Privacy policy

Controller

tap & type UG (haftungsbeschränkt), Pestalozzistr. 14, 14943 Luckenwalde, Germany, email: kontakt@waffenschrank.app (see legal notice).

Person in charge of the protection of personal information (Canada, including Québec): Stefan Ritschel, managing director of tap & type UG (haftungsbeschränkt), kontakt@waffenschrank.app.

The basic principle: your data stays with you

Waffenschrank is a local-first app: all content (guns, ammunition, training, documents, photos) is stored on your device – in the web app, in your browser’s storage, which the browser may clear on its own in some circumstances (see “How long we keep things”). It reaches a server only if you set up a backup, device sync, a showcase or a club page yourself; what goes where is described in the sections below. There is no forced account, no tracking, no advertising and no analytics components; we do not analyze how you use the app. Which aggregated figures Apple and Google show us is explained under “What we receive from the App Store and Google Play”. Text recognition (OCR), photo cut-out and target analysis run on the device — photos do not leave it for this. Only in the web app does text recognition download its recognition model and its computing core from our own server (web.waffenschrank.app) on first use, not from a third-party host; even there the image itself is analyzed in the browser and is not uploaded. If you record the other party’s name, address and date of birth for an acquisition or a transfer, that is another person’s data: it too stays on your device and never goes into a showcase; it goes into iCloud, Drive and account backups and into device sync only in encrypted form. If you yourself export a backup file without a password (the app warns against this), a PDF with these details or a CSV file of the US register, the file is not encrypted.

The shot timer uses the microphone solely to detect shots as volume peaks. The analysis runs in real time on the device; audio is never recorded, stored or transmitted — only the detected points in time (numbers) are saved. Microphone access is active only while the timer is running.

The training coach works out its advice entirely locally from your entries. On devices with built-in on-device AI (Apple Intelligence or Gemini Nano) it can additionally have a short summary phrased — that, too, happens solely on the device. Only aggregated figures go into that summary, never gun, location or personal data, and none of it leaves the device or is stored.

Hints about Pro: After certain steps – such as your first backup, a completed deadline or your tenth session – the app shows a one-time card about a matching Pro feature on the overview. Whether and when is decided solely on your device, from your entries; to do this, the app stores there which hints it showed and when, and what it found when you first started version 3.5. If the Pro page offered you a free trial, the app also stores its length, price and currency along with the time, so it can mention it under “More” for up to seven days. None of this leaves your device; we don't learn whether or when you see a hint. You can turn the hints off in your profile under “Hints about Pro features”. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in making our own features known; the switch is also your objection under Art. 21(2) GDPR); for storing on your device, § 25(2) no. 2 TDDDG or the corresponding provision in your country (see “The basic principle”).

The app's content data — the database (folder “SQLite”), the photos (folder “photos”) and the documents (folder “documents”) — are excluded from the iOS device backup. They are therefore not automatically included in the device or iCloud backup. On Android the system backup is switched off entirely for the app, so no content automatically ends up in a Google backup there either. Technical remnants (e.g. app settings in system storage and, on iPhone and iPad until the next launch, the error message of a crash at startup, see “What happens at startup — even without an account”) can still end up in the device backup; gun, ammunition and training data do not. A backup of your content only comes about if you set one up yourself: iCloud backup, Google Drive backup (Android), account backup/sync or manual export. Without one of these, the data is lost if the device is lost or breaks.

Waffenschrank is not directed at children; accounts, showcases and club pages are intended for adults aged 18 and over.

Do Not Track: We do not collect personal information about your online activities over time or across third-party websites or online services, and no third party does so through our app or website. Browser “Do Not Track” signals and Global Privacy Control therefore change nothing here — there is no tracking for them to switch off.

Storing or reading on your device: Where this policy cites Section 25(2) no. 2 of the German TDDDG for this, it refers to access that is strictly necessary for a service you have expressly requested; such access needs no consent (Art. 5(3), second sentence, of Directive 2002/58/EC). Outside Germany, the corresponding provision of your country applies: in Austria, § 165 Abs. 3 TKG 2021; in France, Art. 82 of Law No. 78-17 of 6 January 1978 (Informatique et Libertés); in Italy, Art. 122 of the Codice in materia di protezione dei dati personali; in Spain, Art. 22(2), third subparagraph, LSSI; in Denmark, Section 4(1) no. 2 of the Cookie Order (cookiebekendtgørelsen, BEK no. 1148 of 9 December 2011); in Poland, Art. 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej); in Czechia, § 89 odst. 3 zákona č. 127/2005 Sb.; in Finland, Section 205 of the Act on Electronic Communications Services (917/2014); in the Netherlands, art. 11.7a lid 3 onder b Telecommunicatiewet; in Belgium, art. 10/2, al. 2, de la loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel; in Sweden, 9 kap. 28 § andra stycket 2 lagen (2022:482) om elektronisk kommunikation; in Slovakia, § 109 ods. 8 zákona č. 452/2021 Z. z.; in Ireland, Reg. 5(5) S.I. No. 336/2011; in Luxembourg, art. 4, paragraphe 3, lettre e), de la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications électroniques; in Estonia and Lithuania, the provision that transposes the Directive there; and in Norway, § 3-15(2)(b) of the Electronic Communications Act (ekomloven). In Hungary, Section 155(4) Eht. (Act C of 2003 on electronic communications) allows storing and reading on your device only after you have been informed and have given your consent; it does not repeat the Directive's exception, although it transposes the Directive. We interpret it in line with the Directive and therefore do not ask for your consent for this access in Hungary either; on its bare wording, this access would need consent too.

What happens at startup — even without an account

The app is not entirely offline. On iPhone, iPad and Android at startup it checks with our own delivery service (updates.waffenschrank.app, served via our hosting provider Cloudflare, Inc. — processor, EU standard contractual clauses) whether a program update is available. This unavoidably transmits your IP address, the project and update identifier, the release channel, the runtime version as well as platform and operating system version. The update library attaches two further items on its own: an installation identifier that is created on first launch and stored persistently on the device, and, once after a crash, the related error message (up to 1024 characters), which is deleted from the device as it is sent. As of version 2.2.1, the app replaces both with fixed placeholders that are the same on every device, so neither item leaves the device; versions before 2.2.1 still send them. Our update service needs neither, does not evaluate them and does not store them. App versions before 1.3 send this check to Expo instead of our delivery service (650 Industries, Inc., USA — transfers are based on the adequacy decision for the EU-US Data Privacy Framework, under which Expo is certified), and they also send the installation identifier. No content from your collection is included. Legal basis: Art. 6(1)(f) GDPR (delivering bug fixes); insofar as the app reads information on your device that this requires, such as the identifier of the installed update, Section 25(2) no. 2 of the German TDDDG or the corresponding provision of your country (see “The basic principle”).

A few seconds after startup, on iPhone, iPad and Android, the app also asks kataloge.waffenschrank.app (likewise via Cloudflare, Inc. — processor, EU standard contractual clauses) whether a newer version of the gun, accessory and ammunition catalogs exists, and downloads it if so. This unavoidably transmits your IP address and the details the operating system attaches to every request (such as app and system version); no installation identifier and no content from your collection is included. A scanned barcode is only matched against the catalogs on your device. Legal basis: Art. 6(1)(f) GDPR (up-to-date catalogs without a new app version).

