Privacy policy

This policy covers the Our Question Diary app (iOS and Android) and the website ourquestiondiary.app. Part A is about the app, part B about the website, and part C applies to both. We have written it as plainly as we can. Where we refer to articles, we mean the EU General Data Protection Regulation (GDPR) unless stated otherwise.

1. Controller

Dimitri Preiß
Rather Str. 30
40476 Düsseldorft
Germany
Email: hello@ourquestiondiary.app
Phone: +49 0177 293 93 97

We are not legally required to appoint a data protection officer and have not done so. If you have questions about data protection, just write to the address above.

Part A: The app

2. The principle: end-to-end encryption

Everything you write in the app – questions, notes, answers, discussion messages and your display name – is encrypted by the app on your device before it leaves the device. The keys are created on your device and stay there. Our server only receives encrypted packages it cannot open. So we cannot read, analyse or pass on your content, and we cannot hand it over in readable form even if an authority asks.

• Private questions can only be read by the person who wrote them. They are stored encrypted on the server so that you can bring them to a new phone with your recovery code.
• Shared questions, answers and discussion messages can only be read by the two of you. An answer only becomes readable for the other person once you have both answered. This is enforced by cryptography, not just by the display.
• Lent keys: the other person only borrows the key to your answers. Their device has to renew it regularly and may keep it for at most 7 days without renewal. If you separate or delete your account, the key is withdrawn and your answers become unreadable for them within 7 days at the latest, even if their phone is offline.
• Recovery code: the 12 words are created and shown only by your device. We never receive them. If you lose both the code and your phone, we cannot restore your content.

We only use proven, open methods (including HPKE according to RFC 9180, XChaCha20-Poly1305 and Ed25519). How everything fits together is publicly described in the protocol specification. The encryption has not yet been externally audited.

On your device, the data is kept in an encrypted database. It is excluded from system backups (iCloud, Google), so no copies end up outside the app’s encryption.

3. What data we process and why

3.1 Account and sign-in

When you first open the app, it creates a random account ID and several key pairs. Only the ID and the public keys are sent to the server. To stop anyone from creating accounts in bulk, your device solves a small computing puzzle; we deliberately don’t use device checks by Apple or Google for this.

To sign in, the app creates a random device ID. The server issues an access token that is valid for 30 days and is renewed. We only store a check value (hash) of it, not the token itself. Only one device per account is active at a time; if you sign in on a new device, the old one is signed out.

Purpose: providing the app to you. Legal basis: Art. 6(1)(b) GDPR (contract of use); for protection against bulk account creation, Art. 6(1)(f) GDPR (our legitimate interest in secure operation).

3.2 Your content

For each item (question, answer, note and so on), the server stores the encrypted package, a random ID, who uploaded it, when it was uploaded or changed, and its size level. Packages are padded to fixed sizes beforehand so that their length doesn’t reveal whether an answer is short or long. The server cannot tell whether a package contains a question, an answer or something else.

Questions and answers can contain very personal things, including information about health, sex life or sexual orientation (Art. 9 GDPR). We cannot read such content because it is encrypted. We only store it so that you can exchange it between your devices and restore it.

Purpose: storing, syncing and restoring your content. Legal basis: Art. 6(1)(b) GDPR.

3.3 Connecting as a couple

To connect, one person creates an invitation. It is valid for 24 hours and can be used once; the server doesn’t know the secret part of the code, it only sees a check value. After that, the server stores which two accounts are connected, the state of the connection (pending, active, separated), the keys you exchange in encrypted form, whether 0, 1 or 2 answers have been deposited for a shared question, and when the devices last checked in. In case of a separation, it also stores who started it and when, when the connection will be finally dissolved, and whether anyone has agreed to undo it. Signed notices between your devices (such as “separated” or “account deleted”) are held by the server until the other device has fetched them.

Purpose: the shared features, revealing answers and separation. Legal basis: Art. 6(1)(b) GDPR.

3.4 Push notifications via Apple and Google

So that a new shared question, a revealed answer or a new message reaches you right away, the app uses your operating system’s push service: on iPhone the Apple Push Notification service (Apple Inc., USA), on Android Firebase Cloud Messaging (Google Ireland Limited, Ireland, together with Google LLC, USA). For this, our server stores your push token (an address that Apple or Google assigns to your device), the platform and when it was last changed. On Android, Firebase Cloud Messaging also creates its own installation ID. Firebase’s analytics features are switched off.

