← Back to homepage

Privacy Policy

Last updated: March 6, 2026

1. Data Controller

Hendrik Heim
Email: [email protected]

2. Overview

Togee is an app for creating and sharing photo albums with family and friends. Protecting your personal data is important to us. This privacy policy explains what data we collect, why we process it, and what rights you have.

3. Hosting and Infrastructure

All data is processed and stored on servers within the European Union.

Service	Provider	Purpose
Database & Authentication	Supabase (EU region)	User management, albums, photos, memberships
File Storage	Supabase Storage (EU region)	Uploaded photos and thumbnails
Push Notifications	Firebase Cloud Messaging (Google)	Notification of new photos
Website Hosting	Cloudflare Pages	Hosting of this website

4. What Data We Collect

4.1 Registration and Account

When you register, we collect:

• Email address — for authentication and account recovery
• Password — stored as a hash; we have no access to your plaintext password
• Username — for identification to other users

Legal basis: Performance of contract (Art. 6(1)(b) GDPR)

4.2 Photos and Albums

• Photos — images you upload to albums are stored in Supabase Storage (EU)
• Album metadata — name, creation date, member list
• SHA-256 hash — for photo deduplication (no access to image content required)

Legal basis: Performance of contract (Art. 6(1)(b) GDPR)

4.3 Push Notifications

If you enable push notifications, we store:

• FCM device token — a technical identifier for delivering notifications
• Platform — whether you use iOS or Android

Notifications are only sent when new photos are uploaded to one of your albums. You can disable push notifications at any time in your device settings.

Legal basis: Consent (Art. 6(1)(a) GDPR)

4.4 Usage Data

• Album views — timestamp of last album view, to prevent duplicate notifications

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

5. Data Sharing with Third Parties

We do not sell your data. Data is only shared with the service providers listed in Section 3, who act as data processors on our behalf. Firebase Cloud Messaging (Google) may process data outside the EU; this transfer is based on EU Standard Contractual Clauses.

6. Data Retention

• Account data: Until you delete your account
• Photos: Until deleted by the user or removal of the album
• Device tokens: Until sign-out or deactivation of push notifications

When you delete your account, all your personal data is completely removed from our systems.

7. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15) — what data we store about you
• Rectification (Art. 16) — correction of inaccurate data
• Erasure (Art. 17) — deletion of your data (“right to be forgotten”)
• Restriction (Art. 18) — restriction of processing
• Data portability (Art. 20) — receive your data in a common format
• Objection (Art. 21) — object to processing
• Withdrawal of consent — at any time with effect for the future

To exercise your rights, contact us at [email protected].

8. Account Deletion

You can delete your account at any time directly in the app. This will permanently remove all your personal data including profile, albums, photos, and device tokens.

9. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

10. Changes

We reserve the right to update this privacy policy. The current version is always available on this page.