Privacy Policy

We take the protection of your personal data seriously and limit data processing to what is necessary to operate our services. This Privacy Policy covers every service we operate under unom.io and punktfunk.unom.io, and the Punktfunk software; the section "Our services at a glance" lists them. Our services do not embed advertising or third-party trackers and do not create cross-site user profiles; only technically necessary cookies are set (see the section "Cookies and local storage"). Below, we inform you about the processing of personal data in accordance with Art. 13 and 14 GDPR.

Part A – General

1. Controller

Enrico Bühler
unom
Schroffenstraße 44
78628 Rottweil
Germany
Email: enrico.buehler@unom.io

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Our services at a glance

3. Hosting and service providers

Our websites, git.unom.io, the unom account, unom improve and our ticket system run on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in data centres in Germany. Hetzner processes the data held on these servers on our behalf, in particular technical connection data such as IP addresses. We have concluded a data processing agreement with Hetzner (Art. 28 GDPR). The legal basis for this is our legitimate interest in providing our services securely and efficiently (Art. 6(1)(f) GDPR). We operate supplementary services – audience measurement, unom translate and our backups – on our own server infrastructure in Germany.

We also use the following service providers, who act on our behalf. With both, a data processing agreement (Art. 28 GDPR) is in place as part of their terms of business.

• Cloudflare, Inc. (USA) answers name lookups (DNS) for unom.io and punktfunk.com, stores the files downloaded through git.unom.io in its R2 storage service, provides the only connection to unom translate (Cloudflare Tunnel), protects the contact form (Turnstile), and redirects punktfunk.com to punktfunk.unom.io.
• Proton AG (Switzerland) runs our mailboxes and sends our emails.

If you sign in with GitHub or Discord, use our Discord server, get an app from an app store, or support us through Ko-fi or Patreon, those providers process your data as controllers in their own right. The relevant sections give the details; for transfers outside the EU, see "Transfers to third countries".

4. Server log files

When you use our services, the server automatically collects and stores information in server log files that your browser or another program (such as a package manager or Punktfunk's update check) transmits:

• IP address
• Date and time of the request
• Page or file accessed
• Referrer URL
• Browser type and version
• Operating system used

This data is processed solely to ensure trouble-free and secure operation, for error analysis and to fend off attacks (for example, automatic blocking after repeated failed sign-in attempts). The legal basis is our legitimate interest in providing our services in a technically error-free and secure manner (Art. 6(1)(f) GDPR). The log data is stored only for as long as necessary for these purposes, at most 14 days, and then deleted. The one exception is the record of failed SSH sign-ins to our servers at Hetzner (IP address and the user name tried), which we use to detect attacks on the servers: it is rotated monthly and kept one more month, so for up to about two months. Visitors to our websites never appear in it, only whoever tries to sign in to the servers over SSH. This data is not combined with other data sources.

5. Cookies and local storage

We set cookies and use your browser's storage only where this is strictly necessary for the service you asked for; this is permitted without consent under Section 25(2) No. 2 TDDDG. The legal basis for the associated processing is Art. 6(1)(f) GDPR.

Our services set no other cookies; in particular, no analytics, tracking or advertising cookies are used, and your data is not passed on for marketing purposes.

6. Transfers to third countries

Some of the providers named here are based outside the EU or EEA:

• Cloudflare, Inc. (USA) for DNS, downloads from git.unom.io including the update check (R2), unom translate (Tunnel), protection against automated access (Turnstile) and the punktfunk.com redirect. The files in R2 are stored in data centres in Western Europe; Cloudflare receives requests through its worldwide network, however, and as a US company it may be obliged to disclose data to US authorities.
• Proton AG (Switzerland) for our email.
• GitHub, Inc. and Discord Inc. (both USA) if you sign in to the unom account with them or use our Discord server; both act as controllers in their own right.
• Ko-fi Labs Limited (United Kingdom) and Patreon, Inc. (USA) if you support us through these platforms; both act as controllers in their own right.

Switzerland and the United Kingdom are covered by adequacy decisions of the European Commission. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR). Hetzner, audience measurement, fonts and our backups stay in Germany.

7. Retention and backups

We keep personal data only for as long as the purpose requires or statutory retention obligations demand; the sections on each service give the periods.

