Privacy

Who is responsible?

The website and the app are run by:

Daniel Wolf, Am Hundsberg 7, 57234 Wilnsdorf, Germany

For questions about privacy, write to us at: wolfi91@gmail.com

Who the website and the app are for

The website and the app are only for the guests of our wedding in Namibia. We create the accounts for you. There is no open sign-up.

We use your data only to plan and run the wedding and the trip with you. We do not sell data and we show no advertising.

Your account

For each account we store:

• first and last name and a username
• an e-mail address, if you gave us one
• your password only as a check value (hash) from which the password cannot be worked out
• the language you chose (German or English)
• when you last signed in
• who you travel with (your travel party)
• notes we make about you for the planning

On the website a sign-in lasts 24 hours. In the app it lasts at least until 15 January 2027, so it does not expire during the trip. We store the keys for the app sign-in and sign-in links sent by e-mail only as check values.

To slow down repeated failed sign-ins, the server keeps your IP address in memory for a short time. It is not written to the database and is gone at the latest when the server restarts.

Reply, trip and questionnaire

So that we can plan the wedding and the trip, we store what you tell us on the website or in the app:

• whether you are coming, the number of people and their names
• notes about food, for example allergies
• your trip wishes: length of the trip, budget, interests, pace, whether you drive yourselves, vehicle, accommodation, arrival and departure, and your notes to us
• your trip plan with daily stages, lodges and driving routes
• your sign-ups for activities
• for the safari on 1 December, whether you join for the full day or the morning (also if someone in your party entered it for you) and which safari vehicle you ride in; the others in the same vehicle see your first names once we publish the plan
• your hotel and flight arrival time, if we arrange a lift or a shuttle for you

The reply, trip wishes, trip plan and sign-ups apply to your whole travel party. All accounts of a travel party see and change the same details.

Information about allergies can be health data. Please only tell us what we need to know for the food. We use it only to plan the meals.

After you sign in, the app and the website ask every person once, individually, about allergies and diet; once you have answered in one place, you are not asked again. We store allergies, how serious they are, your emergency kit, what others should do in an emergency, and diets that reveal something about health or religion (for example gluten-free, lactose-free, halal or kosher) only if you explicitly tick the consent box there. Without the tick we store only “vegetarian”, “vegan” or “pescatarian”, “no special requirements” or that you prefer not to say. We use this information only for catering at the wedding and so that the right help can be given to you in an emergency. Only you and we can see it; your travel party sees your emergency details only if you switch on “Also show my travel party in an emergency”. We give the kitchen of the lodge where the wedding takes place only names and travel party, whether you gave any details (for example “no special requirements” or “not stated”), diets (with your note on them) and allergies, not how serious they are and not your emergency details; for people who have answered this question neither in the app nor on the website, the food note from your reply in the questionnaire. Only we see how serious an allergy is and your emergency details, so that we can help in an emergency. You can change or delete your details at any time in the app under Settings → “Allergies & diet”; deleting them withdraws your consent.

People who plan the trip routes for us see your names, your username, your e-mail address, the number of people, your trip wishes and your trip plan.

Checklist, packing list and wildlife list

When you tick something in the checklist or packing list, we store it for your account. That way the list is the same on all your devices.

In the wildlife list we store which species you marked as seen. We do not store the place.

Chat

All guests who replied yes can use the chat. We store:

• the groups you are in and who is in them
• your messages and photos
• meeting points and wildlife sightings you share, with place and time
• up to which message you have read a group

All guests who replied yes see your first and last names so they can add you to groups. Only the members of a group see its messages. As hosts, we can see all groups in the admin area so we can remove content if there is a problem.

The app makes photos smaller before sending them. The server removes embedded details such as the place where the photo was taken and stores the photos encrypted.

If we have switched on automatic translation (which is currently the case), the server sends the text of your messages to DeepL (DeepL SE, Cologne) to translate it into German or English, even if everyone in the group speaks the same language. We use DeepL's free plan, under which DeepL may also use the submitted texts to improve its services. So please don't put sensitive information such as health details in the chat. You agree to this with the chat and photo rules before you write your first message; you cannot switch the translation off afterwards. We store the translation with the message.

