Privacy policy / DSGVO

This English text is a convenience translation. The German text is binding. If the two differ, the German text applies.

Version of 15 October 2026. Older versions stay available at their own address.

This notice describes what actually happens to personal data. It covers the website www.pookie-planner.com, the web app app.pookie-planner.com, the API at api.pookie-planner.com, and the iOS and Android apps. It is one document. The section says which surface it means.

Pookie Planner is a digital service for two people. There is no price in money. You provide personal data. Access is possible worldwide. One set of rules applies: German data protection law, and the mandatory consumer protection of the country where you live.

Controller

Max Kossatz
Freiberger Straße 4
01067 Dresden
Germany

Pookie Planner and MileTribe are brand names. No other company is the other party to the contract or the controller. There are no other controllers and no employees. There is no joint controllership under Article 26 GDPR. The controller is established in the European Union. A representative under Article 27 GDPR is not required.

Email: support@pookie-planner.com

Phone: +49 171 3452085

Contact form: /contact, without an account. Messages sent through it are read within a few working days.

No data protection officer is appointed. There is no duty to appoint one.

Complaint to a supervisory authority

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. This right is not limited to one authority.

The authority at the controller’s seat is the Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, datenschutz.sachsen.de.

Who the service is for

The service is only for people aged 18 or over. Minors are not the audience. Each person gives their own date of birth. Age is checked on the calendar day in the Europe/Berlin timezone. Under 18 is refused. The date is stored only if the person is an adult.

The person who creates the account is checked at registration. If they are under 18, no account is created. The second person is checked at first use. If they are under 18, they get no access. The first person’s account remains.

An account always belongs to both people. There is no separation that leaves the account open. Withdrawal, deletion in the app, and a lock for abuse end the contract and the access for both.

When the second person has not arrived yet

The person who creates the account enters the second person’s first name and, usually, their email address. Those details do not come from the second person.

Once an address is stored, an email goes to it. That email is the notice under Article 14 GDPR. It names the source: the person who created the account entered the first name. It links the terms, this notice, and the withdrawal instructions. If sending fails, it is retried within one month.

The second person has no access until, at first use, they give their own email address, their date of birth, and accept the legal texts. A further email about the contract follows.

If no address is given, we cannot send that email. Only the first name is stored. The second person sees this notice at first use, before they have access.

Place data from search is not indirect collection about another person. It is described with the recipients.

Website

The marketing site is a static site. Fonts are hosted by us, not by a font service. There is no audience measurement, no advertising, no social plugins, and no embedded third-party content. Our own JavaScript is the consent dialog and the language switch.

A request to the bare domain pookie-planner.com is redirected to www.pookie-planner.com. That redirect sets no cookie and adds no tracking parameters.

The host still writes access logs. See the section on logs.

Account, sign-in, and contract

Purpose. To run the account, sign in, reset the password, confirm the contract, and tell you when the account ends.

Data. Email address of the person who creates the account, which is also the account address. Two first names. Two passwords, stored only as a hash, never in clear text. The otter’s look. The account timezone, default Europe/Berlin. Each person’s own date of birth, once they pass the age check. The time and version of the terms, this notice, and the withdrawal instructions they accepted, and that they confirmed they are an adult. Session: see cookies. For a password reset, a hash of the link and of a digit code, for 60 minutes, then useless. The digits and the link exist only in the email.

Legal basis. Article 6(1)(b) GDPR. The processing is necessary to conclude and perform the contract, including the confirmation under section 312f of the German Civil Code. The email to the second person before their first use is also based on Article 6(1)(c) GDPR, because we have to tell them where the data came from.

Recipients. The host and the sending service, in the recipients section.

Retention. For the life of the account. The reset record for 60 minutes. The end of the account is in the retention section.

If you do not provide this. Without the account email, without both people, and without a password, there is no account. The second person has no access without their own email, date of birth, and the legal texts. The registration form asks for their email. An older flow can create the account without that address. Then no invitation email is sent.