On iPhone, iPad and Android the purchase handling only checks in at startup if a purchase has been started, a code redeemed or a Pro unlock recognized via the store on this device before, or — as of version 2.2.1 — if the store on your device has a record of a Pro purchase by your account (the app looks this up there without sending anything itself); it then checks whether Pro still applies — as a rule at most every twelve hours, more often while a purchase is not yet completed or after a subscription has expired (see “Purchases”). If you have never bought anything, it only checks in once you open the Pro page. The app only opens further connections once you set up or trigger the feature in question yourself: account, backup, showcase, contact form and filling from shop links. After that, some of them also continue on their own — the automatic backup, the monthly refresh of a showcase and, when Pro ends or returns, pausing or re-uploading additional showcases.

This applies to the app from version 2.2. Older versions contact the purchase service (RevenueCat) at every launch to check the Pro status.

Device permissions

The app only asks for permissions when you use the matching feature: camera and photo library (photos of guns, documents and receipts, barcode and text scanning), microphone (shot timer), NFC (reading tags on cabinets and cases), Face ID or fingerprint (app lock and releasing the recovery key), notifications (reminders) and, on iPhone and iPad, the calendar (adding events only, when you add several deadlines at once; the app can’t read your calendar). Whatever this produces stays on the device. Whatever you add to your calendar is then stored there — and, if your calendar syncs with an online service, there as well.

Text recognition, barcodes and coach on Android (Google ML Kit)

On Android, libraries from Google (ML Kit) handle text recognition, barcode scanning, cutting out photos and document scanning; the training coach’s summary is written by Gemini Nano through the AICore system service. The image, recognized text, barcode content and coach input are processed on the device. On its own, ML Kit would send diagnostic and usage data to Google LLC (USA) from the first use of one of these features (firebaselogging.googleapis.com): a persistent identifier of the installation, package name and library version, language setting, device model and manufacturer, Android version, country, mobile network, network type and time zone. We have switched off this transmission path in the app: the events are neither stored nor sent. Cutting out photos and document scanning run in Google Play services on your device, a system component from Google; what it transmits to Google itself is governed by Google’s terms and lies outside this switch-off. ML Kit is not included on iPhone and iPad.

Reminders, widgets and shortcuts

Reminders – of deadlines, maintenance, training, competitions and your own appointments, of the end of a Pro trial and of the renewal of an annual or quarterly Pro subscription – are scheduled and shown by the device itself (local notifications). There is no push service; no server learns what the app reminds you of. The email before an annual or quarterly subscription renews is a separate channel (see “Renewal reminder”).

For widgets, Live Activities, shortcuts and Siri, the app places the necessary details on iPhone and iPad in a shared area of the device (app group): the number of your guns, of your ammo types running low and of your training sessions in the past twelve months; the make, model and caliber of each gun; the name, caliber and stock of each ammo type and the stock per caliber; the title, due date and type of your open deadlines together with the gun they belong to; the proof-of-need traffic light, the app language and internal identifiers the app uses to find these entries again. Serial numbers, storage locations and the numbers of your permits are not included. If you tick off a deadline in the widget on iPhone or iPad, that request stays in the app group until the app carries it out the next time you open it. For the deadlines widget on Android, the app stores the title and due date of your open deadlines in its own storage. While the app lock is on, it stores only neutral counters without names. The app sends nothing from these areas, and they are excluded from device backups. If you share a photo or PDF from another app with Waffenschrank on iPhone or iPad, the share extension also places the file there until you next open the app; the app then moves it into its own storage. Until then it is excluded from the device backup in the app group, provided you have opened the app at least once since installing it. The extension shows nothing from your collection. Widgets on the home screen show their content without asking for the app lock; on the lock screen and in StandBy, iOS hides it while the device is locked. A Live Activity shows the title, timer and counters of your training day there. If you use Apple features that show widgets or Live Activities on other devices (such as a Mac, Apple Watch or CarPlay), Apple transfers the display there. If you create a shortcut with a gun, ammo type or deadline, the Shortcuts app stores its name in the shortcut and syncs it via iCloud if iCloud sync for Shortcuts is turned on. Siri only tells you deadlines and stock while the device is unlocked. What you say to Siri is processed by Apple under its own responsibility and its privacy notices; the app phrases its answers on the device and hands them to Siri for output. Whether Siri sends content to Apple in the process depends on your device and your Siri settings.

Spotlight search (optional, iOS only)

If you switch on system search under More → Security, iOS remembers the manufacturer, model and caliber of your guns for the device's Spotlight search — even without opening the app and outside the app lock. The setting is off by default. If you switch it off again or turn on the app lock, the system index is emptied and no longer filled. Legal basis: Art. 6(1)(a) GDPR (consent by activation).

iCloud backup (optional, no account)

If you enable the iCloud backup, the app stores encrypted backup files in the iCloud Drive container of your Apple ID (folder “Waffenschrank”). The database as well as your photos and uploaded documents are backed up; those files sit next to the backup, each encrypted individually. Encryption (AES-256-GCM) happens on the device; the key is a random value stored solely in your iCloud keychain and synchronized between your devices. Apple, as the provider of your iCloud account, is responsible for the storage; we receive no data and have no access to the files or the key. The app cleans up older backups there by the same rule as the backups in your account (see “Optional account, cloud backup & sync”). If you set up the iCloud backup again, the app deletes, at your request, all backups and files in this folder and creates a new key; the data on your device remains unchanged. Legal basis: Art. 6(1)(a) GDPR (consent by activation). On iPhone and iPad, the app also checks at first launch whether this folder already contains a backup for your Apple ID – for example after reinstalling – even if you have not yet enabled the iCloud backup on this device; for this, iOS syncs the folder with iCloud as usual and already downloads the encrypted backup files to the device, so that restoring later does not have to wait. If it finds any, it shows you the date and size of each and – if the key is already on the device – the number of entries. That number is stored encrypted in the file name; to read it, the app uses the key only for that purpose and does not open the backup itself. The most recent complete backup is suggested, not necessarily the newest one. A backup is decrypted and restored only once you confirm, and we receive no data in the process. Legal basis for this check: Art. 6(1)(f) GDPR (so that you can get to your backup after reinstalling), and for accessing your device § 25(2) no. 2 TDDDG or the corresponding provision of your country (see “The basic principle”).

Google Drive backup on Android (optional, no account)

If you enable the backup on Android, the app stores encrypted backup files in the private app folder (“appDataFolder”) of your Google Drive. That folder is reserved for the app; other apps and the Drive interface cannot reach it. The database as well as your photos and uploaded documents are backed up; those files sit next to the backup, each encrypted individually. Encryption (AES-256-GCM) happens on the device; the key is a random value and is kept in Google Block Store — end-to-end encrypted and therefore unreadable for Google, provided your device has a screen lock. If the device reports no end-to-end encryption, the key stays purely local; only your recovery code then leads back to the backup. Google, as the provider of your Google account, is responsible for the storage; we receive no data and have no access to the files or the key. Access is limited to the “drive.appdata” scope; the app cannot reach the rest of your Drive. The app cleans up older backups there by the same rule as the backups in your account (see “Optional account, cloud backup & sync”). If you set up the backup again, the app deletes, at your request, all backups and files in this folder and creates a new key; the data on your device remains unchanged. Legal basis: Art. 6(1)(a) GDPR (consent by activation).

