Privacy policy

1. Controller

The controller for Easy Sunday within the meaning of the General Data Protection Regulation, GDPR (DSGVO), is:
Holger Seim
Revaler Straße 31
10245 Berlin
Email: kontakt@easysunday.app

Easy Sunday is a free application for family planning. In the following, Holger Seim is also referred to as the “operator”.

2. How Easy Sunday works

• Sign-in with Google and approval: Anyone with a Google account can sign in. New users are first placed on a waiting list and can only use the app once the operator has approved their access. The operator can also approve addresses in advance.
• Families as separate spaces: Each family has its own, sealed-off space. A family never sees the data of another family. Each person belongs to at most one family; a family has at most two parents.
• Invitations: A parent can add a second parent by their Google address. The invited person receives an invitation email and is thereby approved. If they already belong to another family, they receive an email asking them to join and must confirm the switch in the app.
• Operator area: For approval and secure operation, the operator sees only administrative data (see section 5), never the content of a family.
• Babysitters do not need an account. They receive a personal link (see section 6).

3. What data we store

To run the app, we store:

• Account: Google address and name from the Google sign-in, the identifier of your Google account (so that a Google address cannot be taken over by another Google account), access status (waiting, approved, blocked), time of sign-up and of approval, and of last use
• Name of the family
• Names of family members and babysitters
• optional: email addresses of babysitters
• optional: phone numbers of parents and babysitters (in international format) and whether Signal is used on that number
• when the messenger is used: messages to and from Easy Sunday via Signal (see section 7) and the number of messages in the current month
• when a parent adds another parent: that parent's Google address, who sent the invitation, the time of the invitation or of the most recently sent invitation email, and whether it was accepted
• First names of the children
• Planning data: recurring and one-off time slots (e.g. drop-off, pick-up, childcare), who is responsible when
• Bookings and requests to babysitters, including the text of a request
• hashed access tokens for babysitter links (the actual link token is stored only as a SHA-256 hash for matching and in encrypted form, so that a link can be shown again when needed – never in plain text in the database)
• encrypted Google refresh tokens (AES-256-GCM) for connected Google Calendars, and the times and status of the last synchronisation
• a log of the operator's actions in the operator area and of automatic approvals and newly created families: when, which action, the Google address of the acting operator (“system” for automatic entries) and the affected account (identifier or Google address) or the affected family

4. Google Calendar access

When a parent connects their Google Calendar, Easy Sunday reads and writes only the following data:

• Personal calendar: start and end time, location and status (free/busy) of events, in order to calculate availability. Titles and attendees of events in the personal calendar are not read.
• Work calendar: only the start and end time, location and transparency (free/busy) of individual events, via a targeted selection of fields (“field mask”). Titles, descriptions and attendees of work events are never retrieved or stored.
• “Easy Sunday” calendar: a private calendar created by the app itself, into which Easy Sunday enters confirmed events (childcare, handovers). If a work calendar is connected, the relevant work address is invited to the event as the only other person (without a notification email to that address).

For this we use only read-only permissions for calendar events (calendar.events.readonly) and, only for the account that manages the family calendar, the permission to manage calendars created by the app itself (calendar.app.created). So that the app can find the “Easy Sunday” calendar again, it also reads the list of your calendars with their names and identifiers (calendar.calendarlist.readonly), but no events from calendars other than the ones you have connected. We never read contacts or any other Google data.

Use in accordance with Google's policies: The use and transfer of information that Easy Sunday receives from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The only purpose for which Easy Sunday uses data from your Google Calendars is shared family planning in the app: recognising free or busy times, suggesting suitable responsibilities and entering confirmed events in the “Easy Sunday” calendar. There are no other purposes.

In particular, this means: data from your Google Calendars is used only for the Easy Sunday features described above. It is not used for advertising, not sold, not passed on to third parties (except where necessary for operation, see section 10, or required by law) and not used to train AI models; nor is it transmitted to Anthropic (section 8). No human reads this data unless you have expressly consented, it is necessary for security (for example to investigate abuse) or it is required by law. The operator does not see any calendar data in the operator area either.