What Apple or Google receive: the push token, the time and an encrypted data package of fixed size. Only the app on the other person’s device can open it; it only contains the type of notification, never a question text or an answer. On iPhone, the notification also contains only a reference to a neutral text stored in the app itself. In addition, the server sends silent pushes without content so that the app syncs in the background (at most one per minute). This way Apple and Google learn that and when your device receives a notification from us.

You can switch off each type of notification individually in the app, or block notifications completely in your system settings. The app also works without push. Reminders about open answers, the “one year ago today” look-back and the notices before a separation is dissolved are scheduled locally on your device; no data is sent to us, Apple or Google for these.

Purpose: delivering notifications. Legal basis: Art. 6(1)(b) GDPR; storing the token on your device is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Apple Inc. and Google LLC are certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by the European Commission’s adequacy decision (Art. 45 GDPR).

3.5 Camera for connecting

You only need the camera to scan the other person’s QR code, and only if you allow it. The image is analysed on your device and is neither stored nor sent. On Android, Google’s ML Kit library recognises the code on the device. ML Kit may send technical usage and diagnostic data (such as device model, app version and performance figures) to Google, but no camera images.

3.6 IP addresses and server logs

Every connection to the server technically transmits your IP address. We only use it to answer the request and, briefly in memory, to fend off too many requests in a short time. We don’t write IP addresses, device or browser identifiers to logs. Error logs without these details are deleted after 7 days.

Purpose: operation and security. Legal basis: Art. 6(1)(f) GDPR.

Our server and database are run by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. We have a data processing agreement with the provider (Art. 28 GDPR). The database is backed up in encrypted form; the key for this is not stored on the same server.

3.7 Crash reports (only if you switch them on)

In the app settings, you can switch on “Send crash reports”. It is off by default, and while it is off the app sends no reports. If it is on and the app crashes, it sends a report with the type of error, the place in the program (file, line, function), the operating system (iOS or Android), the app version and the time. A report never contains questions, answers, names, the error message itself or identifiers of your account, device or connection.

Reports go to our own server running GlitchTip, which we operate in the EU (Hetzner Online GmbH, Germany). No other providers are involved. Your IP address is technically transmitted but not stored. We delete reports after 90 days.

Purpose: finding and fixing bugs. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time by switching the setting off again.

3.8 What the app doesn’t do

• No ads, no tracking, no analytics tools, no profiles, no passing on or selling of data.
• No analysis of your content, including automated text analysis. We can’t read it anyway.
• No access to contacts, location, photos or microphone.
• The impulse questions from “… einfach reden!” are included in the app. Nobody learns which impulse you draw.

4. What the server still learns

Even with end-to-end encryption, the server sees some so-called metadata. We name it honestly:

We cannot hand over more than this, even if an authority asks.

5. How long we keep data

6. Deleting, exporting and restoring in the app

• Deleting single questions or answers: directly in the app. If you withdraw an answer the other person has already seen, it also disappears on their side; they then see “withdrawn”.
• Separating: at any time, without asking. Your answers and messages disappear from the other person’s app, within 7 days at the latest even offline. Questions remain.
• Deleting your account: in the app settings. We delete everything on the server immediately (see section 5). Because we don’t know any email address or name, we cannot find your account on request. Please delete it in the app. If you no longer have your phone, you can restore your account on a new device with your recovery code and then delete it.
• Exporting: you can export your questions and answers, and the shared ones you are allowed to see, as a file. This file is not encrypted; the app tells you so.

Limits no technology can solve: the app cannot delete screenshots, photos of the screen or copies written down. Anyone holding your unlocked phone sees what you see; that’s why the app lock with PIN or Face ID or fingerprint is switched on from the start.

Part B: The website

7. Visiting the website and hosting

When you open this website, your browser sends technically necessary data to our server: your IP address, date and time, the address requested, your browser language and your browser and operating system identifiers. We only use this data to deliver the page to you and to protect it against attacks (Art. 6(1)(f) GDPR).

The server keeps no access logs. If a technical error occurs, an error log containing the IP address may be created. It is deleted after 7 days at the latest.

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on a server in Germany. We have a data processing agreement with the provider (Art. 28 GDPR).

The connection is always encrypted (HTTPS). When you follow a link to another website, your browser doesn’t tell it that you came from us. Invitation links carry the code after the # sign; your browser never sends this part to our server.

