Privacy Policy

Courtesy translation — the German version is legally binding.

1. Controller

Sanel Hasic
Schillstraße 104a, 86169 Augsburg, Germany
Email: support@shliff.app

2. Hosting (Firebase Hosting)

This website is hosted by Firebase Hosting (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When you access the site, the provider processes technically necessary data (including IP address, time, requested file, browser/device information) in server logs to ensure delivery and security. The legal basis is my legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). A data processing agreement is in place with Google.

3. Beta waitlist (form sign-up)

When you sign up for the beta, I process your email address as well as the time and the confirmation status of your sign-up. Sign-up uses a double opt-in procedure: after submitting, you receive a confirmation email; only after clicking the confirmation link are you added to the waitlist.

• Purpose: inclusion in the waitlist and invitation to the beta version.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Processing/delivery: via the service Brevo (see section 4).
• Storage period: until withdrawal or until the purpose ceases (end of the beta phase).
• Withdrawal/unsubscribe: at any time via the unsubscribe link in every email or informally by email to the address above; the lawfulness of processing carried out up to the point of withdrawal remains unaffected.

4. Processors

Hosting (Google): The website is provided via Firebase Hosting (Google Ireland Ltd.) (see section 2); a data processing agreement is in place. Processing in third countries (including the USA) cannot be ruled out; Google bases such transfers on the EU Standard Contractual Clauses (Art. 46 GDPR).

Email/waitlist (Brevo): For the waitlist and for sending the confirmation and invitation emails I use the service Brevo by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The data you provide in the form is transmitted to Brevo and stored there (servers in the EU). A data processing agreement is in place with Brevo; for details see Brevo's privacy notice (brevo.com).

5. Fonts

The fonts used (Space Grotesk, Space Mono) are served locally from this server. No connection to Google servers is made and your IP address is not transmitted to third parties.

6. Cookies & local storage (localStorage)

For purely functional purposes, entries are set in your browser's local storage (localStorage): your language choice (DE/EN) and your decision in the cookie banner. These entries are technically necessary, are not used for analytics or tracking, are not transmitted to me, and do not require consent (Section 25(2) German TDDDG). Analytics cookies (Google Analytics, see section 8), by contrast, are set only after your consent via the cookie banner.

7. The “Shliff” app (analytics, crash reports, AI processing)

The Shliff mobile app (iOS/Android) processes data primarily locally on your device; your idea content is not transmitted to me or third parties — unless you use the optional AI features (see below).

• Anonymous usage analytics (Firebase Analytics): only after your explicit consent (opt-in; OFF by default, revocable at any time in the app settings). Only anonymous usage events (e.g. “idea created”) and device/usage metadata are collected — no idea content, no titles/descriptions, no personal data. Provider: Google (Firebase). Legal basis: consent (Art. 6(1)(a) GDPR).
• Crash reports (Firebase Crashlytics): likewise only with consent. Technical crash/ error diagnostics (stack traces, device/OS info) are transmitted to improve stability — no idea content. Provider: Google (Firebase).
• AI processing (optional): If you enable the AI features (structuring/evaluation/ chat), the text you type or speak is transmitted to the AI provider you choose (e.g. Google Gemini, OpenAI, Anthropic) and processed there to generate the response. These features are OFF by default. Your API key is stored only locally in the device’s secure key store. The respective provider’s privacy notice also applies. Legal basis: consent/performance of a contract (Art. 6(1)(a)/(b) GDPR).
• Offline speech recognition: When offline speech recognition (Whisper) is enabled, transcription happens locally on the device; no audio data is transmitted.
• Third countries: Using Firebase or an AI provider may involve processing in third countries (incl. the USA); providers rely on the EU Standard Contractual Clauses (Art. 46 GDPR) for such transfers.

8. Web analytics (Google Analytics 4)

This website uses Google Analytics 4 — only after your consent via the cookie banner — a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Without consent, Google Analytics is not loaded and no data is transferred to Google.

• Purpose: audience measurement (e.g. page views, referrers, device type) and conversion measurement (e.g. beta sign-ups).
• Legal basis: your consent (Art. 6(1)(a) GDPR), given via the cookie banner.
• Cookies: Google Analytics sets the cookies _ga and _ga_* with a storage period of up to 14 months.
• IP addresses: are truncated by Google Analytics 4 at collection and are not stored.
• Withdrawal: at any time via the “Cookie settings” link in the footer of the homepage — it clears your choice and reopens the banner so you can decide again. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

9. Your rights

You have the following rights vis-à-vis the controller:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18),
• data portability (Art. 20), objection (Art. 21) and withdrawal of consent given (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.