We back up the databases of the unom account, git.unom.io, unom improve, our ticket system and our content management system, and the files of git.unom.io and the ticket system, every six hours. These backups are encrypted before they leave the server, are kept on our own hardware in Germany and are deleted after 14 days. In addition, Hetzner takes a daily image of the git.unom.io server and keeps the last seven. We do not back up the files git.unom.io stores in R2 separately. We copy the unom translate database every hour to our own hardware in Germany; in addition, we back up the whole container unom translate runs in every night to storage on our own network. We delete both kinds of copy after 14 days.

Deleted data can therefore remain in a backup for up to 14 days; we use backups only to restore operation after a failure.

8. Children and young people

The unom account, unom translate and unom improve are intended for people aged 16 and over. If we learn that someone younger has sent us data without their parents' consent, we delete it.

Part B – Our services in detail

9. Websites

This section covers unom.io, punktfunk.unom.io and docs.punktfunk.unom.io. Visiting them produces the server log data described above.

Audience measurement with Plausible Analytics

To analyse the use of the websites unom.io and punktfunk.unom.io, we use Plausible Analytics, a privacy-friendly statistics solution that we operate ourselves on our own infrastructure (analytics.unom.io). No cookies are set, and no information is stored on or read from your device. We do not use audience measurement on docs.punktfunk.unom.io.

Plausible records aggregated usage data, such as pages visited, referrers, approximate country of origin, device type, browser and operating system. Your IP address is processed only briefly to derive such details and to count visits; it is not stored. No cross-site or cross-device profiles are created, and no data is passed to third parties. All data remains on our infrastructure.

The legal basis is our legitimate interest in understanding and improving the use of our services (Art. 6(1)(f) GDPR). Because Plausible sets no cookies and does not access your device, no consent under Section 25 TDDDG is required for this.

Fonts

The fonts used on our pages are served from our own server. Your browser does not connect to providers such as Google Fonts for this, so no personal data is transmitted to such providers.

10. Contact by email and contact form

You can reach us at enrico.buehler@unom.io, with questions about Punktfunk also at support@unom.io, and with reports of security vulnerabilities at security@punktfunk.com. If you contact us by email, we process the details you provide (in particular your email address, name and the content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to entering into or performing a contract, and otherwise our legitimate interest in answering your request (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer needed for this purpose, unless statutory retention obligations prevent this.

Our mailboxes are hosted by Proton AG (Switzerland), and that is where we handle your message. Our server at Hetzner also runs the ticket system Chatwoot (support.unom.io); it receives email only for an address we do not publish.

Contact form. With the form at unom.io/en/contact you send us your email address, your message and, if you like, your name. The website does not store the form: the server sends its content as an email through Proton AG (Switzerland) to our mailbox, and we reply from there. To limit the number of messages per hour, the server keeps your IP address in memory for up to an hour. Cloudflare Turnstile from Cloudflare, Inc. (USA) protects the form; it loads only once you select a field of the form. To detect automated access, Cloudflare processes your IP address, user agent, a TLS fingerprint and the website you are on. For this, Cloudflare acts as our processor; to improve this detection, Cloudflare acts as a controller in its own right. Turnstile sets no cookies, but uses your browser's local storage inside its embedded frame. The legal basis for this is our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR); access to your device is strictly necessary for the use of the form you requested (Section 25(2) No. 2 TDDDG). Otherwise, the legal basis and deletion are the same as for email.

11. unom improve

At improve.unom.io you report bugs in our software, currently Punktfunk, suggest ideas, vote on them, comment and follow posts. We set each post's status and list the posts by status on a roadmap. Anyone can read; to post, vote, comment or follow a post, you sign in with your unom account. unom improve needs no registration, password or email address of its own.

What we store. When you sign in, unom improve takes your identifier and display name from your unom account and updates the name each time you sign in; it also stores the tokens the unom account issues for this sign-in. unom improve does not receive your email address, does not store your avatar and sends no emails. For your sessions we store the expiry, the IP address and the user agent. We also store, with your identifier, what you do in unom improve: your posts (title, text and whether it is a bug or an idea), comments, votes and the posts you follow, and the notices we show you there, such as a new status or a new comment on a post you follow.

