Privacy notice

This notice covers this website. The Daunder app itself sits behind a sign-in and handles your travel data; what it stores is described inside the app under Your data, where you can also download or delete all of it at any time.

Controller

Christian Schimanski
Blenser Straße 25
52385 Nideggen
Germany
Email: [email protected]

We have not appointed a data protection officer: our processing does not meet the thresholds of Art. 37 GDPR or § 38 BDSG. For any question about your data, write to the address above — it reaches the controller directly.

The short version

• No analytics, no tracking pixels, no advertising networks, no profiling.
• No cookies are set by this site.
• Fonts are served from this site, not from Google Fonts, so no request leaves for a third party while you read.
• Our own server writes no access log for page requests — there is no record of your visit on it.
• If you only read, nothing of you is stored anywhere by us.

Delivering the page

Delivering a page technically requires your IP address, the requested path, the time and your browser identification to be processed. This happens at our delivery provider (Cloudflare, see Recipients), which uses connection data to deliver the page and to defend against attacks. The legal basis is our legitimate interest in operating this site securely and reliably (Art. 6 (1) (f) GDPR).

The origin server behind it keeps no access log. Requests are not written to a file there, so there is nothing to retain and nothing to hand over. The system journal of the waitlist service records only that a confirmation was requested — without the email address.

Appearance setting

If you use the light/dark switch, your choice is stored in your browser’s local storage under daunder-theme. It is not a cookie, it is never transmitted to us, and clearing your browser data removes it. This is a technically necessary convenience setting under § 25 (2) TDDDG and needs no consent.

Signed-in area

Once you sign in at daunder.app, your browser stores a session token in local storage, together with your language and the trips you have already opened, so that the app keeps working without a connection. None of this is a cookie, none of it is shared with anyone, and all of it is strictly necessary for the service you asked for — so no consent banner is required (§ 25 (2) no. 2 TDDDG). Signing out removes the token and the stored trips from this device.

Entries you wrote without a connection stay on the device until they reach the server, even after signing out — otherwise signing out would destroy text you have not sent yet.

Beta waitlist

If you join the waitlist, we process the name and email address you enter, the time of registration, and the time and IP address of your confirmation.

• Confirmation is required. We first send one email with a confirmation link. Your address is only added to the list once you click it. Without that click the pending entry is deleted automatically after seven days.
• Purpose and legal basis: to inform you about beta access, on the basis of your consent (Art. 6 (1) (a) GDPR). We store the time and IP address of the confirmation as proof of that consent (Art. 7 (1) GDPR).
• Extent: we store nothing beyond the fields named above — no browser identification, no referring page, no behavioural data. The links in our emails are plain addresses: they contain no tracking, and we do not measure whether you open a message.
• Withdrawal: every email carries an unsubscribe link, and you can write to [email protected] at any time. Withdrawal deletes your entry — it is not merely marked as inactive — and does not affect processing that already took place.
• Erasure: at the latest when the beta programme ends, or immediately on request.
• The form contains a hidden field that only automated scripts fill in. It is used solely to discard spam and is never stored.

Daunder Plus: payments and codes

If you buy Daunder Plus on daunder.app, the payment page is run by Stripe and the subscription is managed by RevenueCat (see Recipients). We never see your card number. We store which plan your account has, until when, the subscription identifier and when you bought it — to unlock Plus, to honour your right of withdrawal and to process a cancellation. If you redeem a code, we store which code your account used and when. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). Payment records are kept as long as tax law requires (up to ten years, § 147 AO).

If you cancel on daunder.app/cancel, we store the email address you entered, the content of your cancellation and the time we received it, and send you a confirmation — because the law requires us to (Art. 6 (1) (c) GDPR in connection with § 312k BGB).

Contacting us

If you write to us, we process your address and the content of your message in order to answer it (Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) where your enquiry concerns a contract). We keep such correspondence only as long as it is needed for the matter or as statutory retention periods require.

Recipients

Delivery, DNS and TLS — Cloudflare

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Delivers this site and therefore processes connection data including your IP address.

Payments — Stripe

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Processes payments for Daunder Plus on daunder.app. Stripe is itself responsible for the data it needs as a payment institution.

Subscriptions — RevenueCat

RevenueCat, Inc., USA. Manages subscriptions and gift-code access for Daunder Plus and receives your account identifier and purchase data. Transfers to the USA rely on the EU standard contractual clauses.

Email delivery — Resend

Plus Five Five, Inc. (“Resend”), USA. Sends the confirmation and notification emails and therefore processes your address and the message content.

With both providers there is a data processing agreement under Art. 28 GDPR, and the transfer to the USA rests on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).

Beyond these, your data is not passed on. It is not sold, and it is not used to build profiles or to train models.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Is providing data required?

No. Providing your name and address is voluntary and is neither required by law nor by contract. Without them we simply cannot put you on the waitlist.

Children

This site is not directed at children. We do not knowingly collect data from persons under 16 years of age.

Your rights

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and you may withdraw a given consent at any time with effect for the future (Art. 7 (3)). A message to [email protected] is enough.

You also have the right to lodge a complaint with a supervisory authority — usually the one responsible for your place of residence or for the controller’s registered office.

Changes

We will update this notice when the site or the services behind it change. Version of 13 September 2026.