic deletion for this.

4.17 Reports of contents. If you report a content to us as unlawful (terms of use, section 5), we process your report with the details you give – with your name if you wish –, the sender address of your e-mail and, insofar as necessary for the review, the reported content. Purpose: to review the report, decide on it, confirm receipt to you and tell you the decision, and be able to prove how it was handled. Legal basis: insofar as the Digital Services Act requires us to handle it, compliance with a legal obligation (Art. 6(1)(c) GDPR), otherwise our legitimate interest in keeping unlawful contents out of the service. We delete the report once it is no longer needed for handling and proof and no statutory retention obligations stand in the way; there is no fixed period and no automatic deletion for this.

5. What stays on your device

The sign-in session (in the keychain), settings of the app, the most recently shown profile pictures and weather data as a cache, and your calendar selection. This data does not leave the device and is deleted with the app; when the family is deleted, the family's caches are emptied.

6. Who sees your data

The signed-in members of your family, within the app and the chosen visibility of lists. Other families see nothing; this is enforced in the database itself.
Whoever has a calendar link shared by the family (section 4.14): titles, times and places of the family appointments.
The provider of an external calendar that an adult has added (section 4.15): on retrieval the connection data of our service and, if stored for the calendar, the username and password for that calendar; with “Test Connection” once the connection data of the device used for the test – no other details about you or your family.
We as the operator, for maintenance and support – as little as necessary, as a rule only counts and times.
Our processors and the further recipients in section 10.

Beyond that, we do not pass data on to third parties unless we are legally obliged to do so.

7. Children

Profiles for children are created by a parent (the owner). A child can use the app on a device of its own if the owner invites it; it then signs in with its own Apple Account. Children see the family's shared contents – including the events from external calendars that an adult has shared –, can suggest meals, complete their own tasks and create lists and entries; in the family channel, the adults write. A list that a child creates only for itself is seen only by that child – not by the owner either; a child cannot create an adults-only list. Notifications to children are limited to what concerns them directly. Children pay nothing and cannot take out a subscription. The app is aimed at adults who organise their family and contains no advertising.

8. Deleting

Delete My Account (in the app under Family; without a family via the account symbol on the setup screen): deletes your account, your sign-in, your device identifiers for notifications and your profile photo. Your profile stays with the family with first name, role and colour, together with what you wrote and planned; the owner can remove it. External calendars you added are removed from the family. Before deleting, you confirm it by signing in with Apple again. If you own a family, you transfer ownership beforehand or delete the family.
Delete Family (owner only): deletes the family with all contents, photos, external calendars and a calendar link for all members, immediately; photos that could not be removed immediately in the process are removed by a daily clean-up run. This too you confirm by signing in with Apple again. The accounts of the other members remain; they can set up a new family or join one.
You can delete your own messages for everyone: the text is removed from the database immediately, and in its place everyone sees “This message was deleted.” A device that already showed the message removes the text the next time it loads the conversation. You cannot delete other people's messages; they are deleted with the family. If you request the deletion of individual contents, we examine the request and delete as far as there is a right to it.
A subscription does not end because of this. If you took out the subscription, it continues at Apple until you cancel it in the settings of your Apple Account. The app tells you this before deleting. A running trial ends when the family is deleted; a new family you set up with the same account does not receive another one (section 4.13).
Both deletions are final and take effect immediately; there is no waiting period. An account deletion has two steps (first the link to the family, the devices and the photo, then the account itself); if the second step fails, the app tells you, and it is repeated automatically within a day. If you set up a family with the same account or join one before that, the deletion is discarded and the account remains.
In the database backups of our hosting provider, deleted data may persist for the duration of the backups there (currently daily backups, each kept for at most nine days); photos are not contained in any backup and are gone once deleted.
Without the app: Write to info@braunetic.de. We verify the request through the owner of your family or your Apple Account and delete accordingly.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Consent you have given (notifications) can be revoked at any time in the system settings. There is no automated decision-making, including profiling.

Objection: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR); an e-mail to info@braunetic.de is enough. We then no longer process the data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can rectify everything you can edit in the app yourself. The details of your account (identifier, e-mail address, sign-in method, times, your profile) can be saved as a file in the app (Family › Export My Data; without a family via the account symbol). For access and portability beyond that, we provide your family's data to you on request as a file (JSON); external calendars are contained in it with name and events, never with their link, username or password. Information on request also covers the details of subscription, trial and evidence records that relate to you (sections 4.11 to 4.13). Requests to info@braunetic.de; we reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), including the authority of your place of residence. The authority responsible for us:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart

10. Processors and recipients

Supabase (Supabase Pte. Ltd., Singapore, as the contracting party; Supabase, Inc., USA, for operation and support) – hosting of the database, sign-in, file storage, server-side functions (among them the calendar link, the retrieval of external calendars and the processing of Apple's notifications about the subscription). Storage and processing of the database in Frankfurt am Main (AWS, region eu-central-1); no region is set for the server-side functions, and they can also run outside the EU. Data processing agreement: Supabase's Data Processing Addendum, which is part of Supabase's terms of service; for access from third countries, the EU standard contractual clauses agreed in it apply. Sub-processor: Amazon Web Services for the infrastructure in Frankfurt.
Apple Inc. and Apple Distribution International Ltd. – “Sign in with Apple”, push notifications (APNs), weather (WeatherKit), map search; sale and billing of the subscription in the App Store, notifications to us about the state of the subscription and our regular query of this state (section 4.12). Apple learns nothing about the trial. Apple processes under its own privacy policy and is itself responsible for the purchase.
IONOS SE, Montabaur, Germany – operation of our mailbox info@braunetic.de (sections 4.16 and 4.17), on the basis of a data processing agreement.
Wikimedia Foundation (USA) – recipe images, only when retrieved by your device. Public contents; legitimate interest.
Operators of websites a recipe link points to (section 4.9) – only when your device retrieves the preview. They are not processors of ours.
Providers of external calendars (section 4.15) – chosen by an adult of your family; they deliver events to our service and receive no details about you in the process – except a username and password stored for their own calendar and, with “Test Connection”, the connection data of the testing device. They are not processors of ours.

A transfer to countries outside the EU takes place only insofar as Apple, Wikimedia and the operators of linked recipe websites carry it out when your device retrieves data, insofar as Supabase, as a provider based outside the EU, can access the data stored in Frankfurt or a server-side function runs outside the EU, and insofar as an external calendar chosen by your family is held by a provider outside the EU; for Supabase, the safeguards named above apply.

11. Security

Encrypted transmission (TLS), encrypted storage at the provider, access to family data only for signed-in members through rules in the database itself (Row Level Security), no secrets in the app, sign-in only through Apple without a sign-in password held by us, signing in again before every deletion, Apple's subscription notifications only with a valid Apple signature, links of external calendars and their usernames and passwords only in an encrypted secret store, username and password only to the calendar's server, and retrievals only from public internet addresses.

12. Changes

We adapt this policy when the app or the legal situation changes. The version currently in force is available at this address; we show material changes in the app.

Status

Status: 26 October 2026