Dawarich Privacy Policy

This policy applies to the Dawarich SaaS at dawarich.app, the hosted tier, and the iOS and Android apps when connected to our SaaS. If you self-host, no data reaches us and you are the sole controller.

1. Controller​

ZeitFlow UG (haftungsbeschränkt) — Kolonnenstraße 8, 10827 Berlin, Germany. Managing Director: Evgenii Burmakin. Email: [email protected]. Full company details: Impressum.

2. What We Process and Why​

The poster file you order is a map rendering of the location data you selected in the Poster Studio. It is shared with our payment and print partners (Section 3) solely to process and produce your order.

No automated decision-making with legal effect (Art. 22). Providing this data is voluntary but necessary to use the service.

Since March 2026, reverse-geocoded place names are no longer stored for SaaS users — they are computed on demand and discarded.

3. Recipients / Processors​

We require an Art. 28 DPA for each active processor. Before enabling the optional PostHog integration, we must verify its DPA and international-transfer terms. We do not sell location history or use it for advertising.

Rybbit, the analytics tool named in section 6, runs on our own Hetzner infrastructure (rybbit.dwri.xyz) rather than a vendor's hosted service, so it adds no processor to this table — no third party receives that data.

International transfers: UK (Paddle) is covered by the EU adequacy decision. Norway (Gelato) is in the EEA, where the GDPR applies directly. US transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (Art. 46 GDPR) otherwise.

4. Retention​

• Account and location data: while your account is active; up to 12 months after cancellation unless you request earlier deletion.
• Poster print files: deleted within 48 hours if the order is not paid; kept up to 90 days after purchase for reprints and support, then deleted.
• Billing data (including poster order records): up to 10 years (§ 147 AO, § 257 HGB).
• Error logs: up to 30 days.
• Optional product analytics: delete the pseudonymous PostHog record after withdrawal; verify and publish the project retention period before enabling production capture.
• Support correspondence: up to 3 years after last contact.
• Tool uploads awaiting an account: deleted within 24 hours if you do not complete signup. Once claimed, the file becomes an import in your account and follows the account-data rule above.

The free tools at dawarich.app/tools/ process your files entirely in your browser by default; nothing is uploaded unless you press "Save to my Dawarich account".

5. Your Rights​

You have the right to access (Art. 15), rectify (16), erase (17), restrict (18), port (20), object to processing based on legitimate interest (21), and withdraw consent at any time (7(3)) without affecting prior processing. To exercise any right, email [email protected] or delete your account in-app.

You may also lodge a complaint with a supervisory authority (Art. 77). Our competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de); you may instead complain in your country of residence or workplace.

6. Cookies​

On dawarich.app we use:

Rybbit stores a randomly generated visitor ID in your browser's local storage so that repeat visits are counted as one visitor rather than several. This pseudonymous ID may be personal data. Rybbit is loaded only after you accept, and withdrawal clears its local storage ID. Landing UTM parameters are also saved only after acceptance; withdrawal clears them. A first-party consent cookie on .dawarich.app lets the Cloud signup page know you accepted campaign handoff. Cloud asks separately for product analytics consent before attaching a campaign to your account or sending events to PostHog.

The Google Ads, Rybbit, Brevo and Partnero tags are not loaded before you accept. Without consent, our links to the Cloud app do not pass campaign, affiliate or ad-click identifiers. After consent, the Google tag can associate an ad click with a signup across our domains; its storage and data-sharing consent settings are granted. Rejecting means we cannot make that association.

To change your mind either way, use the control below — the Cookie Settings link in the footer of every page brings you back here. It clears your stored answer and optional storage, then reloads the page so the tags stop running and the banner asks you again.

Delete the dawarichCookieConsent cookie and reload the page. With JavaScript enabled, a one-click button appears here instead.

On my.dawarich.app we additionally use first-party session cookies strictly necessary for login. Optional Cloud product analytics requires a separate affirmative choice. After that choice, self-hosted Rybbit may store a browser visitor ID and Cloud may send a pseudonymous account ID with allowlisted signup, usage milestone and billing events to the EU PostHog project. Google Ads and Partnero on Cloud require both this Cloud choice and the marketing-site consent. Declining either choice keeps those marketing scripts off. Withdrawing Cloud product analytics consent clears the account's campaign fields and queues deletion of its PostHog identity and events.

7. Security​

HTTPS for all transfers, encrypted database storage and backups, application data stored in the EU. Crash traces may be sent to Sentry (US) and retained for up to 30 days.

8. Children​

You must be at least 16 years old to use Dawarich. We do not knowingly collect data from children under 16.

9. Hosted Dawarich (legacy Patreon tier)​

For the legacy "hosted dawarich" Patreon tier, each instance runs on a dedicated server, accessible only to the subscriber. We access it only for maintenance. Cancellation may lead to deletion after a grace period.

10. Changes​

We will notify you of material changes (new purposes, new processors, changed retention, etc.) by email and/or in-app notice at least 30 days before they take effect. Non-material edits are published here with an updated date below.

Last updated​

Effective 2026-09-02. Contact for all privacy matters: [email protected].