Skip to content
aevana

Privacy policy

This English version is a courtesy translation. The German version is legally binding and prevails in case of any differences.

1. Controller

Wi3e Digital UG (haftungsbeschränkt)
Friedrich-Ebert-Straße 55
42103 Wuppertal
contact@aevana.de

2. Hosting

This application is operated by a hosting provider with servers located in the European Union. Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Server location: Nürnberg

3. Data collected

We process the following categories of personal data:

  • Account and family data: the organizer's name and email address, the child's name and date of birth, the chosen delivery (reveal) date, the plan purchased, and billing/invoice address (Germany only).
  • Sign-in with Google or Apple (optional): if you, as organizer, register or sign in with your Google or Apple account, we receive from that provider your name, your email address, whether the provider has verified that email address, and a user ID assigned by the provider. With Apple, the email address may be a relay address generated by Apple ("Hide My Email"); Apple only sends the name on the first sign-in. Of this, we store the name, email address, the provider and the user ID. We do not store the provider's access or refresh tokens, and we get no access to any other data in your Google or Apple account. An account created this way initially has no password; you can set one in your profile at any time.
  • Free start: to limit the free start to one per account and per child, we store on the account a note that a free start was used, and, as a keyed one-way fingerprint (hash) of the child's normalized name and date of birth, a marker on the capsule and in a separate table that is independent of the capsule. The fingerprint does not allow the name or date of birth to be read back.
  • Contributors: the name, relationship to the child, and email address of every invited contributor (the invitation address), plus their individual, randomly generated submission email address. If the submission address is replaced, we keep the person's earlier submission addresses with the time of the replacement, so that emails to an old address can still be matched and are deleted with the family. If the person changes their invitation address themselves, we store the new address until it is confirmed (24 hours at most) and then, for 14 days, the previous address (encrypted), so that the change can be undone. If a contributor accepts the invitation to the web interface, a user account (email address, hashed password) is additionally created for them; we store the link between the account and the invitation address as the time of confirmation and a hash of the confirmed address.
  • Check of the sender of incoming emails: so that only the invited person sends contributions, we check every email to a submission address: whether the sender address in the message header (the "From" header) is exactly the invitation address, and whether our mail server could confirm the sender's domain with DMARC. "Reply-To", "Sender" and the envelope sender do not count for this check. We store the sender address from the header (encrypted), the result of the check (verified; address matches but is not verified; address matches but could not be checked because of a technical problem on our side; another address) and the technical check values (the results of DKIM, SPF and DMARC, the checked domain and whether a "Sender" header was present), these without any address. Only a verified message becomes a contribution. Every other message is discarded: no contribution is created. The invitation address then receives, at most once in 24 hours, a notice that an email to the submission address was ignored, with the sender address partly masked. If the check could not run because of a technical problem on our side, the invitation address instead receives, also at most once in 24 hours, a notice that the email could not be processed and should be sent again later (without the sender address); once the problem is fixed it receives one further notice per incident. For this we store, in the log entry, the time at which that notice was sent. We send nothing to the sender. The organizer sees only the number of emails ignored and, separately, of emails not processed because of a technical problem in the last 30 days, neither sender nor content. For a discarded email, the encrypted raw message and, in its log entry, the encrypted sender address (from the envelope and the header) and the encrypted subject are deleted together, 7 days after receipt at the earliest (section 6); the result of the check, the recipient address, the time and technical identifiers of the message (Message-ID, queue number, size, number of attachments) remain in the log entry. If a very large number of discarded emails reach one submission address within a short time, further ones are not evaluated and not stored as raw messages for the rest of that period; a log entry with the envelope data remains, and its encrypted sender address is deleted after the same period.
  • One-time codes and confirmation links for addresses: to link an account to an invitation, replace the submission address or change the invitation address, we send a six-digit code or a confirmation link to the invitation address (and, for a change, also to the new address). A code is valid for 15 minutes; we store it only as a keyed hash in the session data, not in plain text, and we limit the number of codes and of attempts.
  • Notices about address changes: when a person changes their own invitation address, we notify the previous address (with a cancel link at the request, and after the change with a link to undo it for 14 days), the new address and the organizer (who sees the new address only partly masked). When the organizer or our support team replaces the address, we notify the previous address (unless it was unreachable), the new address and a linked account; when our support team replaces it, the organizer is told too (with the contributor's name only). When the submission address is replaced, we notify the contributor and, unless the organizer did it, the organizer. The related audit log entries contain only ids, no addresses.
  • Trusted contact (optional): the organizer can name one trusted contact per capsule and gives us that person's name and email address for this. We store these details, the language for emails and whether the person has accepted. We send the person an invitation; further messages are sent only after they have accepted: on delivery of the capsule, before the end of access after delivery, when the organizer does not answer our regular check-in and when the recipient is waiting for confirmation. The trusted contact can confirm the recipient in place of the organizer and correct the recipient's email address as long as the recipient is neither confirmed nor has set a password. The trusted contact does not see any content of the capsule.
  • Content (entries): photos, voice notes, and text messages/captions submitted by contributors, either by email or via the web interface for contributors with a user account. Photos are automatically re-oriented based on their EXIF orientation during processing, and all EXIF metadata — including any GPS location data — is stripped in the same step. Audio files are transcoded to a single standard format. Drafts started but not submitted via the web interface are automatically deleted 90 days after they were last saved; we remind a contributor with a user account by email 7 days before. Contributions held because a limit was reached (free start or storage limit) are stored in the same way until they are added or the capsule is deleted.
  • Second copy of photos and voice notes: a second copy of the uploaded photos and voice notes (originals and display copies) is stored in a separate storage bucket with its own access credentials at the same storage provider (Hetzner) in the EU/EEA (section 7).
  • Raw inbound email: messages received by email, including those that failed the sender check, are temporarily stored in their original form so that a failed processing can be repeated (see section 6). They are stored encrypted; their content is not visible to our team in our admin interface.
  • Recipient login data: the contact email address and password (hashed) of the recipient (the child, or their legal representative) used to access the sealed capsule after delivery. Because delivery can also happen early ("early exit") before the child's 18th birthday, the recipient may still be a minor at that point; first access is in every case only unlocked after explicit confirmation by the organizer, or in the organizer's place by the trusted contact they named or by our support team (see § 3 of the AGB).
  • Payment, order and invoice data: orders (plan, add-ons, additional delivery years, upgrades), payment status and payment references, the means of payment used, refunds and chargebacks, invoices and credit notes ("Rechnungskorrektur") with buyer name and billing address, and the confirmations given at checkout (AGB, privacy policy, withdrawal instructions, request to start immediately) with timestamp and version of the text. Payments are processed through our payment provider Mollie (section 7); we do not store card or PayPal details.
  • Gift vouchers: for a voucher purchase, including without an account, we process the buyer's name, billing address and email address, the optional gift message, the voucher code, its balance and its redemptions. The person redeeming a voucher is not shown the buyer's data, and the buyer is not shown the redeemer's data.
  • Promotional codes: if you redeem a promotional code with an order, we store which code was used for which order of the family with which discount, the payment reference, the status of the redemption (reserved, redeemed, released) and the times. The code, the name of the promotion and the discount also appear on the order and on the invoice.
  • Support requests: if you contact us via the contact form, we process your name, email address, the topic and your message; for signed-in organizers we add the capsule concerned, its status, the latest order, the language and the app version, so that we can help you.
  • Usage/log data: server logs and an audit log of security-relevant account actions (e.g. deleting a family, a refund, a payment dispute, confirming the recipient).
  • Time of last sign-in: we store the time of the last successful sign-in to your account, so our support team can tell an inactive account from a locked-out one. The time is deleted when the account is deleted.
  • Funnel data without cookies: see section 10.
  • Analytics data: see section 10 (consent-based only).