How we protect this data technically, in particular the encrypted storage of the Google access credentials, is described in section 14.

5. Approval and operator area

When a new person signs up, the operator receives an email at kontakt@easysunday.app with their name and Google address, so that he can review and approve their access. After approval, the person receives an email saying that their access has been activated. If access is not approved, no email is sent.

In the operator area, the operator sees only administrative data: names and email addresses of the parents, access status, date of sign-up, time of last use and counts (e.g. how many children, time slots and babysitters a family has created and how many messenger messages it has sent in the current month). The operator does not see names of children and babysitters, time slots, bookings, message contents or calendar data there. The operator can block access and delete families, for example in case of abuse. Each of these actions is logged, as are automatic approvals (when an already approved family has entered the address as a parent) and newly created families.

6. Babysitter links

Babysitters do not sign in; instead, they receive a personal link from the parents. Via this link they see only the requests and appointments that concern them, and can accept or decline. The link always belongs to exactly one family. Parents can invalidate it at any time by deleting the babysitter. The parents are responsible for ensuring that the babysitters they enter agree to their data being used in Easy Sunday.

7. Messenger (Signal)

Once the messenger has been set up for your family, parents and babysitters can write to Easy Sunday via Signal, individually or in a family group to which a parent has added Easy Sunday. Easy Sunday uses its own Signal number for this. The messages are end-to-end encrypted in transit and are only decrypted on our server; Signal itself cannot read their content. As with any Signal message, Signal Messenger LLC (USA) receives the technical data needed for delivery. In addition, the terms and privacy policy of Signal apply.

Easy Sunday replies only to messages from phone numbers stored under “Personen” (People). Each phone number of a parent belongs to exactly one family, so every message is clearly assigned to one family and concerns only that family's data. Messages from other numbers are discarded immediately: their content is neither kept, nor analysed, nor passed on. This also applies in groups: messages from group members who are not stored under “Personen” do technically reach our server, but are likewise discarded immediately, without being kept or analysed. When Easy Sunday is added to a group, it introduces itself there once and explains that it reads along.

In groups, Easy Sunday reads the messages of the stored people in order to recognise arrangements (e.g. “I'll do the pick-up on Wednesday”). This only results in a suggestion, which a parent has to confirm; without confirmation, nothing is entered. These suggestions can be switched off in the settings under “Messenger”.

The purpose of the processing is to understand your messages, to query or change the family plan accordingly and to reply to you, and, on request, to send babysitter requests directly via Signal.

Because every message incurs costs for processing by Anthropic, each family has a monthly allowance of messages (100 by default). For this we count the messages per family and month. Once the allowance is reached, Easy Sunday only replies with a short notice until the next month.

8. Processing by Anthropic (Claude)

If you use the messenger: so that Easy Sunday understands messages in everyday language (e.g. “Can Jonas do the pick-up on Thursday?”), they are transmitted to Anthropic, PBC (USA) and processed there by the AI model Claude. Only the text of messages from stored people is transmitted, together with the minimum context needed for planning: first names of parents, babysitters and children, names and times of time slots, and the plan for the days in question. Not transmitted are phone numbers, email addresses, data from your Google Calendars, access tokens, and messages from people who are not stored under “Personen” (People). Each request contains only data of the family concerned. The AI can only suggest fixed, predefined actions, which Easy Sunday checks before carrying them out. If parents change several things at once or delete something, this is always carried out only after their confirmation.

Anthropic processes this data on our behalf (data processing on behalf of a controller). According to Anthropic, inputs submitted and outputs generated via the API are not used to train models, in accordance with Anthropic's commercial terms of service. According to its own information, Anthropic may retain data from the API for a limited period for safety and abuse review. You can find more information in the Anthropic Privacy Center.

Because Anthropic is based in the USA, this involves a transfer of data to a third country (USA). This transfer is based on the EU Standard Contractual Clauses or, where Anthropic is certified for it, on the EU-US Data Privacy Framework.

