Privacy policy
How Tembunar processes your data, why it is needed and what rights you have.
Updated: 2026-09-25
1. Controller and contact
Lukas Funk
Seeweg 32, 44263 Dortmund, Deutschland
Privacy enquiries: Contact details after security check at /kontakt
2. Website visits and hosting
When you visit, technically necessary connection data such as your IP address, time, requested address and browser information is sent to the server infrastructure. This enables delivery, diagnostics and security. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a secure and functioning service.
Hosting provider and processing location: Railway Corporation stellt den Anwendungsserver und den persistenten Datenträger in der gewählten EU-West-Region (Amsterdam, Niederlande) bereit. Cloudflare, Inc. übernimmt DNS, vorgeschaltete HTTPS-Auslieferung und Angriffsschutz. Eine EU-Serverregion bedeutet nicht, dass sämtliche Betriebs-, Support- und Unterauftragsverarbeitungen dieser Anbieter ausschließlich in der EU stattfinden.
Recipients, processing agreements and, where relevant, international transfer safeguards: Für Hosting, technische Auslieferung/Sicherheit und Anmeldeversand werden Railway, Cloudflare und Resend eingesetzt. Die Anbieter veröffentlichen in ihre Vertragswerke einbezogene Auftragsverarbeitungsbedingungen und Regelungen zu Unterauftragnehmern sowie Drittlandübermittlungen; hierzu gehören EU-Standardvertragsklauseln. Verbindliche Details: https://railway.com/legal/dpa ; https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://resend.com/legal/dpa . Bei der Kontaktweiterleitung kommt zusätzlich Google/Gmail zum Einsatz. Dessen Rolle und Vertragsgrundlage hängen vom verwendeten Kontotyp ab und müssen für das Betreiberpostfach vor öffentlicher Freigabe abschließend geklärt werden. Es wird keine ausschließlich europäische Verarbeitung sämtlicher Dienste zugesagt.
3. Account, sign-in and language
We process your email address, display name, optionally a username and salted password hash, and sign-in and session data. Passwords are not stored in plain text. Guests verify their email using a one-time sign-in link. Creators use a username and password or an available social sign-in method.
This processing is necessary to provide the account service you request under Article 6(1)(b) GDPR. Without the required information, sign-in and private wishlists cannot be used. You may choose a display name.
Your chosen interface language is saved with your account and in a language preference cookie. Automatic selection uses your browser's preferred language, not precise location or IP geolocation. Unsupported languages fall back to English.
Email provider: Anmelde-E-Mails werden über Resend (Plus Five Five, Inc., USA) versendet. Verarbeitet werden Empfängeradresse, Nachrichteninhalt einschließlich Anmeldelink und Zustelldaten. Die Versandregion ist EU-West; Resend speichert Nachrichtendaten und Protokolle jedoch in den USA. Laut Anbieter gelten regulär 30 Tage Aufbewahrung für E-Mail- und Logdaten, zusätzliche Sicherungen sieben Tage. Der bei Registrierung einbezogene Auftragsverarbeitungsvertrag enthält EU-Standardvertragsklauseln. Kontakt-E-Mails an Contact details after security check at /kontakt werden über Cloudflare Email Routing an das Gmail-Postfach des Betreibers weitergeleitet. Dabei erhalten auch Cloudflare und Google die für Weiterleitung und Postfachbetrieb erforderlichen Nachrichten- und Verbindungsdaten. Einzelheiten zu Resend: https://resend.com/security/gdpr ; Google: https://policies.google.com/privacy
4. Google and Apple
If available, choosing social sign-in opens the selected provider. For Google we use the openid and email scopes and receive a provider identifier, email address and its verification status. You explicitly confirm your own display name; the Google profile name and photo are not imported. An external contact email must be verified independently before it can be used for recovery. Google sign-in does not grant ChatGPT access; that requires separate authorization. For Apple we receive a provider identifier and, where supplied, your name, email address and its verification status. We do not receive your Google or Apple password. Linking takes place through the sign-in or connection flow you explicitly choose.
Google Ireland Limited and Apple Distribution International Ltd. also process data under their own privacy policies, which explain international transfers. The account processing we perform is based on Article 6(1)(b) GDPR.
