Privacy policy

This statement describes which personal data tellmelo processes, for what purpose, on what legal basis, who receives it and how long it is kept; the features named are examples. The legal basis is given in brackets; placed before a list or at the end of the first paragraph, it applies to the whole section unless stated otherwise.

New in this version

In brief; the text below is what counts.

• Feed Duel: a guessing game with public posts, alone or for two, with a monthly rating, leaderboard and prizes; during a game your other devices are locked; you take your posts and yourself out with switches (Feed Duel).
• Groups with channels: chat channels, roles, invitation links, a feed channel that is off for now, and muting, kicking and banning by the group; what is stored and who sees it is under Groups.
• Muting channels: chat channels can be muted just for yourself, for some hours or until further notice (Groups).
• Calls: voice and video calls with screen sharing, directly between the devices and end-to-end encrypted, for now with early access; nothing is recorded, only the entry in the chat is stored (under Posts, replies and messages).
• Voice channels: in released groups, talking, camera and screen through the own media server; nothing is recorded or stored (under Groups).
• Bots: members can create bots that groups take in with their consent; a bot reads what it may see in the group (under Groups).
• Sparks for groups: instead of levels, a group’s leaders turn perks on with its sparks; stored is which and since when (under Rewards, loyalty rhythm and sparks).
• Arranging pages, widgets and gallery: On a computer you arrange pages yourself and add widgets; you can submit your own widgets and designs to the gallery, which the team reviews (Arranging pages, widgets and gallery).
• Developer area and simple widgets: API keys, bots, apps and webhooks are in the developer area, several named API keys with a last day, every change confirmed with your password and, where applicable, a code; the team checks changes to approved apps (Tools for organizations, partners and developers, Signing in to other sites). New simple widgets, including habits and mood just for you (Arranging pages, widgets and gallery).
• Designs for the whole app, drawing and ratings: A design now covers the whole app, you can draw on pages, and widgets, designs and bots can be rated and reviewed (Arranging pages, widgets and gallery).
• Minor correction: The switches for the post of the week and the Explore programme are under Settings → Taking part.

Overview

Controller

No data protection officer has been appointed; the requirements of § 38 BDSG are not met.

The essentials

• No advertising, no selling, no tracking: no analysis for advertising, no analytics tools or tracking pixels; data goes only to the recipients named.
• Server in Germany, run by the controller; translation, language detection, images, videos and link checks run there.
• Outside providers only when you need them: none when pages load; sign-in and payment services only if you choose them; push services only with push; Discord only with the desktop app.
• You decide: Learned topics, the public profile and findability can be switched off; for the Discovery programme, push, the recap by email and your place you are asked first.

The German version is authoritative. Translations of this and the other legal texts are reading aids.

When you visit

Server, security and icons

For operation and security (Art. 6(1)(f) GDPR: a secure, lawful and consistently displayed service):

• Server logs: IP address, time, address requested, amount of data, browser identifier and language, for operation and to fend off attacks, for at most 14 days; not logged are the session cookie, the regular requests of signed-in members and unchanging program files.
• Counters against mass requests: how often a sign-in or an IP address does something, without an account only under an irreversible fingerprint; they expire after at most two days, most after one minute to one hour.
• Protection against attacks (also Art. 32 GDPR): requests that only attackers make (trap addresses, searches for other people’s files, malicious code in addresses, repeated failed attempts at sign-in or in team areas) are stored by tellmelo for 30 days with an irreversible fingerprint of the IP address, the IP address without its last part, the kind of incident, the path without search terms and the time. If it happens again, the address is blocked for 15 minutes, one day or 30 days. Fingerprints of the addresses from which team members sign in or use their sign-in are kept for 30 days so that these are never blocked; if the administration is closed during an attack, it opens only to the addresses from which team members have signed in.
• Outside connections to the database are reported by tellmelo to the team, only with the program name and a shortened address, without storing them.
• Embedded GIFs and videos: If another website shows a GIF or video from tellmelo, its visitors’ browsers load it from this server, with a server log; to prevent overload, the server counts the requests for one minute in memory under an irreversible fingerprint of the IP address. The player sets no cookies; the other website is responsible for embedding it.
• Country check: The server determines the country of a request from the IP address using the country list of DB-IP (db-ip.com, CC BY 4.0), which it downloads itself, without storing the country or linking it to your account. From states whose laws for social networks tellmelo cannot meet, only a notice is shown; the legal texts and the contact form remain reachable. The interface for programs (the API with keys, the media picker and embeds for other websites, “Sign in with tellmelo” for other sites’ servers) stays reachable from every country.

Cookies and storage on your device

tellmelo only stores its own entries on your device. What is there at the moment is shown by the button with the shield at the bottom edge, and after signing in on a phone under Settings → Appearance & app → What’s on your device.

There is no consent banner: apart from the push script, everything is exempt from consent because you choose it or the service needs it (§ 25(2) no. 2 TDDDG; for sign-in and “Read offline” also Art. 6(1)(b) GDPR). For push you are asked explicitly when you switch it on (§ 25(1) TDDDG, Art. 6(1)(a) GDPR, Push).

Language and translation

tellmelo is available in fourteen languages. The choice in your account applies, otherwise the cookie tellmelo-language, otherwise the browser’s Accept-Language header, which is only read, otherwise English (Art. 6(1)(b) GDPR; without a choice of your own Art. 6(1)(f) GDPR: showing the page in your language).

Translation and language detection run on this server, with translation models from Mozilla and the language model fastText from Meta, which the server downloads without any information about members; no text goes to an outside service. When a post, addendum or reply is written, tellmelo detects its language, for paragraphs in several languages those too, and stores it with the text so that “Translate” appears where it is needed; if it is unclear, the language of the account or of recent texts applies. Translation happens only when you click, without storing or logging the text or the translation; only the number of your translations stays in memory for one minute, for the per-minute limit. Messages are never translated (Art. 6(1)(b) GDPR; towards the authors Art. 6(1)(f) GDPR: that their texts are understood).

Links and how they are checked

Links open via a notice page; the target address stands after the #, which the browser does not send to the server. Which links you open is not stored, and the target site does not learn where you came from. Link previews are loaded by the server, not by your browser.

Checks for harmful sites: tellmelo compares links in posts, replies, messages, profiles and group profiles with lists of known phishing, scam and malware sites (such as Phishing.Database, Block List Project and, if the operator wishes, abuse.ch), which a service on this server downloads and keeps; no address goes to an outside service for this. A new website is opened once without any information about you, and for its age only the domain name is sent to the registry (RDAP). For each website, its address, when it first appeared, how often it was posted and reported and the result are stored, not by whom, and, as long as the link is there, which profile links to it. tellmelo shows new websites to the team once, as well as those submitted by members (with their identifier, assessment and reasons). Blocked sites cannot be linked; tellmelo removes links to them from profiles and group profiles and says so (Art. 6(1)(f) GDPR: protecting members from harmful sites).

Account

Account and sign-in

For the account, tellmelo stores (Art. 6(1)(b) GDPR):

• Username and display name, chosen by you, public.
• Email address (required, no disposable addresses), stored encrypted, with the key kept separately; for sign-in codes and links, messages from the operator, for example about changed legal texts, and emails you switch on.
• Password only as an scrypt hash; email codes, links and secrets only briefly and as hashes. Two-factor sign-in is optional; its secret is stored encrypted.
• Passkeys: the public key with its identifier, the name you give it, when it was created and last used and whether it is synced; the private key stays on your device or in your password manager.
• Signed-in devices: time, last access and a rough description such as “Chrome on Windows”, no IP address. You remove devices and passkeys under Settings → Account & security.
• Security history: a new password, a new email address, the second factor on or off, new recovery codes, a passkey added or removed and sign-ins on new devices, each with its time and, for new devices, the rough description; visible only to you under Settings → Account & security → Security history, kept 180 days.
• Last use, to the hour: for marking new posts, notices after an absence, “last online”, the recap, invitations, programmes and the end of unused organization accounts.
• Settings, such as language, notifications, privacy, the app’s bar and start view, hidden notices.

