Privacy
Achtung delivers notifications. That needs to know who you are and which device to write to, and little else. This says exactly what is stored, where, and for how long.
Last updated: 6 September 2026.
Who is responsible
Olav Gausaker Madrid, Spanish tax ID 78972983E, referred to below as “we”. For anything about this policy, including exercising your rights: privacidad@gausaker.com.
What we collect, and why
Your account
Name, email address and password. The password itself is never stored — only a cryptographic hash that cannot be reversed, so nobody, us included, can read it. For each open session we also store the IP address and the browser or app you signed in from, so you can close sessions and so unusual access can be spotted.
Legal basis: performance of the service you asked for.
The devices you receive on
For every phone or browser you register: the identifier Apple, Google or your browser gives us so we can write to it, the platform, the app version, the language and when it last connected. Browsers additionally store two public encryption keys that they generate themselves.
That identifier is the only thing that makes a notification reach your device and not someone else’s. Without it the app still works, but you only see what arrived when you open it.
The notifications you receive
Stored in full: title, text, attachments and any link they carry. And, per recipient, when it arrived, whether you have read it and whether you archived it — that is what makes the inbox yours and not someone else’s.
We also store the outcome of every delivery attempt to every device: whether it worked, the error code if it did not, and the identifier Apple returns. That is what gets looked at when someone says “it never reached me”.
Your API tokens
Only a cryptographic hash of the token is kept, plus the eight visible trailing characters so you can recognise it in the list. The full token is shown once, when you create it, and cannot be recovered afterwards.
Channels, organisations and invitations
Which channels you follow, which organisations you belong to, and which invitations have been sent — for those, the invitee’s email is kept until the invitation is accepted or expires.
Who else processes your data
Achtung relies on these providers. All of them act on our behalf and only for what the table says.
| Provider | What for | Where |
|---|---|---|
| Neon | The database: everything above | Frankfurt (EU) |
| Vercel | The website and API, and attachment storage | Frankfurt (EU) |
| Apple (APNs) | Delivering notifications to iPhone and iPad | United States |
| Google (Firebase) | Delivering notifications to Android, and usage and crash reporting | United States |
| Google, Mozilla or Apple | Delivering notifications to your browser, depending on which you use | United States |
| Amazon (SES) | Account email: confirmations and invitations | Ireland (EU) |
Transfers to the United States rely on the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
What Apple and Google can see
Worth stating plainly. For a notification to sound on your phone it has to be handed to Apple or Google, and that hand-off carries the title and a preview of the text: they can read that part. The full content, the attachments and the rest of your inbox never leave our database.
In the browser this does not happen: there the notification travels encrypted end to end with your own browser’s keys, and the service carrying it cannot read even the title.
Analytics and crashes
The Android app includes Firebase Analytics and Crashlytics, which collect usage data, an installation identifier and reports of any crashes. They exist to show what gets used and to fix what breaks.
The iPhone app and the website carry no analytics at all. There are no advertising cookies, no profiling, and nothing is sold or shared with third parties for commercial purposes.
How long it is kept
- Notifications, until you delete them. Archiving removes them from the inbox but does not erase them.
- Devices, until you uninstall the app: when Apple or Google tell us it is gone, the record is deactivated automatically.
- Everything else, for as long as you have an account. Delete the account and everything hanging off it goes with it.
There is no automatic deletion by age today: nothing disappears merely because time has passed. If that changes, it will be said here.
Your rights
You can ask for access to your data, correct it, delete it, take it elsewhere, restrict its use or object to it. Write to privacidad@gausaker.com and it will be resolved within one month at the latest.
You can delete your account yourself, without asking anyone: it is in Settings, and it takes the inbox, the devices, the tokens and the subscriptions with it. It is immediate and there is no recycle bin. The only thing that survives is any notification you sent to other people, which lives in their inbox rather than yours, and which stops being associated with you.
If you believe your data has been mishandled, you can complain to the Spanish Data Protection Agency (aepd.es).
Children
Achtung is not directed at children under 14 and does not knowingly collect their data.
Changes
If this changes materially, you will be told by email or inside the app before it applies. The date above says when it was last touched.