PHANEIA

Legal information

Website privacy notice

English translation updated October 12, 2026 from the German source. The operator details and legal and operational information remain subject to release review.

German source updated July 26, 2026; links to app privacy and help added September 30, 2026.

This privacy notice applies to this website. How the Phaneia app handles data is described in the separate draft app privacy notice. See Help and contact for help with the current test version; the German help source is also available.

1. Controller

The controller responsible for processing data on this website is:

Robert Oberdorfer
Asternweg 49
32676 Lügde
Germany
Email: phaneia@posteo.com

2. Website visits and server log files

Whenever you visit this website, the hosting provider automatically records information sent by your browser in server log files. This includes, in particular: your IP address, the date and time of access, the page or file requested, the previously visited page (referrer), your browser and operating system, and the HTTP status code transmitted.

These data are technically necessary to deliver the website, maintain its stability and security, and prevent abuse. They are not combined with other data sources or analyzed for advertising purposes.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). The hosting provider stores the log files only for a short period and then deletes them.

3. Hosting and technical services provided by Cloudflare

This website is served through Cloudflare Pages. We also use Cloudflare Pages Functions, Workers KV and D1 for the forms. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (German branch: Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 8th floor, 81671 München).

Cloudflare processes technically necessary connection data, particularly your IP address, to deliver the website, process form requests and prevent abuse. To limit automated form submissions, the Pages Function derives a pseudonymized check value from the IP address supplied by Cloudflare. This value is stored in Cloudflare D1 and is not linked to form contents. It applies to a 15-minute window. Expired values are deleted in the next automatic cleanup run, which takes place every five minutes. The application itself does not store the IP address in D1 or in the early test list.

The legal basis for secure and reliable operation and this short-term abuse prevention is Article 6(1)(f) GDPR. Where Cloudflare processes data on our behalf, it does so under a data processing agreement pursuant to Article 28 GDPR.

Because Cloudflare, Inc. is based in the USA and operates a globally distributed network, personal data (particularly your IP address) may be transferred to the USA as a third country. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision pursuant to Article 45 GDPR); Cloudflare has also incorporated the EU Standard Contractual Clauses pursuant to Article 46 GDPR. Further information is available in Cloudflare’s privacy policy and the Cloudflare Data Processing Addendum.

4. Email delivery through Resend

We use Resend to confirm your signup and send the beta and launch messages you subsequently permit. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Your email address, message contents and technically necessary delivery data are sent to Resend. Other information from the early test list, particularly your chosen platform and signup source, is not sent to Resend.

Resend processes these data on our behalf to deliver the emails. Resend’s Data Processing Addendum applies under Article 28 GDPR. For transfers to the USA, Resend relies on the EU-US Data Privacy Framework pursuant to Article 45 GDPR and, additionally, the EU Standard Contractual Clauses pursuant to Article 46 GDPR. The German source states that delivery data are accessible for 30 days under the plan we use; the current plan and that period remain subject to operational confirmation. Further information is available in Resend’s privacy policy.

To deliver the welcome email reliably, we temporarily store the message contents and delivery status in Cloudflare D1. Completed or unresolved delivery jobs are deleted after 30 days in the next cleanup run, or immediately when you unsubscribe. Retries use the same message contents and the same delivery identifier.

5. No cookies or tracking

Phaneia does not set cookies on this website, use analytics or tracking services, include advertising, or load fonts, videos, maps or social media plugins from third-party servers. Our emails contain no tracking pixels or individual open or click measurement. Consent under § 25(1) TDDDG and a cookie banner are therefore not required.

6. Early test list and double opt-in

When you join the early test list, we process your email address, chosen platform, signup source, and the time and version of your consent. The sole purpose is to inform you about the beta test, important development milestones and the release of Phaneia. The legal basis is your consent under Article 6(1)(a) GDPR. Emails are sent in accordance with § 7(2) UWG.

We use double opt-in: after submitting the form, you initially receive only a confirmation email. Unconfirmed details are held in Cloudflare D1 for seven days and then deleted in the next automatic cleanup run, which takes place every five minutes. Confirmation links previously sent from Workers KV retain their original validity during the transition. The email link opens a confirmation page. Only after you also click the “Confirm email address” button on that page do we add your email address to the early test list in Cloudflare D1. This second step prevents automatic link checks from confirming your signup unintentionally. The unconfirmed details are then removed from the confirmation job.