8. Local storage for colour and contrast

If you choose a colour or “More contrast” in the footer, your browser stores this setting in your device’s local storage so it is kept for your next visit. This data never leaves your device. Storing it is strictly necessary for the display you explicitly asked for (§ 25(2) no. 2 TDDDG). You can change the setting at any time or clear the site data in your browser.

9. Google Analytics (only with your consent)

We would like to know how many people visit the website, how they find it and which pages they read, so that we can improve it. For this we use Google Analytics 4, but only if you choose “Allow” in the cookie notice. Without your consent, Google Analytics is not loaded, no cookies are set and no data goes to Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

Where Google Analytics runs: on the home page and the other pages of the website, but never on the invitation, security, privacy and imprint pages. Neither the cookie notice nor Google Analytics appears there. Anyone who has been invited should leave no traces. There is no Google Analytics in the app.

What data: the pages viewed and time spent on them, date and time, the page you came from, clicks on links to other sites, device type, operating system, browser, screen size, language and an approximate location (country, region, city) that Google derives from your IP address. According to Google, Google Analytics 4 does not store IP addresses; for visits from the EU, the location is determined on servers in the EU and the IP address is then discarded. The data is linked to a random ID in a cookie, not to your name. We have switched off Google Signals and the link to advertising services; the data is not used for personalised advertising.

Cookies: _ga distinguishes visitors by a random ID, _ga_<ID> stores the state of the current session. Both last 24 months and are renewed on every visit. In addition, your browser remembers your choice in the cookie notice (allow or decline) in local storage so that we don’t ask again on every visit.

Retention at Google: we have set data retention in Google Analytics to 2 months. After that, Google deletes the data at the level of individual visitors; only aggregated figures without any link to you remain.

Transfer to the USA: Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so this transfer is covered by the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Google has also agreed to the European Commission’s standard contractual clauses.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

Withdrawing consent: you can withdraw your consent at any time with effect for the future. To do so, click “Cookie settings” in the footer of a page with statistics, for example the home page and choose “Decline”. We then delete the Google Analytics cookies in your browser and no longer load Google Analytics. If your browser has “Global Privacy Control” switched on, we don’t ask at all and treat this as declining.

You can find more about how Google handles data in Google’s privacy policy.

10. Fonts, content and links

Fonts, images and scripts are served from our own server. We don’t embed anything from Google Fonts, content delivery networks, social networks or video platforms. Apart from Google Analytics after your consent, the website loads nothing from other servers.

The source code and technical documents are hosted on GitHub (GitHub Inc., USA), and the app is available in Apple’s App Store and on Google Play. Your browser only connects to these providers when you click one of these links. Their privacy policies apply there.

Part C: For the app and the website

11. Contact and support by email

Support is available by email only, at hello@ourquestiondiary.app. If you write to us, we only use your address and message to reply to you (Art. 6(1)(b) GDPR, for general questions point (f)). We delete the message once your request has been dealt with, unless statutory retention obligations apply. We never link emails to an account in the app; we couldn’t anyway, because we don’t know any names or addresses for accounts.

Please never send us content from the app and never your recovery code. We don’t need either to help you, and we will never ask for them.

12. Recipients and third countries

We don’t sell data and don’t pass it on for advertising. Data is only received by:

• Hetzner Online GmbH (Germany) as hosting provider for the server, database, website and crash reports, with app content only in encrypted form;
• Apple and Google for push notifications (section 3.4), and on Android Google for ML Kit (section 3.5);
• Google for Google Analytics on the website, only with your consent (section 9);
• authorities, only where we are legally obliged, and then only what we have (section 4).

Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just send us an email. For the app, you can exercise most of these rights yourself: export, deleting single items and deleting your account. Because we don’t know who owns which account, we usually cannot match a request to a particular account. Section 4 lists everything the server can know about an account at all; you can export your content yourself at any time.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

Withdrawing consent: you can withdraw any consent (crash reports, Google Analytics) at any time with effect for the future (Art. 7(3) GDPR), in the app with the switch, on the website via “Cookie settings”.

We do not use automated decision-making or profiling. Using the app is voluntary. Without the data listed in sections 3.1 to 3.3, however, the app cannot work.

14. Complaints to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

15. Changes

If anything changes, for example because the app gets a new feature, we update this page and the date above. You can find earlier versions in the version history.