Optional account, cloud backup & sync

An account is voluntary. You can sign in with an email address and password, with a one-time code sent by email, with “Sign in with Apple” or with your Google account. With “Sign in with Apple”, Apple passes us an identifier and your email address (or, if you choose to hide it, a private relay address from Apple); the app does not ask for your name. So that we can revoke this connection at Apple when you delete your account, as Apple requires, the server stores a revocation token issued by Apple; it is used and then removed when the account is deleted. With Google we receive an identifier and your email address; Google also sends your name and profile picture, which our server discards when saving your data. The respective provider is responsible for the sign-in procedure on its side.

Account emails: the emails about your account – confirming your registration, sign-in and confirmation codes, confirming a new email address and security notices, for example after a password change – are generated by Supabase’s sign-in service and sent through the email delivery service Resend (Plus Five Five, Inc., USA — processor). For this, Resend receives your email address and the email itself, including the code or link, and records when it was sent and whether the receiving mail server accepted or rejected it. The emails are sent from the EU region Ireland (eu-west-1); according to Resend, however, emails and delivery logs are stored in the USA. This transfer is covered by the adequacy decision for the EU-US Data Privacy Framework, under which Resend is certified; in addition, our contract with Resend includes the EU standard contractual clauses. According to Resend, it deletes emails and delivery logs after 30 days; they remain in Resend’s backups for up to seven days longer. We have not enabled tracking of whether you open an email or click a link in it. If your mailbox permanently rejects an email or you mark it as spam, Resend adds your address to the suppression list of our sending account so that no further email goes there; it stays there until we remove it – at any time if you ask us to. Under its contract with us, Resend also uses information about the use of its service, such as sender, recipient and delivery logs, under its own responsibility to detect abuse and to operate its service; Resend’s privacy policy applies to this. Legal basis: Art. 6(1)(b) GDPR (providing the account); for the suppression list, Art. 6(1)(f) GDPR (our interest in delivering account emails reliably).

Two-factor authentication (optional): if you turn it on, Supabase’s sign-in service stores, for each authenticator, the secret key the codes are generated from (it is needed to check them), the name you give it, when it was set up and last used, and for every code check the time and IP address — at most until you remove the authenticator or delete your account. For your recovery codes, we store only a hash instead of the code itself, along with when it was redeemed; they are deleted when you generate new ones or delete your account, and they stop working as soon as you turn off two-factor authentication. We record redemption attempts — successful and failed alike — per account for abuse protection and delete them after a little more than a day. Legal basis: Art. 6(1)(b) GDPR (providing the account).

Cloud backups and device synchronization are end-to-end encrypted (AES-256-GCM; the key is derived from your protection password on the device, PBKDF2 with 600,000 rounds). We cannot decrypt these contents (zero knowledge). This holds as long as your protection password is strong and not the same as your account password: the account password is sent to the server with every sign-in, the protection password never is.

Unencrypted, the server only sees the envelope: your email address and the language for emails about your account (it follows the app’s language), the time and size of the backup files, the number and size of the encrypted photo and document files and — for synchronization — 64 encrypted compartments across which the app distributes your entries using a key that only your devices know: their size, rounded up to coarse steps, how often and in what order they were changed, and which signed-in sessions on your account support this form of synchronization. From this, one can roughly tell how large your collection is overall and when you sync, but not which areas it covers, how many entries there are, or what is in them. As long as a signed-in device or browser on your account still uses an app version older than 2.3, the app also syncs in the earlier form: the server then sees, for each record, which table and which row identifier it belongs to, when it was last changed and uploaded, and the identifier of the device it came from — and thus how many entries you keep in which area. Once all signed-in devices use 2.3 or later, the app deletes this information from the server; if a device with an older version signs in again, the app creates it again. Deleted entries remain as an encrypted deletion marker, and so do the encrypted files of deleted photos — both until you delete the account or reset the cloud data. Added to this is what Supabase’s sign-in service records on its own: when you last signed in; for each signed-in device, its IP address and browser or app identifier for as long as the session there lasts — it ends when you sign out or delete the account, but at the latest 30 days after signing in or after 14 days without use (you then sign in again), and the sign-in service deletes its entry as scheduled one day later; a sign-in log with IP addresses, which we delete after 30 days; and the platform’s access logs with time, IP address, requested URL, browser or app identifier, a checksum of the sign-in key sent along, the approximate location that Supabase’s upstream network service (Cloudflare) derives from the IP address (country, city, in some cases postal code, network operator), technical characteristics of the encrypted connection and Cloudflare’s assessment of whether the request is automated, which Supabase deletes after 90 days at most. To guard against abuse, the server also counts calls per IP address or account for some server functions; only a checksum of that is stored, and we delete it no later than two hours after the first call.

If an authority or a court requests data from us, we can only hand over what we hold: account, purchase and envelope data, published showcases, posts on club pages and messages sent to us. We cannot decrypt the end-to-end encrypted contents of sync and cloud backup — not even when ordered to — and what exists only on your device, in your iCloud or in your Google Drive, we do not have. We do not sell personal information and do not share it for advertising.

If you enable automatic backup, your protection password is placed in your device's protected key store (Keychain or Keystore) so the backup can run without asking; it does not leave the device. The app cleans up older cloud backups itself after each successful backup: it keeps the seven most recent, the most recent one from each of the last seven days with a backup, and the most recent one from each of four further, older weeks. If a new backup holds less than a fifth of the records in the last complete backup, the app also keeps that complete backup – no matter which of your devices it comes from – until a backup again holds at least a fifth of it; so a full copy survives an accidental wipe, a reinstallation and a switch to a new device. To make this possible, each backup carries its record count in its file name, encrypted with the backup’s key; the server sees no number. For backups from older app versions without this information, the app compares file sizes. Backups with a timestamp in the future, for example after a wrongly set device clock, are not deleted automatically. Hosting: Supabase (Supabase Pte. Ltd., Singapore — processor, EU standard contractual clauses); storage is in the EU region Frankfurt (eu-central-1). According to Supabase, Supabase, Inc. (USA) may also access the data as a sub-processor for support and operations; EU standard contractual clauses apply to this as well. The Supabase server functions (Edge Functions) called by the app from version 2.8 onwards, by our website and by our database also run in Frankfurt; with older app versions, they run in the data center closest to your device, which may also be outside the EU; EU standard contractual clauses apply to this as well. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Without an account we create none of this.

If you create an account, publish a showcase, create or join a club, or agree to the terms of use in the app, we store as evidence which version of the terms of use you agreed to and when – together with the identifier of your account or showcase. The record is deleted together with the account or the showcase. Legal basis: Art. 6(1)(b) GDPR (contract) and (f) (evidence of the contract).

Showcases (voluntary sharing)

If you actively publish a showcase, only the details you selected (including downsized photos of the selected items) become publicly available at an address that cannot be guessed. Serial numbers, storage locations, stock levels, prices and permit data are technically excluded as data fields. The app does not check what a photo shows: make sure yourself that no serial number and nothing from your home can be made out; the app removes embedded location data before uploading. A showcase also works without an account; since version 3.5, when you publish or refresh one, the app has it attested that the request comes from the genuine app (see “App check for showcases and the contact form”).