If we have switched on the Ably service, the app keeps a connection to Ably so that new messages appear quickly. Ably only receives a signal that there is something new, but no messages, names or locations. Ably does see your guest ID and your phone's IP address.

You can report other people's messages and photos in the app. We then store who reported what, when and why, and send ourselves as hosts an e-mail without the content itself. You no longer see the reported content. If you block someone, we store that until you unblock them; you then no longer see their messages and photos. Before you share your first message or photo, you accept the chat and photo rules; we store when. The server automatically replaces offensive or objectionable words in messages, meeting points, sightings and group names with “•••”. We log that this happened, with the affected word but without the rest of the text.

You can delete your own messages. The text disappears at once; we delete the photos with it at the next maintenance run. Photos you selected but did not send expire after one day and are deleted at the next maintenance run.

We keep all chat data until 3 March 2027. After that we permanently delete all groups, messages and photos.

Live location

The app shares your live location only if you start it yourself in a group. Sharing ends after 60 minutes at the latest. You can stop it earlier at any time.

While sharing, the app regularly sends your location and its accuracy to the server. The server stores only the latest location and overwrites it with each new update. The group members see it on a map.

Once sharing has ended, nobody sees your location any more. If you stop sharing yourself, leave the group, sign out in the app or cancel your reply in the app, the server deletes the coordinates at once. In all other cases sharing ends after 60 minutes and the server deletes the coordinates at the next maintenance run.

So that sharing continues while the screen is locked, the app needs permission to use your location in the background.

Map and navigation in the app

The app downloads the map and routes for Namibia once as a package. After that, the map and navigation work without internet.

For navigation, the Etosha map and showing where you are, the app uses your location only on the phone. It is not sent to us or anyone else.

Others only get your location if you share a live location, a meeting point or a wildlife sighting in the chat yourself.

Notifications and reminders

The app registers your phone with our server. For this we store:

• a random ID that the app creates itself
• whether it is an iPhone or an Android phone, the app version and your language
• whether notifications are on and whether they should show the message text
• if you allow notifications: an address that notifications are sent to (push token)

We send notifications through Google's Firebase Cloud Messaging, and on iPhones also through Apple's notification service. A notification contains the group name and the name of the person who wrote. It only contains the message text if you switch on "Show message text" in the app.

If you switch notifications off, we delete the push address. If you sign out, we delete your phone's registration completely.

The app schedules reminders, for example for events, on the phone. It sends nothing to us for this.

Registering your iPhone for the app

The app is not in the App Store. So that Apple allows it on your iPhone, we register the iPhone with Apple. To do this you tap “Register iPhone” on wedding-namibia.com/app/ios and install the registration profile in Settings. Your iPhone then sends us:

• the device identifier (UDID)
• the model, for example “iPhone15,2”
• the iOS version
• the iPhone's name, for example “Anna's iPhone”

We store this information with your account and give the device identifier together with your name to Apple (Apple Developer Program) so that Apple signs the app for your iPhone. We only use this information to install the app. The app's installation file is stored under a random web address in our storage at Cloudflare (R2) and, as Apple requires, contains the device identifiers of all enabled iPhones. No profile stays installed on the iPhone.

On this page you can also sign in with the password from the app. The page then remembers this with a cookie for at most 30 days, only for wedding-namibia.com/app/ios.

Data on your phone

So that the app works without internet, it stores your trip plan, messages, photos and changes not yet sent on the phone. This data is encrypted. The key is kept in the phone's protected storage (Keychain on iPhone, Keystore on Android).

When you sign out, the app deletes this data from the phone. Changes that were not sent yet are lost.

If you protect the app with Face ID, a fingerprint or your phone's passcode, your phone does the check. The app only learns whether the check worked.

Error messages stay on the phone. The app does not send crash reports to us or to other services.

Photos in the gallery

Photos you upload to the gallery through the website or the app are stored together with your account, the image size and the time. New photos appear in the gallery right away; we can take any photo out again or delete it. If we switch on approval, new photos only appear after we have looked at them. All signed-in guests see the photos in the gallery.

