Privacy Policy

Effective date: 01.08.2026

1. Who we are

sharewood is an app for sharing items among friends. It is jointly operated by:

Daniel Lohmeier-von Laer
Karl-Immermann Straße 30, 09111 Chemnitz
Email: helpdesk@sharewood.app

Alex Nördemann
Pestalozzistraße 19, 09130 Chemnitz
Email: helpdesk@sharewood.app

We are joint controllers for your personal data within the meaning of Art. 26 GDPR and applicable national data protection laws. For any privacy-related request, please contact us at the email address above - either of us will handle your request.

2. Data we collect

Data	Purpose	Legal basis
Email address	Account creation, login, password reset, important service notifications	Contract performance (Art. 6(1)(b) GDPR)
Username / display name	Identifying you inside the app to your friends	Contract performance
First name / last name	Personalizing your profile; identifying you to your friends	Contract performance
Avatar / profile photo	Displaying your profile picture to your friends	Contract performance
Items you share (title, description, photos, tags, category)	Core feature - displaying your items to your friends	Contract performance
Booking data (dates, status)	Managing reservations and loans of items	Contract performance
Chat messages	Communication between friends about items	Contract performance
Comments	Discussions on shared items	Contract performance
Reports	Reviewing and moderating reported items or comments (who reported what, and why)	Legitimate interest (Art. 6(1)(f) GDPR)
In-app notifications	Informing you about relevant activity (bookings, messages, comments)	Contract performance
Friend connections	Building your network within the app	Contract performance
Profile visibility & discoverability settings	Controlling who can view your profile and whether you are suggested as a potential friend to other users	Legitimate interest (Art. 6(1)(f) GDPR)
Language preference	Displaying the app interface in your preferred language	Contract performance
Device push token	Sending push notifications (booking reminders, messages, etc.)	Consent (Art. 6(1)(a) GDPR)
Device session information	Security - managing active login sessions	Legitimate interest (Art. 6(1)(f) GDPR)

3. Third parties

We use the following third-party services which may process your data:

Google Firebase

• Firebase Authentication - manages sign-in via Google, Apple, or email/password and links your account to a Firebase user ID. Google may receive your sign-in credential. Firebase Privacy
• Firebase Cloud Messaging (FCM) - delivers push notifications to your device. Google receives your device push token.

We do not use Firebase Analytics or any other analytics/tracking service - automatic data collection for Firebase Analytics is explicitly disabled in the app.

Google Sign-In / Apple Sign-In

When you sign in with Google or Apple, that provider shares your email address (and optionally your name) with us. We never receive your password from them. Please review:

• Google Privacy Policy
• Apple Privacy Policy

AhaSend

We use AhaSend to deliver transactional emails: registration confirmation, password reset, and messages you send us via the contact form. AhaSend processes your email address and, for contact form submissions, the message content and any reply-to address you provide. AhaSend Privacy Policy

4. Data storage

• Your data is stored on a server located in the EU.
• Photos you upload are stored on the server and are only visible to your friends.
• Passwords are hashed - we never store or see your password in plain text.
• Communication between the app and our server is encrypted via HTTPS/TLS.

5. Data retention & deletion

• Your data is stored as long as your account is active.
• When you delete your account, all your personal data (profile, items, bookings, chats, comments, friend connections) is permanently deleted.
• We keep rolling backups of our database for disaster-recovery purposes. Deleted data may persist in these backups for up to 30 days before being permanently overwritten.
• Expired login sessions and revoked tokens are automatically purged.

6. Your rights (GDPR)

You have the right to:

• Access - request a copy of all personal data we hold about you.
• Rectification - correct inaccurate data.
• Erasure - have your data deleted ("right to be forgotten"). You can delete your account directly in the app.
• Data portability - receive your data in a machine-readable format.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - withdraw consent for push notifications at any time via your device settings.
• Lodge a complaint - file a complaint with the competent data protection supervisory authority.

To exercise these rights, contact us at: helpdesk@sharewood.app

7. Children

sharewood is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided personal data to us, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated effective date. Continued use of sharewood after changes constitutes acceptance of the updated policy.

9. Contact

For questions about this Privacy Policy or your data:
helpdesk@sharewood.app