Signing in with Google, Clovord or Apple

With “Continue with Google”, “Continue with Clovord” or, in the iOS app, “Sign in with Apple”, the service transmits, with your permission, an identifier of your account there, your email address if it has confirmed it (with Apple, if you wish, a relay address) and your name, with Clovord also the username; not your profile picture, contacts or password. The identifier is stored to recognise you; if the confirmed address already belongs to an account, the two are linked. For a new account, the details are held encrypted until sign-up is complete, for at most 30 minutes. As long as an account created this way has no password set via a link, you can also sign in without the service, with a code tellmelo sends to the address. Accounts with team rights cannot use some services. Disconnecting under Settings → Account & security deletes the identifier; with Apple, tellmelo then also revokes the permission there, as it does when the account is deleted. What the services process themselves is governed by their privacy policies (Art. 6(1)(b) GDPR).

Signing in with your phone

On a computer you sign in with your signed-in phone: the computer shows three numbers between 1 and 99, and you confirm “Is this you?” on the phone by choosing the same three out of nine numbers or, with nearby sign-in in the same network, with one tap; no camera is needed. A request is stored with a rough description of the computer such as “Chrome on Windows”, the numbers and a hash of its secret, valid for a few minutes and deleted after one day at the latest; the phone receives a notification, also by push. If you enter your name on the computer and are signed in to the app on a phone, the page offers this and, for that, learns whether your account offers it. Switch it off under Settings → Account & security → Signed-in devices (Art. 6(1)(b) GDPR).

Nearby sign-in is voluntary and off at first. If you switch it on, tellmelo stores, while the app is open on the phone, for at most ten minutes a fingerprint of its public IP address formed with a secret key, not the address itself. A computer in the same network then offers you sign-in without showing your name, but not if there are more than three such phones in the network. Switching it off deletes the fingerprint immediately and withdraws your consent (Art. 6(1)(a) GDPR).

Age and parents

The date of birth is checked at sign-up and not stored. Under 16, the account is created only with the consent of a parent or guardian; until then the details, both email addresses encrypted, are held for at most 14 days. As proof, the time of consent and the address it came from (encrypted) are kept until the account is deleted (Art. 6(1)(b) in conjunction with Art. 8 GDPR).

Supervision (optional): Up to two parents or guardians can connect their account and set a daily time and a night-time rest. For this, tellmelo counts, per day, the seconds a page is visibly open on the child’s device. The parents see these times for the last seven days, the child’s name and username and the settings, never posts, messages or contacts; the child sees who is connected and what applies. If a parent confirms that the child is 16 (date of birth checked again, not stored), or if supervision ends, connections, settings and times are deleted. Supervised accounts have stricter defaults and do not use some features (Art. 6(1)(b) in conjunction with Art. 8 GDPR; for the child’s data Art. 6(1)(f) GDPR: parental responsibility under § 1626 BGB and the protection of minors).

Invitations

Accounts prepared by the operator contain name, username, for organizations public contact details and, for an invitation by email, the address (encrypted). Nothing becomes visible before the person opens the link and sets a password; invitations not accepted are deleted after 14 days, immediately on request (Art. 6(1)(f) GDPR: making it easier for people and organizations to join).

Members’ invitation links contain only the username. For rewards, tellmelo stores who invited and checks, using data that is stored anyway, whether the new account meets the requirements (Terms); the inviting member only sees numbers, not people. If the invitation does not count, the link is deleted after at most 60 days, immediately with “Don’t count me”, otherwise together with one of the accounts (Art. 6(1)(b) GDPR; towards the invited member Art. 6(1)(f) GDPR: rewarding invitations fairly).

Profile

For the profile (Art. 6(1)(b) GDPR):

• Profile details such as picture, cover image, description, website, link page and badges are visible to everyone who can see your profile (public profile); equipped shop items only to those who have not switched off looks from the shop. The month you joined and badges can be hidden (for the month you joined Art. 6(1)(f) GDPR: others can see how long someone has been here). The server occasionally fetches a website you entered to look for a link with rel=me to your profile and stores only the result.
• Place (optional): place, region, country, postcode, street and house number (encrypted) and rounded coordinates, to recognise posts and questions from your area; only the place is public, if you show it. The address search asks Photon (komoot GmbH, Potsdam) with your input, without your IP address; answers stay cached for 30 days without any identifier. Withdrawing under Settings → Profile → Your place deletes all place details (Art. 6(1)(a) GDPR).
• Organization accounts show their address, industry, phone number, email address and opening hours publicly. The account type ends after 18 months without signing in or when the team withdraws it; the account and its posts remain.
• Mutual contacts and similar hints are calculated by tellmelo when shown, from lists that are visible anyway, without storing them.

Verification and claims about organizations

A human decides on applications for a verification badge, also for groups. Stored are the application with its reasons, account type and time, for people the figures at the time of sending, and the decision. Companies and associations upload an officially recognised document; it is kept encrypted and only until the decision, only administrators can open it, every opening is logged, and you may black out what is not needed (Art. 6(1)(b) and (f) GDPR: protection against accounts that pretend to be someone else).

Claims about organizations: If an account writes in posts, replies or its profile that it speaks for a company, an authority or tellmelo, it receives, unless it is verified, the note “not confirmed” until it gets verified or the team settles the claim, together with a request to provide proof through verification. Stored are the account, where the claim was found, the name of the organization and when the claim was settled, not the rest of the text; open claims are kept until settled, settled ones for one year. If the operator has switched it on, unencrypted direct messages are also checked when sent, end-to-end encrypted ones never (Art. 6(1)(f) GDPR: protecting members from deception).

Moderator program

Applications are made under Settings → Taking part → Moderation while the operator has them open. Stored are the languages chosen, when you agreed to which version of the agreement, the results of the test and the training in percent, the state of the application and the operator’s decisions with reasons. For every test you submit (application, end of the training, new material in the training), the posts shown and each of your decisions are kept encrypted for 90 days, so that only the operator can review your answers; if you withdraw your application or delete your account, they are deleted immediately. Your date of birth is only checked. As a moderator, tellmelo counts your steps in the audit log over the last 30 days and the date of your last post, for the level of your badge and a reminder after 14 days without activity; after 30 days the operator is told (Art. 6(1)(b) GDPR).

Helpers aged 16 or over take a shorter test, a shorter training and the same check of the ID copy; in addition, whether you want to become a moderator or a helper is stored. If the operator invites you, there is no application; stored are who invited you and when, and your answer (Art. 6(1)(b) GDPR).

Copy of your ID: After passing the test, you upload a photo of the front or back of your ID card or passport on which your name, document number and date of birth can be read; you may black out the rest. It is stored visibly marked as a copy, made smaller, without metadata and encrypted. Only the operator can open it: once for the review, after that only with a reason you receive every time as a notification and by email; every opening is in the audit log. The copy is deleted as soon as you withdraw your application or stop, a new copy is requested or the cooperation ends; if it ends because of serious misconduct, it is kept for at most 3 months, even after your account is deleted, and you are told the reason (Art. 6(1)(a) GDPR and § 20(2) PAuswG, withdrawn by withdrawing your application or stopping; after serious misconduct Art. 6(1)(f) GDPR: establishing or defending legal claims).