We count how often a showcase has been opened and show you that counter; we do not evaluate individual visits. The showcase page is delivered by our hosting provider Cloudflare, Inc. (processor, EU standard contractual clauses), which processes the technically necessary connection data of visitors. The visitor’s browser fetches the content directly from our server at Supabase; this involves the same access logs and the same abuse counting as described under “Optional account, cloud backup & sync”. So that a published showcase does not expire unnoticed, the app refreshes it by itself at most once a month at startup. If you are signed in when you publish a showcase or when it is refreshed in this way, we link the showcase to your account so that it is deleted together with the account. You can take any showcase offline at any time; the link then becomes permanently invalid. If Pro ends, additional showcases you published starting with version 2.5 are paused: their address then only shows that they are paused, and we delete their content from the server by the following day at the latest. So that this also applies if you no longer open the app, the app sends a deadline along when you publish such a showcase and each time it refreshes one: the end of the Pro period it knows of, plus 45 days, rounded up to a whole day. For showcases that are not paused under the showcase terms, and with the one-time purchase, there is no deadline. We store the deadline with the showcase – for a showcase without an account only with its address, not with an account. Once the deadline has passed, we pause the showcase; if it is linked to your account and your account has Pro with us, it stays online. With Pro, the app uploads the content again at the same address. The app doesn’t refresh a paused showcase. We delete the deadline together with the showcase. Legal basis: Art. 6(1)(a) GDPR (consent); for the deadline and the check against your account’s Pro status, Art. 6(1)(b) GDPR (scope of Pro under our terms of use); with regard to visitors, Art. 6(1)(f) GDPR (delivering the page and protection against abuse).

Club pages

If you create a club page or join one, we store the club name, the join code, the account identifiers of those involved and the contributions you explicitly submit (competition results, for example). They are stored with our host Supabase (see “Optional account, cloud backup & sync”). These details are not end-to-end encrypted — the club’s administrator has to be able to read and approve them. What the administrator approves is published as a public page that anyone with the link can open: the club name and achievements without names, but with discipline, level, year, placing, number of participants and result — in a small club this may reveal who is meant. When the administrator publishes or updates this page, the app has it attested, on iPhone, iPad and Android since version 3.5, that the request comes from the genuine app (see “App check for showcases and the contact form”). If you withdraw a contribution or delete your account, the server removes it from the public page straight away. You can end your membership at any time. Legal basis: Art. 6(1)(a) GDPR (consent).

Purchases (Waffenschrank Pro)

Purchases go through the App Store (Apple) or Google Play; the purchase handling is done by RevenueCat (RevenueCat Inc., USA — EU standard contractual clauses). The RevenueCat SDK only starts when you open the Pro page or — if a purchase has been started, a code redeemed or Pro recognized via the store on this device before — at startup and when you sign in, to check whether Pro still applies; once running, it may check in again each time you return to the app until the app is closed. As of version 2.2.1, when the app starts on an iPhone, iPad or Android device on which it does not yet know of any purchase, it first looks in the App Store or Google Play on your device to see whether your Apple or Google account has bought Pro — for example in the case of a purchase made before version 2.2, after a reinstall or, on iPhone and iPad, through Family Sharing. As of version 2.3, it also looks there whenever it checks whether Pro applies and does not already know of Pro from a purchase on this device, and when you tap “Restore purchases”. In doing so, the app only checks whether the purchase records for this app include a Pro purchase, and it does not itself send anything for this — neither to us nor to RevenueCat; whether the store syncs its purchase history with Apple or Google in the process is decided by Apple or Google, not by us. If you tap “Restore purchases”, RevenueCat does not respond and no one-time purchase can be seen on your device, the app on iPhone and iPad additionally asks the App Store explicitly to sync your purchases with Apple; Apple may prompt you for your Apple Account in the process. If the app finds no Pro purchase, nothing further happens. If it finds one on a device on which it does not yet know of any purchase, the RevenueCat SDK starts as described above. With a subscription, Pro only applies after the SDK’s response. As of version 2.3, the app already recognizes the one-time purchase from its entry in the store — without RevenueCat and without our servers, so that it applies even if these cannot be reached or no longer exist; this only ends if the store itself no longer has a record of the purchase, for example after a refund. While the RevenueCat SDK is running, a purchase identifier, your IP address and technical device details go to RevenueCat. The app stores the last known purchase status, and whether the store has a record of the one-time purchase, on the device so that Pro applies even without a check. Without an account that identifier is a pseudonymous random one: it has no link to your name or email address, but together with your IP address and device details the requests from the same device can be linked to one another. Once you are signed in it is linked to your account identifier so that Pro applies on all your devices. Apple and Google also report purchases, renewals, cancellations and refunds directly to RevenueCat, even when the app is not running; if the purchase belongs to your account, RevenueCat passes this on to our server. Our server uses events for a purchase without an account only for a reminder address you have set up (see “Renewal reminder”) and, at your request, for ending a Google Play subscription (below); the log then only records the time and type of the event, without an identifier. For this, our server (Supabase, see above) records for your account whether and until when Pro applies and where the unlock comes from (for example a store purchase or a redeemed promo code), together with the ID of the related purchase or which promo code you redeemed and when; the app queries this while you are signed in. If you have a Google Play subscription and switch to the one-time purchase, you can choose before buying that we cancel the subscription for you afterwards: the app passes this request, with the time, to RevenueCat – where it stays on your customer record until you withdraw it before buying or the record is deleted – and remembers it on your device; once the one-time purchase has come through, our server cancels the subscription directly with Google Play (Google is itself responsible for Google Play): to do so, it looks up the subscription’s order ID in RevenueCat, retrieves that order from Google to obtain its purchase token, and checks the subscription’s status; none of this is stored. The subscription will then no longer renew, and you keep the time you’ve paid for. We never receive payment data. Legal basis: Art. 6(1)(b) GDPR (the purchase, providing Pro and the steps before it that you initiate yourself); for the store look-up, insofar as you have not bought Pro, Art. 6(1)(f) GDPR (our legitimate interest in recognizing purchases without passing data of non-buyers to RevenueCat); for the look-up in the store on your device and for storing the purchase status on the device, Section 25(2) no. 2 of the German TDDDG or the corresponding provision of your country (see “The basic principle”).

Club seats: A club can provide Pro seats for its members on this website and hand them out by invitation link. If you redeem a seat, you sign in on the website with your account and choose a display name. We store which account holds the seat, the display name, and when you redeemed it and gave your consent; of the invitation link, only a checksum. The club's administrator sees nothing of this except your display name and the date of redemption — never your email address, your collection, your guns or how you use the app. The administrator can withdraw the seat, and you can give it back yourself at any time; we then delete the assignment immediately, and your account only keeps the note that Pro from the club seat has ended. If the term ends without renewal, we delete the assignment after 30 days. About the club we store its name, the number of seats, the term, the purchase reference and the account identifier of the administrator. Legal basis: Art. 6(1)(b) GDPR; that the club sees your display name and date is based on your consent when redeeming (Art. 6(1)(a) GDPR), which you withdraw by giving the seat back.

