Dawarich Privacy Policy

This policy applies to the Dawarich SaaS at dawarich.app, the hosted tier, and the iOS and Android apps when connected to our SaaS. If you self-host, no data reaches us and you are the sole controller.

1. Controller​

ZeitFlow UG (haftungsbeschränkt) — Kolonnenstraße 8, 10827 Berlin, Germany. Managing Director: Evgenii Burmakin. Email: hi@dawarich.app. Full company details: Impressum.

2. What We Process and Why​

The poster file you order is a map rendering of the location data you selected in the Poster Studio. It is shared with our payment and print partners (Section 3) solely to process and produce your order.

No automated decision-making with legal effect (Art. 22). Providing this data is voluntary but necessary to use the service.

Since March 2026, reverse-geocoded place names are no longer stored for SaaS users — they are computed on demand and discarded.

3. Recipients / Processors​

All listed processors are bound by DPAs under Art. 28 GDPR. We do not sell data or share it for advertising.

Rybbit, the analytics tool named in section 6, runs on our own Hetzner infrastructure (rybbit.dwri.xyz) rather than a vendor's hosted service, so it adds no processor to this table — no third party receives that data.

International transfers: UK (Paddle) is covered by the EU adequacy decision. Norway (Gelato) is in the EEA, where the GDPR applies directly. US transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (Art. 46 GDPR) otherwise.

4. Retention​

• Account and location data: while your account is active; up to 12 months after cancellation unless you request earlier deletion.
• Poster print files: deleted within 48 hours if the order is not paid; kept up to 90 days after purchase for reprints and support, then deleted.
• Billing data (including poster order records): up to 10 years (§ 147 AO, § 257 HGB).
• Error logs: up to 30 days.
• Support correspondence: up to 3 years after last contact.
• Tool uploads awaiting an account: deleted within 24 hours if you do not complete signup. Once claimed, the file becomes an import in your account and follows the account-data rule above.

The free tools at dawarich.app/tools/ process your files entirely in your browser by default; nothing is uploaded unless you press "Save to my Dawarich account".

5. Your Rights​

You have the right to access (Art. 15), rectify (16), erase (17), restrict (18), port (20), object to processing based on legitimate interest (21), and withdraw consent at any time (7(3)) without affecting prior processing. To exercise any right, email hi@dawarich.app or delete your account in-app.

You may also lodge a complaint with a supervisory authority (Art. 77). Our competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de); you may instead complain in your country of residence or workplace.

6. Cookies​

On dawarich.app we use:

Rybbit stores a randomly generated visitor ID in your browser's local storage so that repeat visits are counted as one visitor rather than several. It is written on the first page you open, before the banner appears, and we do not currently ask for consent before writing it. It contains no personal data, is never sent to a third party, and you can remove it by clearing site data for dawarich.app.

The Google Ads tag is present on every page, but it runs under Google Consent Mode with ad_storage, ad_user_data, ad_personalization and analytics_storage all set to denied until you accept. In that state it writes no cookies and no identifiers to your device; if you never accept, or you decline, it stays denied. The Brevo and Partnero tags are not loaded at all before consent.

Because the tag itself loads, it does send Google a cookieless request on each page view containing the page address, your IP address and browser user agent, with ad-click identifiers redacted. It sets nothing on your device and carries no identifier that would let Google recognise you on someone else's site — but it happens whether or not you accept.

If you reached us from one of our ads, the tag also copies the ad-click identifier Google placed in your landing URL (gclid, alongside a _gl parameter) onto links you follow to my.dawarich.app, so that the click and the sign-up can be matched. This travels in the address bar rather than in a cookie, is limited to our own two domains, and also happens whether or not you accept. It is the reason we keep the tag loaded at all: without it, that link between an ad click and a sign-up is lost.

To change your mind either way, use the control below — the Cookie Settings link in the footer of every page brings you back here. It clears your stored answer, switches Google Ads storage back off straight away, and reloads the page so the Brevo and Partnero tags stop running and the banner asks you again.

Delete the dawarichCookieConsent cookie and reload the page. With JavaScript enabled, a one-click button appears here instead.

On my.dawarich.app we additionally use first-party session cookies strictly necessary for login.

7. Security​

HTTPS for all transfers, encrypted database storage and backups, application data stored in the EU. Crash traces may be sent to Sentry (US) and retained for up to 30 days.

8. Children​

You must be at least 16 years old to use Dawarich. We do not knowingly collect data from children under 16.

9. Hosted Dawarich (legacy Patreon tier)​

For the legacy "hosted dawarich" Patreon tier, each instance runs on a dedicated server, accessible only to the subscriber. We access it only for maintenance. Cancellation may lead to deletion after a grace period.

10. Changes​

We will notify you of material changes (new purposes, new processors, changed retention, etc.) by email and/or in-app notice at least 30 days before they take effect. Non-material edits are published here with an updated date below.

Last updated​

Effective 2026-09-02. Contact for all privacy matters: hi@dawarich.app.