Privacy policy

Last updated: September 2026

This policy covers the website erwein.app and the Erwein app. The General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) apply.

1. Controller

Mikke Plank
Neuer Platz
9800 Spittal an der Drau
Austria
Email: support@erwein.app

2. This website

erwein.app is a static site. It sets no cookies, embeds no fonts, maps, videos or analytics services from third-party servers, and does no tracking.

There is therefore no access to your device within the meaning of § 165(3) of the Austrian Telecommunications Act 2021 — neither storing nor reading. No consent is required, and for the same reason there is no cookie banner.

When you visit, our host processes technically necessary connection data in server log files: IP address, date and time, the address requested, volume of data transferred, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). We do not evaluate this data on a personal level.

Contact form

If you use the form on the support page, we send your name (optional), email address, chosen topic and message by email to our support mailbox. No database is created; the details are not stored on the web server. We process them solely to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once the request is closed and no retention obligations apply.

To guard against automated submissions, the server keeps a check value derived from your IP address for one minute. The IP address itself is not stored.

3. The Erwein app

Account and sign-in

An account is required. You can sign in with Apple, with Google, or with an email address and password. Depending on the method, we process your email address, display name and an identifier from the respective provider. With “Sign in with Apple” you can hide your email address; the app works fully that way.

Profile data

Your profile holds: display name, email address, phone number (if provided), date of birth, gender, profile picture and profile background, and your stated preferences for drinks and music genres.

The date of birth serves age verification — the app is intended for people aged 17 and over. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).

Posts, photos and videos

A post consists of the chosen drink, optionally a photo or video, a text, a timestamp and optionally a place. You set the visibility for every post yourself:

• Public — visible to all signed-in users
• Partners in crime only — confirmed friends only
• Only me — nobody but you

Replies within a round are always visible to the people involved, because otherwise a conversation would look different to different participants.

A post can also be a mood — five levels with which you say how the evening is going for you, without a drink and without a photo. A mood follows the same three visibility levels. Its live status ends at six in the morning; the post remains, like any other.

Recognising the drink on your device

After you take a photo, the app offers what it believes is in it. To do that it reads the text on the label and asks Apple's on-device model which drink family and which drink is likely. Both run on your device: the photo is not transmitted for this purpose, no third party receives it, and the result is a suggestion that takes effect only when you tap it.

Crews

A crew is a fixed group. We store its name, its mark, who is in it, and which posts have been filed in it. Its content is visible to its members only; filing a post in a crew does not change the post's visibility. You can leave a crew at any time, which removes your membership.

Music

A mood and a story can carry a soundtrack. We store only the identifiers of the songs in Apple's catalogue, in the order chosen — no audio, no playback history, and no record of what you listen to. Whoever may see the mood or the story can play the songs; playing them in full requires your own Apple Music subscription.

If you save such a list into your own Apple Music library, the app needs access to your music library. That access is optional, is used solely for that purpose, and can be revoked at any time in the iOS settings. The legal basis is your consent (Art. 6(1)(a) GDPR).

Location data

If you grant access, we use your location to suggest nearby places, link a post to a place, and show public posts around you. Granting access is optional and can be revoked at any time in the iOS settings; you can also pick a place by hand. The legal basis is your consent (Art. 6(1)(a) GDPR).

Contact matching to find friends

If you grant access to your contacts, the app reads the email addresses and phone numbers from your address book and asks our server whether Erwein accounts exist for them. These values are transmitted in plain text. They are used solely for the comparison and are not stored permanently; no record is created for contacts without an Erwein account.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the iOS settings. Matching is optional — you can add friends via your personal link or QR code instead, which requires no address book access.

Push notifications

With your permission we send notifications about reactions, comments, replies in a round, friend requests, crew invitations and activity in your crews. For this we store a device identifier from Apple (push token). It is removed when you sign out or delete your account.

No usage analytics

The app contains no analytics and no crash reporting toolkit. It is not recorded which screens you view, how long you use the app, or how you operate it. There is no advertising and no profiling.

4. Services used

We have concluded data processing agreements with Google and Brevo. Where data is transferred to third countries, this is done on the basis of the EU Standard Contractual Clauses.

5. Deleting your account

You can delete your account yourself, completely, at any time: Settings → Delete account. For security reasons you will be asked to sign in again.

This removes:

• your profile including profile picture and background
• all your posts including photos and videos
• your reactions and comments, including those under other people's posts
• your notifications
• your friendships, including the mirrored records held by others
• your crew memberships, including the copies of you held on the crew itself; a crew nobody is left in is removed with you

Deletion runs server-side and completes even if you remove the app immediately afterwards. It is final; recovery is not possible. Other people's posts remain, even where you took part in them — they belong to their authors.

Once finished, we send a confirmation to the email address you signed in with.

Record of deletion

To evidence our accountability obligation (Art. 5(2) GDPR) we keep a deletion record for 730 days. It contains the time of the request and of completion, plus the number of records removed per area — no name, no content and not your email address. Instead of the address, an irreversible check value is stored, which lets us answer a later enquiry without retaining the address itself. After 730 days the record is removed automatically.

6. Your rights

Under the GDPR you have the right to:

• access the data held about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing (Art. 21)
• withdraw consent with effect for the future (Art. 7(3))

Please write to support@erwein.app.

Right to lodge a complaint

If you believe the processing of your data breaches data protection law, you may lodge a complaint with the supervisory authority under Art. 77 GDPR:

7. Changes

We update this policy when the app's features or the legal situation change. The current version is always available at erwein.app/privacy.