What others see. Posts and comments are public with your display name, as are the number of votes, the status and our note. No one sees your identifier, your IP address or who voted for what. We publish your first post only after we have seen it; until then only you and we can see it. The community page of punktfunk.unom.io shows the title, vote count and status of public posts. The pages of unom improve load nothing from other providers.

Bugs on the issue tracker. We copy every public bug post – title, text and a link back – to our public issue tracker at git.unom.io, without your name or identifier; an idea only if we decide to track it there. The tracker is open to everyone and may be indexed by search engines.

Retention. Posts, comments and votes stay stored until they are removed. You can edit your posts and take back votes and follows at any time. If we hide a post or comment, it is no longer public but stays stored. We keep a record of our moderation (which status we set, what we hid and whom we blocked) and store blocks with the identifier. Sessions end when you sign out, at the latest 7 days after you last used them. For copies of the database, see "Retention and backups".

Deletion. You cannot yet delete your posts or your data in unom improve yourself, and deleting your unom account does not by itself change anything there. Write to us at the address above, and we delete your data in unom improve and, on request, also the text we copied to the tracker.

Legal basis. We provide unom improve under our Terms and publish your posts with your name for that purpose (Art. 6(1)(b) GDPR). We copy bug posts to the tracker on the basis of our legitimate interest in handling bugs in a way the public can follow (Art. 6(1)(f) GDPR). We process IP addresses and user agents in sessions, the moderation record and blocks on the basis of our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR). The session cookie is strictly necessary (Section 25(2) No. 2 TDDDG). unom improve runs on our server at Hetzner; there is no tracking.

Bug reports from our Discord forum

If you open a post in the "bug-reports" forum of our Discord server, we copy its title and the text of its first message, with a link to it, to unom improve as a public post, and from there to the issue tracker. We do not copy your Discord name, your Discord identifier, other messages or attachments; if the text mentions someone, it shows their Discord display name. In the Discord post we note the tracker number and whether the report is open or closed. For older posts, unom improve sometimes holds only the title and the link. The legal basis is our legitimate interest in handling bug reports in a way the public can follow (Art. 6(1)(f) GDPR). If you do not want this, a message to the contact details above is enough, and we remove the text from unom improve and the tracker. Your use of Discord itself is covered by the privacy policy of Discord Inc. (USA).

12. Code hosting platform git.unom.io

At git.unom.io we run a code hosting platform (Gitea) on which the source code of our projects is publicly available. Visiting it produces the server log data described above.

In front of the platform, a protection against automated access (Anubis), which we run ourselves on the same server, checks whether a request comes from an ordinary browser. On your first visit, your browser solves a short computational task; Anubis processes your IP address and user agent and records the result in a cookie, so that the check is not repeated on every page. The legal basis is our legitimate interest in protecting the platform against overload from automated requests (Art. 6(1)(f) GDPR).

The platform sets only technically necessary cookies (session cookie, CSRF protection, language setting, and the Anubis cookies). They are strictly necessary to provide the service; storing them is permitted without consent under Section 25(2) No. 2 TDDDG. No analytics, tracking or advertising cookies are used.

Files you download from git.unom.io – releases, packages, attachments and avatars – are served by Cloudflare's R2 storage service; the section "Downloads, package repositories and update check" gives the details.

Self-registration is disabled; user accounts exist only for project participants. For these accounts we process the user name, email address, password (stored only as a cryptographic hash), the data of the second sign-in factor every account must have, and the content created while contributing. The legal basis is providing the platform to the participants (Art. 6(1)(b) GDPR). An account on git.unom.io can also be used to sign in to the unom account; git.unom.io then passes your name, email address and avatar to the unom account (see the section "unom account").

Contributions to public repositories (in particular commits, issues and comments) contain the details the contributors themselves provide – for commits, typically a name and email address in the commit metadata – and are publicly visible as part of the version history. This follows from how Git works and is necessary to keep the origin of the code traceable (Art. 6(1)(f) GDPR). Public issues and pull requests also come from unom improve (section "unom improve") and from unom translate (section "unom translate").

13. Downloads, package repositories and update check

Downloads on punktfunk.unom.io. The download buttons go through an address on punktfunk.unom.io (/dl/…) that only counts how often each file was clicked and then sends you on to git.unom.io or to the app store concerned. We also count how often the install script (punktfunk.unom.io/install.sh) is fetched. We store neither your IP address nor anything else about you in doing so.

