Controller
Alex Fitterling
Wöhrder Kreuzgasse 8
90489 Nürnberg
Germany
Email: info@sp33c.tech
Hosting and server logs
This website is hosted on Amazon Web Services (AWS) on servers in the EU (Frankfurt, eu-central-1). When you visit, your browser transmits technical data — including your IP address, date and time, the page requested, and your browser and operating system — which is processed in server logs to deliver the site securely and reliably. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functional website). AWS acts as our processor under a data processing agreement.
Security monitoring
To protect our systems against attacks and misuse, we analyse server, firewall and application logs (including IP address, time, requested address, browser identifier and error messages) in a security monitoring system. It runs on servers of Hetzner Online GmbH in Germany. The legal basis is our legitimate interest in IT security (Art. 6(1)(f) GDPR, Recital 49). The data is deleted after 90 days unless it is needed to investigate a security incident.
Language cookie
We store a single strictly necessary cookie named “locale” to remember your language choice. It contains only a language code (e.g. “de”), is not used for tracking, and is therefore exempt from consent. Legal basis: § 25(2) TDDDG and Art. 6(1)(f) GDPR.
Contact form
If you use the contact form, we process the name, email address, subject, and message you provide. To prevent spam we use a double opt-in: your submission is stored temporarily and we email you a confirmation link; only after you click it is your message forwarded to our support inbox. Unconfirmed submissions are automatically deleted after 24 hours. Legal basis: Art. 6(1)(b) and (f) GDPR (handling your request).
Recipients and processors
Contact submissions, rate-limit counters and connection sessions are stored in Amazon DynamoDB and emails are sent via Amazon SES, operated by AWS as our processor within the EU. Requests from the AI features are processed by Anthropic PBC (USA) as our processor; that transfer is safeguarded by the EU standard contractual clauses (Art. 46 GDPR). We do not sell your data or share it with third parties for their own purposes.
The app on your device
Don’t Forget Me keeps your lists, trips, people and pinned places on your iPhone. Geofencing runs entirely on-device — the app is told you crossed an edge, never where that edge is — and your location never leaves the device. The app has no account of its own. Purchases are handled by Apple; we receive no payment data.
iCloud sync
If iCloud is switched on for Don’t Forget Me on your device, your data is synced through Apple’s CloudKit into the private database of your own iCloud account, so it is available on your other devices. Apple operates this storage under its own privacy policy; we have no access to it, except through a connection you set up yourself (see “Connecting an AI assistant”).
AI features
The AI features are optional and only run when you start them. When you have a packing list built for a trip, or edit a list by instruction, the app sends what that request needs to our server at AWS in Frankfurt: your trip description or instruction, the titles and item texts of the lists involved, and the app language. Our server passes them to Anthropic’s Claude API, which produces the result and returns it to the app. We do not store this content. Your IP address is used only to count requests for rate limiting, in counters that delete themselves automatically when their time window ends. Please do not put sensitive personal information in a trip description. Legal basis: Art. 6(1)(b) GDPR (providing a feature you requested).
Connecting an AI assistant
If you connect Claude, ChatGPT or another assistant to your lists, you sign in to iCloud through this website. We then keep the iCloud web session token Apple issues, which is needed to read and change the lists in your private iCloud database on your behalf, for at most 21 days, and the codes and tokens of the connection, stored only as hashes, for at most 30 days. Your list content passes through our server only while a request is being handled and is not stored. The assistant you connect receives the list data needed for your request; its provider processes it under its own privacy policy. Removing the connection in your assistant revokes its tokens; the iCloud session token then expires on its own after at most 21 days, or earlier on request to info@sp33c.tech. Legal basis: Art. 6(1)(b) GDPR.
No tracking
We use no analytics, advertising, tracking pixels, social-media plugins, or third-party fonts — neither on this website nor in the app — and we never show the App Tracking Transparency prompt.
Retention
Unconfirmed contact submissions are deleted after 24 hours. Confirmed messages are kept only as long as needed to handle your request and to meet legal obligations. Content sent by the AI features is not stored; rate-limit counters expire with their time window. Connection data is deleted after at most 21 days (iCloud session) and 30 days (connection tokens). Server logs are retained briefly for security and operations.
Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- rectification of inaccurate data (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interests (Art. 21)
To exercise any of these rights, email info@sp33c.tech.
Right to complain
You also have the right to lodge a complaint with a data protection supervisory authority — for example the Bavarian State Office for Data Protection Supervision (BayLDA).