Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Stefan Mende
Obere Hausbreite 9
80939 Munich
Germany
Email: datenschutz@patchio.de

Full details in the legal notice.

2. General information about data processing

patchio is an organisation tool for families and blended-family households. We process personal data only to the extent necessary to provide the application and fulfil the usage relationship.

The legal basis is predominantly Art. 6(1)(b) GDPR (performance of the contract for use of the application), in individual cases Art. 6(1)(a) GDPR (consent, e.g. for optional email notifications), and Art. 6(1)(f) GDPR (legitimate interest, e.g. to ensure stable and secure operation).

3. What data we process

The following data is processed as part of using patchio:

• Account data: email address, password (hashed), first name, profile avatar (optional)
• Signing in with Google: instead of email and password, you can sign up and sign in in the browser and in the app via “Continue with Google”. Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; possibly Google LLC, USA) then sends us an identifier for your Google account, your email address and the profile details Google releases in the process (usually name and profile picture). The legal basis is Art. 6(1)(b) GDPR (providing your access). Google is responsible in its own right for the sign-in at Google itself; Google's privacy policy applies. You can disconnect the link in your profile under “Connected accounts”. “Sign in with Apple” is only available in the app (see section 11).
• Household and family data: names and relationships of other household members (including those without a login, e.g. children), memberships in households and groups, sharing codes
• Calendar and task data: events, event series, reminders, tasks, visibility settings
• Lists and meals: shopping lists, recipes, meal plans
• Pantry data: pantry items with storage location and stock level
• Directory data: contacts with addresses, opening hours and other notes that you enter yourself
• Emergency card data: health and emergency information (blood group, allergies, medication, medical conditions, insurance, GP) that you voluntarily maintain for a family member. Before you save an emergency card for the first time, we require your express consent via a checkbox (Art. 9(2)(a) GDPR). The time and version of your consent are logged for evidence purposes.
• Emergency card access logs: timestamp and identity of the family member accessing it, for every read access via the emergency card's print view. Retained for 90 days, then automatically deleted. The logs are visible to every fellow household member and serve transparency within the household as well as the accountability obligation under Art. 7 GDPR.
• ID documents (document vault): if you use the document vault, we store the images/PDFs of ID papers you upload (e.g. passport, ID card, birth certificate, residence permit) along with a title, type, and optional note (Art. 6(1)(b) GDPR), held with our processor Supabase in the eu-west-1 (Ireland) region (see section 5). Responsibility lies either with the person themselves (if they have their own access) or with their registered carers — either way, they also decide whether individual other people, or a linked household, can see it too. Household admins who aren't carers can't see these documents, and neither can other household members without such a share; a file is only ever delivered through a short-lived, one-time ticket, never a permanent link. Technically, patchio could still read the stored files server-side — there's no end-to-end encryption. If you delete your account, your own ID documents are deleted with it, not handed over to the household that remains. On request, we additionally store the issue date and the document number for a document; the number lives in its own table, locked down by a database policy, and — inside the app — is retrievable only through a dedicated, logged function; it is included in the data export of your own account. If an expiry date is set, you can also turn on a reminder by email and in-app notification, sent ahead of the expiry only to whoever is responsible for it — the document number is never mentioned in it.
• Document vault access logs: timestamp and identity of the household member accessing it, for every open, download, retrieval of the document number, or change to a share. Retained for 90 days, then automatically deleted. Unlike the emergency card logs above, these entries are visible only to whoever is responsible for that particular document, not the whole household — this data is more sensitive than the emergency card.
• Health and cycle data (Health module): if you actively use areas of the Health module (e. g. routines, medication, readings, journal or the cycle log), we process the health data you enter (Art. 9(2)(a) GDPR – based on your express consent given by actively creating the entries). The journal and cycle log are technically restricted so that only you can read them – not even other family members or household admins have access. You can fully delete this data yourself at any time (cycle log via “Turn off”). It's never shared with third parties.
• School data (School module): if you use the School module for a child, we process the details you enter: school profile (federal state, school type, year, and school name where given), subjects and clubs, timetable, assessment dates, and grades. Assessment dates are visible to every household member in the family calendar; a child's grades are specially protected and kept technically separate: only the child themselves and the members with the “Manage school” permission can see them – and only as long as visibility is set to “Family”. If it's set to “Only the child”, nobody but the child has access, not even admins. Every change to this visibility setting is logged and shown to the child. The school-holiday and public-holiday data the calendar shows comes from the OpenHolidays API (openholidaysapi.org) and is published under the ODbL-1.0 licence (Open Database Licence); it's built permanently into the application and shown without any link to you personally.
• Accident reports (vehicles module): if you record an accident, we store the details of the European accident report: date, time, place and country – if you wish, with your device's GPS coordinates (only when you tap “Use current location”) –, injuries and damage, details of witnesses, details of the other party (keeper, driver, number plate, make, insurer and policy), how it happened, a sketch, photos and both drivers' signatures. This means we also process third parties' data (the other party, witnesses). The report is visible to the people who can see the vehicle in patchio; the person who recorded it and the vehicle managers can edit or delete it. Deleting it also removes photos, sketch and signatures. The legal basis is Art. 6(1)(b) GDPR; for third parties' data, Art. 6(1)(f) GDPR (legitimate interest in settling the claim).
• Weather/location data: for the weather tile, automatically the weather location stored in your profile or, if you haven't entered one, your household's main home (town/postcode) — not your device's real location. You can additionally have the weather shown for the exact location of an event that has one; this only happens when you tap to request it yourself (details in section 5, “Weather for event locations”).
• Payment and billing data (only with a paid subscription): payment method details (e.g. credit card, or SEPA direct debit mandate with IBAN), billing name and address, amount, payment status and billing history. The actual payment data (card number, IBAN) is processed directly by our payment provider, Stripe, and isn't made available to us in plain text (see section 5).
• Financial data from the bank statement import: if you import a bank statement as a CSV, XML or Excel file (Finances → Import), patchio reads it only in your browser – the file itself is never sent to our servers. Only the transactions recognised in it are stored: date, amount, counterparty, the counterparty account's IBAN, and the purpose. This data sits in the relevant household with the visibility of the account it belongs to (private by default), and it therefore contains personal data about third parties – e.g. names and IBANs of the people you exchange payments with. You only get AI category suggestions for it if an admin has turned on AI categorisation (see section 5); the purpose is masked before it's sent to Claude (Anthropic), and IBANs are never included. If you delete the account or your account (login), the imported transactions that belong to it are deleted along with it – expenses already created from them stay. The imported transactions are included in your own account's data export.
• Technical data: IP address, timestamps, browser type, and server logs from our infrastructure providers (see section 5)