Plans, sparks, gifts, shop and payment

For purchases and gifts, tellmelo stores (Art. 6(1)(b) GDPR; towards gift recipients Art. 6(1)(f) GDPR: delivering gifts):

• Plans, sparks and gifts: type, scope, start and end of plans, of sparks bought and of a sparks subscription, who gave whom what as a gift and where it came from (purchase, operator, a partner’s allowance). What the operator gives a partner to give away (plan months, sparks, looks with a number of copies) is kept in the partner’s inventory and deleted when the partnership or the account ends. Gift recipients learn the name and @name of the giver; whoever hands out gifts under a post only sees the number of places given.
• Shop items: which ones you bought when and at what price or received as a gift from whom, and which you have equipped, for limited items the number of your copy, for unique looks that of your purchase. What is equipped (profile frame, effect over the cover image, look of the profile card) is visible to everyone who sees your profile or posts and has not switched off looks from the shop. Likewise for groups: which group received an item when and at what price, who among its leaders bought it and what the group has equipped (frame around its picture, effect over its cover image, look of its group header); this is visible to everyone who sees the group and has not switched off looks from the shop. Purchases are deleted with the account or the group; the payment remains as a record with the person who bought it. Exclusive items can be seen and received only by members and groups on their list; the entry ends with the account or group. If the team gives you an item or equips one for you, tellmelo stores when and by whom, what was equipped before and your answer (keep or give back); you learn of it by notification and email.
• What you create with plan features, such as notes (encrypted), reminders, messages sent later (encrypted until sent), animated custom emojis and those beyond the ten every account has, or text snippets, remains for six months after the plan ends, so that it comes back with a new plan, and is then deleted, with an email two weeks before.
• Inventory and plan points: for each point the plan, origin (plan, pack, gift, team, trial point, thank-you for a test purchase in the beta of the iOS app), payment, receipt and, for gifts, arrival, whether and when it was redeemed automatically or by you and which plan time it covers, whether it was refunded, and your setting for automatic redemption. For gifts from the inventory (points, sparks, items), who gave whom what and when, visible to both in the history; for sparks and items also the arrival (for the seven-day lock), for items whether and when you first equipped them. Points and history are deleted with the account; the other member then sees “a deleted account”.
• Voucher codes: code, payment and time, so that a code applies only once per member; deleted with a refund.

Payment: in the browser with Stripe (in the EU: Stripe Payments Europe, Limited, Dublin), in the Android app through Google Play (Google Commerce Limited, Dublin), in the iOS app through the App Store (Apple Distribution International Ltd., Cork). You enter payment details only there; tellmelo does not receive them. tellmelo only transmits the product, scope, price and a pseudonymous order identifier and learns whether and when something was paid, renewed, cancelled or refunded, with the provider’s identifiers and proofs of purchase. The payment page shows whether tellmelo sells itself or the provider, which then handles tax, receipt and refund. As sellers and for their own purposes, the providers are responsible themselves (stripe.com/de/privacy, policies.google.com/privacy, apple.com/legal/privacy). You cancel App Store purchases or request a refund in Apple’s window, which the iOS app opens from the inventory; tellmelo learns only the outcome (Art. 6(1)(b) GDPR).

Stored at tellmelo are orders until completed, payments, refunds (including voluntary ones within 48 hours), your consent to an immediate start (waiving the right of withdrawal), invoices, cancellations and withdrawals (details in the form /cancel encrypted) and a billing address you add (encrypted); invoices to private individuals do not show a name (Art. 6(1)(b) GDPR; for records Art. 6(1)(c) GDPR with § 147 AO and § 14b UStG).

Content and exchange

Posts, replies and messages

What you write and do stays stored until you delete it or your account: posts, replies, reactions, votes in polls and on replies, earlier versions of edited posts, drafts (encrypted), replies scheduled for later (visible only to you until then), collections, follows, mutes, blocks, lists such as close friends, and direct messages. Public posts are seen by everyone, posts for close friends only by them, direct messages only by those involved. Each post comes with your settings, such as who may reply, whether replies wait for approval, co-authors, whether a picture was made with AI; an approved reply keeps the time it was written and also receives the time of approval. When you import from another platform’s archive, your browser reads the archive; only your posts go to tellmelo (Art. 6(1)(b) GDPR; where other members are affected, for example by notices about their posts or the media library, Art. 6(1)(f) GDPR: exchange on the platform).

• Upvotes and downvotes: Replies are voted up or down, an earlier “Like” counts as an upvote; stored is who voted on which reply, when and how, never both. Under the reply stands its score, upvotes minus downvotes, below zero too (not in calm mode); its author learns by notification who voted it up, at most once in 30 days per person and reply, otherwise this is not shown. Nobody sees who voted down, not even the author, only whoever gives a downvote sees their own; nobody is notified of it. Each level is sorted by upvotes minus downvotes, with a small head start in the first 3 hours; a reply with at least 3 downvotes and more than twice as many downvotes as upvotes is shown folded at the end (“not helpful”) and is missing from the post’s public page. Votes end with the reply or the account and are included in the data export.
• Highlighted reply: Whoever wrote a post can highlight a direct reply to it, change it or take it back. It is then shown first for everyone, also on the public page, with “Highlighted by …”; its author receives a notification, at most once in 30 days per reply. Stored with the post until it is taken back or the reply is deleted.
• Images are resized by your browser, which first removes EXIF data including the GPS location; videos, GIFs and sounds are converted by the server (ffmpeg) without metadata and recording location, and the uploaded file is deleted. For allowances such as video points, the size and time of an upload are kept for up to 7 days. A post you send while its video or GIF is still being converted is held back unpublished by tellmelo until then; if the conversion fails, it becomes a draft again.
• Media library: GIFs and videos shared for everyone can be found and posted by all members, with your name and @name; you can take the sharing back at any time. On other websites, tellmelo’s player shows them, also with name and @name, only if you expressly allow it. Custom emojis shared with your followers can be used by them in their own texts, animated ones only with a plan. Only the sharing or permission is stored, until you take it back; the permission for other websites also ends with the sharing.
• The text of messages is stored encrypted on the server (AES-256-GCM, key kept separately), as are welcome and away messages of organizations; this mainly protects copies and backups of the database. Pictures and files in them can be retrieved only by those involved. By default, messages are not end-to-end encrypted: the server decrypts them for display, and anyone with access to the running server can technically read them. Whether the other person is typing or online is kept in memory for at most 24 hours and is visible only to people you have written to yourself; switch it off under Settings → Messages. Voice messages are recorded by your browser with the microphone when you allow it and record one; tellmelo turns the recording into an MP3 file of at most three minutes without metadata and stores only that, like pictures, in messages, posts and replies (Art. 6(1)(b) GDPR). They are not available in chats with end-to-end encryption.
• End-to-end encryption (optional, Settings → Messages): your browser creates a key pair and seals the private key with your six-digit PIN, which never leaves your device, and a random part that the server keeps encrypted. Stored are the public key (for the people you talk to), the sealed private key, a check value of the PIN as a hash, the server’s part (encrypted), the number of wrong PINs in a row, whether encryption is on and whether only people with encryption may write to you, and after a fresh start with a forgotten PIN also earlier public keys. If both people in a chat have it on, the browser seals every text and every photo (AES-GCM) before sending, including messages for later; tellmelo stores them in that form, with the identifiers of both keys, and can neither read nor view them, not even for previews. Still visible are who writes to whom and when, the approximate length, the number and approximate size of the photos and whether a message was read. Your browser first checks photos with the model and threshold of the picture check, which it loads once from tellmelo with the first photo (about 3 MB), and does not send a detected photo; the result stays on the device, nothing is stored. Videos and GIFs do not work in such chats; tellmelo checks links only when they are opened. The request to switch on encryption arrives as an automatic, unencrypted message. The server protects the short PIN by handing out its part only for the right PIN and making you wait longer after every five wrong attempts; but whoever runs the server itself and has its keys could guess it with some effort. You choose how long a device stays unlocked (device). In the data export, such messages appear sealed; all keys are deleted with the account.
• Calls (for now with early access): you can call people you may write to and with whom your messages do not wait as a request, unless they have switched calls off under Settings → Calls. Voice, picture and a shared screen go directly between the devices, end-to-end encrypted (WebRTC with DTLS-SRTP); where a firewall prevents that, tellmelo's own TURN server relays the encrypted stream without being able to read it. For this, each device learns the other's IP addresses and network details. Nothing is recorded. While a call rings or runs, tellmelo stores who calls whom since when, whether with video, and the connection details of both devices with their IP addresses; afterwards only an entry in the chat remains (voice or video call with its length, missed or declined), stored and deleted like a message, and a missed call arrives as a notification. A ringing call comes as a push like a message, if you get messages as a push. Noise suppression (RNNoise) and voice activation run on your device only; your browser stores the chosen devices and settings (Art. 6(1)(b) GDPR).
• Mutes and blocks are not revealed to the people affected, except that they can no longer write to you or see you.
• Counts and hints such as “Since your last visit”, your week, “Help out”, “Say hello” or statistics about your posts are calculated by tellmelo when shown, from data that is stored anyway; at most, when you hid a hint is stored, and an image for sharing only if you post it.
• Badges show, in five levels with a number, how many posts, replies and pictures someone has published, how many they follow, how many followers they have, how many likes (for replies upvotes) and reposts they have received and how many likes (for replies upvotes) they have given; calculated when shown, kept in memory for at most 10 minutes. Stored with the account are only: for Bughunter the number of your bug reports that the team has marked as confirmed or fixed, and with the report that it has been counted (the badge does not show the reports); for Early Supporter, who has plan time before 2027 (bought, given, from the team or for testing), since when and, after it ends, when it ended. The badge lapses together with both details three months later if no plan time is running any more. Hide them under Settings → Taking part → Rewards (Art. 6(1)(f) GDPR: an incentive to take part).

