DE Open the app

Privacy Policy

This is a translation. In case of doubt, the German version applies.

schnaq GmbH

c/o TechHub.K67
Kasernenstr. 67
40213 Düsseldorf
Germany

+49 156 78354553
info@schnaq.com

Commercial register: HRB 95753
Registry court: Amtsgericht Düsseldorf (Local Court of Düsseldorf)

VAT ID: DE349912851

Represented by the managing directors:
Dr. Alexander Schneider, Dr. Christian Meter and Michael Birkhoff

The German version of this page is legally binding.

Scope

This privacy policy applies to this website (schnaq.app), where you can also join schnaqs with an access code, and to the web application schnaq App (app.schnaq.com). Last updated: 8 October 2026.

If an organisation uses the schnaq App to create its own schnaqs, for example a company for a workshop, that organisation is the controller for the content and the participants’ data. In that case, we process this data on its behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR (General Data Protection Regulation). In this case, it is best to contact the organisation directly with any concerns regarding your data. We forward any requests we receive.

General information on data processing

We process personal data only to the extent necessary to provide the website, the schnaq App and our services. The legal bases are in particular Art. 6(1)(b) GDPR (contract and use of the App), Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation) and, where we ask for permission, Art. 6(1)(a) GDPR (consent).

We erase personal data as soon as the purpose of storage no longer applies and no statutory retention obligation prevents erasure.

We do not use your contributions and content for our own purposes. In particular, we do not analyse them and do not use them to train AI models.

Provision of the website and the App

When you access the website and the App, our systems and those of our service providers process technically necessary connection data: IP address, date and time, the address requested, browser and operating system, and the previously visited page. Without this data, the pages cannot be delivered or protected against attacks. The legal basis is Art. 6(1)(f) GDPR.

The user interface of the website and the App is delivered by Vercel. We operate the App’s API, the database and the stored files with Scaleway in Amsterdam (Netherlands). We store our servers’ logs with Scaleway in Paris (France) and delete them after 7 days. The database is backed up automatically every 6 hours. The backups are deleted after 7 days.

Cookies and browser storage

The schnaq App itself does not set any cookies for advertising or analytics purposes. The following storage on your device is strictly necessary for the service to function (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act):

You can delete this data at any time via your browser settings. The App may then only work to a limited extent.

Audience measurement with Vercel Web Analytics

To understand how the App is used, we use Vercel Web Analytics. This method works without cookies and does not store anything on your device. It records pages viewed and actions, such as “schnaq created”, each with the time, page address, previous page, approximate location (country and region), device type, browser and operating system. To distinguish visits, Vercel generates a hash from the request and discards it after 24 hours. We only see aggregated statistics that do not allow any conclusions to be drawn about individual persons. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is improving the App.

Error monitoring with Sentry

If an error occurs in the App, we receive an error report via Sentry. It contains the technical error description, the affected address, browser and operating system, and a pseudonymous identifier (user ID or device ID), but no names or email addresses. Sentry stores the reports in Frankfurt am Main. They are deleted automatically after the retention period configured there. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is stable and secure operation.

Using the App without an account

You can take part in schnaqs without an account. In that case, in addition to the technical data, we only store your contributions, votes and a freely chosen display name. We do not link your contributions to any identity. Anyone who chooses the same name appears to others as the same person.

Because we cannot attribute anonymous contributions to a person, we can only process requests concerning them if you clearly identify the contribution. The moderators of a schnaq can delete contributions at any time.

Using the App with an account

When you register, we store your email address, your username and your first and last name. You can optionally upload a profile picture. We use this data to display your contributions under your name, to manage your schnaqs and roles, and to send you notifications. The legal basis is Art. 6(1)(b) GDPR.

Login is handled by our own login service at auth.schnaq.com. It is hosted with Scaleway and protected against attacks by Cloudflare. If you would like to delete your account, please write to us at info@schnaq.com.

Content in schnaqs

We store contributions, questions, responses to polls and feedback forms, as well as uploaded images and files, so that the schnaq works. They can be seen by anyone who knows the link to the schnaq and, for protected schnaqs, additionally the access code. Uploaded files are stored with Scaleway and can be retrieved via their address. Please do not upload confidential files if the link is shared.

Your contributions must be your own and must not infringe the rights of third parties. Please do not enter special categories of data, such as health data, in contributions.

Emails and contact

We send the App’s system emails, such as invitations to moderate, via Scaleway Transactional Email. If you send us an email, we store your details in our mailbox with IONOS until your request has been dealt with and no retention obligation applies any longer. The legal basis is Art. 6(1)(b) or (f) GDPR.

If you report a contribution in the App, we email its text and a link to it to us and to the person who created the schnaq so that the report can be reviewed. The email does not say who reported it. Via the App’s feedback function, you can send us your name, email address, a message and, optionally, a screenshot of the page. We use this information only to process your feedback.

Service providers and transfers to third countries

We use the following service providers. We have concluded data processing agreements pursuant to Art. 28 GDPR with all of them.

Vercel, Sentry and Cloudflare are based in the USA. A transfer of data to the USA cannot be ruled out. All three are certified under the EU-U.S. Data Privacy Framework. The European Commission’s adequacy decision pursuant to Art. 45 GDPR therefore applies to them. In addition, we have agreed the European Commission’s Standard Contractual Clauses with them (Art. 46(2)(c) GDPR).

Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the rights described below vis-à-vis us. Please address your request, preferably by email, to the controller named above.

Access: You have the right to obtain from us at any time, free of charge, information about and confirmation of the personal data stored about you, as well as a copy of this information.

Rectification: You have the right to rectification and/or completion if the personal data processed concerning you is inaccurate or incomplete.

Restriction of processing: You have the right to request restriction of processing where one of the following applies:

Erasure: You have the right to have the personal data concerning you erased without undue delay where one of the following grounds applies and insofar as the processing is not necessary:

Data portability: You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. In exercising this right, you also have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible. This must not adversely affect the rights and freedoms of others.

Objection: You have the right to object at any time to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Withdrawal of consent: You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, if you consider that the processing of personal data concerning you infringes the GDPR. The data protection supervisory authority competent for us is:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, Tel.: +49211/38424-0, Email: poststelle{at}ldi.nrw.de