Privacy Policy

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

The highlighted details are placeholders and will be replaced before release.

Account data. Name, email address and password (stored exclusively as a secure hash) of the adults who create an account.

Mailbox data. Names and phone numbers of the family members set up as mailboxes (e.g. Grandma, Grandpa).

Voice messages. Audio recordings sent to the box via WhatsApp or the app, or recorded on the box itself. They are automatically deleted no later than 30 days after arrival.

Event log. Technical metadata: timestamps, delivery status and system messages (e.g. “message played”). No voice content.

Push tokens. Only if you enable notifications: a technical key for your device so we can send you notifications. Optional and revocable at any time.

Server logs. Short-lived technical logs from our hosting provider (requests, errors) used for security and debugging.

Performance of a contract (Art. 6(1)(b) GDPR). Running the Callbox: accounts, linking the box, and delivering and playing voice messages.

Legitimate interest (Art. 6(1)(f) GDPR). Security and stability of the service, debugging, and preventing abuse.

Consent (Art. 6(1)(a) GDPR). We only send push notifications if you explicitly enable them. You can switch them off at any time in your device or browser settings — this withdraws consent for the future.

The Callbox is used by children, but accounts are created exclusively by adults. Voice messages are always initiated by family members — the child simply presses a button to listen or record. Parents stay in control: they set up the mailboxes, decide who is connected to the box, and can delete messages and data. We do not process any data directly from children via the account.

We work with these service providers to run the app:

Hetzner Online GmbH (Germany). Hosts the server the Callbox software runs on. The data stays in Germany.

Cloudflare, Inc. (USA). Delivers and protects the web app (content delivery network). Receives technical access data when the page is loaded.

Meta Platforms, Inc. (USA). WhatsApp Cloud API. Only if your family uses WhatsApp do voice messages pass through Meta's servers.

Resend (USA). Sends the transactional emails (login links, password reset).

Expo (USA). Delivers push notifications — mobile app only, and only if you enable notifications.

We work with providers outside the EU on the basis of the European Commission's standard contractual clauses.

Voice messages are automatically deleted no later than 30 days after arrival. Your account remains until you delete it. The event log and server logs are rotated regularly and overwritten in the process.

You have the following rights in relation to us:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR), e.g. the state data protection authority responsible for us

For questions about privacy or to exercise your rights, you can reach us anytime at [email protected].

We update this policy when the app or the legal situation changes. You will always find the current version right here.