Your shared garden

Privacy.

This notice describes the current a word for u app, its account service and these help pages.

Updated 8 October 2026

Who is responsible?

nofluff · Dr. Jannik Nitz
Klosterstraße 79b
50931 Cologne, Germany
no@no-fluff.de

What the app uses

Your account: email address, chosen display name, chosen language, account identifier and creation date. Your email is used for passwordless sign-in. Your connected person sees your name and language.
Your shared garden: connection and invitation records, shared time zone, words, meanings, optional examples, sender and delivery dates, and daily reminder records. Your connected person can read the words you send.
Your device: account-specific cached words, favourites, reveal state and appearance/motion preferences stay on the device. A sign-in session and, if enabled, a push token are kept in the operating system’s secure storage. Device tokens are also registered with the server for notification delivery.
The live animation: touch positions and small tilt values are exchanged while connected. Tilt is used only when you enable it and grant the phone’s permission. These animation values are transient and are not stored in the account database.
Technical operation: network connections expose IP addresses and request/device information to the server and infrastructure providers. Service errors may be recorded to diagnose failures. The application does not log sign-in tokens or the contents of words.

The app does not request your contacts, camera, microphone or precise location. It contains no advertising or behavioural analytics integration. These help pages use local styling, no external fonts, no cookies and no analytics scripts.

Why we process it

Account, sign-in and garden data are necessary to provide the service you request (Article 6(1)(b) GDPR). Technical safeguards and fault diagnosis support secure, reliable operation (Article 6(1)(f)). Optional notifications and device motion are enabled by your choice and permission (Article 6(1)(a)); you can withdraw that choice in Us or your phone settings. Support messages are processed to answer your request, under Article 6(1)(b) or (f), depending on the request.

You must provide an email address, name and language to use the connected app. Notifications and device motion are optional. We do not use this data for automated decisions with legal or similarly significant effects.

Services involved

Hosting: the account service runs on our server in Germany on IONOS infrastructure. See IONOS privacy information.
Sign-in email: STRATO GmbH transports requested emails. It processes the recipient address, sign-in message and delivery information. See STRATO privacy information.
Optional push: If you enable notifications, Expo’s push service and Apple Push Notification service or Google Firebase Cloud Messaging deliver notifications to registered devices. They receive a device token and a notification announcing a new word or thought, including the sender’s display name. The word and translation are not included. See Expo, Apple and Google.
App distribution: Apple TestFlight/App Store and Google Play process installation and test information under their own terms and privacy notices.

Push and distribution providers may process data outside the European Economic Area, including in the United States. Their linked notices describe their processing locations and transfer safeguards. We do not sell account or garden data.

How long it stays

Data	Retention
Sign-in and deletion links	15 minutes; single use.
Invitations	Seven days; removed when used or cancelled.
Sessions	Up to 30 days; ended by sign-out or account deletion.
Account and shared words	While the account/garden exists. Disconnecting deletes shared words for both people; deleting an account also removes its connection and sessions.
Notification tokens	Until notifications are disabled on that phone, the account is deleted, the phone signs out, or the provider reports the token as invalid.
Pending notifications	Retry for up to 24 hours; removed after successful hand-off.
Support correspondence	For as long as needed to resolve the request and any related legal obligations.

Operational recovery copies can contain older records after deletion from the live database, until those copies are separately removed. They are not part of normal app access. Contact us if you want us to review and remove data retained in recovery copies. Provider delivery and infrastructure records follow the respective provider’s retention rules.

Deleting your data

In Us, choose Delete account and confirm. This removes the live account, shared connection, shared words and active access. You can also use the account deletion page, which sends a confirmation link to your account email. Signing out does not delete the shared garden.

Your rights

You can request access, correction, erasure, restriction and portability where applicable. You may object to processing based on legitimate interests and withdraw consent without affecting earlier processing. Contact no@no-fluff.de. You can also complain to a supervisory authority, including LDI NRW. The GDPR sets out these rights.