Groups

In groups (Art. 6(1)(b) GDPR; for decisions by the leaders, violations and public group pages Art. 6(1)(f) GDPR: order in groups, visible public groups):

• Membership with role and start is seen by the members, for public groups by everyone who sees the group; bell, sparks and figures only show totals, not who.
• Channels and chat: Besides the channel with the group's posts there are chat channels. For each message, the channel, author, time, text, media (images, GIFs, videos, voice messages) and the message it answers are stored; the members who see the channel can see them. Unlike direct messages, the text lies unencrypted on the server, as with posts. Up to when you have read a channel is stored for the number of unread messages, seen by nobody else and deleted when you leave. If one of two members has blocked the other, neither sees the other's messages. A deleted message is gone at once with its media; answers to it lose their quote. If the leaders or someone allowed to moderate remove someone else's message, the group's log notes it, without content and without reasons. After you leave, your messages stay in the group; if you don't want that, delete them first. Whoever is mentioned in a message with @name or, by roles with this right, with @everyone gets a notification naming the channel and the group, not the text; with @name only if they allow mentions by the writer, with @everyone only if the group's bell is not off. You can report other people's messages to the team; the report ends with the message. If the team removes a message, it is gone with its media; its beginning (up to 160 characters) stays stored with the case, so its writer sees what it was about.
• Muting channels: You can mute a chat channel for yourself, for 1, 8 or 24 hours or until you turn it back on. The channel, the end and the time are stored; nobody else sees it. Meanwhile the channel does not count towards what is unread, and @everyone from it does not reach you, your @name still does. The mute ends with its time (deleted the night after), when you turn it back on, when you leave, or with the channel or the account; it is in the data export.
• Voice channels (for now only in groups the operator releases): members talk to each other there and, where they may, show their camera or screen. Sound and picture travel encrypted (WebRTC, DTLS-SRTP) to tellmelo's own media server (LiveKit), which passes them on to the others in the channel; so they are not end-to-end encrypted, and nothing is recorded. While you are in a channel, the media server knows your account, name, picture, IP address, whether your microphone, camera or screen are on, whether you hear nothing, and your ping with the connection route (UDP, TCP or through tellmelo's own TURN server); everyone who sees the channel in the group and the team in the administration see this too. None of it is stored. Muting or disconnecting by the moderators is entered in the group's log. Noise suppression and voice activation run on your device only. Reactions (emojis) take the same way to the others in the channel and are not stored; how loud you hear someone is stored by your browser only.
• Bots: members can create up to five bots: accounts of the kind “bot” without a password or email address, run through an API key of their own and not findable in search. Stored are name, username, description, the permissions asked for, whether others may add the bot, who created it and when (bots). A group takes a bot in only when someone who may manage roles there agrees; the bot gets a role of its own with the permissions granted (community_roles.bot_id), and taking it in and removing it appear in the group’s log. A bot carries the “Bot” mark and reads and writes in the channels it may see, like a member; tellmelo hands it this content through the API. What the program behind a bot does with it is the responsibility of the person running it. A bot is deleted when that person deletes it or their account; it leaves a group when the group removes it (Art. 6(1)(b) GDPR).
• Bots in real time: A bot can have a picture and a banner, which its maker uploads. Bots their makers let others add appear in a directory with name, picture, description, maker and the number of their groups. A bot only enters the directory after the team has reviewed it; for this, its category, the state of the review with a note from the team to its maker, whether the team features it and since when it is listed are stored (bots.category, review_state, review_note, featured, listed_at). What happens in a group that has bots (a message written or deleted, someone joining or leaving, someone entering a voice channel) is kept for one day as an event (bot_events) for the bots there; a bot only receives events of channels it may see, as a stream, page by page, or delivered to an HTTPS address its maker sets (bots.webhook_url, signed, retried). The person running the bot is responsible for what happens there (Art. 6(1)(b) GDPR). Bots can offer commands, which the chat field suggests after “/”, and buttons in their messages; using one tells the bot who used it, kept for 15 minutes so it can answer (bot_interactions). A bot's answer for one member alone is shown only to them in the channel, for a day (bot_private_replies). A bot can take a seat in a voice channel to play music or sound there, marked as a bot; it hears nobody there.
• Roles: The leaders and anyone allowed to manage roles can create roles with a name, colour and rights and give them to members. Which roles someone has is seen by the group’s members in the member list; for each role, it is stored who has it and since when. It ends when the member leaves the group.
• Hub and channel symbols: Every group has a hub, its page with picture, banner, name, description and the parts its leaders switch on, including a text of their own; everyone who can see the group can see it. Anyone allowed to manage channels can give channels and categories a symbol: an emoji, a symbol from tellmelo’s set or a picture of their own, with a colour and a shape; members see it in the channel list. A picture of one’s own goes through the image check, belongs to whoever uploaded it, and is deleted once it is no longer used anywhere.
• Pinned messages: Anyone allowed to moderate in a chat channel can pin messages, at most 50 per channel; everyone who sees the channel finds them in its side panel. Stored with the message is since when it is pinned and by whom; nobody sees who pinned it. When the message goes, so does its pin. Searching a channel stores nothing.
• Threads in channels: Replies to a message in a chat channel can go into its thread instead of the chat; we store which message a reply belongs to. Visible to everyone who can see the channel. When the first message is deleted (by its author, by moderation or with its account), the thread ends with all its replies.
• Self-assignable roles and the welcome: A group's leadership can offer roles that members take and put down again themselves; they allow no more than taking part (viewing, writing, attachments, voice channels) and often open channels of their own. Who holds such a role is visible to members as with other roles. In your first days in a group the app greets you once with the welcome text and these roles; that this has happened is remembered only on your device.
• A group's emojis: Whoever may manage a group's channels can give it up to 50 emojis of its own (picture and name); its members use them in their texts and the channels as symbols, and texts show them to everyone who reads them. The picture belongs to whoever uploaded it; the emojis go with the group.
• Invitation links: Anyone allowed to invite can create links to the group. What is stored is who created a link and when, for how long and how many times it is valid and how many times it has been used, not by whom; the leaders and whoever created it can see this. Anyone who joins with a link counts as invited. tellmelo deletes expired and used-up links the following night, revoked ones immediately. A link works only as long as the person who created it may invite; it is deleted when they leave or their account goes.
• Feed channel: Posts in a group’s feed channel also appear in the public feed, insofar as the group is visible to the reader; only the leaders and roles with this right may write there. If the feed channel is off, its posts remain stored and in the data export but until it is on again only their author sees them, in their own profile, where they can also delete them; they are deleted with the account.
• Applications are stored encrypted together with the questions as worded; the leaders can read them, not the tellmelo team.
• Invitations: The leaders see whether they are open or declined; declined ones are kept for 30 days so that no one is invited again right away.
• Moderation in the group: The leaders and roles with the permission can mute members below them (one minute to one week; they can then only read, also after leaving and rejoining), kick them (they can join again) or ban them (1, 7 or 30 days or until lifted; no joining or applying until then). For each mute and ban, whom it concerns, until when, when and by whom are stored; those who may mute or ban see this, and the person concerned through their notification and in the data export, there without who it was. tellmelo deletes expired ones the night after, at once with the group or the account.
• Decisions in the group, including removing a post, are logged with reasons (encrypted; optional for a mute) that the leaders see; those affected receive the reasons as a notification.
• Public group pages show name, description, pictures, topics, member count and latest posts, the latter only from members who are findable themselves.
• Violations by a group are decided by a human on the team, with reasons; the leaders can appeal (Moderation).

