Brauchma

Privacy policy

Last updated:

This is a translation. The German version of this policy is the binding one.

This policy explains which personal data the Brauchma app and this website process, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Who is responsible

The controller is Zwala, Waldviertel. For every question about your data, and to use your rights, write to brauchma-support@googlegroups.com.

In short

What Brauchma stores about you

Your account

When you sign in for the first time, Brauchma creates an account with these details from Google:

Brauchma updates these details from Google every time you sign in, the picture when its copy is more than a week old. It also stores the language and theme you choose, the accent colour you choose as a member of a supporting family, whether you have finished the tour, your role (user or administrator), when the account was created, when you last signed in, and whether the operator has disabled the account.

How you heard about Brauchma

Brauchma asks you once in the app how you heard about Brauchma, with six answers to choose from. The question is optional and can be skipped. Brauchma does not store your answer with your account; it only counts how often each answer was chosen in a week. Your account only records when the question was answered or skipped, so that it does not appear again. Administrators see only the counts per week and in total.

Sessions

Each device you sign in on gets a session. The server stores a fingerprint of the session key (not the key itself), when the session started, when it was last used, when it expires, and the browser's identification string (user agent), which names the browser and operating system. A session expires 180 days after you last used Brauchma on that device, and at the latest one year after you signed in on it, however often you use it; then you sign in again. Signing out deletes it at once.

Settings → Account lists the devices you are signed in on, with the browser and operating system, when the session started and when it was last used, and lets you sign out each one. For actions in the admin area and for deleting your account, Brauchma asks you to sign in with Google again if your last sign-in was more than 30 minutes ago.

Families and lists

For each family Brauchma stores its name, who created it and when, its members with their role (owner or member) and the date they joined, and the family's lists (up to five) with their names, sort order and category order. The name of a family created for you at sign-in contains your first name.

For each item on a list Brauchma stores the name, quantity, unit, category, an optional note, who added it, who checked it off and when, and when it was created and last changed. Items you delete or clear from the cart are deleted. When the owner deletes a list, its items are deleted with it. For suggestions and the "Bought before" sheet, each family also keeps a history of the item names it has used, with the last unit, quantity and category and how often each was used. This history belongs to the family, not to a person. Each family also counts how many shopping trips it has ended and how many items it has added in total; the app shows these numbers in its notes about supporting Brauchma.

For each list, a member can turn on "Learn the order while shopping" in the list's menu; the switch is off until someone turns it on. Only while it is on does the server record shopping rounds for that list. A shopping round is everything checked off on the list without a break of more than 45 minutes. For each shopping round Brauchma stores the order in which something was first checked off in each category, when the round started and when something was last checked off. Brauchma stores no person with a shopping round, so not who checked anything off either. A shopping round is over 45 minutes after the last check. The server then adds it to the list's counts and deletes its data in doing so, at the latest in its hourly run, so at the latest about an hour and 45 minutes after the last check. As counts, the list keeps for each category the sum of its positions and the number of shopping rounds it appeared in. From three shopping rounds on, the server adjusts the list's order from these counts and stores when it last did; the list's menu shows that date. When someone changes the order by hand, Brauchma deletes the counts and starts over. When learning is turned off, Brauchma records nothing more and keeps the counts. When the list is deleted, everything stored for it is deleted.

When a roadmap poll is running, supporting families can vote on what Brauchma should do next. Brauchma stores the family's vote, the chosen option and when it was cast, not which member cast it. Administrators see only the number of votes for each option. The vote is kept until the poll or the family is deleted.

Members of a family see each other's name, profile picture, role and joining date, and everything on the family's lists. They do not see each other's email address.

Invitations

When someone invites a person to a family, Brauchma stores the family, who invited, the kind of invitation (link or email), the invitation's secret link in protected form only (a fingerprint from which the link cannot be recovered; the link itself is shown once, when it is created), its status (open, accepted, declined, revoked or expired), when it was created, when it expires, and who answered and when. For an email invitation it also stores the invited email address. All members of the family see open invitations, including the invited address.

