Privacy notice

1. Controller

The controller for the processing described in this notice is the person named below. No data protection officer has been appointed.

Service provider

Michael Reimer

Address

Am Langenbach 10
48308 Senden
Deutschland

Email

support@vlogy.app

2. Website visits

Our website is delivered through Vercel. When a page is requested, technical information such as IP address, time of request, requested resource, referrer, user agent and response status can be processed to deliver the site, protect it from abuse and investigate faults. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR).

This website does not use advertising pixels, marketing cookies, analytics scripts or a public contact form.

When you choose a language, we store your preference for one year in a first-party cookie named “__Host-vlogy_locale”. This cookie is necessary to display the site in your chosen language and is not used for tracking.

3. Vlogy account, group and content data

To provide Vlogy, we process account and profile data (such as email address, display name, profile image and internal account identifier), private-group data (such as group name, membership, invitations and rotation settings), and user content (such as recorded or imported video including audio, clip titles, duration and processing metadata). We also process limited technical and security data, including session records, IP address, user agent and app version. This is necessary to provide and secure Vlogy (Art. 6(1)(b) and (f) GDPR).

Private videos can contain personal data about other people. Only upload or share content when you have the necessary rights and permissions to do so.

4. Notifications and support

If you allow device notifications, the app may process an Expo push token, platform, locale and delivery status to send relevant group or turn notifications. We do not use notification data for advertising.

When you contact support, we process the contact details, message and attachments you provide in order to handle your request (Art. 6(1)(b) or (f) GDPR).

Emailsupport@vlogy.app

5. Recipients and international transfers

• Vercel: delivery and protection of this public website, including technical request data.
• DigitalOcean: API, database and backend hosting in New York, USA; account, group and service data.
• Mux: video and audio uploads, transcoding, storage and authorized playback; processing in the USA and international delivery infrastructure.
• Cloudflare: DNS, API transport and security, including IP addresses; encrypted database backups in US R2 storage.
• Resend: transactional email, recipient addresses and delivery data. mailbox.org: support correspondence and attachments, hosted in Germany.
• Expo (650 Industries), Apple APNs and Google FCM: push tokens and notification delivery. Firebase is used for Android push, not Firebase Analytics.
• Apple and Google: optional sign-in, app verification and store purchases; identifiers, verification signals and transaction data. They also process data under their own privacy notices.
• Grafana Cloud: infrastructure metrics and technical logs in an EU region; not an advertising or app-behaviour analytics service.
• Sentry (Functional Software, Inc., USA): limited technical app-error reports, stored in the EU region in Germany.

Vlogy is not hosted exclusively in the EU. US hosting and international provider access also concern users in the EEA. The linked provider terms describe processing roles, subprocessors and safeguards. DigitalOcean, Mux, Cloudflare, Resend and Expo include EU standard contractual clauses for relevant transfers. An adequacy decision, including the EU–US Data Privacy Framework, applies only where it covers the actual recipient and processing. You can request information and copies of the applicable safeguards from support; confidential details may be redacted. EU storage alone does not exclude access from other countries.

• Vercel
• DigitalOcean
• Mux
• Cloudflare
• Resend
• mailbox.org
• Expo
• Apple
• Google
• Grafana Cloud
• Sentry

Emailsupport@vlogy.app

6. Retention

Account and group content remain while needed to provide the service, until you delete them or an applicable group retention rule takes effect. A Premium archive feature is not a promise to delete all backend copies on that date. Inactivity alone does not currently trigger automatic group deletion. Account and content deletion requests are handled separately; see the deletion instructions below.

Authentication codes expire, but expiry does not itself erase every security record. Technical logs, support correspondence and safety reports are kept while needed to resolve the incident or request, investigate abuse, or preserve relevant evidence. We review continued necessity; unresolved cases may need longer retention than closed ones. These categories currently have no uniform automatic deletion deadline; retention is determined by the purposes and legal duties described here. The separate abuse-prevention limits below still apply.

Purchase records and minimal account links may remain after account deletion for subscription verification, refunds, disputes and statutory accounting or tax duties (Art. 6(1)(b), (c) or (f) GDPR). The applicable legal duty and unresolved claims determine the duration; unnecessary profile and media data are not retained for those purposes. Encrypted R2 backup objects have a 45-day lifecycle and a 30-day immutability period. Backups are restricted to recovery; deletion records must be reapplied after restoration. Provider recovery copies may have their own rotation periods.

7. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent with future effect. You may also lodge a complaint with a competent data-protection supervisory authority.

Emailsupport@vlogy.app

8. Updates

We will update this notice when Vlogy’s data processing changes. The current version is published on this page.

9. Age eligibility and minors

Vlogy is available only to people aged 16 or older. We use a self-declared date of birth only transiently to calculate eligibility and do not retain the date itself. For an eligible account, we retain only the coarse age band 16–17 or 18+, the assurance method, the applicable policy, terms, privacy and safety-standards versions, and their acknowledgement timestamps. An unsuccessful under-age check does not create an account or retain the submitted date.

10. Account deletion

You can permanently delete your account in the app or request deletion without access to the app. The dedicated page explains the affected data, group ownership, timing, limited retention and subscriptions.

Read the account-deletion details

11. App security and abuse prevention

To protect Vlogy against automated registrations, manipulated apps and excessive uploads, we use Apple App Attest and Google Play Integrity, installation identifiers, account activity and usage counters. Network addresses, email addresses and installation identifiers are stored as keyed digests in the abuse counters; these are pseudonymous, not anonymous. Apple and Google process technical app and device signals for their checks. We do not use these checks for advertising. The legal basis is our legitimate interest in a secure, reliable service (Art. 6(1)(f) GDPR).

Usage counters are normally retained for up to 31 days, security events for 30 days and inactive app verification keys for 90 days. Account trust data is removed on account deletion; bounded pseudonymous counters can remain until expiry to prevent immediate quota resets. Checks may temporarily limit new groups or uploads, but do not prevent account deletion. Contact support@vlogy.app if a restriction appears incorrect or you wish to object.

12. Sign-in, purchases, diagnostics and access

Email sign-in uses a one-time code, not a Vlogy password. With Apple or Google sign-in we receive the provider identifier, email address (possibly an Apple relay address) and available profile information; the provider does not give us your password. We use these data to authenticate and secure your account (Art. 6(1)(b) and (f) GDPR). Without required account data we cannot create or authenticate an account.

For Premium we process the store, product, transaction identifiers or purchase tokens, status, purchase and renewal dates, expiry, refunds and the associated account and group. This verifies and restores access, prevents duplicate assignments and handles support (Art. 6(1)(b) and (f) GDPR); statutory records rely on Art. 6(1)(c). Apple or Google handles payment details; Vlogy does not receive full card numbers.

A bug report can include your message, account, platform, OS and app version, language, screen and error identifiers and a request correlation identifier. These help support investigate your report (Art. 6(1)(b) or (f) GDPR). Product analytics remain disabled. Automatic technical error reports are described separately below. Necessary infrastructure monitoring and reports you submit are separate. Do not send passwords, sign-in codes or unnecessary sensitive media.

Camera, microphone, photos and notifications use device permissions; you can change these in device settings. Refusing a permission affects the corresponding feature, not unrelated features. Private media access requires active group membership. Authorized personnel and technical providers may process data for delivery, support and security; Vlogy is not end-to-end encrypted. Security restrictions can be reviewed by support. Acknowledging this notice is not consent to unrelated marketing or optional processing.

13. Technical error and crash reports

In app versions with crash reporting enabled, technical failures are reported automatically, including failures before sign-in or during onboarding. Reports contain a filtered error category, code stack, app version and build, operating system, device model, event time and fixed technical progress markers. They do not intentionally contain account or installation identifiers, email addresses, video, audio, purchase receipts, access tokens or arbitrary message text. IP addresses are necessary for network transport but are not stored in our error reports. We do not use session replay, screenshots, advertising tracking or performance profiling for this purpose.

We use this restricted diagnostic processing to identify and fix failures that prevent use of Vlogy and to maintain a reliable, secure service, based on our legitimate interests (Art. 6(1)(f) GDPR). It is not product-behaviour analytics. You can object on grounds relating to your particular situation through the contact details in this notice. Reports are not matched back to accounts or combined with other data to identify users. Sentry processes them under a data processing agreement; EU storage does not exclude access from the USA or other countries. The agreement includes standard contractual clauses for relevant transfers.

The device keeps a bounded queue of up to 20 reports for delivery after a connection or restart; queued reports are removed after delivery or eviction. Error events are retained for 30 days on the free plan and up to 90 days for events received during a trial or on an applicable paid plan. The plan at receipt determines retention; a later downgrade does not shorten older events automatically. We do not extend this through external report archives. Provider recovery copies are subject to its deletion procedures.