4. Purposes of processing

• Providing and displaying the application
• Managing accounts, households, families and groups
• Sending transactional emails (confirmations, password resets, reminders for assigned events, timer emails)
• Protecting against misuse and ensuring operation (e.g. rate limits, error analysis)

We don't carry out any automated decision-making or profiling within the meaning of Art. 22 GDPR.

If you use our contact form, we process the data you provide (name, email address, message) as well as your IP address, to handle and answer your enquiry. The legal basis is Art. 6(1)(b) and (f) GDPR (handling your enquiry, and our legitimate interest in communication). The data is deleted once your enquiry has been resolved and no retention obligations stand in the way.

5. Processors and recipients

To provide the application, we use the following processors. We have a data processing agreement under Art. 28 GDPR with each of them.

• Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore, and subsidiaries) — database, authentication, file storage, edge functions. Data is stored in the eu-west-1 (Ireland) region. Data isn't regularly transferred to third countries as part of operation.
• Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA) — static hosting of the frontend and edge CDN. Vercel's DPA applies, including the EU Standard Contractual Clauses (SCCs). Where personal data (e.g. IP address) is processed, a transfer to the USA may take place; the legal basis is Art. 6(1)(f) GDPR in conjunction with the SCCs under Art. 46(2)(c) GDPR.
• Resend (Plus Five Five, Inc., 2261 Market Street #4667, San Francisco, CA 94114, USA) — sending transactional emails and the newsletter from the sender address noreply@patchio.de. Sending runs through the European region (eu-west-1, Ireland); however, Resend also stores the related data (recipient address, content, logs) in the USA. For this arrangement, Resend's DPA applies, including EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(b) GDPR (contractual email communication) and, where applicable, (a) GDPR (consent for optional notifications). For the newsletter, its open and click tracking and the legal bases for them, see section 6b.
• Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; and Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA) — processing payments for a paid patchio subscription. Only once you take out a subscription do we process the data needed for payment: payment method details (credit card, or SEPA direct debit mandate with IBAN), billing name and address, amount, payment status, and a technical identifier for your subscription. You enter the sensitive payment data (full card number, IBAN) directly with Stripe; it's processed exclusively by Stripe and isn't passed to us in plain text. Stripe processes some of this data in the USA; the transfer is secured by the EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR and the EU-US Data Privacy Framework (DPF), to which Stripe, Inc. is certified. The legal basis is Art. 6(1)(b) GDPR (performing the subscription contract) as well as Art. 6(1)(c) GDPR for the tax-mandated retention of billing data. Stripe additionally carries out fraud prevention in its own right; details are in Stripe's own privacy policy.
• Anthropic (Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA) — only for optional AI features. These are switched off by default without exception and must be expressly turned on by a household admin. There are two separate switches for this, which work independently of each other:
  