What the couple writes

Purpose. The service the contract owes: ideas, places, phone numbers and links of places, hearts, reactions, comments, planned dates, open days, the activity log, and badges. Places you dismiss in Discover are remembered so they are not suggested again.

Data. What you write in those fields, and which of you wrote it.

Legal basis. Article 6(1)(b) GDPR.

Recipients. The host. The assistant only if you have allowed it. Google only if you search for a place, open the map, or request weather.

Retention. Until the account ends. What you delete in the app stays in the database marked deleted and is no longer shown. There is no extra period after that. It follows the same path when the account ends. That path does not delete the texts. See the retention section.

The other person sees the confirmed place (a town or a street address) and its map coordinates. The rough device location is not shown to them. Both of you see the rest of the couple’s content.

Home and weather

Purpose. The confirmed home is required for the app to open and for nearby places to be ranked. The weather place belongs to the forecast.

Data. The place you confirm: a town or a street address, each with coordinates. Plus a separate weather place if you set one. The forecast itself is an hourly figure for that place, without your email and without the account id. On the location screen, one precise device fix may go to Google so the current address can be suggested. That precise fix is not stored. What is stored is the place you confirm.

Legal basis. Article 6(1)(b) GDPR. Both are part of the contractual function, not consent.

Recipients. The host. Google as its own controller when the place is resolved or the weather is requested.

Retention. For the life of the account. A weather answer sits for one hour in a cache that is not tied to an account. A resolved place name sits in that cache for 30 days, a miss for 24 hours. A rough place bias in memory sits for 30 minutes. Coordinates of public venues for the map stay until they are overwritten. These caches are not home addresses.

Without a home. The app does not open.

Place search, the map, and Google

Purpose. To search for places, show details and photos, resolve a home or a weather place, turn a location into a place name, and draw the map. Discover is an optional extra. The same search runs when you use it. The app works without Discover.

Data. Search words, the confirmed home or a rounded location as a ranking hint, on the location screen one precise device fix to name the current address, and the place names, addresses, phone numbers, links, and coordinates Google returns. We do not store photos. The browser or the app loads the image through a short-lived address at Google. A jump to google.com/maps is a visit to Google, not a call to our API.

Legal basis. For our processing, Article 6(1)(b) GDPR. Whoever searches or opens the map is asking for exactly that processing. Google is its own controller for this, not our processor, and not a joint controller with us. The terms are the Controller-Controller Data Protection Terms. For personal data from the EEA those terms name Google Ireland Limited. There is no data-processing agreement with Google. Google publishes the Maps Platform EU standard contractual clauses.

Map on the device. After sign-in, when the map surface is shown. No extra dialog only for the map. The marketing site has no map. On the web, the Maps JavaScript API loads scripts and tiles from maps.googleapis.com and maps.gstatic.com, and fonts from fonts.googleapis.com and fonts.gstatic.com. A measurement on 26 September 2026 in Chrome saw no Google cookie. Cookie names that measurement did not set are not listed here. The native map is the same function. Advertising IDs, app-set IDs, and installation IDs are not listed here until a fresh install has shown them. Loading the map is the exception under section 25(2) no. 2 TDDDG: you opened the map. There is no second dialog just for that. At launch only the maps library: no Street View and no place search in the browser. Place search goes through our API.

Retention. On our side, as in the home and weather section. We do not set how long Google keeps a request. Google’s own notice applies: Controller-Controller Data Protection Terms.

Rough location

Purpose. To rank suggestions by distance. No live tracking, no stored history, and it is not shown to the other person.

Data. A coarse device location, rounded to two decimal places, in memory only, for at most ten minutes. It is not written to the device.

Legal basis. Article 6(1)(a) GDPR, plus the permission of the operating system or the browser. There is no separate dialog only for the sensor. The app stays usable without location. Ranking then falls back to the confirmed home. Location does not later become mandatory.