5. Wishlists, purchases and shared pools
We store list titles, occasions, optional dates and descriptions, wish names, optional original and affiliate links, notes, wish prices, categories, importance, order, memberships, purchase marks and comments. Pools add the organizer, PayPal link, target amount and manually entered balance. This supports the gift organization you request under Article 6(1)(b) GDPR.
Wishlists are available only to their creators and signed-in members. Anyone with a forwarded invitation link may join after signing in. Other gift-givers can see buyer names and comments. Creators cannot see these by default, but can reveal them after three confirmations. Pool data remains hidden from creators.
Please do not enter sensitive information, passwords or unnecessary information about others. The operator may access data where necessary for operation, security or a specific enquiry.
6. AI for variants
Cloudflare Workers AI processes wish titles and notes on requests from our application to identify multiple variants. It may match purchase comments to those variants. The application does not send account identifiers, email addresses or product links for this analysis; personal information you put in free text may nevertheless be included.
This supports the requested list functionality under Article 6(1)(b) GDPR. Suggestions can be wrong: gift-givers can change the display and confirm uncertain assignments. This is not automated decision-making with legal or similarly significant effects under Article 22 GDPR.
AI provider and processing location: Die Variantenanalyse nutzt Cloudflare Workers AI (Cloudflare, Inc., USA) mit dem Modell @cf/meta/llama-3.3-70b-instruct-fp8-fast. Sie läuft außerhalb des Tembunar-Servers im Cloudflare-Netz; eine Beschränkung der Inferenz auf die EU ist nicht eingerichtet. Cloudflare erklärt, Eingaben und Ausgaben ohne ausdrückliche Zustimmung nicht zum Training seiner Modelle oder zur Verbesserung eigener bzw. fremder Dienste zu verwenden. Quelle: https://developers.cloudflare.com/workers-ai/platform/data-usage/
Assessment of processing and transfers: Die KI unterstützt die vom Nutzer angeforderte Strukturierung von Wünschen. Die Verarbeitung der dafür erforderlichen Wunschangaben erfolgt zur Bereitstellung der Funktion (Art. 6 Abs. 1 lit. b DSGVO). Nur die für die Analyse benötigten Angaben werden übertragen; Kontozugangsdaten, Sitzungstokens und vollständige Listen werden nicht als Analyseinhalt übermittelt. Keine besonders sensiblen persönlichen Angaben in Wunschtexte aufnehmen. Ergebnisse können falsch sein und bewirken keine ausschließlich automatisierten Entscheidungen mit rechtlicher oder ähnlich erheblicher Wirkung. Auftragsverarbeitung und etwaige Drittlandübermittlungen richten sich nach Cloudflares DPA und dessen einschlägigen Übermittlungsgarantien. Die Analyse wird durch Eingabe-/Ausgabebegrenzungen und ein tägliches Anfragebudget begrenzt.
7. Security and abuse prevention
We protect bug reports, feedback, link reports and contact disclosure with server-side bot verification and shared rate limits. Wish creation has no additional bot check. We limit sign-in attempts and use expiring tokens and session checks. Rate limits process identifiers, hashed email addresses and, where the server infrastructure is configured accordingly, hashed IP addresses. Hashing does not guarantee anonymization. The basis is Article 6(1)(f) GDPR, protecting accounts and the service.
Cloudflare Turnstile is enabled. Cloudflare, Inc., USA, processes network and browser information to detect automated access. Assessment of legal basis and transfers: Cloudflare Turnstile schützt den Anmeldevorgang vor automatisiertem Missbrauch. Hierfür verarbeitet Cloudflare unter anderem IP-Adresse, Browser-/User-Agent- und TLS-Signale, Sitekey und Website-Ursprung. Die Einbindung dient unserem berechtigten Interesse an Sicherheit und Missbrauchsschutz (Art. 6 Abs. 1 lit. f DSGVO); die Prüfung ist auf den sicherheitsrelevanten Vorgang begrenzt. Cloudflare beschreibt sich für die konkrete Schutzleistung als Auftragsverarbeiter und für die Verbesserung seiner Bot-Erkennung als eigener Verantwortlicher. Eine ausschließlich europäische Verarbeitung wird nicht zugesagt. Es gelten die jeweiligen Rollen und Übermittlungsgarantien aus Cloudflares DPA und Turnstile-Datenschutzhinweisen: https://www.cloudflare.com/cloudflare-customer-dpa/ und https://www.cloudflare.com/turnstile-privacy-policy/
8. Shop links, Amazon, PayPal and WhatsApp
The app uses outbound links, not PayPal or Amazon tracking scripts. Merely displaying a PayPal button does not connect to PayPal. Opening a link sends connection data and its embedded information to the provider. Support links contain the recipient and amount, not wishlist or account identifiers.