  (1) The “AI categorisation” switch (under “Manage”). If it's on, the following is sent: for category suggestions on expenses and contracts, the description and amount (for contracts, also the provider) and the names of your categories; for the shopping list, only the plain item name, when an item is unknown to the local dictionary. Not sent: names of people, IBAN/account details, customer numbers, receipts, notes, or the split. The sole purpose is the category suggestion; you always confirm the final entry yourself. The same switch also covers images: if a recipe has an image uploaded, the ingredients can be read from it — this sends that one image to Claude (Anthropic). This only happens on explicit request, via the “Read ingredients from the photo” button, and never automatically: not on upload, not in the background. No other recipe details are sent along with it (no name, no notes, no method, no people). Any member of your household who's allowed to edit recipes can trigger this — even for an image someone else uploaded. What's visible in the image is determined purely by which image you choose to upload; so don't upload images whose content shouldn't reach Claude. The result is a suggested ingredient list, which you review, edit, and apply yourself.
  
  The same switch also covers recipe import from text, photo or PDF (“Paste text” or “Photo or PDF” tab in a recipe's import dialog). If you paste a recipe text or choose a photo or PDF, that one text or that one file is sent to Claude (Anthropic), so it can produce a structured suggestion for the name, ingredients, amounts and method. This also runs exclusively on explicit request, via the relevant button, and never automatically. An uploaded photo or PDF is deleted after processing and isn't kept as the recipe's image. The same monthly allowance applies as for the other AI features; once it's used up or the switch is off, only import by link continues to work. Any member of your household who's allowed to edit recipes can trigger this. Here too, the result is only a suggestion, which you review and edit before saving.
  
  Since the School module launched, the same switch also covers the school letter scanner. If you tap “Scan a school letter” in “School → Dates” and photograph one, that one photo is sent to Claude (Anthropic), so it can suggest dates, deadlines, amounts and a packing list from it. A school letter typically contains a child's data (year, school, events, occasionally the child's name) — this data is sent along with the photo. The transmission only happens on explicit request, by tapping the button, and never automatically: not while taking the photo, not in the background, and letters already saved aren't reprocessed. No other patchio details are sent along: no child's name from their profile, no year, no grades, no events, no address or contact data. The original photo stays within your household — it sits in a private storage area that only members of your household can access. If you don't attach it to an event, patchio deletes it when you close the scanner, and automatically after 24 hours at the latest. The result is a suggestion, which you review, edit and apply yourself. Any member allowed to edit school entries for that child can trigger this.
  
  (2) The “Family email address” switch (under “Family”). If it's on, the subject and text content of emails sent to that address are sent to Claude (Anthropic), so an event or task can be recognised from them (subject truncated to 300, text to 20,000 characters). Only emails from the address of a registered household member on file with patchio are processed. Attachments aren't sent to Claude: patchio evaluates vCards (.vcf) and calendar files (.ics) itself without AI; every other attachment isn't processed at all. If a contact or event can be read directly from a .vcf or .ics attachment, that email isn't sent to Claude at all. This path doesn't depend on the “AI categorisation” switch — it has its own consent.
  
  Anthropic PBC is based in the USA; Anthropic's DPA applies, including EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(a) GDPR (consent given by turning it on). Anthropic doesn't use data submitted via the API to train its models. Both switches can be turned off again at any time in the relevant place.
• AppSignal (AppSignal B.V., Rietwaard 4, 's-Hertogenbosch, Netherlands) — technical error and crash detection in the browser (frontend), so we can quickly spot and fix errors in the application. When an error occurs, only technical details are sent: the error message and technical trace (stack trace), browser and device type, the page visited, the time, and the IP address. Not sent: names, email addresses, account or content data; token- or ID-like parts of addresses (e.g. invitation or poll links) are automatically stripped before sending. There's no tracking and no profiling — only errors are reported. AppSignal processes the data exclusively in the EU (Netherlands); no transfer to third countries takes place. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, error-free operation of the application).