4. Purpose of processing

We process this data to: fulfil the contract for the digital time capsule (account management, free start, receiving and processing contributions, managing contributors, delivering the capsule on the chosen date or on early exit by the organizer, exports and wind-down exports); enable registration and sign-in, optionally with Google or Apple, including matching an existing account with the same email address verified by the provider, to avoid duplicate accounts, and connecting a Google or Apple account to your account in your profile, also if it uses a different email address (in that case we store only the provider and the user ID); notify the trusted contact named by the organizer and let them confirm the recipient; process one-time payments, refunds and payment disputes via Mollie; issue invoices and credit notes and retain accounting records required by law; sell and redeem gift vouchers; check and redeem promotional codes and keep to their usage limits; answer support requests; secure the recipient's access to the capsule (password login, confirmation by the organizer, the trusted contact or our support team); make sure that contributions by email and through the web interface come only from the invited person, and prevent anyone from pretending to be them (sender check, one-time codes and confirmation links, notices about address changes, linking an account only to a confirmed invitation address); operate the service securely and reliably (abuse/rate limiting of submission addresses, voucher codes and promotional codes; a second copy of photos and voice notes to restore them after a disaster); understand how our offer is used without identifying you (funnel data); and, only where consent has been given, evaluate service usage in a pseudonymized way (section 10).