This applies to the app from version 2.2. Older versions contact the purchase service (RevenueCat) at every launch to check the Pro status.

Renewal reminder

If you bought Pro as an annual or quarterly subscription through the App Store or Google Play and it is linked to your Waffenschrank account, we send you an email about five weeks before each renewal (for a purchase in US dollars, also three weeks before, because the laws of several US states require different timing) stating the date, the price (if already set), the deadline and how to cancel. If the free trial of an annual subscription you bought in US dollars is still running, we instead send you an email three to four days before it ends, stating the date, the price after the trial and how to cancel, because several US states require a notice before a trial ends; in other currencies, only the app reminds you that your trial is ending. You won’t get any of these emails for a monthly subscription, if you have Pro through Family Sharing, while the store is still retrying a failed payment, or if you have already canceled the subscription. For this purpose, our server (Supabase, see above) also stores, with your account, which subscription you bought through which store, the amount and currency you paid for the current period, and whether it was an introductory or special price; RevenueCat sends us these details with every purchase and renewal. Shortly before sending, the server checks with RevenueCat whether your subscription will actually renew. The email is sent through Resend, as described under “Account emails” – with the same details on storage location, deletion periods and the suppression list. It contains nothing from your inventory, and we don’t track whether you open it. So that you don’t get it twice, we record which renewal or which end of a trial we sent it for – without your email address and without the email’s content; for the unsubscribe link, we store only a checksum, so that the link in an earlier email still works. We delete the purchase details as soon as the annual or quarterly subscription on your account ends (no later than two days afterwards) or you unsubscribe from the reminder, the sending record 13 months after the renewal, the checksums 13 months after sending, and everything no later than when your account is deleted. You can unsubscribe using the “Unsubscribe” option in your email app, by replying to one of these emails, or by writing to kontakt@waffenschrank.app; we then won’t send any more and will remember that until you delete your account. Other emails about your account are not affected. Without an account, the app reminds you with a notification (for a purchase in US dollars, also three weeks before) if you have allowed it to send notifications; if you get neither a notification nor an email, it shows you a notice on the Overview screen from 45 days before the renewal. Both are created on your device, and the app sends us nothing for this; without an account, you only get an email if you add an address for it (next paragraph). Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in informing you in good time before a charge, and thereby also meeting the obligations that the consumer law of some countries – such as France, Italy, Spain, Belgium (from May 2027), Sweden, several US states and Canadian provinces – places on the provider).

Email reminder without an account: if you took out such an annual or quarterly subscription without a Waffenschrank account, you can optionally add an email address in the app under Pro, used only for these reminders – before each renewal and, for an annual subscription in US dollars, before the trial ends. Our server (Supabase, see above) then first sends an email with a confirmation link via Resend, as described under “Account emails”; only once you confirm within 48 hours do we remind you as described above – otherwise we delete the address after 48 hours. For this we store the address, the app language, the random identifier under which RevenueCat keeps your purchase without an account, a checksum of a random key that lets only your app look up and delete the entry, the currency in which you bought the annual subscription on this device (if the app knows it), the purchase details and sending records as above, and checksums of the links in our emails. When you add the address and before each email, the server asks RevenueCat, using this identifier, whether you have an annual or quarterly subscription from the App Store or Google Play. To prevent misuse, we count attempts per identifier, per address and per IP address – only as a checksum that we delete after two hours at the latest. We use the address for nothing else – no advertising, no newsletter – and don’t link it to any account. You can remove it at any time in the app, with the link in each of these emails, with “Unsubscribe” in your email app, by replying to one of these emails or by writing to kontakt@waffenschrank.app; we then delete the address and all related details right away. If your annual or quarterly subscription ends, we delete everything no later than two days afterwards; if you sign in to an account in the app, the app removes the address, because the reminder then goes to your account’s address. Legal basis: Art. 6(1)(a) GDPR (your consent, which you give by adding the address – with the confirmation link you confirm that the address is yours; you can withdraw it at any time with effect for the future by removing the address); for counting attempts to prevent misuse, Art. 6(1)(f) GDPR (our legitimate interest in not sending anyone unwanted emails).

Crash reports (only with consent)

The app only sends crash reports with your consent; the default is off. At the earliest three days after the first launch, it asks you once whether it may send crash reports; both answers carry equal weight, and it does not ask again afterwards. The record of your answers to this question and the ones below (the last ten, each with time, route and version of the question) is kept by the app on the device so that it can abide by them; it does not leave the device. Your choice applies to the device on which you make it: backups do not carry it along, and if you restore one, the choice on this device stays as it is. On a new device, crash reports are off at first, and the one-time question appears there at the earliest three days after the first launch on that device. You can change your choice at any time under More → Security. If you have not consented, the app asks after a crash whether it may send the report on exactly that crash (see below). Our service provider is Sentry (Functional Software, Inc., USA — processor; transfers are based on the adequacy decision for the EU-US Data Privacy Framework, under which Sentry is certified; in addition, our contract with Sentry includes the EU standard contractual clauses); the reports go to the EU ingest point in Germany. In versions before 2.5, on iPhone and iPad, while reports are on, the Sentry library also has the name sentry.io looked up at startup and when the network changes, through the name service (DNS) your device uses, to tell whether a network is available; the lookup contains no report and no content from the app, but whoever answers it (usually your internet or Wi-Fi provider) can see that this name is being requested from your IP address, and when. From version 2.5 on, the library detects the network without this lookup. Only in versions before 2.2.1 is one item transmitted even without this consent: in those versions, if the app crashed the last time it ran, the update request at the next launch includes the related error message (see “What happens at startup — even without an account”).

A report contains the error message with the point in the program where it occurred, the app version, device model, operating system version, language and time zone, plus a heavily trimmed trail of the last steps: only screen changes with masked identifiers and network calls with shortened addresses. Screen titles, input, console output and your account identifier are explicitly filtered out, so content from your collection does not make it into a report. The text of the error message itself is the exception: it is transmitted in full, because a bug cannot be found without its message — in some cases it may contain a value from your data. As of version 2.2.1, a report no longer carries a device identifier: the identifier that the Sentry library adds on its own — on Android a random, persistent identifier of your installation, on iPhone and iPad a checksum of this app’s device identifier and the device model — is removed by the app before sending, including for crashes in the native parts of the program. Versions before 2.2.1 still send it; their reports are pseudonymous, so they can be linked to one another, but not to your account. Even without a device identifier a report is not anonymous: for technical reasons the service provider receives it together with your IP address, and the error message may contain a value from your data. A report sent individually (see below) contains the same details without the trail of the last steps.

