The protection and security of your personal data is important to us. This privacy policy explains how we process your data when you use our Reunicorn app, what rights you have in this regard, and how you can exercise these rights.
The entity responsible for data processing on our app is:
WTF Kooperative eG
Forsmannstr. 14 b
22303 Hamburg
Reunicorn is a decentralized and end-to-end encrypted application. This means that your personal data is not stored on central servers, but exclusively locally on your device and encrypted for contacts and, if applicable, other persons within the network.
We only process data when it is technically necessary.
Purposes: In order for you to use the app’s features, the data is transmitted in encrypted form via the Veilid peer-to-peer network. This ensures particularly data protection-friendly operation without a central server.
To ensure that information shared with your contacts is available even when the sender and recipient are not online at the same time, this encrypted data may be temporarily stored on the devices of other people participating in the Veilid network. We do not have access to this data at any time.
Categories of Data: Profile and location data, if you actively share it, is stored in encrypted form on the network. In addition, technically necessary metadata is processed.
Recipients:
Legal Basis: Art. 6 (1) (b) GDPR (contract or pre-contractual measures).
Storage Period: The data is stored locally on your device until you delete it and decentralized in the Veilid network.
Purposes: Certain information is automatically processed as soon as the app is used. When you download the app, certain necessary information is transmitted to the app store you have selected.
Categories of Data: In particular, your username, email address, customer number, time of download, payment information, and individual device identification number may be processed. This data is processed exclusively by the respective app store and is beyond our control.
Recipients:
Legal Basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures).
Storage Period: We do not store any personal data.
Purposes: We use the services of MapTiler AG for the map and address function. Location data is only shared with your contacts if you activate this feature.
Categories of Data: Current or planned locations, technical usage data when accessing maps and searching for addresses.
Recipients:
Legal Basis: Art. 6 para. 1 lit. b GDPR (contract or pre-contractual measures).
Storage Period: We do not store any personal data.
Purposes: You can optionally receive push notifications. In order to use push notifications, a consistent token is generated after consent is given, which is transmitted to the WTF server without disclosing your IP address or other user details and is used to send push notifications to your device.
Categories of Data:
Recipients:
Legal Basis: Consent (Art. 6 (1) (a) GDPR)
Storage Period: We do not store any personal data.
Purposes: Payment processing may be carried out via app store operators in order to activate additional functions.
Categories of Data: Transaction and payment data, without us having access to payment details.
Recipients:
Legal Basis: Art. 6 para. 1 lit. b GDPR.
Storage Period: We do not store any personal data.
Purposes: In order to provide its functions, the app requires access to certain data. Some of this data is necessary for the use of the app, while other data is optional. Access is required for the following Purposes:
Categories of Data: The permissions set are stored locally on your device. You can change them at any time in your device settings.
Legal Basis: The legal basis here is Section 25 (2) No. 2 TDDDG. Device access is access that is necessary for the provision of the respective function.
Storage Period: We do not store any personal data.
Purposes: When you contact us by email, the information you provide us with is processed to the extent necessary to respond to the inquiry and any requested measures.
Categories of Data: Identifying data (e.g., names), contact data (e.g., email), content data (e.g., entries in online forms).
Recipients:
Legal Basis: Contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR) or legitimate interest in effectively responding to inquiries (Art. 6 (1) (f) GDPR).
Storage Period: Contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR) or legitimate interest in effectively responding to inquiries (Art. 6 (1) (f) GDPR).
We have profiles on social networks. Our social media profiles complement our website and offer you the opportunity to interact with us. As soon as you access our social media profiles on social networks, the terms and conditions and data processing guidelines of the respective operators apply. The data collected about you when using the services is processed by the networks and, if necessary, also transferred to countries outside the European Union where there is no adequate level of protection for the processing of personal data. We have no influence on data processing in social networks, as we are users of the network just like you. Information on this and on which data is processed by the social networks and for what purposes the data is used can be found in the privacy policy of the respective network listed below. We use the following social networks:
Our page is available at: https://floss.social/@reunicorn.
Our instance is operated by floss.social.
The privacy policy of the instance is available at: https://floss.social/privacy-policy
Purposes: We process personal data as a controller when you send us inquiries via social media profiles. We process this data in order to respond to your inquiries.
Legal Basis: The processing is based on our legitimate interest (Art. 6 (1) (f) GDPR). The interest lies in the respective purpose.
Storage Period: We do not store any personal data outside the network.
When we process your data, it may be necessary to transfer or disclose your data to other recipients. In the sections on processing above, we name the specific recipients as far as we can. If recipients are located in a country outside the EU, we indicate this separately under the individual points listed above. Unless we expressly refer to an adequacy decision, no adequacy decision exists for the respective recipient country. In these cases, we will agree on appropriate safeguards in the form of standard contractual clauses to ensure an adequate level of data protection (unless other appropriate safeguards, such as binding corporate rules, are in place). You can access the current versions of the standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
In addition to these specific recipients, data may also be transferred to other categories of recipients. These may be internal recipients, i.e., persons within our company, but also external recipients. Possible recipients may include, in particular:
You can delete your locally stored data at any time via the app or the settings in your operating system. Due to the decentralized design, we cannot guarantee the deletion of your data on your contacts’ devices.
We do not use automated decision-making that has a legal effect on you or similarly significantly affects you.
You have the following rights, provided that the legal requirements are met. To exercise these rights, you can contact us at the address you are familiar with.
You have no contractual or legal obligation to provide us with personal data. However, without the data you provide, we are unable to offer you our services.
The app does not use cookies or similar tracking mechanisms.
We take every conceivable precaution to protect and secure your data. We welcome your questions and comments about data protection. If you have any questions about the collection, processing, or use of your personal data, or if you wish to request information, correction, blocking, or deletion of data, or withdraw consent you have given, please contact us using the contact details provided above.
December 2025