The photos are stored at a long, random web address. Anyone who knows this address can open the photo without signing in.

When you upload to the gallery, we remove embedded details such as the place, time and camera model from the photo.

Older photos in the gallery may still contain these details until we have removed them.

Website: cookies, logs and statistics

The website only sets cookies it needs to work:

• a sign-in cookie while you are signed in (at most 24 hours)
• a cookie on the iPhone page (wedding-namibia.com/app/ios) if you sign in there (at most 30 days)
• a cookie for the language you chose (one year)
• a security cookie against forged forms (one hour)

When you open the website or the app interface, our hosting provider Vercel processes technical data such as IP address, time, the address opened and the browser identifier. We need these logs to run the service and to find errors. Vercel deletes them automatically after a short time.

With Vercel Web Analytics and Speed Insights we count page views and measure how fast the website loads. No cookies are set for this.

The sign-in page may include protection against automated sign-in attempts from Cloudflare (Turnstile). It checks technical features of your browser.

For signed-in guests, the website shows maps with map images from OpenStreetMap. It asks the routing service OSRM (project-osrm.org) for driving routes using the coordinates of the stops. Some pages show YouTube videos in privacy-enhanced mode. These services learn your IP address.

E-mails

We send e-mails, for example invitations, sign-in links and reminders, through the Resend service. Resend receives your e-mail address and the content of the e-mail. We store which e-mail we sent to whom and when.

Service providers

We use these service providers for the website and the app. They process your data on our behalf:

• Vercel (USA): hosting of the website and the app interface, storage for the app's map package, page statistics
• Neon (USA): database for account, trip and chat data
• Cloudflare (USA): storage for gallery and chat photos (R2), protection of the sign-in page (Turnstile) if switched on
• Resend (USA): sending e-mails
• Google (USA): delivering notifications through Firebase Cloud Messaging
• Apple (USA): delivering notifications on iPhones, enabling your iPhones for the app (device identifier) and installing the app
• DeepL (Germany): translating chat messages on the free plan, under which DeepL may use the texts to improve its services, only if we have switched on translation
• Ably (United Kingdom): signal for new chat messages, only if we have switched on Ably

Some of these providers are based in the USA or process data there. The transfer is covered by the EU standard contractual clauses in the providers' data processing agreements or by the EU-US Data Privacy Framework.

How long we keep data

• Chat: until 3 March 2027, then we permanently delete everything
• Live location: while sharing, at most 60 minutes; after that we delete the coordinates as described above
• Account, reply, trip data, checklist, packing list, wildlife list and gallery photos: until 31 March 2027 at the latest, then we delete everything for good
• Registered iPhones (device identifier, model, iOS version, name): until 31 March 2027 at the latest, like your account; we disable the devices at Apple after the trip
• Allergies and diet from the app: until you delete them, at the latest until 31 March 2027, then we delete them for good
• Your phone's registration for notifications: until you sign out
• Data on the phone: until you sign out or delete the app
• Server logs at the hosting provider: only a short time

If you ask us to, we delete your data earlier.

Legal basis

• Planning the wedding and the trip, running the website and the app and keeping them secure: our legitimate interest (Art. 6(1)(f) GDPR)
• Notifications, live location, photos, registering your iPhone and anything you tell us voluntarily: your consent (Art. 6(1)(a) GDPR)
• Information about allergies, diets for health or religious reasons and your emergency details: only with your explicit consent (Art. 9(2)(a) GDPR), which you give in the app or on the website by ticking the consent box, or in the website questionnaire by entering them voluntarily, and can withdraw at any time; they are used only for catering at the wedding and so that the right help can be given to you in an emergency

You can withdraw your consent at any time, for example by switching off notifications, stopping location sharing, deleting your details under “Allergies & diet” or writing to us.

Your rights

You can ask us at any time which data we store about you and get a copy of it. You can ask us to correct wrong data, to delete data or to restrict its use. You can object to processing that is based on our legitimate interest.

To do so, write to us at the address above. You can also request the deletion of your account in the app (Settings → Delete account); we then delete the account and your data within 7 days.

You can also complain to a data protection supervisory authority, for example in the country where you live.