If someone invites you by email address, Brauchma gets your address from that family member, not from you. The invitation shows up in Brauchma when you sign in with that address; if the operator has set up email, Brauchma also sends you one email with the link (see "Email" below). The invitation stays open for at most 30 days. The record of the invitation, with your address, is deleted 30 days after the invitation ends (see "How long data is kept"). To have it deleted earlier or to object, write to the support address.

Access list and refused sign-ins

Brauchma can limit sign-in to a list of allowed accounts. That list holds the email address, the role, an optional note by the operator, who added it and when. An invitation does not bypass the list: if your address is not on it, your sign-in is refused and the operator decides whether to add you.

When a sign-in is refused because an address is not on the list, Brauchma records the email address and the time so the operator can let that person in. If the refused sign-in started from an invitation link, Brauchma may also create an email invitation for the address from that link, so the family is waiting once the person is let in. The members of that family then see the address among the open invitations. The records of refused sign-ins are deleted automatically after 30 days.

Administration log

Brauchma keeps a log of administrative actions and family changes: accounts created, deleted, disabled or enabled, changes to the access list, families created, renamed or deleted, members removed or leaving, ownership changes, invitations created, revoked, accepted or declined, and contributions an administrator enters or removes by hand. An entry holds who did it, what, when, and details such as the email address of a created or deleted account, the invited email address, a family's old and new name, or the amount of a contribution. The operator uses this log to trace problems and misuse. Entries are deleted after 12 months. After 90 days, email addresses in entries that belong to no current account and to no entry on the access list, for example the address of a deleted account, are replaced with "(removed)".

Administrators see this log and, in the admin area, each account's name, email address, role, creation date, last sign-in and number of families. For invitations waiting for someone to be let in, they also see the invited address, the family's name and who invited. They also see the record of contributions described under "Payments", and counts such as how many families were created or were active in a week, which name nobody. The admin area shows no list contents.

Storage on your device

The app stores the following on your device:

All of this is needed to provide the service you asked for: signing in, and a list that works without reception. None of it is used for tracking or advertising. Under § 165 (3) of the Austrian Telecommunications Act (TKG 2021) such storage needs no consent, so Brauchma shows no cookie banner.

Notifications are the one exception: only when you turn them on does your browser set up a push subscription for Brauchma on your device, with your consent (see "Notifications"). Turning them off removes it.

Server logs and abuse protection

The Brauchma server writes a technical log. It records each request to the app, except the status checks of the monitoring, with the kind of request, the page in a general form without numbers or invitation links (for example /api/v1/join/{token}), the result, how long it took, a random request number and, when you are signed in, your internal account number. It also records starts and stops, sign-ins and account deletions with the internal account number, sent or failed invitation emails with the invitation number, for each shopping trip how many notifications were sent, failed or skipped (without push endpoints), for each recorded contribution the provider, the amount, the currency and the internal family number, requests refused because of too many attempts with the page in the same general form, and errors. It contains no email addresses, no list contents and no IP addresses. If an invitation email fails, the log keeps the mail server's error message, which may name the recipient's address.

To protect sign-in and invitation links against automated guessing, the server counts requests per IP address (20 per minute). It also limits how many changes each account can make (120 per minute), counted by the internal account number. These counters exist only in the server's memory. They are not written to disk or to the log and are gone at the latest when the server restarts.

The server in front of the app (the TLS proxy that handles the encrypted connection) does not keep an access log. When it cannot pass a request on, for example while the app restarts during an update, it logs an error that includes that request: the IP address, the address of the page (which can contain an invitation link or, after a refused sign-in, your email address), and the browser's request headers, with cookies removed.

Both logs go to the server's system journal, which keeps entries for 30 days and deletes older ones automatically.

