Privacy policy for the website and the Sermony app for Android and iOS

Status: The information about this website applies unchanged. The sections on the Android and iOS app describe the state before their release — the app is not yet available on Google Play or the Apple App Store. This note will be removed upon release.

1. Scope and controller

This policy covers the website sermony.de and the Sermony app for Android and iOS. It applies to both operating systems; differences are noted in the relevant sections.

Responsible for this website and for publishing the app:

Eduard Seibel
Am Schützenhof 11
27726 Worpswede
Germany

Email for contact and privacy matters: [email protected]

You can also use the contact form.

The app connects to the congregation server you select. The operator of that server, not us, is responsible for your user account, the congregation management and all content. Their privacy policy applies to this in addition; the app links it next to this one.

The services involved in app notifications are described in section 6.

Entering a third-party server address transmits data to that server. The operator of this website does not automatically gain access to its user accounts or content as a result.

2. Visiting the website

When a page is requested, we process in particular the IP address, the requested address, the time and technical information about the browser and connection. This makes it possible to deliver the website and to detect malfunctions or abuse.

The website is operated by a hosting provider in Germany. For delivery and protection against attacks we use Cloudflare, Inc., USA. Cloudflare processes the connection data and website requests passing through its infrastructure, including the content transmitted. Information on international transfers can be found in section 7.

The form features limit requests based on the IP address; the identifiers used for this are held in memory only and cover a time window of at most ten minutes. Log data is kept only briefly and is continuously overwritten. It is not combined with other data and is not used to identify individual persons.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing the website in a functional and secure manner.

3. Language, appearance and cookies

The website stores the selected language and colour scheme as well as the dismissal of the cookie notice. These cookies are set to last up to one year each; you can delete them earlier in your browser.

No advertising or audience measurement tools are used.

Storing and reading these functional settings serves the language and appearance you selected and remembers the dismissed notice (Section 25(2) No. 2 TDDDG). Where personal data is processed in this context, this is based on our interest in a usable website under Art. 6(1)(f) GDPR.

4. Contact requests

The contact form processes your name, email address, optionally your congregation or organisation, subject and message. The request is sent to the responsible contact mailbox. The data is used to process and answer your request.

We handle general project and support requests on the basis of Art. 6(1)(f) GDPR; our interest is answering your message. Requests to exercise your data protection rights are handled to fulfil our legal obligations under Art. 6(1)(c) GDPR. Reading the privacy policy does not constitute consent to advertising.

Please do not send passwords, access tokens or unnecessary information about other people. For deletion requests, the server address and account email are sufficient to begin with.

The contact mailbox is operated by us on rented server infrastructure in Germany. Only Eduard Seibel has access to the messages. We keep them as long as necessary to process them and for possible follow-up questions and delete completed cases afterwards. Records of consent and open data protection requests are subject to a separate retention period.

5. Notification about the self-hosted launch

If you sign up, we store your email address, the time of sign-up and confirmation, the version of the consent text, and the confirmation and unsubscribe keys. You first receive an email to confirm your sign-up. No additional notification containing your address is sent to our support mailbox.

The launch notification is based on your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time via the unsubscribe link in your confirmation email or via the contact form. Withdrawal does not affect the lawfulness of processing carried out before it. For older sign-ups without an unsubscribe link, you can use the contact form or the email address above.

Unconfirmed sign-ups are deleted from the active database after seven days. Confirmed sign-ups, including their records of consent, are deleted no later than 365 days after confirmation. The automatic clean-up runs every minute; after server downtime, at the next start. Signing up again or clicking the confirmation link again does not extend these periods. If you unsubscribe, the entry is removed from the active database immediately. Backups have their own deletion cycle (section 8).

6. Data in the Android and iOS app

Account and selected server

When you sign in and use the app, credentials or sign-in tokens, account identifier, profile information and the required permissions are processed with the selected server. This may include your name, email address, congregation membership and an optional profile picture. Your IP address is also processed with server requests.

The app stores the selected server address and connection settings on the device. Sign-in tokens are stored using the operating system's protected storage.

Content and playback

For playback, the app loads media and associated information from the selected server. Playback progress, playback events and completion of a playback can be stored on the server linked to an account. This serves to resume playback and for the instance's statistics.

Individual playback events are stored in personal form only briefly; the statistics derived from them no longer contain any link to an account. The exact periods are set by the operator of your server.

For downloads, media, images and associated information are stored on the device. When listening offline, progress data may first be stored locally and synchronised with the server later. Downloads can be removed in the app.