Arranging pages, widgets and gallery

On a computer you can arrange the parts of a page yourself, put the menu bar at the top or on the left and add widgets; the feature is being switched on step by step. Your settings store the arrangement of each page (position, size, direction and look of the parts), the menu bar, where you moved the pencil, and your widgets with their settings, including the text of a note and the title and time of a countdown (settings.ownLayout); only you see this. So that an arranged page appears right away when loading, your browser remembers whether you arranged pages and where the menu bar is (local storage tellmelo-own-layout). If a widget shows a picture you uploaded, it is noted that the picture is in use, so the clean-up of unused pictures does not delete it (widget_media). A widget with posts fetches, when shown, the newest posts you may see anyway. Everything ends when you remove it or delete your account, and is included in the data export (Art. 6(1)(b) GDPR). Simple widgets store what you enter, likewise only in your settings: the items of a checklist, time zones, options to draw from, links, habits with the days ticked off in the last 28 days and your mood per day for the last 30 days. Widgets for chats, groups, notifications, trends, the challenge and your week only show what you can see anyway and store nothing extra. Your mood can reveal something about your health: it is stored only when you enter it yourself, shown to nobody and deleted at any time with “Delete history” (Art. 9(2)(a) GDPR).

• Your own widgets: You can write widgets yourself, from HTML with styles and scripts. Stored are the name, description, category, the code, when you wrote and changed it and whether you submitted it (gallery_items). A widget runs in a sealed-off frame: without access to your account or to the cookies and storage of tellmelo, and without a connection to the internet. It only learns the time, language, light or dark and its size, and can fetch public posts of a #tag or profile (text, name, username, time), which it cannot send anywhere. If its author says the widget uses the internet (gallery_items.network), it may also load content from https addresses outside tellmelo and send requests there; their operators learn your IP address and what your browser sends with every request and are responsible for that themselves. Such a widget only runs once you have allowed it after a notice; which ones you allowed and which are blocked is kept in your settings (settings.widgetNetwork) until you change it (Art. 6(1)(a) GDPR). If a widget tries to download something, this is stopped, the widget is blocked for you and the attempt is noted once per member with its time for the team’s review (gallery_download_reports) until the team has decided; the author does not learn for whom it happened (Art. 6(1)(f) GDPR: protecting members from harmful content).
• Drawings: What you draw on a page while arranging lies under its parts and widgets and is kept in your settings: each line and shape with its tool, colour, width and points (settings.ownLayout); only you see it unless you share it as a design. It ends when you delete it or your account, and is included in the data export (Art. 6(1)(b) GDPR).
• Designs: You can share your layout as a design: the whole app as you laid it out, that is every page, groups and messages, the menu bar, the widgets and your drawings, with a full description if you write one (gallery_items, gallery_items.details). Pictures never come along, your own widgets only if they are in the gallery; notes, countdowns and drawings as you entered them. Whoever takes a design replaces their own layout with it; this can be undone right after.
• Gallery and review: What you submit is reviewed by the team before others can find it. For this it sees the name, description, code or design and your name and username, and can send it back to you with a note; which team member reviewed it is stored (gallery_items.reviewer_id). In the gallery all members see it with your name, your username and how often it was taken; who took it is only counted, once per member (gallery_uses), and shown to no one. If you change something approved, others get the reviewed version until the team approves the change; if you delete it, it disappears from the gallery and for everyone using it (Art. 6(1)(b) GDPR; for the review Art. 6(1)(f) GDPR: protecting members from harmful or misleading content).
• Ratings and reviews: You can rate widgets, designs and bots in the directory with one to five stars and write a review, but not your own entries. Stored are the stars, the text and when you rated and last changed it (gallery_ratings). All members see the average and how many gave which stars; they see your review with your name and username, stars without a review without a name. You can change or delete both at any time; they also end when the entry is deleted or you delete your account, and are included in the data export (Art. 6(1)(b) GDPR). If you report a review, this is stored once per member with its time until the team hides it or finds it fine (gallery_review_reports); its writer does not learn who reported it. A hidden review is seen only by its writer, its stars still count (Art. 6(1)(f) GDPR: protecting members from insulting or misleading reviews).

Local newsroom

For the local newsroom (Art. 6(1)(b) GDPR; for reports and views Art. 6(1)(f) GDPR: a safe platform, showing the reach of articles):

• Invitation with region and time, until you answer or the team withdraws it. Role: region, a badge text of your own if one is given, area (centre and radius), who invited you, start and end. tellmelo determines the area from the name of the region using the address search, to which only this name goes (Photon), otherwise from the place in your settings.
• Articles: title, standfirst, text, cover image, times, status. Published articles are public, readable without an account and open to search engines, with your name and the badge; deleted when you delete them or your account.
• Following regions: which regions you follow and since when, for notifications about new articles (can be switched off). For the feed card and the choice near you, only the server compares the regions with the place from your settings; the place is not passed on.
• Views only as a daily total per article, separately for members and visitors, without views by the author and by search engines; who read an article is not stored.
• Reports: article, reason, reporting account, time and decision, until 180 days after the decision; who reported is seen by the team, not by the author.
• The role, invitation, articles, followed regions and your own reports are included in the data export.

Public profile, previews and search engines

Public content is accessible and findable even without an account. You object (Art. 21 GDPR) with the switches under Settings → Privacy; search engines remove what they have already indexed according to their own rules (Art. 6(1)(f) GDPR: making public content accessible and findable, having shared links visibly lead to sign-in).

Public profile (on by default, off under supervision): Under /u/username anyone sees your profile as a member would, with your public posts and, on their pages, replies from other public profiles; likes, replies, follows and messages require signing in. Never public are posts for close friends, posts from non-public groups, scheduled and removed posts. If your profile is not public, the link and its preview only show name, username and profile picture with a request to sign in.

Findable by search engines (a separate switch, on by default, only with a public profile): search engines may index your profile, your public posts and their pictures, they appear in the sitemap, and your posts may appear as examples on public pages of tellmelo, such as the sign-in page (translated on this server, not stored). When it is off, your pages are closed to search engines, and your content does not appear on indexable pages.

Shared links: For a link to a post in a messenger or network, its server loads a preview with name, profile picture, the beginning of the text and the first picture, more for public profiles; none for posts from non-public groups, from blocked accounts and removed posts. Links to a #tag, to Explore, the groups, the shop and the post of the week have a preview with title and picture; for visitors without an account, a #tag also shows its latest posts by members whose content search engines may index. These pages are not included in search engines.