We don't share data with any other third parties, unless we're legally obliged to.

Maps and directions links. At places with an address (contacts, homes, emergency information, event locations), patchio offers a directions button. patchio doesn't embed any third-party map — no map service, script or image from a third party is loaded, and no address leaves the application without your involvement. Only once you tap the button does your device open the maps or navigation app, or a maps website, and hand over the relevant address to whichever provider is set up there: on Android, to the navigation app you've chosen; on iPhone, to the Maps app; in the browser, to Google Maps (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). What that provider does with the address is governed solely by its own privacy policy; we have no influence over it and get no feedback from it. If the address contains other people's data (e.g. a contact's address), you're the one sharing it by tapping. The legal basis for offering the feature is Art. 6(1)(f) GDPR (legitimate interest in a usable application); you deliberately trigger the transmission itself by tapping.

Weather for event locations. For the weather tile (dashboard, menu), patchio automatically asks Open-Meteo (OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen (UR), Switzerland) for the current weather and 7-day forecast for your stored weather location (profile override or main home, see section 3) — this happens without any further action from you when you open it. If an event has a location, patchio doesn't automatically show a weather preview there: if patchio recognises an address with a postcode in it (the same detection that decides on the directions button, and which additionally lets a town be extracted), a hint button appears first (“Show weather (sends town)”), which transmits nothing. For plain free text with no recognisable address — like “kitchen” or “gym” — this button doesn't exist at all, and neither does it for an address without a postcode (only street and house number): Open-Meteo's weather service doesn't understand street addresses, only town names — such a vague or incomplete entry would otherwise match some place of the same name somewhere else in the world, and the wrong weather is worse than none at all. Only once you tap the button does patchio work out the town from the entered location and send only that — never the street, house number or postcode — to Open-Meteo, to determine coordinates and the current weather from it. If the location contains other people's data (e.g. a private address), by tapping you're sharing the town recognised in it — not the full address. Open-Meteo processes the request without an account or sign-in; according to its own privacy policy, Open-Meteo doesn't link any IP addresses that arise from this to an identity, and deletes the related server logs after 90 days. There's no data processing agreement in place — patchio contacts the service directly from your browser and has no influence over processing there; what Open-Meteo does with the request is governed solely by its own privacy policy. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a usable weather display); for event locations, you deliberately trigger the transmission by tapping.

6. Cookies and local storage

We don't use tracking or marketing cookies. Only technically necessary data is stored in your browser:

• Supabase's auth session token in local storage (necessary to keep you signed in)
• Theme setting (light/dark/auto) in local storage (convenience)
• Offline cache for the shopping list and the app shell (service worker)
• an offline mirror of your core areas (e. g. calendar, tasks, shopping list, directory) in IndexedDB, so patchio can show the last-loaded state even without a connection; it's deleted when you sign out

This data never leaves your device. A consent requirement under §25 TDDDG (Germany's Telecommunications Digital Services Data Protection Act) only applies to non-essential cookies; we don't use any.

6a. Audience measurement without cookies

On patchio's public information pages (home page, feature pages, guides, comparisons and similar) we measure how many visitors come and which pages are read — without cookies and without storing anything on your device or reading anything from it. We don't measure inside the app or after you sign in.

For this, your browser sends only the page path, the host of the site you came from (e. g. "google.com", not the full address), a campaign tag from the link, if any, and the type of event (page view, or a click on "Sign up" or an app-store button). From the user agent your browser sends with every request anyway, our server derives only coarse classes — device class (phone, tablet, computer), browser and operating system — and stores only these classes, not the user agent itself. In addition we store the page language and the time, rounded to the full hour.

Our statistics store no IP address. We use the IP address and user agent only for a moment, to compute two checksums with a secret key that changes every day: an identifier that groups several requests of the same day, and one we use to limit mass bogus requests. After the day ends, neither can be recomputed or linked to you: the daily key and the counter of the limit are deleted. A person who visits on two days counts as two visitors. There is no link to your account.

Separately, as with any page request, our hosting providers create technical access logs that also contain the IP address and user agent. They are not part of our statistics; what section 5 says about our processors (Supabase, Vercel) applies.