Congregation membership and the content used may allow conclusions about religious beliefs — special categories of data under Art. 9 GDPR. The legal basis on which your server operator processes them is determined by that operator; for congregations, Art. 9(2)(d) GDPR or church data protection law will usually apply.

Error reports

The app can send technical error reports to the selected server. These contain the error message, technical error details, the affected app page, app version and platform. On the server, the report may be linked to the account email.

On Android, a crash report may be temporarily stored on the device until it is sent. Retention on the server is determined by its operator.

Error diagnosis serves secure and functional operation (Art. 6(1)(f) GDPR). Access is limited to the authorised persons of the selected server.

Notifications

For notifications on Android and iOS, Google Firebase Cloud Messaging (FCM) is integrated. On iOS, delivery additionally takes place via the Apple Push Notification service (APNs). In the process, installation and delivery identifiers as well as technical delivery information are processed. The selected Sermony server stores the link between a delivery identifier and the account and device platform.

Depending on the server configuration, delivery is relayed via a central Sermony service. For this purpose it processes delivery identifiers, the device platform and technical information about the notification. This may also be the case for an independently operated congregation server.

The notification itself contains no content: after receipt, the app loads the text to be displayed from your server. Identifiers and technical delivery data are nevertheless processed by the delivery services.

Push is voluntary and turned off by default. You turn it on yourself — when you first start the app or later under Settings → Notifications. As long as it is off, no push registration takes place; the app then does not load the delivery SDK either.

The legal basis is Art. 6(1)(b) GDPR: you expressly request the notifications, and the processing described is necessary to provide them. The associated access to your device does not require consent under Section 25(2) No. 2 TDDDG, because it is strictly necessary for the service you expressly requested. The time and version of the activation are stored on the device. The app also works without push.

You can turn push off again in the same place. The app then unregisters the delivery identifier with the server and requests deletion of the Firebase delivery and installation identifier; on iOS it also unregisters from Apple delivery. In case of connection errors, the deactivation remains in effect and the technical unregistration is completed on a later attempt or the next signed-in use. Merely turning off notifications in the operating system settings does not replace this deletion path.

Google states a period of up to 180 days for removing the data associated with a deleted Firebase installation identifier from its active systems and backups. This is not an additional storage of the delivery identifier in your Sermony account. More information: Firebase: Delete installation IDs, Privacy and Security in Firebase and Apple Privacy Policy.

7. Service providers and data transfers

Recipients are hosting providers for server operation in Germany, Cloudflare for delivering and securing website requests, and Google and, on iOS, additionally Apple for app notifications. Support is handled in-house by Eduard Seibel.

With Cloudflare and the app delivery services, processing outside the European Economic Area, in particular in the USA, is possible. A server in Germany therefore does not mean that data is processed exclusively in Germany. This is based on Cloudflare's data processing addendum and the corresponding terms of Google and Apple; they provide safeguards under Chapter V GDPR including standard contractual clauses. For transfers to certified companies in the USA, the European Commission's adequacy decision on the EU-US Data Privacy Framework also applies.

For independently operated congregation servers, any further service providers depend on their setup. Selecting your own server therefore does not automatically mean that all data is processed exclusively on that server.

8. Retention and account deletion

Account deletion can be requested in Sermony under Profile → Security → Delete account. Access is blocked immediately. Final deletion takes place after a period set by the operator of your server (software default: 30 days).

Personal settings, sign-ins and playback progress are linked to the account and are removed when it is finally deleted. Delivery identifiers are removed from the account as soon as deletion is requested. Congregation content may contain personal information, voice or image and requires a separate review; it does not automatically become anonymous when an account link is removed.

Administration logs record security-relevant changes and deletions and may contain account and operation identifiers, email and IP addresses. They serve traceability and proof that deletion obligations have been fulfilled (Art. 6(1)(f) GDPR). Their retention is determined by the operator of your server.

Deleted data may remain in backups for some time. The backup cycle and its periods are determined by the operator of your server.

A deletion request is also possible without the app installed. The steps are described under Delete your Sermony account and associated data. Uninstalling the app does not delete a server account.

9. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent with effect for the future. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation.

Address your request to the controller responsible for the data concerned. You also have the right to lodge a complaint with a competent data protection supervisory authority.

For processing by Eduard Seibel, the competent authority is the State Commissioner for Data Protection of Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, email: [email protected]. You may also contact another competent supervisory authority, in particular at your place of residence or at the place of the alleged infringement. For independently operated congregation servers, a different, possibly church, supervisory authority may be competent.