Short links under tmlo.app (/@… profile, /+… group, /t/… #tag, otherwise a code) redirect to tellmelo immediately, with a server log like any request. For a code, tellmelo stores only the target and when it was created, not who created or opens it. The name for a post of your own (with a plan) is stored by tellmelo with the post and the time until the post is deleted.

Feed and programmes

Feed and learned topics

Topics of posts: The server attaches a few topics to every post, from its #tags, a fixed word list in fourteen languages and keywords from the text, translated into English on this server. They are visible only to team members with the right to see them; they work in the feed, search, #tag bar and automations and end with the post (Art. 6(1)(b) GDPR).

Learned topics (on by default, off under supervision): reading, searching, liking, voting, replying, sharing and answers to occasional questions in “For you” give points to the topics of posts, only from the word list, from which politics, religion, health and sexuality are deliberately left out. For each topic, a score and a time are stored, not what you read or searched for; without activity, the points halve after 30 days. With them, “For you” weights your feed and suggests groups: profiling within the meaning of Art. 4(4) GDPR, without an automated decision under Art. 22 GDPR. Under Settings → Your feed you see and delete the topics; switching it off is your objection (Art. 21 GDPR) and deletes everything learned (Art. 6(1)(f) GDPR: a feed that suits you).

What you set yourself, such as followed #tags, wishes for a time, sliders and saved mixes, is only in your settings and visible to no one; the mirror and similar views are created when opened and not stored (Art. 6(1)(b) GDPR).

A lent feed exists only at your request: through the link, another person reads your “For you” list in your order for one hour and so learns which topics occupy you; one row with a random key is stored for one hour (Art. 6(1)(a) GDPR).

Reach, highlighting and partners

tellmelo counts views of a post once per person and day, using an irreversible fingerprint of day, person and post that is deleted after 2 days; the author and the team see the number. The team can highlight posts (marked, not for sale) or hold them back, noted on the post and in the audit log. Per day and week, tellmelo counts how many members were active and came back and stores only these totals (Art. 6(1)(f) GDPR: showing the effect of posts, improving a fair service). For partner accounts, tellmelo only evaluates the date of the last post, to send reminders to post (Art. 6(1)(b) GDPR).

Discovery programme

For the Discovery programme (Terms), tellmelo regularly calculates, from data that is stored anyway, a score for your activity over the last weeks (on how many days you wrote, how others responded) and does not store it; the team only sees it for members with a place and the next ones in the queue. This is profiling within the meaning of Art. 4(4) GDPR without an automated decision: a place only comes about with your yes, under supervision with that of the parents (Art. 6(1)(f) GDPR: making active members visible; object with “Don’t ask again” or under Settings → Taking part).

Stored is whether you are invited, have a place or no longer want to be asked, and your choice for the portrait. With a place, Explore shows all members your profile with the “Discovered” mark, selected public posts, on how many days of the last four weeks you wrote and your most frequent #tag. Whether a place fits a person’s #tags and interests, tellmelo calculates when displaying it, only for that person. After the end, your profile stays under “Discovered before” for up to 30 days; for this, the date the place began is stored (Art. 6(1)(b) GDPR).

“New here” shows accounts from the last 14 days with public posts, calculated when displayed, without supervised accounts and without members who have objected to the programme.

Rewards, loyalty rhythm and sparks

For programmes without monetary value (Terms), tellmelo stores only what they need: for the loyalty rhythm, the days of the current week on which you were active (without the time of day, read from your posts and reactions), the day and week of your last visit, counted weeks and levels reached; for sparks, per spark its origin, validity and which group it is currently given to; for groups, which perks their leaders have turned on and since when, and their own invitation link; for rewards, the levels reached. Only you see your rhythm; others do not see whom you give sparks to, groups only the number. tellmelo checks eligibility using details stored anyway, such as the age of the account, a confirmed address or the first steps (Art. 6(1)(b) GDPR).

Post of the week

For the post of the week (Terms), every Sunday tellmelo picks, from data stored anyway, the public posts of the week before with the most response, at most one per person, never from supervised accounts or from members who have turned it off under Settings → Taking part → Post of the week. The winners appear in the year album at /album; visitors without an account only see posts there from public profiles that are findable in search engines. Deleted posts disappear from the vote and the album (Art. 6(1)(f) GDPR: a selection carried by the members; object with the switch or by withdrawing).

For each vote, the chosen posts are stored with their response and whether they were withdrawn or taken out by the team; who voted for what only until the vote closes and visible to no one, not even the team, after that only the number of votes (for voting Art. 6(1)(b) GDPR).

Feed Duel

In Feed Duel, members guess, alone, against someone who is also looking right now, or on a challenge, which of two public posts got more response on its first day. For this, tellmelo picks, from data stored anyway, posts from public profiles that are between one day and one week old and counts their likes, replies and reposts of the first day; never posts by the players themselves or from accounts that a player has blocked or muted or that have blocked a player, never from supervised accounts or from members who have turned it off under Settings → Taking part → Feed Duel. When it is turned off, the text of your posts is also missing from earlier results (Art. 6(1)(f) GDPR: a game with posts that are public anyway; object with the switch).

For each duel, tellmelo stores who plays against whom and how it came about, the two posts of each round with their response, when each player started and, for each round, their guess with its time. The players see each other’s name and profile picture, the other’s guesses only after the round, and the result. You can only challenge members who follow you; the challenge and the result arrive as a notification. Supervised accounts only play alone. Others only see as a number how many are looking for an opponent right now (Art. 6(1)(b) GDPR).

Rating and leaderboard: From the duels of a month, tellmelo calculates a rating for each player (from the guesses, their speed and the results against others) and stores it with the number of games. The leaderboard shows members name, profile picture, rating and games of the month; never supervised accounts, never between two accounts when one has blocked the other; turn it off under Settings → Taking part → Feed Duel (Art. 6(1)(f) GDPR: a competition among players; object with the switch). The first two of a month receive a prize (Terms); stored is who received which place with which rating (Art. 6(1)(b) GDPR).

Lock on other devices: While you play, tellmelo remembers in which session the game is being played, with the device description from sign-in, and until the end of the game, at most a few minutes, locks your other sessions and API keys; they only show on which device the game is being played. The entry is then deleted (Art. 6(1)(f) GDPR: a fair game without looking things up on the side).

Duels are kept for 90 days after they end, searches and challenges that nobody accepted for one day after they expire, ratings for 90 days after their month, awarded prizes for one year; your duels, guesses, ratings and prizes are included in the data export.

Advent calendar and raffle

In December, the Advent calendar counts, from data that is stored anyway, what you did on tellmelo on a given day, such as posts, replies, likes and upvotes; what is newly stored is which doors you opened and when. The gifts go into your inventory (Art. 6(1)(b) GDPR).

For each raffle ticket, tellmelo stores the ticket number, a random code, the time, the version of the conditions of participation and your confirmation that you are at least 18 years old; the date of birth is only read for this. The team can look up which account a ticket number belongs to and which ticket number an account has, in order to check participation and the prize; this does not show the code, and every lookup is recorded in the team’s log. The ticket list is published without names; the public random number comes from drand, without any data about you going there.

If you win, tellmelo stores, encrypted, the payout you chose and the PayPal address or the retailer, and checks your age using an identity document, whose copy is then deleted (Art. 6(1)(b) GDPR; for the age check also Art. 6(1)(f) GDPR: prizes only for adults).

Doors are kept until 31 March after their December, tickets for 90 days after the ticket list closes (after that only the ticket numbers drawn), payout details for 30 days after the payout or after the prize has lapsed; doors and tickets are included in the data export.

