Privacy policy

1. Who is responsible

Kilian Nepomuk Abeln
162 Victoria Street
Potts Point NSW 2011
Australia
Email: realup.de@gmail.com · Contact form

RealUp is a private project, not a company. It is currently run from Australia. For people in the European Union the General Data Protection Regulation (GDPR) still applies, so this policy follows it.

2. This website (realup-app.com)

2.1 Hosting

The website is hosted by Cloudflare, Inc., USA (Cloudflare Pages). When you open a page, Cloudflare has to process your IP address, the time, the page you asked for and your browser’s identification (user agent), to deliver the page and to fend off attacks. RealUp does not analyse this data and uses no visitor statistics.

Legal basis: our legitimate interest in a secure, working website, Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and a data processing agreement is in place.

2.2 No cookies, no ad trackers

The website sets no cookies and uses no advertising tools. The font and our scripts come from our own server. The only outside scripts are Cloudflare’s statistics script (2.3) and, only on the log-in page, the waitlist page and the page for deleting your account, Cloudflare’s bot protection (2.8). Nothing is loaded from Google or other third parties, and no videos are embedded. The website only talks to our database at Supabase (section 4) when you log in, join the waitlist, use the contact form or delete your account.

The buttons for Instagram, TikTok, X and YouTube are plain links. Nothing is sent to those services until you click one. After that, their privacy policies apply.

2.3 Visitor statistics

We use Cloudflare Web Analytics to see how many people visit the website and which pages they read. It sets no cookies and stores nothing on your device. According to Cloudflare, it uses no fingerprinting, doesn’t recognise you on your next visit and doesn’t follow you across other websites.

Cloudflare records the page you visited, the time, the website you came from, your browser and device type, your country and how fast the page loaded. We only ever see totals, never individual visitors. Legal basis: our legitimate interest in knowing how the website is used, Art. 6(1)(f) GDPR. Cloudflare, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework.

2.4 What is kept in your browser

To log you in, the website keeps a few small entries in your browser’s storage. They are strictly necessary for the service you asked for, so no consent is needed (§ 25(2) no. 2 TDDDG). The data in them is processed to provide the service (Art. 6(1)(b) GDPR). None of it is used for tracking.

2.5 Your account on the website

The website uses the same account as the app. To sign up, you enter your email address and a password, and we email you a code to confirm the address. Your password is never stored in plain text. Purpose: logging you in. Legal basis: Art. 6(1)(b) GDPR.

Log in with Google or Apple. If you use one of these buttons, you’re sent to Google or Apple, and their privacy policies apply there. RealUp then receives your email address and, depending on the provider, your name and a link to your profile picture.

2.6 The waitlist

You can join the waitlist with just your email address, no account needed. If you open the waitlist page while logged in, you’re added with your account. We store your email address, an invite code, the code of the person who invited you (if any), when you joined, your language, a random key for the links in our emails, when we last emailed you about the waitlist and, if you have an account, your user ID. If you create an account later with the same address, your entry is linked to it and you keep your spot.

Purpose: to show you your spot, to send you one email with your spot, and to tell you when RealUp launches. If someone enters an address that is already on the list, we send that email to that address again (at most once every 10 minutes), never to anyone else. Legal basis: Art. 6(1)(b) GDPR.

The ranking. Only people with a RealUp account get an invite link. The more friends join through it, the further up you move. The person who invited you only sees their number go up, not who you are. The invite code travels in the web address (?ref=…) and is not stored in your browser. When you sign up, it’s saved to your account, so it still counts if you continue in a new tab.

Leaving. Every waitlist email has a link to remove your address. Your entry is then deleted right away. It is also deleted together with your account.

2.7 Contact form and email

If you use the contact form, your name (optional), your email address and your message are sent as an email (through Brevo, see section 4) to our inbox realup.de@gmail.com, which Google provides. The message is not stored in our database. The database only counts how many messages were sent each day, without any content, to stop spam.

Purpose: answering you. Legal basis: Art. 6(1)(b) GDPR if your message is about using RealUp, otherwise our legitimate interest in answering you, Art. 6(1)(f) GDPR. The same applies if you email us directly. We delete messages once your request has been dealt with.

2.8 Protection against bots

On the log-in page, the waitlist page and the page for deleting your account, we use Cloudflare Turnstile to make sure a person, not a program, is signing up, joining the waitlist, logging in or asking for a code. Most of the time you won’t notice it. Only if Cloudflare isn’t sure, you’re asked to tick a box. Turnstile is not loaded on any other page.

To tell people from bots, Cloudflare processes signals from your browser, such as your IP address, your browser’s identification (user agent), technical details of the connection and the website you’re on. The result is a one-time code that our server (Supabase, section 4) checks with Cloudflare. It is not used for advertising, and it doesn’t follow you across other websites.

Legal basis: our legitimate interest in protecting accounts and the service from automated abuse, such as fake accounts and mass emails, Art. 6(1)(f) GDPR. Reading information from your device for this is strictly necessary for the secure service you asked for (§ 25(2) no. 2 TDDDG). Cloudflare, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework. For improving its bot detection, Cloudflare also acts as a separate controller, see Cloudflare’s Turnstile privacy policy.