The purpose is to evaluate our reach and the effect of our marketing; the legal basis is Art. 6(1)(f) GDPR. Because nothing is stored on or read from your device, no consent under §25 TDDDG is needed. We delete individual events after 13 months. We use no third-party analytics service; the data sits with our processor Supabase and is not passed on. You can object to the processing under Art. 21 GDPR (see section 8); since we cannot identify you, a single record cannot be looked up, however.

6b. Newsletter

Our newsletter reports news about patchio. It's sent via Resend (see section 5). You receive it in one of two ways:

• Signing up via the form on our website: after you sign up, we send you a confirmation email; you're only added once you click the link in it (double opt-in). As evidence, we store the time of sign-up and confirmation as well as the IP address and browser identifier (user agent) you signed up with. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every issue. The evidence stays with your entry even after you unsubscribe, so that we can prove the consent (Art. 7(1) GDPR) – for three years after you unsubscribe, the regular limitation period. After that, we delete the IP address and browser identifier automatically; your email address only remains marked as “unsubscribed”, so that we don't add you again by mistake. The evidence is deleted earlier if you ask for deletion or delete your patchio account.
• As a household admin: admins receive the newsletter without a separate sign-up, because they already use patchio. The legal basis is our legitimate interest in informing existing users about changes to the service (Art. 6(1)(f) GDPR). You can object at any time – via the unsubscribe link in every issue. Anyone who has unsubscribed once is never added again.

Open and click tracking: for every issue, we use Resend to measure whether and when the email was opened and whether links in it were clicked (links run through the subdomain links.patchio.de for this). This information is linked to your email address; we use it to see which topics resonate and to improve the newsletter. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can object at any time by unsubscribing via the unsubscribe link. We delete the open and click times automatically twelve months after the event – earlier if you delete your patchio account or ask us to.

6c. Cancelling and withdrawing without logging in

If you cancel or withdraw via /kuendigen or /widerruf, we store your declaration with the time we received it: the type of declaration, the reason and requested date if given, your email address or your name with an invoice number, and an encrypted checksum of your IP address (no plain-text IP address; it only protects the form against mass abuse). We use this to match the declaration to your subscription, carry it out with our payment provider Stripe and send you confirmations by email. The legal basis is the performance of the contract and our legal obligation to accept and confirm cancellations and withdrawals (Art. 6(1)(b) and (c) GDPR, §§312k, 356a BGB). We keep the declaration as long as claims can still arise from it, i.e. until the end of the regular limitation period (three years from the end of the year in which it was received); after that we delete it automatically.

7. Retention periods

• Account data: until you delete your account
• Content data (events, lists, contacts etc.): until you delete it, or until your account is deleted
• Technical server logs from our processors: per their standard retention (typically 7–30 days)
• Households without any activity: if no member of a household signs in for twelve months and nothing else happens there, we delete the household and the accounts belonging to it completely (Art. 5(1)(e) GDPR, storage limitation). After eleven months, and again about three weeks before the deadline, we remind the household admins by email; a single sign-in resets the period. Households with a running subscription or trial are exempt, as are households where a member is active elsewhere.
• Invoice and payment data for a paid subscription: retained for the statutory tax and commercial-law periods (generally up to 10 years under §§147 AO, 257 HGB), even beyond an account deletion, to the extent necessary to meet retention obligations.
• Data you created in a shared household or group stays available there, even if you yourself leave the household. Your personal identifiers (name, email) are deleted when your account is deleted.
• Your submissions in the feedback area (bugs, requests, questions) and the replies underneath: when you request deletion, you choose what happens to them — anonymise them (the text stays, but is disconnected from your account) or delete them along with your account. If you don't choose, they're anonymised. Attached screenshots are deleted either way. Roadmap entries stay in place; we write their text ourselves and it doesn't name you.

8. Your rights

You have the following rights against the controller:

• Right to access the data stored about you (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability in a structured, common format (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You can contact the authority for your place of residence; the authority responsible for the controller is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

To exercise your rights, an informal message to datenschutz@patchio.de is enough.

9. Data security

Data is transmitted encrypted via TLS (HTTPS). Database content is secured with row-level security (RLS), so that users can only see data for the households and groups they're a member of. Security-relevant HTTP headers (HSTS, CSP, X-Frame-Options, Permissions-Policy) are enabled.

10. Processing data of children and minors

The application is aimed at people aged 16 and over. People under 16 can't register on their own (cf. Art. 8 GDPR). Children under 16 only get their own login through an invitation from a household admin with parental responsibility, who gives their consent by doing so. For such a child account, we additionally process the child's account data (email address, first name) and whatever the child enters or ticks off in patchio themselves.