9. Emails

Easy Sunday only sends emails when this is necessary for using the app:

• Invitation of another parent or invitation to another family: name and email address of the invited person and the name of the person sending the invitation
• Notice to the person that their access has been activated
• Notice to the operator that a new sign-up is waiting (name and Google address)
• Notice to the other parent when a family has been deleted

Feedback: Via “Feedback geben” (Give feedback) you can send us a message. It is sent by email to kontakt@easysunday.app and contains the type of feedback, your text, the page of the app you were on, information about your device and browser, and your email address as the reply-to address. The feedback is not stored in the app, only in the operator's mailbox, and is deleted once it has been dealt with and is no longer needed.

To prevent abuse, the number of invitations and feedback messages per day is limited. For this we count how many such emails have been sent per family or person and day.

10. Hosting and service providers

We pass data only to the following service providers, and only to the extent necessary for the respective function:

• Hetzner Online GmbH (Germany): hosting. The app, its database, the backups and the connection to Signal run on a server at Hetzner in Germany.
• Resend (sending in the EU region): sending the emails listed in section 9.
• Google: sign-in with Google (for this we receive only name and email address, no calendar access) and the calendar features from section 4.
• ImprovMX: forwarding of emails to kontakt@easysunday.app (e.g. feedback, notices of new sign-ups, your enquiries) to the operator's mailbox.
• Signal: delivery of messenger messages, if and to the extent that you use the messenger (section 7).
• Anthropic: understanding messenger messages, if and to the extent that you use the messenger (section 8).

When you access the app, the server necessarily processes your IP address for technical reasons, in order to deliver the pages and to limit repeated requests (protection against abuse).

11. Legal bases

• Art. 6(1)(b) GDPR (DSGVO) (user relationship): account, sign-in, family space, planning, calendar connection, messenger and the related emails to parents.
• Art. 6(1)(f) GDPR (DSGVO) (legitimate interest): data about children and babysitters entered by parents (the family's interest in organising childcare), invitation emails to people who do not yet have an account, approval, operator area, log, limiting of requests and emails, and backups (interest in secure operation free of abuse), reading along in Signal groups for suggestions, and the handling of feedback.
• Art. 6(1)(a) GDPR (DSGVO) (consent): where we ask you for consent in an individual case. You can withdraw consent at any time with effect for the future.

12. Cookies

Easy Sunday sets only strictly necessary cookies: a session cookie that keeps you signed in after sign-in (for up to 30 days or until you sign out), and, during sign-in with Google or when connecting a calendar, a short-lived security cookie (at most 10 minutes) that binds the request to your browser, and a language cookie (NEXT_LOCALE, 1 year) that remembers your choice when you switch language in the footer. No consent is required for this (§ 25 Abs. 2 Nr. 2 TDDDG), because these cookies are strictly necessary for signing in, or store a setting you explicitly choose yourself.

In addition, Easy Sunday stores one entry in your browser's session storage (sessionStorage) when the page reloads automatically after an update: the time of that reload, so that the page does not reload repeatedly. The entry contains no personal data, is not transmitted to us and is deleted when you close the tab. No consent is required for this either (§ 25 Abs. 2 Nr. 2 TDDDG).

13. No tracking, no advertising, no selling

Easy Sunday uses no analytics tools, no tracking tools, no advertising and no cookies for marketing purposes. Data is not sold, nor passed on to third parties for advertising or analytics purposes.