Sign-in with Google and profile pictures

You sign in with your Google account. Your browser goes to Google, you sign in there, and Google tells Brauchma your account ID, email address, whether the address is verified, your name and the link to your profile picture. Brauchma asks for nothing else and receives no access to your Google data. Google learns that you signed in to Brauchma. For this step Google is an independent controller; for users in the European Economic Area that is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google's privacy policy applies: policies.google.com/privacy.

Profile pictures are served by Brauchma's own server. When you sign in, Brauchma's server uses the link from Google to fetch a small copy of your picture (96 × 96 pixels) from Google, stores it in Brauchma's database and keeps only the copy, not the link. It fetches a new copy at a sign-in when the stored one is more than a week old. When the app shows your picture or another member's, your browser loads it from Brauchma, and only signed-in users can load it. Your browser does not contact Google to show pictures.

Email

Email is optional and only works when the operator has set up a mail server. At present no mail server is configured, so Brauchma sends no email; invitations work by link. When a mail server is configured, Brauchma sends exactly two kinds of email: invitations, sent to the invited address with the family's name, the inviter's name and the join link, and test emails, which administrators send to themselves. Brauchma sends no newsletters and no notifications by email. If a mail server is configured, the operator's email provider processes the recipient's address and the message on the operator's behalf.

Notifications

Shopping trips

A member who is about to go shopping can tap "Going shopping" and choose now, in 15 or in 30 minutes. Brauchma then stores the trip: the family, who announced it, when, when the member leaves, when the trip ends, and how many items were open on the family's lists at that moment. A trip ends when the shopper taps "Done", or on its own 30 minutes after the announced start; Brauchma stores when and how it ended.

While a trip is active, all members of the family see it in the app with the shopper's name, the time and the number of open items. The shopper sees how many items were added since the announcement and, before announcing, how many members would get a notification, as a number, not who.

What is stored when you turn notifications on

Notifications are optional. The switch "Shopping trips" under Settings → Notifications is off until you turn it on yourself. Brauchma never asks for it on first use; your browser asks for permission only when you turn the switch on.

When you turn it on, your browser sets up a push subscription with the push service of its maker, and Brauchma stores for this device:

With your account Brauchma stores that notifications are on, your quiet hours and your time zone, which the browser reports (for example Europe/Vienna). For each trip it records which devices got a notification and when, so that a device gets at most one per trip.

What a notification contains

A notification says who is going shopping, when, and how many items are open, for example "Anna is going shopping" and "In 15 minutes · 9 open items · Anything missing?". It also carries the internal numbers of the trip and the family, so that tapping it opens the right family. It never contains item names and never anyone's email address.

Who delivers notifications

Brauchma's server cannot reach your phone directly. It hands each notification to the push service of your browser's maker, which delivers it: Google for Chrome, Samsung Internet and Edge on Android, Microsoft for Edge on Windows, Apple for Safari and the home-screen app on iPhone, and Mozilla for Firefox. On Android, a push service may pass the message on through Google's delivery service to reach the phone. Which push service is used depends on your browser, not on Brauchma.

The message is encrypted with your device's keys before it leaves the server. The push service sees the endpoint, the encrypted message and the time it was sent, but not its content.

Your controls

If the push service reports that a subscription no longer exists, Brauchma deletes it at once. After three failed deliveries in a row Brauchma stops sending to that device and shows this in Settings; turning the switch off and on again on that device starts it again. A user can have at most ten devices; when an eleventh is added, the oldest is removed.

Legal basis

You give your consent by turning the switch on (Art. 6 (1) (a) GDPR). You can withdraw it at any time by turning the switch off or removing the device; this does not affect the notifications sent before.

Payments

Using Brauchma is free. Families who want to can support it with a voluntary contribution (see the support page). Brauchma itself takes no payments and never sees card details: you pay on the page of a payment provider or by bank transfer.

What Brauchma stores

Every family has a support code, a short random code that the app creates the first time a member opens Settings → Support Brauchma. The code travels with a payment so that the contribution can be linked to the family. All members of the family see the code and whether, since when and until when the family is a supporter; Brauchma does not know which member paid.