Withdrawal. In the operating system or browser settings. In the app settings, “This device” shows whether location is on or off. “Ask again” appears only when the system would still show a dialog, and it asks right away. It does not turn a permission off. On iOS and Android, “Open Settings” leads to the system settings once the system no longer asks. A browser has no such button, so there it is a sentence. The system permission stays until you change it there.

Microphone and transcription

Purpose. To turn speech into text for the assistant, only while you hold the record button.

Data. The audio clip. We do not store it. It goes to our API and from there to OpenAI (model whisper-1). Text comes back.

Legal basis. Article 6(1)(a) GDPR, together with the permission of the operating system or the browser. The app stays usable without speech. Typing is enough.

Withdrawal. The same system permission as for location, in the operating system or browser settings. In the app settings, “This device” shows whether the microphone is on or off. On iOS and Android, “Open Settings” leads there once the system no longer asks. There is no “Ask again” for the microphone: the next hold on the record button asks by itself while the system still asks. Without consent for the assistant, no clip is sent to OpenAI.

Assistant

Purpose. To turn one free-form message into a plan: create, plan, move, answer, react, cancel. The plan is saved only when you accept it. The assistant is optional. The app works without it.

Data. The text you type or speak. Both first names and the timezone. Up to six earlier turns of the same sitting, which the device holds. The server does not store that sitting. The server stores only the plan the assistant prepared: the individual steps with the details they would later write to your account, a short summary, and notes. If the message picked a place, the place details that were read go with it. Through tools, the current jar and calendar of this account, read as the signed-in person. Email addresses, passwords, and session credentials are not sent to OpenAI.

Legal basis. Article 6(1)(a) GDPR, collected before the first use, separately for each person. In settings the switch is labelled “Let the otter capture what I say so it can be processed”. It is on your own card, not on the other person’s.

Recipient. OpenAI Ireland Ltd as processor. Contract: Data Processing Addendum. API inputs and outputs are not used to train models. That is how the organisation’s data controls are set. We do not claim zero data retention. OpenAI may keep inputs for abuse monitoring, generally for up to 30 days, and longer in some cases. Some features store files or conversation data until they are deleted. OpenAI’s own notice governs: Your data. We do not store the prompt or the clip as a table of their own.

Retention. A prepared plan belongs to the person who asked for it and can be accepted for 30 minutes. It is deleted when you accept or discard it, close the window, send a new message (which replaces the plan), or 30 minutes pass. The daily clean-up removes expired plans at the latest. After you accept, only a one-line summary and the list of changes made stay for a short time, so that tapping Accept twice does nothing twice. What you accept becomes part of your ideas, dates, and the activity log and follows their retention. The other person does not see a plan.

Withdrawal. Turn the same switch off. No new request goes to OpenAI after that. The app stays usable.

Email

Sending. Resend sends transactional mail. The from address is Pookie Planner <noreply@pookie-planner.com>. That address does not accept replies. The reply-to address is support@pookie-planner.com, except for the contact form, where the reply-to address is the one you typed. Every mailbox under @pookie-planner.com is at Fastmail.

Mail that does not need a marketing consent. Password reset. Contract confirmation to the person who created the account. Invitation to the second person. Contract mail to the second person after first use. Confirmation link for withdrawal at /withdraw, only if the typed address is stored, for 60 minutes, only a hash of the link. Acknowledgement of withdrawal. Acknowledgement when the account is ended in the app. Notice of a lock for abuse, with the grounds. These emails rely on Article 6(1)(b) GDPR. The invitation and the acknowledgements required by statute also rely on point (c).

Data in the email. Recipient address, subject, bilingual text, first name, and depending on the kind the link, the reset digits, the legal links, or the grounds of a lock. Passwords are not in the email.

Mailboxes. People and automation agents who work for the controller may read every mailbox and send from them. Product mail is still sent by Resend, not from the mailbox.

New features and offers. Only with each person’s own consent, Article 6(1)(a) GDPR. Not pre-selected. The switch is labelled “Email me about cool new features and offers” and sits in your own settings. Sending only to that person’s own address. That email is not sent today. The consent is stored so that a later send goes only to people who agreed. Withdraw it with the same switch, for the future.