We store confirmed entries until you withdraw consent or the announced beta and launch communications have ended. We then delete the entries within six months, unless legal obligations prevent this. You can withdraw your consent at any time with effect for the future using the unsubscribe link in every email or by contacting phaneia@posteo.com. When you unsubscribe, your email address is immediately deleted from the early test list. Withdrawal does not affect the lawfulness of processing carried out before it.

To document consent given or withdrawn, we store a pseudonymous check value of the email address, the event “confirmed” or “withdrawn,” the consent version and the time separately from the early test list. The value is generated with a secret key as a non-reversible HMAC; the email address itself is not included in this record. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to document valid consent and defend against legal claims. These records are automatically deleted no later than three years after the respective event.

7. Optional information about willingness to test and price suitability

The English-language confirmation flow continues without the optional German test-readiness and price questions described below. It does not ask you to answer a translated or converted price question.

In the German-language flow, immediately after confirmation you can voluntarily indicate whether you would test Phaneia in the next four weeks and whether around 10 euros per month is generally realistic for you. We store only the selected answer categories, together with a pseudonymous linking value to the early test list and the time of the response. There is no free-text field. We do not ask for Bible passages, denomination, religious beliefs or personal experiences in these questions.

These details help us assess the first test group and planned pricing model realistically. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is product and launch planning that minimizes data collection. You can skip the questions without disadvantage. An unanswered record is automatically deleted after seven days. Answered details are stored only as long as the corresponding entry in the early test list and are deleted together with that entry when you unsubscribe. You can object to this processing at any time as described in section 13.

8. Anonymous passage suggestions

You can use the “Which passage has you thinking?” field to send a Bible reference or a short question. We store the text, its source within the website and the time, but no email address or user identifier generated by us. Passage suggestions are stored separately from the early test list, both technically and logically. We do not store an IP address in our database for this purpose.

These details are used solely to prioritize the first explanations in Phaneia. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is product and content planning that minimizes data collection. Please do not enter names, email addresses, personal faith experiences or other details that identify you or another person. Passage suggestions are deleted no later than twelve months after submission.

9. SSL/TLS encryption

This website uses SSL or TLS encryption for security and to protect data in transit. You can recognize an encrypted connection by “https://” in your browser’s address bar.

10. Contact by email

If you contact us by email (phaneia@posteo.com), we process your details solely to handle your inquiry. The legal basis is Article 6(1)(f) GDPR (legitimate interest in responding to your inquiry), or Article 6(1)(b) GDPR if your inquiry concerns entering into or performing a contract. We delete these data when they are no longer needed for that purpose, unless statutory retention obligations prevent this.

This website links to external services, particularly the Apple App Store and Apple Inc. When you click these links, you leave this website. Processing on the linked pages is governed by their own privacy policies, over which we have no control.

12. Your rights

Subject to the applicable legal requirements, you have the right at any time to:

  • Access your personal data being processed (Article 15 GDPR).
  • Have inaccurate data rectified (Article 16 GDPR).
  • Have data erased (Article 17 GDPR).
  • Restrict processing (Article 18 GDPR).
  • Data portability (Article 20 GDPR).
  • Object to processing (Article 21 GDPR).
  • Withdraw consent with effect for the future (Article 7(3) GDPR).

To exercise these rights, contact the controller listed in section 1.

13. Right to object

You have the right at any time to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. This particularly concerns server log files, short-term abuse prevention, consent records, optional test-readiness and price details, passage suggestions and contact inquiries, where these do not serve pre-contractual measures or performance of a contract. Following an objection, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can send your objection informally to the email address listed in section 1.

14. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf

15. Changes to this privacy notice

We update this privacy notice when data processing on this website changes. The version published here with the date stated above applies.

16. AI features of the app

The AI features are a fixed part of the Phaneia app and therefore part of the terms of use. When you use an AI feature in the app, the app sends your question, the context shown for it (for example the selected Bible passage) and, in conversations, the earlier messages of the conversation (at most the latest ten) through the Phaneia service to Anthropic and shows you the answer. Notes and personal vocabulary notes are not sent. The legal basis is Art. 6(1)(b) GDPR, because the processing is necessary to perform the terms of use. We therefore do not ask for separate consent to AI use, and there is no setting that turns AI use off in the app. If you do not want AI processing, you cannot use the AI features and, to that extent, cannot use the app.

Separately, the personal learning profile remains a voluntary feature based on your consent (Art. 6(1)(a) GDPR). It is only taken into account in AI requests after you explicitly turn it on; you can withdraw this consent at any time with effect for the future in the app settings (Art. 7(3) GDPR).