Back to homeDeutsch

Privacy policy

This is a convenience translation. Only the German version is legally binding.

1. Controller

Abubakar Abditube

Email: info@manawg.com

2. Data protection officer

ManaWG is run privately by Abubakar Abditube. No data protection officer has been appointed.

3. Who we are

ManaWG is an app for shared flats (WGs, or Wohngemeinschaften). We do not sell personal data and we do not show ads. For product analytics we send only the details described in section 4f to PostHog Cloud EU. The accounts you create to sign in and to be a member of your flat are separate from this; section 4a has more on them. The app’s source code is published as open source under the Apache License 2.0.

4. Processing activities

4a. Account, authentication and local data

  • Purpose: So that contributions can be assigned to your flat membership.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use)
  • Sign-in and local data: You can sign in with Google, or with an email address and either a password or a one-time code sent by email. With Google sign-in we receive your email address and name from Google. With email sign-in, Supabase sends confirmation emails, sign-in codes and password-reset emails to your address. Resend delivers them; the sender appears as noreply@manawg.com. Supabase Auth manages sign-in, and the session is stored in cookies. In addition, flat assignments and name drafts may be held in the browser’s local storage.
  • Retention: We keep account data until you delete your account under Settings → Access → Delete account. Local flat assignments and name drafts stay in the browser until you clear its storage manually.
  • Recipients and processors: Supabase for sign-in and database hosting; Resend for sending email (see section 5).
  • Storage location and transfers to third countries: Supabase stores data in Frankfurt am Main (EU). This region setting does not rule out further transfers. Resend, Inc. (USA) receives your email address and the message content when an email is sent. The transfer relies on EU standard contractual clauses or the EU-US Data Privacy Framework.

4b. Flat data (flat name, memberships, expenses, fixed costs, cleaning rota, shopping list, supplies, calendar, noticeboard, chat)

  • Purpose: So that the organisation features of your flat are available.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use)
  • Retention: Shared flat data is kept for as long as the flat exists. When a member leaves the flat, this data is not deleted for that reason. If the flat is deleted permanently, we remove the related data from the active database. If you delete your account while others stay in the flat, your display name remains on the expenses and contributions you recorded, so that the remaining members can keep settling up correctly (Art. 6(1)(f) GDPR). The link between these entries and your account is removed.
  • Recipients and processors: Supabase for database hosting.
  • Storage location and transfers to third countries: Supabase stores data in Frankfurt am Main (EU). This region setting does not rule out further transfers.

4c. Technical logs and error diagnostics

  • Purpose: For secure, stable operation, troubleshooting and protection against misuse.
  • Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in secure and stable operation).
  • Retention: Vercel logs are kept for 30 days at most. If Sentry is enabled for the deployment in question, the deletion period for error events depends on the applicable Sentry plan. Sentry lists the retention periods for each plan.
  • Recipients: Vercel Inc. (USA) provides the hosting and processes server logs. If Sentry is enabled for an app deployment, Sentry (Functional Software, Inc.) receives technical error data, such as error types, stack traces (the sequence of code leading up to an error) and approved diagnostic identifiers. For ManaWG, the EU is set as the Sentry storage region; this does not rule out further transfers. Before anything is sent, variable error messages, user details, context data that has not been approved, and request headers and bodies are removed. Request paths are cleaned; values from URL queries and fragments, flat codes, calendar access tokens and signed file URLs are made unrecognisable. The Sentry integration adds neither user details nor automatically detected IP addresses to error events. It does not send automatically collected session data or performance traces.
  • Transfer to third countries: Vercel logs may be routed through servers in the USA. EU standard contractual clauses are in place.