When a contribution arrives, Brauchma stores:

The provider's message about a payment can also contain the payer's name, email address and a message. Brauchma reads only the support code, the amount, the currency and the payment id from it and keeps nothing else. It never stores the payer's name, email address, card details or bank details. A payment whose code matches no family and no gift code is recorded without a family.

Gift codes

A member can also give a supporter year to another family. The app then creates a gift code, a short random code that travels with the payment in place of the support code. The code identifies the gift, not a person. For each gift code Brauchma stores the code, whether it is unpaid, paid or redeemed, the family it was created in, the way it was paid, the amount, the currency, the provider's payment id, when it was created, paid and redeemed, and the family that redeemed it. A paid gift is recorded as a contribution like any other, at first without a family; the family that redeems the code is then shown as a supporter, and the contribution is recorded for that family. As with every contribution, Brauchma stores nothing about the person who paid.

At the payment provider

The payment itself takes place at the provider, which processes your data under its own terms and privacy policy:

The provider sees what it needs for the payment, typically your name, email address, payment details and the amount. In the operator's account at the provider, and on the bank statement for a transfer, the operator sees what a payee sees: the payer's name, email address or account number, the amount and the reference. The operator uses this only to handle the payment, for example a refund, and for the tax records; none of it is entered into Brauchma.

Legal basis and retention

The support code, gift codes and the supporter status serve the thank-you a family receives for a contribution, as part of the service, Art. 6 (1) (b) GDPR. The record of each contribution, including a paid gift with its code, is kept because the operator has to keep records of income for tax purposes, Art. 6 (1) (c) GDPR together with § 132 of the Austrian Federal Fiscal Code (BAO). These records are kept for seven years from the end of the calendar year, also after the family is deleted; they are not yet deleted automatically after that.

This website

This website sets no cookies, runs no scripts and loads nothing from other servers. It is served by the same TLS proxy as the app; what that proxy logs is described above.

If you write to the support address, your message and email address are used to answer you. The support address is a Google Group, a consumer service of Google. Google Ireland Limited stores the messages as an independent controller under its own privacy policy; there is no data processing agreement with Google for this mailbox, and Google may process the messages in the USA (see "Transfers outside the EU"). Messages stay in the group until the operator deletes them, at the latest 12 months after your request has been dealt with.

Purposes and legal bases

Brauchma makes no automated decisions about you and creates no profiles. Without your Google account details Brauchma cannot create an account for you.

Who receives data

Nobody else receives your data. Brauchma does not sell data and shares none for advertising.

Transfers outside the EU

Brauchma's own server is in the EU. Google may process data in countries outside the EU, including the USA, when you sign in, when Brauchma's server fetches your profile picture, and for messages to the support address. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

When you turn notifications on, the push service of your browser's maker may process the endpoint, the encrypted message and the time of sending in the USA. Google LLC and Microsoft Corporation are US companies certified under the same EU-US Data Privacy Framework. Apple Inc., which runs the push service for Safari and the home-screen app on iPhone, and Mozilla Corporation, which runs it for Firefox, are based in the USA as well; the message they relay is encrypted end to end and the endpoint does not name you.

If you contribute, the payment provider you choose may process your data outside the EU under its own privacy policy; Ko-fi Labs Limited is based in the United Kingdom. Brauchma itself transfers no data to the providers beyond the support code or gift code that travels with your payment.

How long data is kept

What deleting your account does

In the app, go to Settings and tap "Delete my account". This:

What stays:

The operator can also delete accounts in the admin area, with the same effect.

Your rights

You have the right to:

To use these rights, write to brauchma-support@googlegroups.com from the email address of your account.

You can also complain to a data protection authority. In Austria that is the Datenschutzbehörde (Austrian Data Protection Authority).

Children

Brauchma is not directed at children under 14. If you believe a child under 14 has given Brauchma personal data, write to the support address and the data will be deleted.

Changes to this policy

When Brauchma changes what it stores or how, this policy is updated and the date at the top changes. Last updated: October 24, 2026.