Retention. While the account exists, we set no maximum period of our own at Resend or Fastmail. After the account ends: the retention section.

Contact and in-app feedback

Contact form, email, phone. Name, email address, and message from /contact. A hidden “Company” field is for automated senders. If it is filled in, we drop the message and do not keep it as a request. You can write the same request to support@pookie-planner.com or call +49 171 3452085. We do not run a third-party ticket system. The app does not keep a call recording.

Legal basis. Article 6(1)(b) GDPR where the message belongs to the contract or to steps before the contract that you asked for. A message that is neither relies on Article 6(1)(f) GDPR: to answer the request you sent.

In-app feedback. Notes to the controller about the service. Only the controller reads them. They are not forwarded to email, a planning tool, or other notes. Legal basis Article 6(1)(b) GDPR. They sit in the database and follow the end of the account. The text remains after the identifiers are overwritten, until you ask for erasure.

Logs, session, and abuse

Purpose. To run the service, limit attacks, and find faults.

Data. IP address, time, path, on some lines the account id, app versions. The session row can hold the IP address and the user agent. Counters against too many attempts: for sign-in, registration, password, withdrawal, and the contact form, the IP address; for the assistant, transcription, and place photos, the account id. A counter’s window is at most one hour. The row can remain until the same key is seen again. It is not turned into a usage profile.

Legal basis. Logs and the IP address on the session: Article 6(1)(f) GDPR. The interest is operation, security, and fixing faults. The counters: Article 6(1)(b) GDPR, operation of the API and steps toward the contract.

Recipients. The host stores the database and the logs. Crash reports: their own section.

Retention. Logs at the host for at most 90 days. The session ends when you sign out, and at the latest after 30 days without use. A counter row outlives its window only until the next attempt.

Objection. An email to support@pookie-planner.com is enough. We then stop, for this account, processing based on point (f): server and access logs, and reports to Sentry. The weather and place caches continue. They rely on point (b) and are not tied to an account.

A lock for abuse is started by the controller. There is no scoring and no solely automatic decision. The path afterwards is the same as ending the account. The grounds go to both stored addresses and are cleared when the identifiers are overwritten.

Crash and performance reports

Purpose. To understand crashes and performance, including session replay (the screen), profiling, release health, the IP address, and the account id (coupleId). This notice names those points even where the program does not switch them all on yet. A narrower sentence about crashes only would be wrong. Session replay can show what was on the screen, including content you were looking at. We do not attach email addresses or idea text in our own error report. In the public app we collect performance data for one in five operations. In the other environments we collect it for every operation. We do not name the files the SDK stores on the device. The coupleId ties a report to the account. It does not create an advertising profile, including one across other websites or apps.

Legal basis, two steps. Writing and reading on the device needs consent under section 25(1) TDDDG. Processing the reports after that relies on Article 6(1)(f) GDPR, interest: fixing faults and keeping the service stable. One click in the dialog gives the TDDDG consent and, where a data-protection consent is needed, that consent as well. The legal bases stay separate. The reports themselves are not based on consent.

When it starts. Never on the marketing site. In the web app only after you allow the item in the dialog. On iOS and Android only after you turn on “Send crash reports.” yourself. The same choice appears at registration, at first use, and as a switch in settings. It is not pre-selected, and it covers the same scope, not crashes alone. The decision is stored on the device under pookie.consent, in secure storage, for 12 months, and is not shared with the website. The API can send an error report once that service is configured there. That is not access to your device and does not depend on the dialog. The objection in the logs section stops those reports as well.

Recipient. Functional Software, Inc. (Sentry), processor. Contract: Data Processing Addendum.

Retention. Events at Sentry for at most 90 days. After you withdraw, we stop sending and stop session replay. We do not send Sentry a separate deletion request for events already there. They age out within those 90 days.

Cookies, local storage, and SDKs

The page /legal/cookies leads here. The German heading of this section is the target of that link.

