Wndrfalk

Privacy Policy

As of: 1 November 2026

This policy applies to the website wndrfalk.app and to the Wndrfalk web app.

Summary

Wndrfalk has no server that holds your projects, and no accounts. I, the developer, do not receive any project data. Your data lives on your device. It only leaves the device when you trigger it: when you share or export a file. When you open the site, the hosting provider processes the technical connection data needed to deliver it (section 2).

There are no cookies, no analytics, no advertising, and no fonts or scripts from third-party servers.

1. Controller

Michael Magenheim
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Email: info@wndrfalk.app

I have not appointed a data protection officer.

2. Visiting the website and the app (hosting)

When you open wndrfalk.app or the app, Cloudflare delivers the files. In doing so, Cloudflare processes the connection data that is technically necessary: your IP address, date and time, the address requested, the status code, the amount of data transferred and information about your browser. Each check for a new version of the app also creates such an entry.

The purpose is to deliver the site and the app, reliably and protected against abuse. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is that the site is available at all and without disruption.

The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. I have a data processing agreement with Cloudflare under Article 28 GDPR. I do not keep access logs myself and I do not analyze visits. Cloudflare also uses connection data under its own responsibility to detect and block attacks. Cloudflare describes this at https://www.cloudflare.com/privacypolicy/.

How long Cloudflare keeps the connection data is up to Cloudflare. Cloudflare does not state a fixed period.

Processing can take place in the USA. The transfer is based on the European Commission's adequacy decision of 10 July 2023 (Data Privacy Framework), under which Cloudflare, Inc. is certified. If that decision lapses, the EU Standard Contractual Clauses apply, which are part of the contract with Cloudflare.

Cloudflare also manages the domain settings (DNS) of wndrfalk.app.

When you visit, I do not set cookies. I do not embed analytics, advertising or social media services, and I do not load fonts or scripts from third-party servers. I deliver the font Onest myself.

3. Contact by email

If you write to info@wndrfalk.app, I process your email address and the content of your message. This also applies to “Report a problem or idea” in the app: the app only opens your mail program with a prepared text. You see everything, you can change it, and you send the message yourself. Diagnostics, if you attach them, contain no project content.

The purpose is to handle your request. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to receive problem reports and inquiries and, where legally required, to answer them.

Cloudflare (email forwarding) forwards info@wndrfalk.app to my private mailbox at Tuta (Tutao GmbH, Deisterstr. 17a, 30449 Hannover, Germany). According to Tuta, messages are stored in data centers in Germany. Cloudflare acts for me as processor in doing so. I delete messages once the matter is closed, unless a legal retention duty applies.

Problem reports and ideas sent from the app get no reply and no support. I answer data protection requests. Providing your email address and your message is required neither by law nor by contract. Without them, however, I cannot receive your message or reply to it.

4. Your project data

Wndrfalk stores your projects, tasks and settings in your browser's storage on your device (browser storage and cache for the files of the app). I have no access to them and do not receive them. You are responsible for this data. Wndrfalk transmits it only if you use one of these functions:

  1. Sharing. A link, QR code or text containing a task or project, sent through the messenger or channel of your choice. These packages are not encrypted. The content sits in the part of the link after the # sign, which is not transmitted to the server (Cloudflare) when the link is opened. It can, however, end up with your messenger, in history and with recipients.
  2. Export data and import data. A file or text. The export is encrypted only if you set a password. Without a password, anyone who has the file can read it. This also covers a project’s tasks as a CSV file, dates as a calendar file (.ics) and reports that you copy, save or share. These files are not encrypted.
  1. Image with QR code. The chosen image is evaluated on the device only and is neither stored nor transmitted.
  2. Clipboard. Only when you tap Paste does Wndrfalk read the clipboard text once. It stays on the device. Copying places text on the clipboard, which other apps can read.
  3. Links and email. When you tap a link or “Open email”, Wndrfalk hands it to your browser or mail app. The app itself sends nothing.

Wndrfalk does not itself encrypt the data stored on your device. If your device is encrypted, the screen lock and device encryption protect it.

5. Browser storage (service worker and cache)

Wndrfalk stores data in your browser: your project data, your settings and the files of the app so that the app can start from your device's storage without loading again (service worker and cache). This is necessary for the service you asked for (section 25(2) no. 2 TDDDG). No identifier is created that I could use to recognize you. A short, random device ID is created when the app first starts. It makes the numbers of your entries unique and tells your own devices apart. It stays on the device and is part of the numbers of your entries, which appear in exported files and in packages you pass on. Anyone who receives several packages from you can tell from it that they come from the same device.

If you turn on “Open the app directly when you visit wndrfalk.app” (at first start or under Me, off by default), your browser stores only this setting. When you open the start page wndrfalk.app, the page checks only this setting and then opens the app. It reads no project data, stores nothing and transmits nothing. wndrfalk.app/?start always shows the start page.

When you first open the start page wndrfalk.app, the page also reads the language setting of your browser and takes you to the matching language version (German, Portuguese, Spanish or French) if there is one. Nothing is stored or transmitted. If you choose a language yourself in the language menu, your choice applies.

You can delete this data at any time in your browser settings. Your project data on this device is then gone too, unless you exported it.

6. Recipients

  • Cloudflare, Inc. (USA): delivery of the website and the app, domain settings (DNS), email forwarding.
  • Tutao GmbH (Tuta), Hannover, Germany: my private email mailbox, where the forwarded messages to info@wndrfalk.app arrive.

I do not pass data on for advertising.

7. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can object at any time, on grounds relating to your particular situation, to processing under Article 6(1)(f) (Article 21). Write to info@wndrfalk.app.

You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Postfach 10 29 32, 70025 Stuttgart, Germany poststelle@lfdi.bwl.de Complaint form: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/

The connection data from section 2 is needed to deliver the site. Without it I cannot show it to you. You do not have to provide anything else. There is no automated decision-making.

8. Users outside the EU

I am a private individual in Germany and process personal data under the GDPR. Where the data protection law of your country also applies, you can exercise the rights it grants you by writing to info@wndrfalk.app. Wndrfalk is not directed at children; the Terms of Service require users to be at least 16 years old.

  • United Kingdom. Where UK data protection law (UK GDPR and Data Protection Act 2018) applies, this policy applies accordingly and you have the rights described in section 7. You can complain to me first (info@wndrfalk.app); I will acknowledge your complaint within 30 days. You can also complain to the UK Information Commission (ico.org.uk). Cloudflare receives connection data in the USA under the UK Extension to the EU-U.S. Data Privacy Framework and otherwise under the standard contractual clauses that are part of the contract with Cloudflare.
  • Switzerland. Cloudflare receives connection data in the USA under the Swiss-U.S. Data Privacy Framework and otherwise under the standard contractual clauses that are part of the contract with Cloudflare. You can complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
  • Brazil. Where the LGPD applies, you have the rights under Article 18 LGPD: confirmation that data is processed, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability, deletion, information about who data is shared with, information about the option not to consent and its consequences, and revocation of consent. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD). Contact for all requests: info@wndrfalk.app.
  • Peru. Contact for requests from and for Peru: info@wndrfalk.app.

9. Changes

If something changes in Wndrfalk that affects this policy, I will update it. The date above shows its status.