Files from git.unom.io. git.unom.io stores releases, packages from our package repositories (for apt, dnf, pacman and npm, for example), attachments and avatars in the R2 service of Cloudflare, Inc. (USA). When your browser, your package manager or the Punktfunk software requests such a file, git.unom.io redirects the request to a short-lived address at R2. Cloudflare processes your IP address, the requested file, the time and the user agent of the requesting program on our behalf. The short links unom.io/pf-decky and unom.io/pf-decky-canary for the Steam Deck plugin also redirect to git.unom.io.

Other package repositories. We run flatpak.unom.io (Flatpak), nix.unom.io (Nix) and winget.punktfunk.unom.io (winget) on our server at Hetzner; they produce the server log data described above.

Update check. By default, the Punktfunk host (Linux and Windows) and the Punktfunk client for Linux check whether a new version has been released. To do so, they fetch a signed version list from git.unom.io, which R2 delivers. This transmits your IP address, the release channel (such as "stable" or "canary") and a program identifier with the installed version (such as "punktfunk-host/0.46.0"). Nothing about you, your devices or your streams is transmitted. In the host, turn the check off under "Host → System → Check for updates"; in the Linux client, set the environment variable PUNKTFUNK_UPDATE_CHECK=0.

Plugins. When you open the plugin catalogue in the host or install a plugin, the host fetches the signed catalogue and the plugin from git.unom.io (through R2) or from a source you added yourself. Plugins may in turn contact third-party services, such as game platforms to load cover art; they do so directly from your host, not through us.

The legal basis is our legitimate interest in providing our software securely and keeping it up to date (Art. 6(1)(f) GDPR).

14. The Punktfunk apps and the host

This section concerns the Punktfunk apps for iPhone, iPad, Apple TV, Apple Vision Pro, Mac, Windows, Linux and Android, and the Punktfunk host.

The apps collect no personal data. There are no user accounts, no registration and no sign-in in the apps. The apps contain no third-party analytics, tracking, advertising or crash-reporting libraries. No tracking within the meaning of Apple's App Tracking Transparency framework takes place. The apps for iPhone, iPad, Apple TV, Apple Vision Pro, Mac, Windows and Android transmit no data to us or to any third party. The Linux client only asks us for updates (see "Downloads, package repositories and update check").

Where your data goes. Punktfunk connects your device directly to a host machine that you run yourself, normally on your own network. Video, audio, mouse, keyboard and controller input – and your microphone, if you switch it on – travel only between your device and that host, encrypted, without passing through any server of ours. We operate no brokering, relay or cloud service for streaming, and we have no access to the contents of a session at any point.

What stays on your device. The app stores locally on your device: the hosts you have added or discovered on your network, your settings and presets, and a cryptographic key your device uses to identify itself to a paired host (in the keychain, on Apple devices). This data does not leave your device and is removed when you delete the app.

Permissions. The app requests only the permissions it needs to work: access to the local network, in order to find hosts and connect to them, and – only if you use microphone streaming – the microphone. The microphone signal is sent to the host you paired with, where it appears as a virtual microphone; it is not recorded and is not sent to us.

Distribution through app stores. If you obtain the app from the App Store or Google Play, Apple or Google process their own data as part of distributing it (such as purchase, installation and crash statistics). We have no influence over this, and the respective provider's privacy policy applies. The aggregated statistics Apple and Google show us in their developer consoles do not allow any individual to be identified.

The host. The Punktfunk host is open source software that you run on your own machine. Any data it produces – local log files, for instance – remains entirely under your control, and none of it reaches us. The host connects to our servers only for the update check and, if you use it, the plugin catalogue (see "Downloads, package repositories and update check"). The source is available at git.unom.io/unom/punktfunk.

15. unom account

The unom account at account.unom.io is the shared sign-in for our applications, currently unom translate and unom improve. You create it the first time you sign in – with GitHub, Discord or your account on git.unom.io or, where we offer it, with a code we send to your email address. We do not store a password.

What we store.