Legal basis: Art. 6(1)(a) GDPR; revocable at any time. Revocation takes effect immediately: the app stops collecting crash data in that very moment, without a restart. Freezes and sessions ended by the system are not recorded at all — only genuine crashes: errors after which the app has quit or shows its error screen instead of the normal screen. An error after which the app can no longer be used also counts as a crash — for example when the database cannot be opened at startup or cannot be converted after an update. In that case the app sends at most one report per update and error; in it, the error message is replaced by an error identifier, and the report contains no content from your collection. Without your consent: if the app shows its error screen, it asks there whether it may send a report on that error; if you decline, it keeps nothing. If it crashes, it keeps a report on your device — for an error in the JavaScript part the error message (up to 1024 characters), the point in the program, the time, the app and system version and the device type, for a crash in the native parts of the program a summary from the crash log that iOS or Android keeps anyway (type of crash, call stack as memory addresses, time, app and system version, device type). There is at most one such report, the most recent one; it is stored in the app’s data folder, excluded from the device backup and does not leave the device by itself. When you open the app again, it asks whether it may send it; only this one report is sent, and the legal basis is then your consent (Art. 6(1)(a) GDPR). After sending or declining, the app deletes it, after 30 days at the latest. If you decline twice in a row, it stops asking and stops keeping anything; you can also switch the asking off yourself under More → Security. For keeping the report on the device and reading the crash log: Art. 6(1)(f) GDPR (our legitimate interest in giving you the choice, after a crash, of whether to send the report) and Section 25(2) no. 2 of the German TDDDG or the corresponding provision of your country (see “The basic principle”).

What we receive from the App Store and Google Play

Apple and Google provide us with aggregated statistics (such as installations, purchases and active devices, also broken down by whether someone came via a shared app link or a link on our website), crash logs from devices whose owners have agreed to share them with developers, for test versions the testers’ feedback including their contact address, and public reviews including the name chosen there, which we can reply to. Apple and Google collect this data under their own responsibility; we use it to fix bugs, to answer questions and to see how people find the app. We do not link it to your account. Legal basis: Art. 6(1)(f) GDPR (fixing bugs, responding to feedback and aggregated reach measurement).

Age information from the App Store and Google Play

Some US states require apps distributed through an app store to request and observe the store’s age information. As of version 2.5, the app therefore asks Apple’s App Store (“Declared Age Range”) on iPhone and iPad (iOS 26.2 or later) and Google Play (“Play Age Signals”) on Android for the age range the store holds for your Apple or Google account — at first launch, after that at most once every twelve months, and every time you create an account. On iPhone and iPad it only asks if the system reports that such rules apply to your Apple Account; on Android it only asks if you have selected the United States as your country in the app. The app never receives your date of birth and only evaluates whether, according to the store, you are under 18 or at least 18. If the store reports that you are under 18, the app blocks creating an account, publishing a showcase, opening a club page, joining a club, submitting achievements and buying Pro; if a new account is created in this case when you sign in with Apple or Google, the app deletes it again immediately. If that fails, for example without a connection, our server deletes such an account in a daily run no earlier than three days after its creation, usually no more than a day later, and in the same way as “Delete account”. This requires that you were not signed in with it after the first ten minutes and that it holds neither content nor a purchase; if it is not certain that all of these conditions are met, the account remains, and we delete it if you ask us to at kontakt@waffenschrank.app. You can still sign in with an existing account; the app on your device remains usable, and none of your data is deleted. The result is kept in memory only until the app is closed: it is neither stored nor sent to us or anyone else, not even with crash reports. The only thing stored on the device is the date and time of the last request, so that the app does not ask more often than permitted; this is removed together with the app. Apple and Google decide, under their own responsibility, how they determine your age and whether they ask for your consent to do so. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in making accounts, showcases, club pages and Pro available only to adults and in complying with the laws of the jurisdictions in which the app is offered); for the request to the store on your device and for storing the date and time, Section 25(2) no. 2 of the German TDDDG or the corresponding provision of your country (see “The basic principle”).

Contact & reporting a problem

If you use the contact form, we process your message, the category you chose, optionally your email address (for follow-up questions) and — if you leave the checkbox checked — technical details: app version, update identifier, release channel, platform and operating system version. Messages are stored with our host Supabase (see “Optional account, cloud backup & sync”); since version 3.5, when you send a message, the app has it attested that the message comes from the genuine app, and none of this is stored with the message (see “App check for showcases and the contact form”). If you are signed in, your account identifier is stored along with it so that we can attribute your request. So that we can read a message promptly and reply to you directly, our server sends it via the email service Resend (see “Account emails”) as an email to our mailbox kontakt@waffenschrank.app – with the category, the message and the time, with the platform if you include the technical details, and with your email address as the reply-to address if you give one. The remaining technical details and your account identifier are not included. Resend deletes this email after 30 days (up to seven days later in its backups); in our mailbox the same applies as under “When you write to us”. If you enter an email address, the app asks our server (Supabase) before you send – shortly after you type the address or open a draft that contains one, so even if you never send the message – whether its domain (only the part after the @) can receive email, so that we can point out a typo; like any request, this gives the server your IP address; it looks the domain up in the Domain Name System (DNS) and neither stores nor logs the domain. Legal basis: Art. 6(1)(f) GDPR (handling your request), and for signed-in users also Art. 6(1)(b) GDPR. We delete messages sent via the form no later than twelve months after receipt, or earlier together with your account.

App check for showcases and the contact form

Showcases and the contact form work without an account and therefore attract misuse, such as other people’s or unlawful images under our address or messages sent to our mailbox in bulk. Since version 3.5, the app therefore has it attested, on iPhone, iPad and Android, that such a request comes from an unmodified Waffenschrank app on a genuine device: when you publish a showcase or the app refreshes it, when, as an administrator, you publish or update a club page, and when you submit the contact form. For this, the app fetches a random value from our server (Supabase, see “Optional account, cloud backup & sync”) that is valid for five minutes and can be redeemed once; the same access logs arise in the process, and how many such random values one IP address can fetch is limited by the server with the same abuse counting, both as described under “Optional account, cloud backup & sync”. Apart from it, the attestation contains only checksums – for a showcase or club page, that of its address; for the contact form, that of your message – never the content itself. On iPhone and iPad, the app uses Apple’s App Attest for this: the first time, the device generates a key in its security chip that never leaves it, and has Apple attest it once; according to its own statements, Apple counts in the process how many such keys have been attested for the app on your device. After that, the device signs every request itself, without asking Apple. The app stores the key’s identifier in this device’s keychain, without iCloud sync; it can remain there even after the app is removed, but is then useless. Our server stores the identifier and the public part of the key with a counter and the day of last use – with no link to your account, your IP address, your showcase or your message – and deletes them 90 days after the last use. On Android, the app asks Google Play on your device for the attestation (Play Integrity). For this, according to Google, Google Play checks your device, the app and its license status at Google Play and returns an encrypted response; what Google Play processes in doing so is Google’s responsibility (Google Ireland Limited) under its terms. Our server has the response decrypted by Google LLC (USA – the basis for the transfer is the adequacy decision for the EU-US Data Privacy Framework, under which Google is certified) and reads from it only whether it belongs to this request, whether Google Play recognizes the app and whether the device passes the check; none of this is stored. The app receives the result of the check as a single-use pass that is valid for ten minutes; it sends it along with the showcase or message, and the server deletes it when it is redeemed. All that is counted is how many checks per week, route and platform were valid, invalid or without attestation, and for what reason, without identifier; we keep these figures for 13 months. If a valid attestation is missing – for example in the web app, in app versions before 3.5, on devices without this feature or without Google Play services – the server may reject the showcase or message or limit it more tightly; you can always reach us by email at kontakt@waffenschrank.app. At present it only counts and rejects nothing. If the check is switched off on our server, the app asks neither Apple nor Google. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting showcases and mailbox from misuse); for creating and using the key, storing its identifier and the request to Google Play, § 25(2) no. 2 TDDDG or the corresponding provision of your country, see “The basic principle”.