14. Data security: how we protect your data

Easy Sunday processes sensitive data, such as calendar events, names of children and contact details. We protect this data, including the data from your Google accounts, with the following technical and organisational measures (Art. 32 GDPR (DSGVO)):

• Encrypted transmission: All connections to Easy Sunday are made exclusively in encrypted form over HTTPS (TLS). Browsers are instructed via HSTS never to connect unencrypted.
• Encrypted storage of the Google access credentials: We store the access keys (refresh tokens) for your Google Calendars only in encrypted form (AES-256-GCM). The key for this is kept on the server separately from the database. Short-lived access keys are not stored. We request only the permissions needed for the features described (section 4). If you disconnect a connection or delete your account, we revoke the access with Google.
• Strict separation of families: Each family has its own, separate space. This is secured twice: in the program code and additionally in the database itself (row level security). Automated tests check with every change that no family can see or change another family's data.
• Least privilege: In the database, the app works with a restricted user without administrator rights. In the operator area, the operator sees only administrative data, no content (section 5). Only the operator personally has access to the server and the database; there are no other staff. Service providers process data only within the scope of section 10.
• Secure sign-in: Sign-in is only possible via Google. New accounts must be approved by the operator. The session is stored in an encrypted and signed cookie that is only sent over HTTPS and cannot be read by scripts. Blocked or deleted accounts are signed out immediately.
• Protected server: The server is located in a Hetzner data centre in Germany. It can only be reached via SSH with a key, a firewall allows only the necessary connections, and security updates are installed automatically.
• Protection against abuse: Sign-in attempts, requests and the sending of emails are limited.
• Data-minimising logs: Server logs contain no calendar contents and no email addresses of other people.
• Backups and deletion: Nightly backups are kept only on the server, are accessible only to the operator and are overwritten after 7 days (section 15).
• Incident response: There is a defined procedure in the event of a data breach: block access, replace keys, inform the competent supervisory authority within 72 hours where required by law, and notify the people affected.

15. Retention period and deletion

We store your data for as long as you use Easy Sunday. You can delete it yourselves at any time:

• “Mein Konto löschen” (Delete my account): You leave the family, your calendar connections are disconnected (the permission is revoked with Google where possible) and your account is deleted. If you were the last parent, the whole family is deleted.
• “Familie löschen” (Delete family): Deletes all of the family's data, including the events that Easy Sunday created in the “Easy Sunday” calendar at Google. Babysitter links become invalid. The other parent is informed by email. The parents' account entries (Google address, name, Google account identifier, status) are kept, so that you can continue to sign in with Google and create a new family. Only “Mein Konto löschen” also removes the account entry; to do this, sign in and delete your account there, or write to us.

Deletion takes effect immediately. Deleted data remains in the nightly database backups for up to 7 days; after that, the backups are automatically overwritten. Backups are used only for restoring after a technical failure. Backups that the operator makes manually during an update of the app are deleted after at most 7 days.

The log in the operator area is kept for 12 months and then automatically deleted, including the entries about accounts that have since been deleted.

Via “Trennen” (Disconnect) in the settings, you can revoke Easy Sunday's access to a connected Google Calendar at any time; the access permission is revoked with Google and the stored token is deleted. If a person (family member or babysitter) is deleted, their stored data (contact details, bookings, messages) is deleted with them.

For the messenger: the text of incoming messages is deleted after 30 days, the text of messages sent by Easy Sunday after 90 days. Open follow-up questions (e.g. “Does that work?”) expire after a short time. A log of the changes to the plan made via the messenger (who, when, what) is kept for 12 months. The Signal connection on our server stores message texts only until delivery, and technical delivery data (e.g. time, sender, recipient) for 30 days.

If access is refused, the waiting account entry is deleted; if the person signs up again later, they are placed on the waiting list again. If access is blocked, only the account entry (name, Google address, Google account identifier, status) is kept, so that the block takes effect. On request, we will also delete this entry.

16. Your rights

Under the GDPR (DSGVO), you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21) to the processing of your data. You can withdraw consent at any time (Art. 7(3)). To do so, simply contact the controller (see section 1).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR (DSGVO)). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

17. Changes

If Easy Sunday changes, we will update this privacy policy. The version published here at any given time applies. If we want to use data for a purpose other than the one described here in future, in particular data from your Google accounts, we will inform you by email in advance and, where necessary, obtain your consent before the change takes effect.

18. Contact

Please send any questions about data protection to Holger Seim, kontakt@easysunday.app.

See also the legal notice and the terms of use.