• Your name, email address and the address of your avatar, as your first sign-in method sent them; if you create your account with an email code, the name you choose yourself. If Discord does not share a verified email address, we assign a placeholder address to which nothing can be delivered.
• For each connected sign-in method, the identifier under which the provider knows you, and when you connected it. We do not store the providers' access tokens.
• Your sessions: start, last use and expiry, the IP address and your browser's user agent.
• Which applications you have signed in to with the unom account, what details they receive and when you last used them.
• A record of security-relevant events: connected and removed sign-in methods, sign-ins by email code, confirmed and changed email addresses, ended sessions, removed application access and the deletion of the account, each with time and IP address.

Signing in with GitHub, Discord or git.unom.io. If you choose GitHub or Discord, we send you to GitHub, Inc. or Discord Inc. (both USA). You sign in there and allow the provider to send us your identifier, name, email address and avatar. The provider learns that you are signing in to the unom account; it is responsible for its own processing, and its privacy policy applies. Signing in with git.unom.io stays on our own servers. Your browser loads your avatar directly from the provider, such as GitHub or Discord, which receives your IP address when it does.

Signing in with an email code. Where we offer it, we send you a six-digit code by email on request, through Proton AG (Switzerland). With such a code you sign in, or confirm or change your account's address. A code works once and for ten minutes; we store it only as a hash and delete expired codes every day. Proton keeps a copy of each of these emails in the Sent folder of our mailbox; those copies stay there until we delete them. So that no one can request codes in bulk, we store the time, the IP address and a keyed hash of the address for each request, and delete these entries after one day. Before each request your browser solves a puzzle that our server sets and checks; no third party is involved. A solved puzzle counts only once: we store its identifier without any link to you and delete it after one hour.

What applications receive. When you sign in to an application with the unom account, it receives a permanent identifier for your account and – depending on what we have allowed the application – your name and avatar and your email address. You can see what each application receives under "Connected apps" at account.unom.io. unom translate receives your name, avatar and email address; unom improve receives your name and avatar and stores only the name. What an application does with this data is described in the section on that application.

What you can manage yourself. At account.unom.io you can connect and remove sign-in methods, see and end your sessions, remove an application's access and delete your account. Once you remove an application's access, its access tokens stop working at once and it receives no new data; what it has already stored, it deletes under its own rules. You can get a copy of your data by writing to the email address above.

Retention. We keep your profile, sign-in methods and the list of your applications for as long as your account exists. A session ends when you sign out, at the latest 7 days after you last used it; we delete expired sessions every day. We also delete expired application access tokens every day, except the newest one per application, which records the connection. We delete entries in the security record after 365 days. If you delete your account, we remove your profile, sign-in methods, sessions and application access at once; entries in the security record stay until their 365 days run out. Backups keep the data for up to 14 days. Data an application has stored itself is deleted by that application under its own rules; for unom translate and unom improve, see their sections.

Legal basis. We provide the account under our Terms (Art. 6(1)(b) GDPR). We process the security record and the IP addresses and user agents in sessions on the basis of our legitimate interest in protecting your account and the connected applications against abuse and in investigating abuse (Art. 6(1)(f) GDPR). The session cookie is strictly necessary (Section 25(2) No. 2 TDDDG). The service runs on our server at Hetzner; there is no tracking.

16. unom translate

At translate.unom.io the community translates our software, currently Punktfunk's web console and Android app. Anyone can read; to suggest translations, you sign in with your unom account.

What we store. When you sign in, unom translate takes your identifier, name, email address and avatar address from your unom account and updates them each time you sign in. We do not use your email address in unom translate and show it to no one. For your sessions we store start and expiry, the IP address and the user agent. For each suggestion we store the text, the language, the string it belongs to, the time, your identifier and your display name, and the reviewer's decision with their identifier, the time and, for a rejection, the reason, which only you see. Before your first suggestion we tell you about the licence and that your name will be shown; we store when you confirmed which version of this notice.

Comments, notices and blocks. If you comment on a string, we store the comment with your identifier, your display name and the time, and show it with that string. Notices we show you personally in unom translate are stored with your identifier. If we block someone from unom translate under our Terms, we store the block with the identifier, the time and the reason.

Who sees your name. Signed-in users see your display name next to your open and accepted suggestions; anyone not signed in does not. When a reviewer accepts your suggestion, the text goes into a public pull request on git.unom.io, whose description lists the translators for each language by display name. This description is visible to everyone, may be indexed by search engines and stays in the pull request's history. We do not write your name into the repository's version history: the commits are authored by the bot account "unom translate", and the commit messages name no translators.