Data belonging to children (e. g. name, birthday, emergency card content, events, assignments) is maintained in the application exclusively by their parents or legal guardians with parental responsibility. The legal basis for this is Art. 6(1)(b) GDPR in conjunction with parental responsibility under §§ 1626 et seq. BGB. For health data in the emergency card, Art. 9(2)(a) GDPR additionally applies; the guardians give express consent explicitly when first saving it, and this is logged.

The guardians are responsible for the data entered for their children and can change or delete it at any time. The rights listed in § 8 (access, rectification, erasure and others) apply equally to children and are exercised by their guardians until the children reach legal capacity themselves.

11. Using the patchio app on your smartphone (iOS and Android)

If you use patchio as an app on your smartphone (iPhone or Android device), the following notes apply in addition. Everything else in this policy continues to apply unchanged — it's the same data and the same processors as in the browser.

• Push notifications: if you allow reminders on your device, your device's operating system generates a device token. We store this token so we can send you targeted reminders (e. g. for events, tasks or medication). On iPhone, delivery runs through Apple's Apple Push Notification service (APNs); on Android devices, through Firebase Cloud Messaging (FCM) from Google. The message visible on the lock screen is deliberately kept general and contains no sensitive content (no amounts, no health details, no names) — you only see the details after unlocking the app. You can turn off push notifications at any time in your device's settings or in patchio. The recipient is, on iPhone, Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA; on Android devices, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (and possibly Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA); in both cases, the transfer to the USA is secured via EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(a) GDPR (consent given by turning on notifications).
• Sign in with Apple: you can register and sign in to the app with “Sign in with Apple”. Apple then sends us an identifier for your Apple account and — if you agree — your name and an email address. If you use Apple's “Hide My Email” feature, we only receive an anonymous forwarding address from Apple instead of your real one. The legal basis is Art. 6(1)(b) GDPR (providing you with access).
• Data on your device: so you stay signed in and the app also works offline, patchio stores certain data locally on your smartphone: your sign-in token; the last-loaded state of your core areas (calendar, tasks, shopping list, directory and others) as a local mirror, so you can view them without a connection; entries you've captured offline (until they're synced); and — if you use the module — your loyalty cards, to show at the till. This data sits in your device's app-specific storage, sealed off by the operating system, and only leaves it as part of normal syncing with your account. It's removed when you sign out or delete the app.
• Camera: the app asks for camera access only when you want to scan a loyalty card or a barcode. The processing happens directly on the device; no camera images are sent to us or to third parties.
• No tracking: the app contains no advertising identifier (IDFA), no app tracking across app or website boundaries, and no third-party analytics or advertising SDKs. We don't ask for tracking permission, because no tracking takes place.

Notifications in the browser and on Mac/PC (web push): even without the smartphone app, you can turn on notifications for a computer, a browser or the installed web app under “Notifications” in your profile — always only for the device you do it on, and only after you allow it in your browser. Your browser then creates a push subscription: a delivery address (endpoint) at the push service of the browser maker and two keys. We store the endpoint, the keys, a shortened browser identifier (user agent) and the time of last use until you turn notifications off on that device, sign out, or the push service reports the subscription as expired. The content of every notification is end-to-end encrypted (the “aes128gcm” scheme under RFC 8291) and — as in the app — deliberately kept general (no amounts, no health details, no names); the push service can't read it, but it does see that and when a notification is sent to the subscription. Depending on your browser, the push service is run by Google (Chrome, Edge, Opera and others; Google Ireland Ltd., possibly Google LLC, USA), Apple (Safari and web apps on iPhone, iPad and Mac; Apple Inc., USA), Microsoft (Edge on Windows; Microsoft Ireland Operations Ltd., possibly Microsoft Corporation, USA) or Mozilla (Firefox; Mozilla Corporation, USA). Transfers to the USA are covered by the Standard Contractual Clauses or, where the provider is certified, the adequacy decision for the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(a) GDPR (consent given by turning on notifications); you can withdraw it at any time in your profile or in your browser settings.

12. Referral programme

If you recommend patchio, we store a referral code against your account. If a family registers through your link or code, we store against the new household which code it came from. The legal basis is Art. 6(1)(b) GDPR (running the referral programme); to guard against misuse, we also check whether someone has referred themselves (Art. 6(1)(f) GDPR, legitimate interest in a fair programme).

