Privacy policy

This is an English translation for your convenience. Only the German version is legally binding.

In short: We only process your data to provide ohanly for your family. No ads, no tracking, no analytics tools, no selling of data. Child profiles don’t need an email address. You can export and delete everything.

1. Controller

The controller for processing personal data on this website and in ohanly Cloud is:

Armin Töpper
Bamberger Str. 20
10779 Berlin, Germany
Email: [email protected]

You can reach us at this address for any data protection question and to exercise your rights.

2. This website

When you visit this page, our web server processes technically necessary information: IP address, date and time, the address requested, the amount of data transferred, browser and operating system, and the previously visited page. This is needed to deliver the page and detect attacks (Art. 6(1)(f) GDPR). We delete the access logs after 14 days.

This page sets no cookies and embeds no third-party content. We serve fonts and images ourselves.

3. Account and family in ohanly Cloud

So that you can use ohanly, we process the data you and your family members enter (Art. 6(1)(b) GDPR – performance of the user agreement):

Account: email address, display name, password (only as an Argon2 hash), optionally passkeys (only the public key) and data for two-factor sign-in, and the language you chose.
Family: family name, members with display name, colour, role and optionally a profile picture.
Content: events, tasks, points and rewards, timetables (subject, time, room, optionally teacher), recipes, meal plans and shopping lists.
Family displays: device name and the unlock PIN (only as a hash).
Log: for important administrative actions – such as invitations, role changes, connected calendars or points corrections – we store who did what and when, so changes in the family stay traceable.

Only a family’s members see its content, each within their role. Each family’s data is kept separate in the database. We don’t analyse your content, don’t use it for advertising and don’t pass it on except as described below. There is no automated decision-making and no profiling.

4. Child profiles

Child profiles are created by adults in the family. They need no email address and no password; we don’t ask for date of birth, school or class. The adults who enter information about children are responsible for it. If a child’s own login is linked later, section 3 applies to that account.

Session cookie: after you sign in we set the cookie __Host-fh_session. It keeps you signed in, is strictly necessary for using the service (§ 25(2) no. 2 TDDDG) and lasts at most 30 days. It becomes invalid when you sign out.
Local storage: settings such as light or dark mode and the language are stored by the app only in your browser.
Abuse protection: to limit sign-in and invitation attempts we briefly process the IP address (Art. 6(1)(f) GDPR). Our server logs contain no content, passwords, cookies or tokens.

We use no other cookies, tracking or analytics tools.

6. Emails

We only send emails needed to use the service: confirming your email address when you sign up, invitations to a family and links to reset your password. If someone invites you, we got your email address from that person; the invitation expires and can be revoked. The legal basis is Art. 6(1)(b) or (f) GDPR (the family’s legitimate interest in inviting members). We send the emails via our own servers. We don’t send newsletters or advertising emails.

7. Calendar connections (optional)

If you connect an external calendar, our servers exchange events with that provider – read only or, if you set it up that way, both ways. We store credentials and tokens encrypted and only use them on the server. You can disconnect at any time. The legal basis is Art. 6(1)(b) GDPR.

Google Calendar: see the details right below.
iCloud, Nextcloud and other CalDAV servers: sign-in with the credentials you enter (for iCloud an app-specific password). The data flows to the provider you connect.
iCal addresses: our server fetches the address you enter.

Google Calendar

Connecting Google Calendar is optional. You sign in with Google via OAuth (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where you see which permissions ohanly receives. The connection runs only through our servers; the app itself never talks to Google.