Amazon short links may be resolved by the server when entered. Amazon receives that server request. Clicking an affiliate link also sends the affiliate identifier. Amazon links may send our website origin as a referrer, but not the complete private list path. This financing is based on the operator's legitimate interest under Article 6(1)(f) GDPR. Retailers are responsible for their subsequent processing.
Optional WhatsApp sharing passes the prepared message and link to WhatsApp. You choose the recipient and whether to send it. We do not read your WhatsApp contacts or messages.
For optional support payments, the operator may receive payment information in their PayPal account. Tembunar does not automatically read your payment details or pool balances. Payments are processed to carry out the requested transaction, and necessary accounting records may be subject to statutory retention.
9. Contact, link reports, bugs and ideas
We process the content, account or contact details, timing and review history of enquiries, ideas and problem reports. Article 6(1)(b) GDPR applies to service-related enquiries; otherwise Article 6(1)(f) applies to answering and improving the service. Legally required content notices are processed under Article 6(1)(c). Reports and internal notes are not public.
10. Retention and deletion
Sessions last at most 30 days; signing out revokes that session. Email sign-in tokens last 15 minutes and are consumed on use. OAuth attempts and surprise-reveal confirmations expire after 10 minutes. Cleanup routines remove expired technical records; expiry does not always mean immediate physical deletion.
Accounts and active lists are stored to provide the service. Deleting a list removes its dependent data. Withdrawn purchase records are initially marked as deleted and no longer displayed.
Binding retention periods for accounts, withdrawn purchases, reports, server logs and backups: Konten und aktive Wunschlisten werden für die Bereitstellung gespeichert; Inaktivität allein löst keine Löschung aus. Anträge auf Kontolöschung werden nach erforderlicher Identitätsprüfung ohne unangemessene Verzögerung bearbeitet; internes Ziel sind 30 Tage, die gesetzliche Monatsfrist für die Beantwortung bleibt maßgeblich. App-Zugriffsprotokolle und Nutzungszähler: sieben Tage. Gefilterte Fehlerprotokolle: 30 Tage. Abgeschlossene interne Anfragen und Meldungen: 90 Tage nach Abschluss bzw. letzter Bearbeitung. Dokumentierte gesetzliche Aufbewahrungsgründe können eine beschränkte längere Speicherung erfordern. Tägliche App-Sicherungen: 30 Tage. Bereinigungen laufen stündlich während des Betriebs und nach Neustart. Bei Wiederherstellung sind zwischenzeitliche Löschungen vor erneuter Freigabe nachzuvollziehen. Zurückgenommene Kaufeinträge bleiben zunächst als gelöscht markiert; Listen- und Kontolöschungen müssen zugehörige Inhalte berücksichtigen. Die Fristen für eigene App-Daten gelten nicht automatisch für eigenständige Protokolle der Infrastruktur- und Mailanbieter. Abgeschlossene E-Mail-Anfragen werden organisatorisch nach 90 Tagen gelöscht, sofern kein konkreter Aufbewahrungsgrund besteht.
Statutory retention, for example for payment records, and necessary evidence preservation may require longer, purpose-limited storage.
11. Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability under Articles 15–20 GDPR. Where processing relies on legitimate interests, you may object based on your particular circumstances under Article 21. Consent may be withdrawn at any time for the future.
Contact the privacy address above. We verify your entitlement without requesting unnecessary extra information. You may also complain to a supervisory authority under Article 77, especially where you live, work or believe a violation occurred.