4d. Photo uploads

  • Purpose: So that photos you upload in the flat app (for example for the noticeboard or as a receipt) can be stored and displayed.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use).
  • Retention: Photos in shared flat content stay available to active members for as long as that content refers to them. When a member leaves the flat, the shared photos are therefore not removed. When the last reference to a photo is removed or the flat is deleted, we block access straight away. A later maintenance run triggers the physical deletion. We cannot promise a maximum period for final deletion or for provider backups.
  • Recipients and processors: Supabase stores the photos in non-public file storage (see section 5). Only members of the flat can retrieve them.
  • Storage location and transfers to third countries: The photos are held in the Frankfurt am Main (EU) region. This region setting does not rule out further transfers.

If you start text recognition of a screenshot in the import (OCR), the app loads Tesseract worker and core files as well as German and English language models from jsDelivr when needed. Recognition runs in your browser. The screenshot and the recognised text are not sent to jsDelivr. According to the jsDelivr privacy policy, jsDelivr and its CDN providers may receive technical data when the files are retrieved, such as IP address, browser type and version, referring domain, requested file URL, time of retrieval, device identifiers and other diagnostic data. If you then open the preview or confirm the import, ManaWG sends the recognised data to its own import API.

4e. Rate limiting (protection against misuse)

  • Purpose: To protect against automated requests, password guessing (brute force) and other misuse. For this we keep counters per IP address or membership ID.
  • Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting the infrastructure).
  • Time windows: The counters run in sliding time windows of one minute or one hour.
  • Retention: In production, the additional Upstash analytics are switched off. The additional analytics metadata stored up to 30 September 2026 was deleted on that day; before then it had no automatic expiry. Rate-limit counters expire 2 hours and 1 second after they are created at the latest.
  • Recipients and processors: Vercel KV / Upstash, Inc. (USA). For IP-based limits, the service receives the detected IP address in full, neither truncated nor hashed, as a key. For other limits we use membership IDs.

4f. Product analytics without analytics cookies (PostHog)

  • Purpose: To develop ManaWG further, we record page views and count how often a flat is created or someone joins a flat.
  • Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in developing ManaWG further).
  • Retention: On the free PostHog plan currently in use, analytics events are kept for one year. You can send deletion requests to info@manawg.com.
  • Recipients and processors: PostHog Inc. processes the data via PostHog Cloud EU in Frankfurt (eu.i.posthog.com). ManaWG sends only page views and the events wg_created and wg_joined. Other events, and extra details passed on by app features, are removed before sending. Also sent are an event identifier (UUID), the time, the project identifier, a technical assignment identifier, the hostname and the browser identifier. The IP address reaches PostHog with the request.
  • Processing region and transfers to third countries: PostHog Cloud EU in Frankfurt. This region setting does not rule out further transfers.

Product analytics runs without analytics cookies and stores nothing in the browser’s local storage for this purpose. ManaWG does not build analytics profiles; automatic click capture, session recordings and surveys are not enabled. Names, email addresses, flat names, flat codes, messages, shopping data and financial data are not sent. For its analysis, PostHog may form an identifier that changes daily from the IP address, browser identifier and domain. Browser protection features or content blockers can prevent the analytics; ManaWG keeps working in that case.

4g. Push notifications

  • Purpose: So that you receive alerts about new flat events such as expenses, tasks or messages if you switch on notifications.
  • Legal basis: Art. 6(1)(a) GDPR (your consent, given through the browser’s prompt). You can withdraw it at any time in the app settings or in the browser.
  • Data processed: The push address generated by the browser, its keys and the text of the notification.
  • Retention: Until you switch off notifications, leave the flat or delete your account.
  • Recipients: The push service of the browser or operating system vendor (for example Google, Apple or Mozilla) delivers the message to your device.
  • Transfer to third countries: Possible, because these push services may use servers in the USA.