If you answer the optional question during setup about how you heard about patchio, we store that answer against your household (Art. 6(1)(f) GDPR, legitimate interest in understanding how families find patchio). The question can be skipped.

For the thank-you month we additionally process whether a referred household has paid its first invoice and whether that payment was refunded or charged back within 14 days (data from payment processing, section 7). This creates one record per referral with a status and the time of the credit, read only by our system; the credit itself is created by our payment provider Stripe as a balance on your household's customer account. The legal basis is Art. 6(1)(b) GDPR (performance of the referral terms).

You only ever see numbers: how many families found patchio through you, how many thank-you months have been credited and how many are still in the waiting period — never who they were or when someone paid; likewise, the referred family never sees your name.

Nothing is stored in your browser or on your device for this: the referral code is transferred directly at registration. We don't set any cookies or other markers for it (see section 6). The match is deleted along with the household; you'll find the terms of participation under referral programme.

Partner programme: if you apply to become a patchio partner, we process the data from your application and your billing details (name, address, tax details, IBAN) to run the partner agreement (Art. 6(1)(b) GDPR) and to fulfil tax obligations (Art. 6(1)(c) GDPR, retention under §147 AO). Your partner area only ever shows you aggregated numbers — never who a referred family is.

On partner pages (patchio.de/mit/…), we only count THAT the page was visited — a daily tally, with no IP address, no device characteristics, no cookies. The same applies to a partner's individual channel links (e.g. a separate link per post): each link gets its own daily total, but again with no IP address, device characteristics or cookies — the channel describes which link you clicked, never you as a person.

Campaign links: when a patchio short link (patchio.de/l/…) is opened, we only count how often the link was opened on a given day. All we store is that number — no IP address, no device or browser data, no cookie, and nothing stored in your browser. We only check the browser identifier (user agent) at the moment of the request, to exclude automated calls (such as link previews) from the count; it is neither stored nor logged. If you register after clicking such a link, we note against your new household, once, which link brought you to patchio. We only ever evaluate this as counts per link and channel — including how many of these households move into the trial or a subscription — and we don't link it to what you do in the app. This is only ever visible to us as the operator; no household member sees it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding which channels reach families). This information is not shared with third parties and is deleted along with the household.

13. Kiosk screen

With the optional Kiosk module, you can mount a tablet or monitor on the wall as a family screen. The screen doesn't sign in as a person: it shows a six-digit code, which a household admin enters in patchio, and then receives a device token once — a random string that sits in the device's storage and is stored with us only as a one-way check value (SHA-256). We also store, against the device, the name you gave it, its browser identifier, its reported screen format, and the pairing and last-seen times. The device token remains valid indefinitely, until you disconnect the device, or until the device hasn't been seen for 90 days — patchio then disconnects it automatically. That's exactly why there's also the disconnect button. The legal basis is Art. 6(1)(b) GDPR (providing the feature you've set up).

When pairing and defending against misuse, we briefly process the requesting device's IP address: kept against the open pairing process for at most one hour, and as a counter in the request throttle for at most one day — after that, both are deleted automatically. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing anyone from pairing someone else's screens, or overloading our servers).

The screen only ever sees data for the one household it's paired to, and only what's needed for display: events, tasks, meal plan, shopping list, school, the parenting schedule, birthdays, points, and the kiosk photos you've uploaded. Not accessed: finances, contracts, health and cycle data, documents, vehicles, loyalty cards, notes on events, phone numbers and addresses. Events marked private don't appear at all or — at the entering person's express request — appear only as “Busy” with no title or location. A guest mode additionally hides tasks, points, school, the parenting schedule and birthdays, and shortens event titles; it works server-side, so the data never even reaches the device.

Kiosk photos sit in a private storage area with no public address; only members of your household and the paired screens (via their device token) can retrieve them. There are at most 30 photos per household. A deleted photo is also removed from storage.

You can disconnect a device at any time under Manage → Kiosk → Devices; its token is invalidated immediately. Devices, layouts and kiosk photos are deleted along with the household and are included in a data access request (Art. 15 GDPR) — the device token itself isn't included, since it only serves as an access credential.

We're upfront about one residual risk: anyone who gains physical access to the device can read the token stored on it and use it to retrieve your household's display data — for as long as the device stays paired. So disconnect a tablet or monitor in patchio as soon as it leaves your household (sale, hand-over, loss).