Publication of the text. Accepted translations become part of the project's public repository (for Punktfunk, git.unom.io/unom/punktfunk) and stay there permanently under the project's licence – for Punktfunk, MIT or Apache 2.0, at the recipient's option. Our Terms (section "Contributions") set out the details.

Cloudflare Tunnel. unom translate runs on our own hardware in Germany and can only be reached through Cloudflare Tunnel from Cloudflare, Inc. (USA). Every request – including your IP address, the session cookie and the content – passes through Cloudflare's network, which terminates the encrypted connection. Cloudflare acts as our processor; for the transfer to the USA, see "Transfers to third countries".

Retention. We keep open and accepted suggestions and comments as the history of the translation for as long as the project is translated with unom translate. We delete rejected and superseded suggestions 90 days after the reviewer's decision. We keep your confirmation of the notice for as long as we keep contributions from you. Sessions end when you sign out, at the latest 7 days after you last used them; we delete expired sessions every day. For copies of the database, see "Retention and backups".

If you delete your unom account. Deleting your unom account does not by itself change anything in unom translate. Write to us at the address above, and we delete your account, your sessions and your open suggestions there and remove your name from the remaining entries. On request, we also remove your name from the description of pull requests already published. Text already taken into a repository stays there under the project's licence.

Legal basis. We process your suggestions and comments and show your name in order to take your contribution under our Terms (Art. 6(1)(b) GDPR) and to keep the origin of accepted text traceable (Art. 6(1)(f) GDPR). We process IP addresses and user agents in sessions, and blocks, on the basis of our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR). The session cookie is strictly necessary (Section 25(2) No. 2 TDDDG).

17. Discord, social networks and external links

Our Discord server. We run a server on Discord (Discord Inc., USA) for the Punktfunk community. If you join it, Discord processes your data as a controller in its own right, and Discord's privacy policy applies. As the operator, we see your user name, avatar and posts just as every member does, and we can moderate posts. The legal basis for moderation is our legitimate interest in a community that works and stays within the law (Art. 6(1)(f) GDPR). We sometimes note bug reports that reach us on the server in an internal working document, to keep track of open ones (Art. 6(1)(f) GDPR); once a report is done, we delete the entry or mark it as done. The section "unom improve" explains how we copy posts from the "bug-reports" forum. Where we and Discord are jointly responsible for processing on our server, you can exercise your rights with us or with Discord; we forward requests about Discord's own processing to Discord or tell you how to reach it. We do not use Discord's member statistics (Server Insights).

External links. Our websites and the documentation link to external services, including the App Store and Apple TestFlight, Google Play, Discord, Reddit, YouTube, Ko-fi, Patreon and repositories on GitHub. When you follow such links, the privacy policies of the respective providers apply; we have no influence on their data processing.

18. Support through Ko-fi and Patreon

You can support Punktfunk financially through Ko-fi (Ko-fi Labs Limited, United Kingdom) or Patreon (Patreon, Inc., USA). These platforms process your account there and the payment as controllers in their own right, and their privacy policies apply. From the platform we receive your name or user name, your email address, the amount and date of your support and, if you write one, your message. We use these details to attribute and book your support (Art. 6(1)(b) and (c) GDPR) and keep them for as long as statutory retention obligations apply, in particular under Section 147 of the German Fiscal Code (AO).

Part C – Your rights

19. Your rights

Within the limits of the law, you have the following rights at any time:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)

A message to the contact details above is enough to exercise your rights. Much of what concerns your unom account you can also view and delete yourself at account.unom.io.

20. Right to object (Art. 21 GDPR)

Where we process personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

21. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (baden-wuerttemberg.datenschutz.de). You can also contact the supervisory authority of your habitual residence.

22. Data security

Our services use TLS encryption (recognisable by "https://" and the padlock icon in your browser's address bar) to protect the transmission of your data. We encrypt the backups of our servers at Hetzner before they leave the server.

23. Changes to this Privacy Policy

We adapt this Privacy Policy when changes to our services or to the legal situation require it. The current version is always available on this page.

Effective date: 6 November 2026.