One click can be two consents: storing or reading on the device under section 25 TDDDG, and processing personal data under the GDPR. Both are stated in the dialog. The legal bases are named separately.

The dialog is on the marketing site and in the web app. It blocks the page until you press one of the three buttons. The legal notice and this policy stay reachable. The items do not start pre-selected.

• “Accept all” turns both items on and stores the cookie. The web app may start Sentry. The website does not load Sentry.
• “Reject all” turns both off. We do not store a refusal, because storing the decision itself needs consent. We delete any cookie already stored. Sentry does not start. If the SDK already started during this visit, we stop it. The dialog returns on the next visit.
• “Save selection” follows the two boxes exactly. We write the cookie only when “Remember this choice” is on. If it is off, we delete any cookie already stored. If “Crash and performance reports” is on at the same time, Sentry starts in the web app for this visit. Without a cookie we ask again on the next visit and do not start Sentry on our own.

To keep a refusal for 12 months, leave “Crash and performance reports” off, leave “Remember this choice” on, and press “Save selection”.

You open the same dialog later from “Privacy settings / Privatsphäre”, in the website footer and in the web app settings. On iOS and Android you withdraw with the switch “Send crash reports.” The choice belongs to the browser or to the app installation, not to the account.

The two items:

1. Remember this choice. A first-party cookie with only the choice, the date, and the version. 12 months. The marketing site and the web app read the same cookie, so you are not asked twice. Storing this choice itself needs consent. We ask again after 12 months, when there is a new purpose, when there is a new actor, or when the stored version no longer applies. A purely editorial change to this notice does not ask again.
2. Crash and performance reports. The section above. The native app has no such dialog. The switch in settings applies there. The native choice is not shared with the website.

Cookie names in production. On the stage they end in .dev:

The session in the app is technically required for the sign-in you asked for. The marketing site has no sign-in session.

App updates

The installed iOS or Android app checks at launch whether an update is available, at u.expo.dev. That is necessary to deliver the version of the app the contract owes. Legal basis Article 6(1)(b) GDPR and the exception in section 25(2) no. 2 TDDDG. No separate consent and no item in the dialog. Which keys the update program writes on the device are not listed here until an install has shown them. This notice names the check and the host.

The recipient is 650 Industries, Inc. (Expo), processor for build and update metadata. Until a separate data-processing agreement is signed, the processor terms in the Terms of Service apply, including standard contractual clauses module 2 for user data. A countersigned enterprise agreement is not in place. We do not claim that agreement.

App stores

Once the apps are listed with Apple or Google, Apple and Google process the store operation as their own controllers. That is not a processing operation of the controller. There is no payment through the store. There is no tracking in the store sense. An advertising ID is not requested.

What does not happen

No audience measurement, no A/B test, no advertising, no attribution, no social login, no push notifications, no payment, no subscription, no invoice, no public profile, no community, and no job applications. If any of that is added later, this notice is changed first, and where consent is required it is collected again.

Special categories

Health data, sex life, religion, and other special categories under Article 9 GDPR are not collected and not offered. There is no separate consent for them. If such details still appear in free text, they stay in the couple’s account and are not published. The exception “manifestly made public” is not used and is not claimed here.

No automated decision

There is no decision based solely on automated processing that produces legal effects or similarly significantly affects a person. The assistant prepares a plan. It is saved only when you accept it. The version gate and the attempt counters do not lock a person by a score. A lock for abuse is started by the controller.

Recipients

No tax adviser, accountant, or insurer receives customer data. The domain registrar, and the build pipeline that does not hold production customer data, are not listed here.

A copy of the transfer safeguards is sent on request to support@pookie-planner.com.

Countries

This notice does not name a country where a service stores the data. Data may sit in different countries, depending on how that service manages it. There is no promise that processing takes place only in the European Union. Support, a deploy, and a laptop can also be outside the European Union.

The transfer mechanism in that recipient’s contract applies. An exception under Article 49 GDPR is not claimed. Which clauses those are is set out in the linked contracts. A copy is available on request.