5. Recipients and processors

The following services receive data for the purposes stated in each case:

  • Supabase: manages sign-ins and hosts the Postgres database and the file storage for photos in Frankfurt am Main (EU).
  • Resend, Inc. (USA): in production, sends the confirmation, sign-in code and password-reset emails triggered by Supabase Auth and the app’s own emails (invitations, payment reminders, the monthly statement). The sender is noreply@manawg.com (see section 4a). The transfer relies on EU standard contractual clauses or the EU-US Data Privacy Framework.
  • Vercel Inc. (USA): hosts the web app and runs the edge network; server logs are generated in the process. A data processing agreement and EU standard contractual clauses are in place.
  • Vercel KV / Upstash, Inc. (USA): runs the Redis-based counters for protection against misuse (per IP address or identifier, see section 4e).
  • PostHog Inc.: processes product analytics via PostHog Cloud EU in Frankfurt am Main (see section 4f).
  • Sentry (Functional Software, Inc.): investigates technical errors if Sentry is enabled for the app deployment in question (see section 4c). See Sentry’s privacy notices and the official Data Processing Addendum. The Data Processing Addendum (a data processing agreement) was concluded on 30 September 2026.
  • jsDelivr and CDN providers: deliver Tesseract worker, core and language files when you explicitly start local OCR (see section 4d).

6. No advertising and no advertising profiles

ManaWG contains no advertising, no Google Analytics and no social media trackers. We do not use data for advertising and we do not track you across different websites. The product analytics without analytics cookies described in section 4f serves to develop ManaWG further; no analytics profiles are created for it. The accounts for sign-in and flat membership are separate from this; they are described in section 4a.

7. Cookies and local browser storage

ManaWG uses cookies for sign-in with Supabase. If you choose a language in the app, a cookie named manawg_locale stores that choice for one year; with “System”, it is removed. In addition, flat assignments and name drafts may be held in the browser’s local storage (Local Storage). If you clear the browser storage, this local data is removed as well.

8. Your rights (data subject rights)

You can assert the following rights against us:

  • Art. 15 GDPR: access to the data we hold about you
  • Art. 16 GDPR: rectification of inaccurate data
  • Art. 17 GDPR: erasure. You can delete your account at any time. Choose Settings → Access → Delete account. This removes your sign-in details and you leave all flats. Data of a flat in which you are the only member is removed from the active database; for the related photos see section 4d. If other members stay in a flat, your display name remains on your earlier contributions (see section 4b). The person who created a flat can remove it irrevocably under Settings → Access → Delete flat permanently. All members, expenses, lists, tasks and noticeboard posts of the flat are then removed from the active database. Access to the related images is blocked straight away; the physical deletion follows later (see section 4d). You can request more extensive deletion by emailing info@manawg.com.
  • Art. 18 GDPR: restriction of processing
  • Art. 20 GDPR: data portability
  • Art. 21 GDPR: objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, for example for logs or rate limiting
  • Art. 77 GDPR: complaint to the competent supervisory authority:
    Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), the Hessian Commissioner for Data Protection and Freedom of Information
    Gustav-Stresemann-Ring 1, 65189 Wiesbaden
    https://datenschutz.hessen.de

Requests to: info@manawg.com

We will answer your request without undue delay and at the latest within one month. For complex requests or a large number of requests, we may extend this period by up to two further months. We will tell you about the extension and the reasons for it within the first month (Art. 12(3) GDPR). This response period is not a promise that all data will be physically deleted within one month; for photos in particular, the description in section 4d applies. Statutory deletion obligations remain unaffected.

Where we process data on the basis of your consent, you can withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR). For push notifications, see section 4g.

9. No automated decision-making / profiling

We do not make automated decisions within the meaning of Art. 22 GDPR and we do not carry out profiling. We use your data for the purposes described in this policy.

10. Obligation to provide data

You are neither legally nor contractually obliged to provide personal data (Art. 13(2)(e) GDPR). However, without signing in (with Google, or with an email address and a password or email code), and without a display name, you cannot use the app.

11. Updates to this policy

If our data processing changes, we may update this privacy policy. We will tell you about material changes by email or in the app.