Privacy policy

1. Controller

[Vorname Nachname], [Straße Hausnummer], [PLZ Ort], email: [[email protected]]

2. Data we process

When creating a story: the texts and photos you enter, the names of the people involved, the chosen occasion and language, optionally your email address for notifications, and an optional password (stored as a hash).

When a story is viewed: the time at which “Yes” was tapped. No data about the viewer is collected apart from technically required server logs (IP address, time, page), which are deleted after 14 days.

When paying: payment is handled by Lemon Squeezy LLC (see section 5). We receive the order number and payment status, no payment details.

3. Purposes and legal bases

Providing the service and performing the contract (Art. 6(1)(b) GDPR).

Security and abuse prevention, such as server logs and request limits (Art. 6(1)(f) GDPR).

You upload photos and texts about other people on your own responsibility. Please make sure the person shown agrees.

4. Cookies

We only use a few first-party cookies: “ui_lang” remembers the interface language (1 year). “story_…” stores access to a password-protected story after entering the password (30 days). “preview_…” unlocks the preview of a draft in the creator's browser for 15 minutes.

If you arrive via a referral partner's link (e.g. onequestion.love/go/name) or a campaign link, the cookies “ref” and “utm” store the partner code or campaign for 30 days. This lets us attribute a later purchase to the partner and pay their commission (Art. 6(1)(f) GDPR). No data is passed to the partner or third parties, and no profile is built about you. There are no third-party advertising cookies.

Consent management: the cookie banner is provided by Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). Your choice is stored in the “CookieConsent” cookie (12 months) so the banner does not reappear on every visit. This processes your truncated IP address, the time and content of your choice and a random identifier as proof of consent (Art. 6(1)(c) and (f) GDPR). This cookie is strictly necessary.

Usage analytics (only with your consent): if you agree in the cookie banner, we use PostHog to understand where users drop out of the builder. It records page views, clicks and session recordings; your story's texts, inputs and photos are masked and not transmitted, and edit links are removed before sending. PostHog stores cookies or local-storage entries in your browser for this (up to 1 year). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it any time via “Cookie settings” at the bottom of the page. Without consent PostHog is not loaded. No analytics run on the story pages shown to recipients.

5. Recipients and processors

Hosting: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Servers and database are located in Germany.

Payments: Lemon Squeezy LLC, USA, as reseller. Lemon Squeezy's privacy policy applies to the payment. Transfers to the USA are based on the EU-US Data Privacy Framework.

AI text suggestions: if you use “Suggest text”, your keywords, the occasion and first names are sent to Anthropic PBC, USA, to generate a suggestion. Anthropic does not use this data for training. Use of this feature is voluntary.

Consent banner: Usercentrics A/S (Cookiebot), Denmark, servers in the EU.

Usage analytics: PostHog Inc., USA, using its EU cloud with servers in Frankfurt, Germany (only after consent, see section 4). A data processing agreement is in place with PostHog; any access from the USA is based on the EU-US Data Privacy Framework.

Fonts are loaded from Google Fonts, which transmits your IP address to Google LLC. [Alternatively: self-host fonts and remove this paragraph.]

6. Retention

Unpublished drafts are deleted 30 days after the last change. Published stories remain stored until you delete them via your edit link or request deletion by email. Order data is retained for 10 years as required by tax law.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority. Contact the email address above.