Apps and notifications

Mandy, the system account

Mandy is the system account of tellmelo: not a person and not artificial intelligence, but fixed rules and simple counts set by the team. The link check, automatic moderation and the marking of claims about organizations run under her name; the team decides on whatever stands out. You cannot write to Mandy, and she does not read messages; in unencrypted messages she only checks links and, if the operator switches it on, claims about organizations. What Mandy stores about you ends with the account (Art. 6(1)(f) GDPR: a lively platform where new members find connections).

• Hints about taking part come from Mandy, each with a reason, for example about a post without a reply, the challenge of the week, how a post of your own was received, and once, two to four days after sign-up, about the first steps. The team sets the maximum number per day, counted against the existing notifications. Only when a nudge to write and the reminder came is stored, so that they do not come again, and your choice under Settings → Notifications, where you switch the hints off.
• Posts and replies: Mandy welcomes new members under their first post, thanks people for replies, asks about lively #tags, writes on fixed occasions, announces the challenge of the week, looks back on the week, sums up replies and highlights posts; if she quotes a post or a reply (without links and mentions), the author receives the usual notification. Every text is planned in advance and stored with member and post for 90 days so that the team can see and stop it; this is included in the data export. In groups, Mandy only writes if the leaders switch it on.
• What Mandy may do: You switch off welcoming, thanking and highlighting or quoting your texts under Settings → Notifications (three switches in your settings). If you mute or block Mandy, you get no replies from her.
• Learning only from totals: how many replies, likes (for her replies upvotes) and reposts her texts had after 48 hours and at which hour most is written. No details about individual members arise; the team can reset what has been learned.
• After a break of at least 7 days, “For you” shows posts from the accounts you follow higher up for one day; the time of your return is stored and overwritten the next time. The team can switch this off for everyone.

Push, apps and emails

Push only exists if you switch it on on a device; you can withdraw at any time, per device. No push service receives the content, only the signal that there is something new; your device fetches the text and the number of unread items from this server with a key of its own. Stored are the address or device identifier at the push service and the browser’s keys or a fingerprint of the app’s key, until you switch push off or sign out. Which push services these are is listed under Recipients; without Google services the Android app checks in regularly itself, the desktop app while it runs. You are notified only where you are using tellmelo right now; for this, open pages report their kind and whether they are in front, only for 75 seconds in memory (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Buttons in a notification (reply, like, vote, share, follow back, accept or decline a call) do the same as in tellmelo; the iPhone and Android apps send them to this server with their key. If you choose once a day, reactions, new followers, mentions and news from groups come together at the hour you pick instead of one by one; messages and sign-ins still come at once. For this the hour and your device’s time zone are stored with your settings. In the iPhone app a call rings like a phone call (CallKit): for this a second device identifier at Apple is stored, and Apple only receives a random identifier of the call; the app fetches who is calling from this server with its key. These calls do not appear in the phone’s call history.

• In the apps the same applies, plus: Widgets only show the number of unread items, fetched with the app’s key and only on the device. Sharing to tellmelo places what you share into the app as a draft; it goes to the server only with your post. Choosing photos opens the system’s photo picker; without any permission, the app only receives the images chosen. The lock with Face ID, Touch ID or passcode is checked by the device; the app only learns the result. The app icon and “Read offline” (device) stay on the device. So that links to tellmelo open in the app, a file from this site that names only the app is retrieved, on iOS through Apple (Art. 6(1)(b) GDPR; for entries on the device § 25(2) no. 2 TDDDG).
• Display in Discord: If Discord runs on the same device as the desktop app for Windows or Linux, the app shows in your Discord profile what you are doing on tellmelo right now (“Rich Presence”): at first the area (feed, a #tag, an open group, the shop), depending on your choice only that you are using tellmelo, or also the public post or public profile you are viewing, with name, beginning of the text and picture; in addition, buttons to the page and, as long as your profile is public, to your invitation link. Never shown are messages, search terms, non-public profiles and posts for close friends or from internal and hidden groups. The details go only to the Discord program on your device; Discord transmits them under its own terms to everyone who can see your profile. tellmelo stores nothing for this; your choice is kept in the desktop app. The display, including the area and the invitation link, is on from the start, which the app points out the first time with a button to the settings. The display and the invitation link can be switched off under Settings → Appearance & app → Discord (Art. 6(1)(f) GDPR: showing your use of tellmelo in Discord, as is usual there).
• Beta of the iOS app through Apple’s TestFlight (Apple Distribution International Ltd., Cork), with Apple’s terms and privacy notices. The operator receives feedback and crash reports from TestFlight through Apple, with the details Apple adds, such as device and system version (Art. 6(1)(f) GDPR: improving the app). Purchases in the beta are free test purchases in Apple’s test environment; tellmelo only stores the plan point that an account’s first test purchase brings as a thank-you (Art. 6(1)(b) GDPR).
• Request for a rating: at the earliest two weeks after sign-up, at most every four months, through Apple, which also decides whether the window appears; you rate only there. The time of the last request is stored (Art. 6(1)(f) GDPR: making the app better known).
• Custom sounds (with a plan): your browser cuts five seconds from a recording; the server converts them without metadata and stores them until you remove the sound (Art. 6(1)(b) GDPR).
• Emails about your account, security, purchases, decisions and changed legal texts are sent as long as the account exists (Art. 6(1)(b) GDPR). The recap after seven days of absence (numbers only) and similar emails only with your consent, which you can withdraw with one click in every email, not under supervision (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG).

Tools

Tools for organizations, partners and developers

The tools (Art. 6(1)(b) GDPR; towards people who come into contact with them, for example in a conversation with an organization or as the trigger of a webhook or an automation, Art. 6(1)(f) GDPR: handling requests, delivering events, reactions as by hand):

• Team access and team inbox (Organization): Up to five people act for the account, see what it sees, including messages to the account, and write in its name; their actions are listed in the account’s log for 90 days. For conversations, they note who is taking care of them and an encrypted internal note, for which the organization is responsible.
• Events, locations and profile additions (Organization) are public in the profile. Sign-ups for events are seen by the organization with name and @name, by others only as a number; events and sign-ups are deleted one year after the event.
• Website widget and webhooks: The widget shows public posts of a public profile on another website, without cookies and scripts. Webhooks send the kind and identifiers of new events and @names to an https address that was entered, never texts, to partners also the state of their allowance; whoever enters them is responsible for receiving them.
• API keys are shown once and not stored; what remains is an irreversible fingerprint, permissions, last use and number of calls, not what was retrieved. Site keys for the GIF picker on your own websites are public; stored are the key, name, addresses entered and when it was created, until you delete it. The picker only shows what members have allowed for other websites; the server treats its requests like embedded GIFs and videos. In the developer area (/developer) you have up to ten API keys, each with a name, permissions and, if you like, a last day (api_keys.name, api_keys.expires_at); a renewed key replaces the secret, expired ones are refused. Every change there, including to site keys, bots, webhooks and apps, you confirm with your password and, if switched on, a two-factor code; only wrong entries are counted, as when signing in.
• Automations (for roles with the right to use them): workflows act for your account on a schedule (posts, also with #tags, named, followed or not followed profiles; every few hours, if you wish only at certain times, with a chance) or on events (every new post, new posts from profiles, with #tags or in groups, first posts of new members, new followers, replies under your posts), with a like, for replies an upvote (never against a downvote by your account), a share, a reply from your texts or a follow. Stored are the workflows (schedule or event, named profiles, groups or #tags, building blocks with texts, last run and how much it planned) and, for each planned or skipped action, the post, reply or person, the action, the text chosen and the times, until 2 days after its time, actions carried out for 8 days, so that nothing you have undone is repeated. Only data that is stored anyway is read; every action goes through the same checks as by hand.

Signing in to other sites

Other sites can offer sign-in with your account at tellmelo. Only when you choose “Allow” does the site receive your username, your confirmed email address and an identifier for this site only, or part of them, never your name, profile picture, posts, contacts or password. Your consent is stored with its scope and times, and for the hand-over a one-time code for at most one minute. Remove sites under Settings → Apps & API → Connected sites; what the site does with the details is its own responsibility. Supervised accounts cannot use this (Art. 6(1)(a) GDPR).