Permissions: always just two read permissions – read the list of your calendars (calendar.calendarlist.readonly) and read events (calendar.events.readonly). We only ask for write access (calendar.events.owned, limited to calendars you own) once you set a calendar to “Both ways”.
Data we access from Google: the email address of your Google account (to show which account is connected); name, colour and access level of your calendars; from the calendars you select, the events from 90 days in the past to about 18 months ahead with title, start and end, all-day flag, time zone, location, description, recurrence including exceptions, and Google’s event ID and version tag. We do not take over attendees, attachments, video-conference links or reminders from Google.
Data we send to Google: only for calendars you set to “Both ways”: events you create, change or delete in that calendar in ohanly – with title, time, location, description and recurrence. We don’t transfer family members, colours or any other ohanly data.
How we use the data: solely to show your Google events in ohanly (calendar, dashboard, family displays and – if switched on – reminders) and to run the sync you chose. For this, our server checks Google for changes about every 5 minutes.
Who sees the data: the members of your family in ohanly see the events of a connected calendar, each within their role – nobody outside your family.
Storage and protection: we store Google’s access key (refresh token) encrypted with AES-256-GCM in our database; short-lived access tokens are kept in memory only. The events we fetch are stored in your family’s data on the ohanly Cloud servers (hosting see section 10). All transfers are encrypted with TLS.
No sharing, no ads, no AI: we do not sell data from Google, and we do not use it for advertising, for profiling or to train AI or machine-learning models. We don’t share it with third parties – except our hosting provider as processor, or where we are legally required to. Nobody at ohanly reads your events unless you explicitly ask us to (for example in support), it is necessary for security or to prevent abuse, or the law requires it.
Disconnecting and deletion: you can disconnect at any time in ohanly under calendar connections. We then delete the stored access key, additionally revoke the access at Google and remove all events taken over from Google from ohanly – unless you explicitly choose “Keep the events as a local copy”. If you deselect a single calendar, we remove its events by default too. Events you delete in Google are removed at the next sync. Disconnecting changes nothing in your Google account.
Revoking access at Google: you can also remove ohanly’s access directly at myaccount.google.com/connections. ohanly then fetches nothing more; to delete the events already taken over, disconnect in ohanly. If you delete your family or account, they are deleted with it (section 11); they disappear from backups after 14 days at the latest.
Transfer to the USA: during sync, data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.

ohanly’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The legal basis is Art. 6(1)(b) GDPR.

8. Recipe import and product lookup

If you import a recipe from a link, our server fetches the page and reads the recipe data. The website sees our server’s address, not yours.

Scanning barcodes in the pantry

In the ohanly apps for phones and tablets you can scan the barcode on a package when you add something to the pantry. The camera is only used when you ask for it and only on your device; images are neither stored nor sent anywhere. With the recognised barcode the app asks Open Food Facts (Open Food Facts, France) directly for the product’s name and amount. Only the barcode and an identifier of the app are sent; like with any request, Open Food Facts also sees your device’s IP address. No information about you or your family goes to Open Food Facts, and our server is not involved in this request. We don’t store the barcode; only what you add with “Add” ends up in the pantry. The Open Food Facts privacy policy applies. The legal basis is Art. 6(1)(b) GDPR.

9. Subscription and payment

Subscriptions and the lifetime licence are sold by Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as reseller (“Merchant of Record”). Paddle processes payment and invoice data as an independent controller; the Paddle privacy policy applies. The European Commission has issued an adequacy decision for the United Kingdom.

From Paddle we only receive what we need to activate the service: status and term of the subscription, the chosen plan and a customer ID; for the lifetime licence also the transaction ID, the time of purchase and any refund. We never see payment details such as card numbers. For this, the payment page loads Paddle’s script; the rest of the app loads no third-party code. The legal basis is Art. 6(1)(b) GDPR.

10. Recipients and processors

Hosting of ohanly Cloud and this website: netcup GmbH, Emmy-Noether-Straße 10, 79131 Karlsruhe, servers located in Germany (processing on our behalf under Art. 28 GDPR).
Paddle as independent controller for payment (section 9).
Calendar providers you connect yourself, as independent controllers (section 7).
Open Food Facts as independent controller, only when you scan a barcode in the app (section 8).

Beyond that we only pass on data if we are legally obliged to.

11. Retention and deletion

Deleting the family: the owner can delete the family at any time. It is then marked for deletion for 7 days – so a mistake can be undone – and deleted for good afterwards.
Deleting your account: we delete your sign-in data. Entries you created in a family stay with the family, but without a link to your account. If nobody else in the family has an adult account, the family is deleted together with your account, after you confirm.
Removing a member: access ends immediately. The name stays in the family’s history and points log until the family is deleted.
After the trial or subscription ends the family is read-only; export and deletion remain possible. We delete them 12 months after expiry, after reminding the owner twice by email.
Sessions and password reset links are deleted 7 days after they expire, data exports once their download link has expired.
Backups are kept encrypted for 14 days; deleted data disappears from the backups by then at the latest.

12. Your rights

You have the right to

access to your stored data (Art. 15 GDPR),
rectification (Art. 16) and erasure (Art. 17),
restriction of processing (Art. 18),
data portability (Art. 20) – in the app as an export for the whole family or for your account (“Settings”),
object to processing based on legitimate interest (Art. 21),
lodge a complaint with a data protection supervisory authority (Art. 77). The authority responsible for us is Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10557 Berlin.

Just write to us at [email protected].

13. Self-hosted instances

Anyone running ohanly on their own server is responsible for the data processed there. We receive no data from self-hosted instances.

Last updated: October 2026