When you write to us

If you write to us at kontakt@waffenschrank.app, we process your email address, your name if you give it, and the content of your message in order to reply (Art. 6(1)(f) GDPR; where it concerns a contract with us, point (b)). Our mailbox is operated by Microsoft (Microsoft Ireland Operations Limited, processor; transfers to Microsoft Corporation in the USA are covered by the adequacy decision for the EU-US Data Privacy Framework; in addition, our contract with Microsoft includes the EU standard contractual clauses). We delete emails once your matter is settled, at the latest twelve months after receipt – unless commercial or tax law requires us to keep them longer (up to six or ten years).

Reports under the Digital Services Act (Regulation (EU) 2022/2065, DSA): If you report content in a showcase or on a club page to us, we process the details of your report – including your name and email address – to review it and tell you our decision (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA). Whoever posted the content does not learn your name from us unless we are legally required to disclose it. We delete the name and email address from a report six months after our decision; we keep the decision itself – which content, when, why – until the end of the third year after it, so that we can document it (Art. 6(1)(f) GDPR).

Filling from shop links

If you paste a shop link and have the details filled in from it, your device calls up that third-party page directly — with no detour through us. As with any page visit, the shop learns your IP address and which page you are requesting; we have no influence on its data processing and receive nothing from it. Legal basis: Art. 6(1)(a) GDPR (consent by triggering).

How long we keep things

Whatever is on your device stays there until you delete it — we have no access to it and can neither see it nor remove it. Before an update that restructures the database, and before a backup is restored, the app creates a copy of your database on the device so that a failure can be undone; this copy is excluded from the device backup. Anything you delete individually remains in it until the copy is removed: the app deletes the copy made before a restore after seven days, and of the copies made before updates it keeps the two most recent. In the web app this only holds with a caveat: as long as the browser has not granted persistent storage, it can delete the data on its own when storage runs low or after a longer period of disuse – Safari, for example, when the page has not been opened for seven days. The web app asks the browser for persistent storage and shows you whether it was granted; that does not replace regular backups. So that the web app can start without a connection, it stores its own program files (code, fonts, images) in your browser’s storage via a service worker; they contain nothing from your collection and nothing about you, and a new version removes the old ones (§ 25(2) no. 2 TDDDG or the corresponding provision of your country, see “The basic principle”). Whatever belongs to an account stays as long as the account exists: if you delete it, the backup files, the sync data, your showcases (those that belong to your account or were published on the device you are deleting it from), your contributions to club pages and your messages to us go in the same operation. At the same time, we delete your customer record at RevenueCat; purchase receipts and invoices stay where they were issued (Apple or Google) for as long as tax law requires. If, exceptionally, the deletion at RevenueCat fails, the purchase history stays there under your account identifier until you ask us to have it deleted (kontakt@waffenschrank.app). Whatever we delete in the database disappears from our host’s backups only when they expire: Supabase backs up the database daily and, on our current plan, keeps each backup for seven days. Until then it still contains what was in the database before the deletion — such as your email address, the encrypted sync data, showcases, club contributions and messages; the backup, photo and document files are not part of it. The same applies to anything you delete individually. We only fall back on these backups to restore the service after a serious failure.

Alongside that, fixed periods apply. Older cloud backups the app clears out itself, by the rule stated above. A published showcase is deleted automatically twelve months after it was last refreshed; as long as you keep using the app, it refreshes an active showcase at most once a month, and a paused one not at all. Once the deadline of an additional showcase has passed (see “Showcases”), we delete its content from the server in the next daily run. An account that was created with Apple or Google on or after 14 October 2026, that no one was signed in with after the first ten minutes, that holds neither content nor a purchase and for which no consent to the terms of use is stored is deleted no earlier than three days after its creation (terms of use, section 4(1)(b)). We delete the checksums used for abuse counting no later than two hours after the first call; they are formed with a key generated anew each day, which we delete after one day, so that afterwards neither an IP address nor an account can be recovered from them. For the app check for showcases and the contact form, we delete the keys of iPhone and iPad 90 days after their last use, the random values and single-use passes as soon as they are redeemed and no later than 30 minutes after they were issued, and the weekly counts without identifier after 13 months. Of the purchase reconciliation, a log of the time and type of the event, together with the account identifier — without prices, without email address — remains for 30 days. We delete messages sent via the contact form no later than twelve months after receipt, or earlier together with your account. Crash reports are deleted by our provider Sentry after the retention period set there, no later than 90 days after the report arrives. The servers that deliver our website and the web app (Cloudflare, Inc. — processor, EU standard contractual clauses) necessarily process the connection data of every request in order to deliver it, including the IP address, browser identifier and approximate location. We do not have Cloudflare keep a log of individual requests; we only count moves on to a store, without IP addresses (see “This website”). All that is retained there are error messages from our server programs, for seven days at most; the programs do not write connection data into them. If one of Cloudflare’s protection rules blocks a request as an attack, Cloudflare may record this as a security event, including the IP address, for as long as Cloudflare provides for such events. Legal basis: Art. 6(1)(f) GDPR (operation, security and troubleshooting). The app’s update service and catalog check write no such logs.

This website

When you open waffenschrank.app, our hosting provider Cloudflare, Inc., USA (as a processor, EU standard contractual clauses) processes technically necessary connection data (IP address, time, resource requested) in order to deliver and protect the site; delivery runs over Cloudflare’s worldwide network, not from a server in one fixed place. So that the site can show prices in your local currency and suggest the right language, Cloudflare tells it the country you are visiting from and your browser’s languages; we store neither. Legal basis: Art. 6(1)(f) GDPR. We set no cookies ourselves and embed no fonts, scripts or images from third-party servers. Which store the site suggests to you – via the store buttons or via the QR code on a computer (waffenschrank.app/app) – is decided solely by the device type your browser sends anyway (such as Android or iPhone). For the store buttons at the top of many pages and for the QR codes, we also count how often someone moves on to a store: we keep only the page or type of page the click came from, its language or country version, whether it was a store button or a QR code, the target store, the time and whether the request looked like it came from an automated program such as a search engine – no IP address, no device or browser identifier, no cookie, nothing that leads back to you. The count is kept at Cloudflare, deleted after three months and not passed on; it shows us which pages bring readers to the app. Here too the legal basis is Art. 6(1)(f) GDPR; nothing is stored on your device for this. The links to the App Store and Google Play also carry an identifier of the page or type of page they come from (such as “web-start”), which is the same for every visitor; from it, Apple and Google show us in their aggregated statistics which pages lead people to the app. What Apple and Google process when you open their store page is their own responsibility. At most two things stay in your browser: your language choice, so that the language suggestion does not reappear, and – only if you choose “Auf diesem Gerät merken” (remember on this device) there – whatever you enter in the WBK form helper (WBK: the German firearms ownership card); without that choice, those entries last only until you close the tab. The form helper deletes remembered entries the next time you open it if your last entry is more than 30 days old. Neither leaves your browser; you remove them by clearing the site data.