5. Legal basis

  • Art. 6(1)(b) GDPR (performance of a contract) for account management, processing of contributions, capsule delivery, payment handling, gift vouchers, the redemption of promotional codes, support requests relating to a contract, and recipient access.
  • Art. 6(1)(b) GDPR also for registration and sign-in with Google or Apple. This sign-in is optional and chosen by you; registration and sign-in with email address and password remain available at all times.
  • Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in preventing a false identity) for the sender check of incoming emails, the one-time codes and confirmation links for addresses, the notices about address changes, and the storage of the sender address, the result of the check, the previous and the unconfirmed new address and the earlier submission addresses under sections 3 and 6.- Art. 6(1)(c) GDPR (legal obligation) for the commercial/tax-law-mandated retention of order and invoice data (§ 257 HGB, § 147 AO).
  • Art. 6(1)(f) GDPR (legitimate interest) for abuse prevention/rate limiting of submission addresses, voucher codes and promotional codes, for the limit of one free start, for the second copy of photos and voice notes (protection against loss), for the temporary, encrypted storage of raw email messages to repeat a failed processing, for the cookie-free funnel data and for other support requests.
  • Art. 6(1)(a) GDPR (consent) for analytics/tracking data under section 10; consent can be withdrawn at any time with effect for the future.
  • Art. 8 GDPR: if the recipient is still a minor at the time of delivery (e.g. following an early exit triggered by the organizer), their access is only unlocked after confirmation by the organizer (typically a parent or legal guardian), or in the organizer's place by the trusted contact they named or by our support team.