3. The app

3.1 Your account

When you sign up: your email address, a display name, a password (only stored as a hash that can’t be turned back into the password, so not even we can read it), your language and, if you add one, a profile picture. Purpose: logging you in and matching your boards to you. Legal basis: Art. 6(1)(b) GDPR.

3.2 What you add

• Boards: name, whether it’s a favourite, when it was created and last changed, and a board PIN if you set one.
• Sources: YouTube links (including Shorts) with title, channel, length and publishing date, and the subtitles retrieved for them. Photos (from your gallery or taken with your camera) and PDFs, with the text read from them.
• Results: summaries, fact checks, the links between statements and their sources, and anything you write yourself into the memory tab.

Purpose: the app’s features. Legal basis: Art. 6(1)(b) GDPR.

One thing deserves its own sentence: what you write into the memory tab yourself is stored and sent to an AI service for processing (section 4). Don’t write anything there that is nobody else’s business.

3.3 Credits and usage counter

Every call that costs money (subtitles, reading a photo or PDF page, summary, fact check) is logged with your user ID, the board, the type of call, the amount of text and the time. The content is not logged. Purpose: these calls cost money. The counter manages your credits and stops a bug or misuse from getting expensive overnight. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.4 On your phone

The app keeps your login (in the phone’s secure storage), your language, light or dark mode and a few small settings on your device. It only uses the camera when you take a photo yourself, and only sees the photos and files you pick. It has no access to your contacts, location or microphone.

3.5 Technical data

When the app talks to the server, the usual connection data is created (IP address, time, function called). The server provider logs it briefly to fend off attacks and find errors. It isn’t used to follow individual people. Legal basis: Art. 6(1)(f) GDPR.

3.6 Google Play

The app is distributed through Google Play. What Google collects there is up to Google, and Google’s privacy policy applies.

4. Who else processes data

RealUp is a small project and can’t work without some outside services. These, and only these, are involved:

• Supabase (database, login, file storage, server functions): Supabase Inc., USA. Stores all the account, waitlist and board data described above. The server is in Tokyo, Japan (region ap-northeast-1). The EU Commission has an adequacy decision for Japan, so its data protection counts as equivalent to Europe’s. Supabase’s data processing agreement with the EU standard contractual clauses applies as well.
• Anthropic (AI): Anthropic PBC, USA (Claude API). Depending on the feature, it receives the subtitles and text of a board’s sources and the memory text (summary), the images of photos and scanned PDF pages (reading them), and the passages to check (fact check, for which Anthropic runs a web search). Your name and email address are never sent. According to Anthropic, content sent through the API is not used to train its models. The transfer to the USA is based on the EU standard contractual clauses.
• TranscriptAPI (subtitles): receives only the ID of the video, no data about you.
• Google, YouTube Data API: receives only the ID of the video, to look up channel, length and date. No data about you.
• Brevo (email): Brevo SAS, Paris, France. Sends our emails: confirmation codes, password resets, the waitlist email and contact form messages. Receives your email address and the content of the email. The data stays in the EU, and a data processing agreement is in place.
• Cloudflare (website hosting, visitor statistics and bot protection): see 2.1, 2.3 and 2.8.
• Google, Gmail: our inbox realup.de@gmail.com. Receives what you send us by email or through the contact form.
• Google and Apple (login): only if you choose to log in with them, see 2.5.

5. Shared boards

• Other members see your display name and email address in the member list, so it’s clear who has access.
• All members see all sources and the memory of the board, including what you wrote yourself.
• An invite code is valid for 24 hours, and you can withdraw it.

6. The board PIN is not encryption

A board can be locked with a four-digit PIN. It keeps prying eyes away from your unlocked phone, nothing more. The board’s content is stored unencrypted in the database, and so is the PIN. So don’t use the same PIN as for your phone or your bank card.

7. How long we keep data

As long as your account exists. There’s no automatic deletion after a set time, and nothing is kept “just in case”.

When you delete your account, your account, boards, sources, subtitles, photos, PDFs, summaries, fact checks, profile picture, memberships and waitlist spot are deleted immediately and completely. Two things stay, and they should be said rather than hidden:

• A shared board that belongs to you is not deleted. It passes to the member who has been there longest, so the others don’t lose their work. Your name and email address disappear from the member list.
• Sources you added to someone else’s board stay there. They belong to the board. After deletion, nobody can tell who added them.

The provider’s backups may contain deleted data for a few more days until they are overwritten as scheduled.

8. Your rights

Under the GDPR you have the right to:

• access the data stored about you (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17). You can do this yourself, in the app or here
• restrict processing (Art. 18)
• data portability (Art. 20). There’s no export button yet. Email us and you’ll get your data in a machine-readable format
• object to processing based on legitimate interest (Art. 21)

Just write to realup.de@gmail.com or use the contact form. You also have the right to complain to a data protection authority, usually the one in the country where you live.

9. Children

RealUp is not aimed at children. Anyone under 16 should only use it with a parent’s or guardian’s consent. We don’t knowingly collect data from children.

10. Changes

When RealUp changes, this policy changes with it. The date at the top tells you which version applies. Significant changes are announced in the app.