On the pages for club seats (waffenschrank.app/verein) you sign in with your account. For this, your browser talks directly to our server at Supabase (the same one as for the account, see above); if you sign in with Google, the page takes you to Google and back. The sign-in, an invitation link until it is redeemed and, for the Google sign-in, a one-time check value are kept only in your browser's session storage and disappear as soon as you close the tab; we set no cookies there either.

Our social media profile

Waffenschrank has a profile on Instagram (instagram.com/waffenschrank.app). Neither the website nor the app embeds anything from Instagram – no buttons, no embedded posts, no tracking pixels. Our links to it are plain links: only when you follow one, or visit Instagram yourself, does its operator process your data, under its own terms – including for its own purposes such as advertising, and even if you have no account there. That processing is determined by the operator; where we may share responsibility for it is explained in the paragraph on Instagram.

What we process there ourselves: what you write to us (comments, mentions, direct messages), whether you follow us or react to our posts, your profile name and whatever your profile shows publicly, as far as we see it in the process. We use this to reply to you and to run our profile. The legal basis is our legitimate interest in providing information about Waffenschrank and in staying in touch with people who are interested in it or use it (Art. 6(1)(f) GDPR); if your message concerns a contract with us, such as a purchase, Art. 6(1)(b) GDPR. We link any of this to your Waffenschrank account only if you ask us to. We delete conversations on our side no later than twelve months after the last message, as far as the network allows; you can usually delete what you wrote yourself there, and the network keeps data according to its own retention periods.

Instagram: for users in the EU, the operator is Meta Platforms Ireland Limited (Dublin, Ireland). Meta compiles statistics (“Insights”) for our profile – for example how many people see and interact with the profile and our posts, broken down by characteristics such as age group, gender or location. We only see aggregated figures, not individual people. We may be jointly responsible with Meta for these statistics (Art. 26 GDPR; CJEU, judgment of 5 June 2018, C-210/16). Meta has published an agreement for this (facebook.com/legal/terms/page_controller_addendum), under which Meta takes primary responsibility, including for the information required by Art. 13 GDPR and for handling your rights. The agreement is written for Facebook Pages; its wording leaves open whether it also covers Instagram profiles. To be on the safe side, we therefore assume joint responsibility. Our legal basis for the statistics is our legitimate interest in understanding the reach of our profile and improving it (Art. 6(1)(f) GDPR). You can exercise your rights against Meta and against us; Meta is best placed to fulfill them, because only Meta holds the visitor data the statistics are built from – we forward requests sent to us to Meta. Meta also transfers data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework; the European Commission’s adequacy decision applies to this (Art. 45 GDPR). How Meta processes data: privacycenter.instagram.com/policy.

For people in Switzerland

If you live in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies to you. Personal data is disclosed by us or our service providers to the following countries (Art. 19(4) FADP): Germany, Ireland and other EU/EEA countries, which offer adequate data protection under Annex 1 of the Data Protection Ordinance (DPO); the United States; Singapore; and, through Cloudflare’s worldwide network, other countries.

In the United States, protection is adequate under Annex 1 DPO only for companies certified under the Swiss-U.S. Data Privacy Framework. According to the public list (checked on 5 October 2026), these are Cloudflare, Inc., Functional Software, Inc. (Sentry), Google LLC, Microsoft Corporation and — for our Instagram profile — Meta Platforms, Inc. Plus Five Five, Inc. (Resend) is certified only under the EU-U.S. Data Privacy Framework, and RevenueCat, Inc. not at all. For these two, for Supabase Pte. Ltd. in Singapore and Supabase, Inc. in the United States (your data is stored in Frankfurt, but access from Singapore and the United States is possible) and for countries outside Annex 1 in Cloudflare’s network, we base the disclosure (Art. 16(2)(d) FADP) on the European Commission’s standard contractual clauses with the adaptations for Switzerland recognized by the Federal Data Protection and Information Commissioner (FDPIC).

For the App Store and iCloud, Apple Distribution International Ltd. (Ireland) is responsible towards users in Switzerland; for Google Play, Google sign-in and Google Drive, it is Google Ireland Limited. What these providers themselves transfer to other countries is governed by their own terms. You can exercise your rights under the FADP with us (kontakt@waffenschrank.app); you can also contact the FDPIC.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR) as well as the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA state where you live or work (Art. 77 GDPR); the authority responsible for us is the Brandenburg data protection commissioner (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg). You can delete account data in the app; local data is deleted by removing the app or via the export/delete functions. Backups in iCloud or Google Drive are not deleted in the process: delete them beforehand in the app under “Cloud backup”, or afterwards in the storage settings of your Apple or Google account (for Google Drive, in a web browser under Settings → Manage apps, where you can delete Waffenschrank’s hidden app data). How to do that — in the app or without it — is set out on Delete your account.

Where we rely on your consent – Spotlight search, iCloud and Drive backup, showcases, club pages, club seats, filling from shop links and crash reports – you can withdraw it at any time with effect for the future (Art. 7(3) GDPR): by switching the feature off, taking the showcase offline, leaving the club page or returning the seat. Processing carried out lawfully until then remains unaffected. You withdraw your consent to the email reminder without an account by removing the address (see “Renewal reminder”).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR) – for the update check, for the catalog check, for looking in the store on your device to see whether you have bought Pro, for checking for an iCloud backup at first launch, for requesting the store’s age information, for the app check for showcases and the contact form, for the hints about Pro features, for keeping a crash on your device until you decide whether to send the report, for delivering our website and for counting moves on to a store, for delivering showcases to their visitors, for what we receive about the app from the App Store and Google Play, for messages sent via the contact form or by email, for the suppression list for account emails, for the reminder before your annual or quarterly subscription renews, for preventing misuse of the reminder address, for keeping our decisions on reports under the Digital Services Act and for the record of your consent to the terms of use – you can object at any time on grounds relating to your particular situation; an informal message to kontakt@waffenschrank.app is enough. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing serves the establishment, exercise or defense of legal claims. The app itself cannot switch off the update and catalog checks, this store look-up, the request for the store’s age information or the app check; the only way to avoid them is to stop using the app – the app check also by not publishing a showcase or club page, taking your published showcases offline (otherwise the app refreshes them itself) and writing to us by email instead of through the contact form. In addition, you can unsubscribe from the renewal reminder at any time without giving a reason (see “Renewal reminder”). Likewise, you can object to the hints about Pro features at any time without giving a reason (Art. 21(2) GDPR), most simply by turning them off in your profile under “Hints about Pro features”. Keeping a crash on your device can be switched off under More → Security with “Ask after a crash”.

Digital legacy: you can tell us by email to kontakt@waffenschrank.app what should happen after your death to the data we hold (account, showcases, club pages), and name a person to whom we should hand it over or who may request its deletion. Without such instructions, your heirs can request deletion; for this we need proof of death and of their status as heirs. We cannot hand over the content of your cloud backup to anyone in readable form – it is end-to-end encrypted. For users in France, this is the information required by Article 85 of Law No. 78-17 of 6 January 1978 (Informatique et Libertés).

This policy describes the app's actual data processing. Questions: kontakt@waffenschrank.app