Supervisory authority responsible for the operator: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). Kontakt und Beschwerdemöglichkeiten: https://www.ldi.nrw.de/kontakt
12. Cookies, analytics and search engines
The app uses its own operational diagnostics and aggregate usage counters as described below. There are no external analytics, retargeting or advertising pixels. Fonts are served locally. Cookies support sign-in, security and your requested language preference.
Public information pages can be read by search engines and AI systems. Private lists, purchases, comments, accounts and administration data are not published in public machine documents or sitemaps.
Optional ChatGPT account connection
When you explicitly authorize ChatGPT, it receives your own wishlist and wish data within the granted permissions and the results of requested changes. A guest access link is returned only on an explicit sharing request. Hidden purchases, buyer details and Secret Santa assignments are excluded. Tembunar does not read your entire chat history or send messages through this interface.
Sign-in takes place on Tembunar. Our existing database stores the account/client mapping, technical permissions, timestamps and short-lived OAuth records. Access tokens last at most one hour, authorization codes one minute and grants 30 days. ChatGPT also receives a refresh token for this explicitly authorized connection. It is replaced on each use and expires no later than 30 days after its first issuance; renewal neither expands granted permissions nor extends this period. The connection is independent of the website sign-in session and can be disconnected at any time. Expired OAuth records are cleaned on startup and every minute while running. Revocation immediately blocks access and deletes related token models; wishlists remain.
Saved write-operation responses may contain wish text and URLs. These response contents are erased after 30 days on the next startup or minute cleanup. The account mapping, request key, operation, payload hash and timestamp remain until account deletion to prevent delayed retries creating duplicate wishes. Old responses are then unavailable. Revoked or expired connection rows are removed after 30 days. Backups follow the separately stated backup retention; restoration requires cleanup and reconciliation of previous revocations.
Disconnect under /connections. ChatGPT processing follows the settings and terms of the OpenAI account you use; this connection does not promise exclusively European data storage. Never put passwords or access tokens into chat.
Technical plugin operations emit sanitized diagnostics containing an error reference, operation name, duration, hashed request identifier and error classification. Account identifiers, email addresses, access tokens, complete guest links, wish text and complete request arguments are not fields of these operation diagnostics. These identifiers are not guaranteed anonymous. App logs and hosting-provider logs have separate storage and retention; the 30-day period for saved operation responses is not a general log-retention period. Infrastructure logs follow the separately disclosed provider and operational settings.
Operational diagnostics and usage statistics
Tembunar stores technical route templates, timestamps, status codes, response times, language and coarse browser/device categories on its own server. For debugging, account identifiers are pseudonymized using a secret and rotate every UTC day. This is not guaranteed anonymization. Request bodies, passwords, session tokens, full IP addresses and private wish text are not collected as log fields. Exception messages and stack traces are filtered. Administrators can inspect up to 30 minutes of preceding technical activity associated with an error.
Separate browser counters measure page views and selected outbound clicks without a visitor identifier or additional cookies. These counters honor Global Privacy Control. There is no session replay, form recording or external analytics pixel. Clicks are not verified purchases or payments. Technical access logs and usage counters are limited to seven days, filtered error logs to 30 days, with additional volume caps, with cleanup at least hourly while running and on startup or access. Backup retention is configured separately. The legal basis and balancing of interests for the final live configuration remain subject to review before launch.
Secret Santa groups and optional reminders
For a gifting group we store its name, display names, memberships, roles, fixed avatars, meeting date and place, theme, optional budget and currency, and an optional salted password hash. Secret draws, selected wish inspiration, personal group aliases, private gift ideas and purchase marks support the requested group functions. Members see the village and shared rules; each giver receives only their own recipient and that recipient's shared ideas. Personal gift notes remain private.
Account-free participation uses a random browser access identifier. Deleting browser cookies may lose access for an account-free guest. Sharing ideas from a personal wishlist requires an account. Organizers can revoke invitation links. Village questions are synchronized only among group participants; these events are cleaned up after one day.
Meeting reminders are sent only to account holders who expressly enable them. Consent can be withdrawn in account settings at any time. Emails contain neither secret assignments nor wish ideas. Deleting a group removes its memberships, draws, gift notes and events; archived villages stay stored. The retention rules above also apply to backups.
To prevent automated collection, email and any phone numbers are displayed after a security check. No sign-in is required.