14. Team mailboxes

If you write to us at one of our addresses (hallo@, partner@, kontakt@, support@ or datenschutz@patchio.de), we process your message in order to answer it. We store the sender and recipient address, subject, content, attachments, and the email's technical headers. The legal basis is Art. 6(1)(b) GDPR when it concerns a contract with you (e.g. support for your account), and otherwise Art. 6(1)(f) GDPR — our legitimate interest in reading and answering business correspondence.

Emails are received and sent through our delivery provider Resend (Plus Five Five, Inc., USA); they're kept there for at most 30 days. We have a data processing agreement with Resend, including EU Standard Contractual Clauses; even with a European delivery route, the data is also stored in the USA. Permanent storage is in our database with Supabase in the EU (Ireland); attachments sit there in a private storage area with no public address. Only people with a platform role have access; every access to an attachment is logged.

For draft replies, we use AI from Anthropic (Claude). The relevant email thread and our notes are sent for this; Anthropic doesn't use this content to train its models. Drafts are always only suggestions — sending is always done by a human; there are no automatic replies.

Because of commercial- and tax-law retention obligations, we keep business emails for six years; deleted messages therefore go into a trash folder and aren't immediately removed for good (Art. 17(3)(b) GDPR). Only drafts that were never sent are permanently deleted from the trash after 30 days. Our server logs don't contain any email content; for messages to addresses we don't have, we only note the sender's domain.

15. Access keys and interface

Your household can enable an interface (API) — an admin turns it on in Management; it's off by default. Once it's on, you can create your own access keys under Profile → Account & security, letting external tools (e.g. Home Assistant) access selected areas of patchio on your behalf – shopping list, tasks, calendar – each with exactly the permissions you choose when you create the key. The legal basis is Art. 6(1)(a) GDPR (your consent through creating the key) and Art. 6(1)(f) GDPR for operating the interface as such.

We only store a cryptographic hash of the key, never the key itself – the plain-text key is shown to you once, when you create it, and we can't see it afterwards either. For every call made with an access key we keep a usage log (endpoint, time, status – no content), which is deleted automatically after 30 days; it powers the "last used" display and abuse detection. If a sign-in with an access key fails, we additionally store the IP address and a truncated, hashed key prefix for one day to prevent abuse.

If a text command is additionally enabled for the interface, the text you send plus your household's category names are sent to our AI provider Anthropic (see section 5) to recognise a task, an event, or a shopping-list entry from it – nothing more. No names, IDs, or other list content are transmitted.

You can revoke any of your access keys at any time under Profile → Account & security; revocation takes effect immediately. An admin can also turn off the whole interface for the household, which automatically revokes every access key in that household.

If you connect an external application by signing in instead of using an access key – for example an AI assistant via MCP – it creates an OAuth connection with the same properties: before the connection is made, you see the application's name, the household, and the permissions you're agreeing to. Data retrieved through an OAuth connection – for example your shopping list, tasks, or calendar, depending on the permissions granted – leaves patchio and is then subject to the privacy policy of the connected application's provider (for claude.ai: Anthropic). An OAuth connection expires automatically after twelve months at the latest and can be revoked at any time under Profile → Account & security → Connected apps – with the same immediate effect as revoking an access key.

16. Videos (YouTube)

Some guides and the “Learn” page contain videos hosted on YouTube. When you open a page, nothing is loaded from YouTube: you only see a preview image from our own server. Only when you click “Play” do we embed the player from youtube-nocookie.com (YouTube's privacy-enhanced mode). From that moment your device connects to Google's servers, and data such as your IP address, device and browser details and the page you are viewing may be sent to Google. We have no influence on how Google processes it further.

The recipient is Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; where applicable Google LLC, USA). The legal basis is your consent given by clicking “Play” (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Without that click, nothing is transmitted; you can use the guides in full without the video. Your consent applies to that one video only and is not stored. If you reload the page, we ask again. The native apps don't embed a player; there, the “Open on YouTube” button opens the video in YouTube or the browser.

“Watched” marker: If you are signed in and start a tutorial video, we store with your account which video you started (the video's ID and the time of the first start). Only you can see this, not the other members of your household, and we use it for nothing other than showing “Watched” on the videos and your progress on the “Learn” page. You can delete all markers yourself at any time with the “Reset watched markers” button; they are also deleted together with your account. Nothing additional is sent to YouTube or Google. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

How Google processes data is described in Google's privacy policy.

17. Changes to this policy

We reserve the right to update this privacy policy when technical conditions or the legal situation change. The version available at the time of use always applies.