Retention and erasure

While the account exists, the periods in the individual sections apply.

End of the account. Withdrawal, deletion in the app, and a lock for abuse block access immediately. Both people are signed out. The sessions are gone.

At the earliest 20 days after the block, we overwrite the email addresses, the first names, the home, the weather place, and the password. That happens only once the email about the end of the account has been sent to every stored address. Until then those details remain, even if the 20 days have already passed. Grounds of a lock, and the name and email from the withdrawal form on the website, are overwritten or cleared at the same time.

This path does not delete everything. What remains is the date of birth, the otter’s look, the timezone, the stored choice about feature emails, the time of the assistant consent, the version of the legal texts accepted, and the texts you wrote: ideas, dates, comments, feedback, and the activity log. If a text contains a name or a place, it can still point to a person. We do not call this remainder anonymous. It is no longer used to perform the contract. We do not publish these texts and we do not train a model on them. If you ask for this remainder to be erased, we erase it. We have no statutory retention today that would stand in the way, because there is no payment and no invoices. If records arise later, statutory periods can apply. This version names no specific numbers of years, because those records do not exist.

Backups and logs at the host. A deleted or overwritten row can sit in a backup until that backup expires, at most 90 days. Logs at most 90 days.

Mail and sending. Messages in the mailboxes to or from a stored address are to be deleted, including the reply-to address. The job searches daily for 90 days. It deletes only once it has access to the mailboxes. Mentions of an address only in the body of mail between us are left. Resend offers no deletion API. We ask Resend to delete the stored send ids and the related request logs. Until then Resend’s own period applies, linked in the recipients section.

Sentry and OpenAI. As in their sections. For Sentry, no separate deletion request. Events age out within at most 90 days.

There is no automatic export when the account ends.

What you have to provide

Your rights

Requests go to support@pookie-planner.com. The controller handles them. An email from a stored address is enough: the account address, or the second person’s own address. No extra identity document is required. One person alone may request access and erasure. The other person is informed if an address is stored for them.

The reply is usually within one month. The request is free of charge, unless Article 12 GDPR allows an exception.

• Access under Article 15 GDPR.
• Rectification under Article 16 GDPR. First names, email, home, and similar details can be changed in the app.
• Erasure under Article 17 GDPR. The path in the retention section is the rule. It is not a promise that every copy is gone at the same moment. The remainder that path leaves, we erase on request.
• Restriction under Article 18 GDPR. There is no switch in the app for this. Write to the address above.
• Notification of recipients under Article 19 GDPR, where we have to inform them and it is not impossible or disproportionate.
• Portability under Article 20 GDPR, where processing is based on contract or consent and is carried out by automated means. On request to support@pookie-planner.com you receive a JSON file with ideas, dates, comments, and profiles. Period: one month. There is no self-service export and no automatic export on withdrawal.
• Objection under Article 21 GDPR against processing based on Article 6(1)(f). The route and the effect are in the logs section. You may object to direct marketing at any time. The switch for feature emails is that objection for that kind of email. That email is not sent today.
• Withdrawal of consent under Article 7(3) GDPR, at any time for the future, as easy as giving it. Lawfulness until withdrawal is unaffected. Location and microphone: the operating system or the browser. Assistant: the switch in your own settings. Reports: the same dialog via “Privatsphäre” on the website and via “Privacy settings / Privatsphäre” in the web app, and in the native app the switch “Send crash reports.” Feature emails: your own switch.
• Complaint under Article 77 GDPR, the section at the top.

Rights concerning a solely automated decision under Article 22 GDPR do not arise, because there is no such decision.

Security

We take appropriate technical and organisational measures to protect the data against loss and unauthorised access. Individual methods are described with the operation they belong to, not as a separate list.

Changes

On a material change to this notice we email the account address and the second person if their own address is stored, and we show a notice in the app until it has been acknowledged. The new version gets a new date. The old one stays available at /legal/privacy/ plus that date. The version stored on an account does not change by itself.