6. Storage period

  • Account, family, and content data (entries, attachments, contributors) are stored for as long as the family exists and are removed immediately once the organizer deletes the family (right to erasure, see section 8). A log entry recording the deletion itself (including the ID of the family and of the person who triggered it, counts of deleted entries and attachments, and, where applicable, payment references) is kept in our audit log for accountability and security purposes. The audit log also records tax-relevant actions (e.g. refunds, consents, invoices) and changes to content: that a caption was edited or an entry was deleted (without the caption text), the labels of milestones, and the reasons for which the organizer referred an entry to our team for review, together with our answer. These content details are stored encrypted. When the family is deleted, we remove the personal details (names, email addresses, captions, labels, notes and storage paths) from all of the family's log entries; only IDs (including payment references), counts, dates and the kind and status of the action remain. Likewise, when an account is deleted, we remove these details from the log entries about the account itself (e.g. a change of email address, a recovery by our team, adding or removing a passkey). The entries of the audit log are deleted automatically after 10 years.
  • The connection to Google or Apple (provider and user ID) is deleted when you disconnect it in your profile, and at the latest together with your account, like the rest of the account data. We do not store the provider's access or refresh tokens.
  • Free start: if no plan is purchased, the capsule is read-only for 30 days after the 30-day free start and then permanently deleted. The note on the account that a free start was used remains as long as the account exists. The keyed fingerprint of the child's name and date of birth is kept for 24 months after the free start began, also if the capsule has been deleted in the meantime, to prevent a second free start for the same child, and is then deleted.
  • Delivered capsules: the recipient has access for 365 days after delivery; if the recipient is confirmed only after delivery, the 365 days start with the confirmation but end no later than 730 days after delivery. After that, the capsule and all its contents, including export files, are permanently deleted. Reminders are sent 60, 30 and 7 days before. If the recipient is still not confirmed when access ends, access is extended once by a further 365 days; if the recipient is still not confirmed after that, the capsule is not deleted automatically.
  • Trusted contact: the trusted contact's name and email address are deleted when the person declines or ends the role, when the organizer removes them or names another person, and at the latest when the family is deleted.
  • Refunded capsules and capsules for which a payment dispute was lost are closed (read-only) and permanently deleted 90 days later; reminders are sent 14 and 3 days before.
  • Platform shutdown: about 90 days before a planned shutdown, every family receives a full export; 7 days before the shutdown, the capsules stop accepting new contributions, and every family whose contents have changed since the first export receives a final, updated export; after the shutdown, all data is deleted, except the data we must retain by law (see below).
  • Drafts started but not submitted via the web interface are automatically deleted 90 days after they were last saved; raw inbound email messages are automatically purged after 7 days at the earliest by default, a successfully processed message only once the entries created from it are safely stored.
  • Sender check and contributors' addresses: the log entry of an email to a contributor's submission address (recipient address, encrypted sender address from the envelope and the header, result of the check and technical check values) is kept until the family is deleted; only the raw message is purged after the period stated above. For a discarded email (also one that could not be checked because of a technical problem on our side), however, the encrypted sender address (from the envelope and the header) and the encrypted subject in the log entry are deleted together with the raw message (7 days after receipt at the earliest; the cleanup runs daily and repeats if deleting the raw message fails); the same applies to the log entry of an email that was not evaluated because too many discarded emails had arrived. The recipient address, the result of the check, the technical check values, the time and the technical identifiers of the message (Message-ID, queue number, size, number of attachments) of a discarded email remain until the family is deleted. The previous invitation address after a change made by the person themselves is emptied once the 14-day undo period has ended, an unconfirmed new address once its 24 hours have ended (the cleanup runs daily). A person's earlier submission addresses are kept until the family is deleted. A one-time code is valid for 15 minutes and exists only in the session data. When the family is deleted, the contributors with all of this data, their address history and all log entries of incoming emails to their submission addresses (earlier ones included) are deleted; the audit log entries about address changes contain only ids.
  • Order, invoice and credit-note data, including the buyer data of gift vouchers, is, by way of exception to family deletion, retained for 10 years as required by § 257 HGB / § 147 AO (Art. 17(3)(b) GDPR), after which it is automatically deleted. For gift vouchers, this period starts for the buyer data kept with the voucher itself only once the voucher is fully redeemed, voided or expired; the invoice follows its own period. If a voucher purchase is not paid (cancelled or failed payment, no voucher and no order), there is no retention duty: the name, address, email address and gift message are then automatically deleted 30 days after the purchase attempt. A retained invoice is no longer linked to the deleted capsule.
  • Promotional codes: the redemption of a promotional code is stored as long as the family exists. When the family is deleted, its link to the family, the organizer, the order and the payment is removed; only the code, the discount, the status and the times remain, without reference to any person, so that the number of redemptions of a code and the accounting stay correct. The code and the discount on the invoice are retained with the invoice (see above).
  • Support requests are stored while they are open and for 12 months after the request has been closed, and are then deleted or anonymized; open requests are not deleted.
  • Funnel events (section 10) are stored for 25 months and then deleted.
  • The second copy of photos and voice notes (section 7) is deleted together with the capsule when the family is deleted, and when an individual entry is deleted. It is used only to restore data after a disaster.
  • We take a daily backup of the database (account, family, and billing data) at Hetzner, kept separate from the primary storage account; these backups are kept, on a tiered schedule, for up to roughly two and a half years before automatic deletion, and are used solely for disaster recovery. Uploaded photos and audio files are not part of this database backup; for them we keep the second copy described above. Already-deleted database content may therefore still be present in a backup until that period has elapsed.

7. Recipients and processors

  • Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany): hosts the application server (server location Nuremberg), provides object storage for photos and audio files and for export files, holds the separate account used for our database backups and stores the second copy of photos and voice notes (originals and display copies) in a separate storage bucket with its own access credentials, separate from our primary storage — all within Hetzner's EU data centers.
  • Mollie (payment provider): processes payments by card, PayPal, Apple Pay and Google Pay, as well as refunds and chargebacks; it receives the data required for this (name, email address, billing address, amount, payment details you enter with Mollie).
  • smtp2go (transactional email delivery, e.g. contributor invitations, invoices, delivery notifications and reminders): we have a data processing agreement with this provider; processing takes place exclusively within the EU.
  • ERPNext (accounting system for invoices and credit notes): operated by us, EU-based; it receives the data on invoices and credit notes (buyer name, billing address, amounts, payment status).
  • PostHog (usage analytics, hosted in the EU): only with your consent (section 10). It is not used for the funnel data described there.
  • Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA) and Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; parent company Apple Inc., USA): only if you choose "Continue with Google" or "Continue with Apple", or connect a Google or Apple account to your account in your profile. You are then redirected to the provider's sign-in page; the provider operates its sign-in service under its own responsibility and its own privacy policy (Google, Apple). Data may be transferred to the USA in the process; the provider bases this transfer on its own safeguards. The provider only sends us the data listed in section 3.
  • If a technical error occurs, a short technical error description (affected component, error message, file/line, a truncated stack trace) may be sent to an internal error-reporting service we operate; in individual cases this may unintentionally include personal data if it happens to be part of the error message.

