Privacy Policy
1. Privacy at a glance
General information
The following notes provide a simple overview of what happens to your personal data when you use the landing page (postureshift.info) or the app (app.postureshift.info). Personal data is any data that can be used to personally identify you. For detailed information, please refer to the privacy policy set out below this text.
Data collection when using PostureShift
Who is responsible for data collection?
Data processing is carried out by the operator of the app. You can find their contact details in the "Notice regarding the responsible party" section of this privacy policy.
How do we collect your data?
Some of your data is collected because you provide it to us, e.g. by voluntarily creating a user account (email address) to sync your posture rotations across devices. Other data is collected automatically by our IT systems, or by the hosting provider we use, when you visit the pages (e.g. technical data such as browser type or the time of access).
What do we use your data for?
Some of the data is collected to ensure the page and app are provided without errors. If you create a user account, data is also used to sync your rotations, settings, and custom postures across devices.
What rights do you have regarding your data?
You have the right at any time to receive free information about the origin, recipients, and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right to lodge a complaint with the competent supervisory authority.
2. Hosting and infrastructure
Hosting
We host the landing page and the app with All-Inkl. The provider is ALL-INKL.COM - Neue Medien Münnich, Inh. René Münnich, Hauptstraße 68, 02742 Friedersdorf (hereinafter: All-Inkl). Details can be found in All-Inkl's privacy policy: https://all-inkl.com/datenschutzinformationen/.
The use of All-Inkl is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our page and app.
Data processing agreement
We have entered into a data processing agreement (DPA) with the provider named above. This is a contract required by data protection law that ensures the provider processes our visitors' personal data only on our instructions and in compliance with the GDPR.
Our own backend (user account, synchronisation)
For the optional user account and cross-device synchronisation of your rotations, we operate our own, self-hosted database (MySQL/MariaDB) with the hosting provider named above — no third-party service is used for accounts or data storage. To send the login link by email, we use the SMTP service of the same hosting provider to send an email to the address you provided.
3. General information and mandatory disclosures
Data protection
The operators of PostureShift take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
Notice regarding the responsible party
Daniel Schwarz
Phone: 016096837183
Email: service@web-schwarz.de
Storage period
Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies, or until you assert a legitimate request for deletion or revoke your consent.
Withdrawing your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time for the future, e.g. by deleting your user account in the app, or by informing us informally.
Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or the place of the alleged violation.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. You may contact us about this at any time.
SSL/TLS encryption
For security reasons, these pages use SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://".
Information, deletion, and correction
Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, as well as a right to have this data corrected or deleted. You may contact us about this at any time.
4. User account and synchronisation (app.postureshift.info)
If you choose to create a user account in order to sync your rotations and settings across devices, we collect your email address (for passwordless login via magic link) as well as the rotations you create (selected postures and times per tab, "Office"/"Car"), your settings (e.g. intervals, notification channels), and any custom postures you add yourself. This data is required to provide you with the synchronisation feature (Art. 6(1)(b) GDPR).
During the login process, a one-time login link, valid for 15 minutes, is sent by email; the associated security token is stored on our side only in hashed form. Your session is managed via a cookie that is strictly technically necessary (Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG) and does not require separate consent.
Without a user account, you can continue to use the app entirely locally on your device; in this case, no data is transmitted to us.
5. Cookies and local storage
The app uses technically necessary local storage for your rotations, settings, and timer status, so that the app also works fully offline. This storage takes place exclusively on your device (Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG) and does not require separate consent.
If you use a user account, a technically necessary session cookie is additionally set (see Section 4).
6. Server log files
Our hosting provider automatically collects and stores information in server log files that your browser automatically transmits to us: browser type and version, operating system used, referrer URL, time of the server request, and IP address. This data is not merged with data from other sources. Collection is based on Art. 6(1)(f) GDPR (legitimate interest in the technically error-free provision of our service).
7. Notifications (sound, voice output, push)
If you wish, the app can use audible cues (Web Audio API), voice output (the browser's built-in Web Speech API), and browser push notifications. These features run entirely locally in your browser or via its built-in interfaces; no data is transmitted to us or to third parties in the process. For push notifications, your browser will ask you for separate permission, which you can revoke at any time in your browser settings.
8. Advertising and funding
Google AdSense
If you have given consent in the cookie consent banner, this page or the app integrates the Google AdSense advertising service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google uses cookies or comparable technologies to serve ads, detect fraud, and measure ad performance. In doing so, personal data may be transferred to Google in the USA and processed there; the USA cannot be guaranteed to have a level of data protection comparable to that of the EU, and it cannot be ruled out that US authorities may access data stored there.
This use is based exclusively on your consent (Art. 6(1)(a) GDPR). If you decline in the consent banner, no AdSense script is loaded and no advertising is shown. You can withdraw your consent at any time via the "Cookie settings" link in the footer, or in the app's settings.
Further information on how Google handles user data can be found at: https://policies.google.com/privacy?hl=en.
Donations (PayPal, Buy Me a Coffee)
On this page and in the app, we voluntarily link donation buttons for PayPal and Buy Me a Coffee. Clicking one of these links takes you to the respective provider's website; any data processing there takes place solely under that provider's own privacy policy. We ourselves do not receive any personal data from you in the process.