Whoever applies for an app for their own site provides name, website, privacy policy, return addresses and purpose; the team decides with reasons (Art. 6(1)(b) GDPR). You can change an approved app at any time: the change sits next to the app (oidc_clients.changes) until the team takes it over or declines it with reasons, and you can withdraw it; until then the approved version applies.

Moderation, support and security

Moderation and account standing

Reports, decisions, warnings, restrictions and appeals are stored so that decisions can be reviewed; your own texts in them encrypted. “Account standing” shows your status; you receive every decision with reasons as a notification and by email, without the name of the person who decided (Art. 6(1)(b) and (f) GDPR: protecting members from spam, fraud and harmful content, order and security of the platform).

Automatic moderation: Before a post appears, the operator’s rules check, using data stored anyway (such as the age of the account, recent texts, links, mentions, words from a list kept by the team), whether a human should look at it first or whether it comes too fast, too often or with a blocked link; until then only you see it, with the reasons. A human decides, also on limits after very fast posting. The team is exempt.

Order of reports: Mandy sorts open reports for the team by fixed weights (most serious reason, number of people reporting, cases against the author in the last 90 days, waiting time), with endangerment of children always at the top. Every report is decided by the team; no new data arises in the process.

Picture check: A recognition model on this server checks every uploaded picture, video and GIF for pornographic or sexually explicit depictions, including drawn ones, for videos and GIFs using the preview image and a few individual frames. Only a percentage value is stored; nothing goes to third parties. Above the operator’s threshold, a post waits for a human; as a reply, message, profile or group picture, the picture is not accepted. The team is exempt; for end-to-end encrypted chats see there.

Temporarily offline: Helpers and the team can take a post or profile details (description, profile and cover picture, website) offline until moderation decides, stored like a report, the previous state of a profile encrypted, until 30 days after the decision. Whether the content is restored or stays removed, you learn as a notification, without the name of the person who took it offline.

Team view and roles: For moderation, team members with the right to do so also see content that would be hidden from them as members, for example because of a block or for close friends, marked and without being able to interact with it. Every team member has a role with fixed rights; roles and their changes are in the audit log.

Contact, support and bug reports

• Contact requests and copyright reports via the forms or by email to the address in the imprint: name, email address, message and, for copyright reports, an address for service are held encrypted together with the replies; tellmelo fetches the mailbox from its own server, attachments stay there, automatically sent emails without a request are deleted. Your rating of a completed request is attributed to the team member who handled it (Art. 6(1)(f) GDPR: answering requests; for copyright reports also Art. 6(1)(c) GDPR with § 10 DDG).
• Help Center and support, also on subdomains of their own such as help. and support., which run on the same server: a request in support also stores its topic. So that you can have the links to your requests sent to you by email, each request carries a non-reversible key value of your email address (HMAC); signed in, “My requests” shows the requests you made while signed in. Whether an article helped is only counted as a number per article, with no link to you (Art. 6(1)(f) GDPR: answering requests and improving the help).
• Questions about an order from the inventory: message (encrypted) with replies, your name, your account’s email address (encrypted) and the order; the team sees what was ordered when, for how much and through which provider, and can refund it (Art. 6(1)(b) GDPR).
• Requests under the GDPR (access, erasure and others) are kept by the team in a list with type, receipt, deadline, extension with reason, completion and who recorded them (who completed them is in the audit log); the list entry is deleted with the request or the account (Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 12(3) GDPR).
• Bug reports: area, description (encrypted), version, browser and system in a few words, the view and, if you wish, a screenshot; you see beforehand what is sent (Art. 6(1)(b) GDPR).
• Tickets: The team handles reports, requests and other matters as tickets with responsibility, status and internal notes (encrypted) that you do not see (Art. 6(1)(f) GDPR: orderly handling).
• Support access: Only if you agree via the link in an email does a team member act in your account for 24 hours, without access to sign-in details, payments, deletion, data export, consents and your messages. Every change is recorded with the previous state (encrypted) so that you can undo it; at the end you receive an overview. End it at any time under Settings → Account & security (Art. 6(1)(a) GDPR).
• Feedback: At the earliest 14 days after sign-up, a card in the feed asks at most once a month how you like tellmelo (five levels, a sentence if you wish); when you delete your account, you can choose a reason and write a sentence. Both are voluntary and are stored without any link to your account (answer or reason, sentence encrypted, month, language); the operator sees them in the administration as an evaluation. Please do not write anything in the sentence that could identify you. Only the month of the last question, whether answered or closed, is kept with the account (Art. 6(1)(f) GDPR: improving tellmelo based on voluntary feedback).

Audit log

Decisions and interventions in the administration are logged with person, subject, time and reasons, without posts and messages. The log remains after an account is deleted, so that moderation stays reviewable (Art. 6(1)(f) in conjunction with Art. 17(3)(e) GDPR: establishing or defending legal claims). Large refunds and changes to team roles are carried out only once a second person with the same right agrees; for this the request, who made it and who decided are stored for up to 90 days.

Periods and rights

How long data is kept

Data is deleted as soon as its purpose no longer applies, at the latest by these deadlines; if a section above states a shorter period, that one applies.

Recipients and third countries

• Processors in Germany (Art. 28 GDPR, under contract): a data centre operator for the server and an email delivery provider; names on request via the contact form.
• Photon (komoot GmbH, Potsdam): only the input in the address search.
• Sign-in services only if you choose them: Google (Google Ireland Limited, Dublin), Clovord (Noah-Steffen Pansegrau, Sundern), Apple (Apple Distribution International Ltd., Cork); they learn that the sign-in is for tellmelo.
• Payment providers only when you buy: Stripe, Google Play, App Store (Payment).
• Push services only with push and only for the content-free signal: in the browser the service of its maker (Google, Mozilla, Apple), in the Android app Firebase Cloud Messaging (Google), in the iOS app the Apple Push Notification service.
• Discord only with the desktop app, via the Discord program on your device: the display in Discord, until you switch it off.
• Recipients you determine yourself: webhook servers of an organization or partner, sites where you sign in with tellmelo, and DuckDuckGo for searches in browser windows of the desktop app; they are responsible for receiving the data themselves.
• Authorities and courts only where a law requires it (Art. 6(1)(c) GDPR).

There are no other recipients. Third countries: Data goes to the USA to Google, Apple or Mozilla with push; when paying and when signing in through a service, Stripe, Google and Apple may transfer data to the USA. The basis is the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the provider is certified under it, for push also your consent (Art. 49(1)(a) GDPR). What Discord does with the display, also outside the EU, is governed by Discord’s terms.

No automated decisions

There is no automated decision under Art. 22 GDPR. The feed sorts by a formula whose sliders you set; its main parameters are named in the Terms. Moderation, restrictions and programmes are decided by a human or by your own yes; Mandy too only holds posts back and sorts reports, the team decides. Only what has no legal or similarly significant effect happens automatically, for example in the check of links and pictures, folding replies with many downvotes and the note “not confirmed” on claims about organizations. You can object to any decision.

Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20).
• Objection (Art. 21 GDPR) to processing based on a legitimate interest.
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future.

Do it yourself: under Settings → Your data you download your data and delete your account; it is blocked at once and finally deleted after 30 days, until then you undo it by signing in. For anything else write to kontakt@tellmelo.com or use the contact form.

Complaint: to a data protection supervisory authority (Art. 77 GDPR), for example where you live or where the controller is based; in Bavaria the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach.

Changes

If tellmelo processes data of a new kind, for new purposes or with new recipients, this statement is updated beforehand; new features within the described framework do not change it. The date at the top names the version in force. An email to your account’s address informs you beforehand about significant changes, not about purely editorial ones.