Beyond the recipients listed above, we only share your data where we are legally required to do so.

8. Rights of the data subject

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). As organizer, you can independently export a complete copy of your family's data (all entries and their metadata) and permanently delete your family via the family settings. You can disconnect Google or Apple in your profile, provided you have set a password or connected another way to sign in; at the latest, the connection ends when you delete your account in your profile; you can also remove aevana's permission in your Google or Apple account settings. As a contributor, you can change your invitation address and replace your submission address yourself (page "How contributing works"); our team answers requests for access, rectification or erasure by hand, starting from your invitation address. For any other request, contact contact@aevana.de.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de

10. Cookies, funnel data and analytics tools

We use technically necessary cookies (e.g. the session cookie, CSRF protection, locale preference). For optional, privacy-friendly usage analytics (PostHog, hosted in the EU) we additionally set a cookie (posthog_consent) that stores your decision from the cookie banner. Analytics is only enabled once you actively opt in ("Accept all"); without your consent, no data is sent to PostHog. You can withdraw your consent at any time via "Cookie settings" in the footer. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

With your consent, PostHog (EU servers) records two kinds of data: first, page views in the browser, without a cookie for the analytics, without automatic capture of clicks or inputs and without session recording; secrets in addresses (such as access links and reset links) are removed before anything is sent. Second, our servers send individual events that are triggered by your actions. These events fall into the following categories: purchase flow (e.g. plan selection, start of and return from payment, the result of entering a voucher or discount code), activity of organizers and contributors (e.g. capsule created, contributors added or invited, entry started, submitted or rejected, timeline and preview opened), use of the hand-over by recipients (e.g. link opened, login, view changed, export requested), actions of the trusted contact, and account and security actions (e.g. successful or failed login, sign-in with Google or Apple, passkey, data export, early exit, deletion of a capsule or account). Logged-in organizers and contributors are identified there by their internal account number; for recipients, trusted contacts and voucher buyers without an account we use a random internal identifier of the respective access (capsule-access:, trusted-contact:, voucher-purchase:), and on pages without a login the identifier of the current session instead. Events of a capsule are assigned to that capsule (grouping by family). As properties we only send identifiers, selection values, counts, yes/no values and coarse size buckets, as well as language, role, the application version, a hashed browser identifier (user agent) and the page address visited without parameters (left empty for secret links). We do not send names, email addresses, birthdates, addresses, entry content, codes, access tokens or secret parts of addresses, and for failed logins we do not send the identifier that was entered. Staff members with access to the admin area are not tracked, and the admin area is excluded from page tracking.

Independently of this, we count a few steps of our offer in our own database, without cookies and without anything being stored on your device: page views of the landing page (without any identifier), registration, creation of a capsule, start and completion of a purchase, and the first entry, each with date and time and, where relevant, the plan and price. We do not store your IP address, browser information, referrer or campaign data. Events are linked at most to your account or capsule; if these are deleted, the link is removed and the events remain only as anonymous counts. The events contain no personal data and are deleted after 25 months. Since no information is read from or stored on your device, no consent is required for this; the legal basis is Art. 6(1)(f) GDPR (our interest in understanding and improving our offer).

11. Recipient after delivery

On delivery, the recipient receives access to the capsule and, from then on, has their own rights as a data subject under section 8. Once the recipient is of age, they can contact us at contact@aevana.de to obtain access to and a copy of their data, to have it rectified or to have it deleted; we examine each request, taking into account the rights of the contributors whose contributions form part of the capsule. After the access period, the capsule is deleted as set out in section 6; the export is the only way to keep a copy.

We use privacy-friendly analytics (PostHog, hosted in the EU) to understand how aevana is used. We only turn this on if you agree. You can change your mind anytime under "Cookie settings" in the footer, or read our Privacy policy.

Your session has expired

Your session has expired. Reload the page to continue – your text is kept.