Privacy policy

Last updated: September 2026. This policy covers the website emorph.de and the emorph app (web and Android). The legally binding version is the German privacy policy.

Draft. Reviewed before launch. Bracketed items are completed by the operator.

1. Controller

The controller is the provider named in the imprint. Contact for privacy requests: hey@emorph.de.

2. At a glance

• No third-party tracking, no ad networks, no external analytics tool.
• No cookie banner, because only one necessary session cookie is set.
• The site fonts are served from our own server, there is no Google Fonts request.
• The microphone, if you allow it, is analysed on your device only. No audio is transmitted or stored.
• Location is optional and used only coarsely (roughly city level) for the weather.

3. Visiting the website

When you open emorph.de, the server processes technically necessary connection data (including IP address, time, requested file, browser type) as far as needed to deliver and secure the page. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, secure service). This data is deleted or anonymised after [retention period, e.g. 7 days].

4. Email address and sign-in code

To use the app you create an account with your email address. To sign in we send you a six-digit code by email. There is no password. We process your email address and the codes and sessions created for sign-in. Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract). We keep your email address for as long as your account exists. Sign-in codes expire after a few minutes and are then deleted.

5. Session cookie

After sign-in we set a technically necessary, signed cookie that identifies your session. It has no advertising or tracking function. Legal basis: section 25(2) no. 2 TDDDG together with Art. 6(1)(b) GDPR. Because no other cookie is set, there is no consent banner.

6. Location for the weather (optional)

In the app you can share your location so your emorph reacts to the weather where you are. Coordinates are rounded to about 11 kilometres, that is city level, before they are stored. We use this coarse location to fetch weather data from Open-Meteo. No precise position is stored. Legal basis: your consent under Art. 6(1)(a) GDPR. You can withdraw it any time in the app, which deletes the stored coarse location.

7. Microphone (optional)

If you allow the microphone, your emorph reacts to sound and music around you. The analysis runs entirely on your device, in real time. No audio is recorded, transmitted or stored. At most a coarse, non-identifying figure of how loud and lively your surroundings were is sent to the server, so the character of your emorph drifts slightly with it over weeks. Legal basis: your consent under Art. 6(1)(a) GDPR. You can withdraw it any time.

8. Usage analytics (first-party only)

To understand how emorph is used and where something breaks, we store our own event data in our database. An event has a name (for example "account created"), a pseudonymous user or session identifier, a timestamp and a coarse device class. We do not store an IP address or a full user-agent string. No third-party analytics service is used, and no record leaves our systems for this purpose. Legal basis: Art. 6(1)(f) GDPR. This data is deleted after 180 days.

If you arrive through a campaign link (parameter ref in the address), we store the campaign code as a property of such an event to roughly assess where sign-ups come from. This stays pseudonymous.

9. Your emorph data

To perform the usage contract we store your emorph data: the values created at genesis, the simulation state, discovered moments and, if any, lineage. Legal basis: Art. 6(1)(b) GDPR. This data exists for as long as your account exists.

10. Hosting and processors

emorph is operated at STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, on the basis of a data processing agreement under Art. 28 GDPR. Servers are located in Germany. Sign-in codes are sent via the SMTP service of STRATO AG, also under a processing agreement. Weather data is provided by Open-Meteo (Switzerland); only the coarse location is sent there, with no link to your account. During the current test phase operation may temporarily run on other infrastructure; this policy is updated when the final provider is in place.

11. Sharing with third parties

Beyond the processors named above we do not share your data. We only disclose data where legally required.

12. Retention

• Account and emorph data: until you delete your account.
• Sign-in codes: a few minutes, then deleted.
• First-party event data: 180 days.
• Server logs: [e.g. 7 days].
• Coarse location: until you withdraw the permission.

13. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21) and withdrawal of consent with effect for the future (Art. 7(3)). Contact hey@emorph.de.

14. Data export and account deletion

You can request a copy of your data or the deletion of your account by email. We handle this promptly. A self-service option in the app is planned.

15. Right to complain

You have the right to complain to a data protection supervisory authority, in particular in the country of your habitual residence or the place of the controller.

16. Social media presence

We maintain profiles on Instagram and Threads (Meta Platforms Ireland Limited, Ireland), TikTok (TikTok Technology Limited, Ireland), X (X Internet Unlimited Company, Ireland), YouTube (Google Ireland Limited, Ireland) and Reddit (Reddit Netherlands B.V., Netherlands). We use these profiles to inform people about emorph and to communicate with them. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in contemporary public communication).

When you visit these profiles, the respective platform operator processes personal data under its own responsibility, including for its own analytics, advertising and personalisation purposes, potentially outside the European Union. Please refer to each operator's own privacy policy: Instagram/Threads, TikTok, X, YouTube, Reddit.

Where we use a business or creator account for individual profiles with access to aggregated usage statistics (Insights), we are jointly responsible with the respective platform operator for collecting these statistics (Art. 26 GDPR); details are governed by an agreement the operator automatically applies to page administrators.

If you contact us via comments or direct messages on one of these platforms, we use your information only to answer your request. Legal basis: Art. 6(1)(f) GDPR.

17. Changes

We adjust this policy when the processing changes, for example when the hosting provider changes. The version published here applies.