Knopfpost

Privacy notice

Last updated: 13 August 2026

1. Controller

The controller responsible for the processing described in this notice is:

Stefanie Grewenig
Talheide 5
21149 Hamburg
Germany
hallo@knopfpost.de

No data protection officer has been appointed.

2. Who these notes cover

This notice covers the public Knopfpost website, the Android app download and the Knopfpost app itself, the associated Telegram and WhatsApp connections, and the server operated for delivery. Knopfpost is intended for parents and other adults approved by parents. Children only ever use the device their parents have set up for them; they do not create a Knopfpost account.

3. Website and APK download

Delivery, technical logs, and security

When you visit the website, the hosting provider processes technically necessary connection data, in particular IP address, date and time of access, requested file, referrer, and browser and operating-system information. This processing is necessary to deliver the website and the APK download and to defend against attacks and disruptions (Article 6(1)(f) GDPR). Our legitimate interest is the secure and reliable operation of the website. We have no access to complete hosting logs and do not maintain our own visitor profiles.

The website is delivered through GitHub Pages. This may involve processing by GitHub, Inc. and affiliated companies, including in the United States. Information on their processing and retention periods is available in GitHub's privacy statement.

No analytics, advertising, or social-media tags

When you visit the page, we set no analytics, advertising, or social-media tags, and load no fonts or other third-party content by default. The external Telegram and WhatsApp links are only requested if you click them yourself.

4. Knopfpost service

Data and purposes

To let a family set up and use Knopfpost, we process the data technically necessary for that:

We use this data solely to set up the household, check approved senders, deliver messages securely and reliably to its tablet, manage access rights, troubleshoot, and prevent abuse. There is no advertising profiling and no automated decision-making with legal or similarly significant effects.

Legal basis

Processing to provide and administer Knopfpost is carried out to perform the usage relationship with the adult who sets it up (Article 6(1)(b) GDPR) and, where necessary, to secure the service, prevent abuse, and enforce household access restrictions (Article 6(1)(f) GDPR). Our legitimate interest lies in a secure, functioning service that stays confined to its household.

Anyone who sends other people's photos, voices, or videos to Knopfpost via Telegram or WhatsApp may only do so if the transmission is lawful and the people concerned, or their legal guardians, have been informed or have consented, where this is required.

The same applies when administrators set a profile picture for another person in the parent view. They choose such a picture themselves — it does not come from that person's messenger — so they may only set it if they are entitled to do so and the person depicted, or their legal guardians, have been informed or have consented, where this is required.

Recipients and international transfers

Adults use Telegram or WhatsApp to transmit messages. Telegram processes this data under its own responsibility and on its own terms; Knopfpost cannot control Telegram's processing. Telegram may process data outside the EU/EEA; by its own account, Telegram relies on the European Commission's approved Standard Contractual Clauses for this. Please see Telegram's privacy policy.

Messages sent over WhatsApp are transmitted through Meta's WhatsApp Business Platform (Cloud API). Meta processes the resulting data under its own responsibility, under Meta's Data Processing Terms for businesses and the WhatsApp Business Data Transfer Addendum; Knopfpost cannot control this processing. This may involve processing data outside the EU/EEA, in particular in the United States; by its own account, Meta relies on the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses. Please see WhatsApp's privacy policy.

The Knopfpost server is operated at Fly.io. Fly.io processes technical operational and stored service data to provide the hosting infrastructure. Where necessary, the data-protection agreements and transfer mechanisms provided for this are used. This may also involve transfers to third countries. Further information is available in Fly.io's privacy policy.

Retention and deletion

Message media and related sender profile pictures are generally deleted from the Knopfpost server seven days after playback has completed. Messages not yet delivered to the tablet are deleted after 30 days at the latest. Deletion runs the next time the household is accessed, or through administrative cleanup; during longer inactivity, actual deletion may therefore be delayed. Deleting a household deletes its data and server media.

Display names and profile pictures set by administrators belong to a person rather than to a single message. They are therefore not deleted after seven days; they are kept until they are removed in the parent view, until that person's access to the household is revoked, or until the household is deleted.

On the configured child device, downloaded media is kept in the app's private storage and removed after the intended playback flow. If parents enable the optional media archiving feature, an additional copy may remain in the device's local media gallery. Parents manage that copy on the device themselves.

We retain technical data only as long as necessary for its purpose, in particular security, troubleshooting, and legal obligations. Statutory retention obligations remain unaffected.

5. Your rights

Subject to the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on Article 6(1)(f). Contact hallo@knopfpost.de for this. For Telegram or WhatsApp data, you may also have rights directly against Telegram or Meta respectively.

You may lodge a complaint with a data-protection supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22
20459 Hamburg, Germany
mailbox@datenschutz.hamburg.de
datenschutz-hamburg.de

6. Updating this notice

We update this privacy notice when the processing or the legal situation changes. The current version is always published on this page.

Please use Knopfpost only with the knowledge and responsibility of the child's parents or legal guardians. Careful handling matters especially for photos, voices, and videos of children.