Privacy Policy
The German version is legally binding.
1. Controller
Janko Enke (sole proprietor, trading as “JappsD”)
Clara-Zetkin-Straße 5F, 15834 Rangsdorf, Germany
Email: support@jappsd.de
We have not appointed a data protection officer because we are not legally required to do so (Art. 37 GDPR, § 38 BDSG).
2. Overview
Ding Dong forwards messages that devices, services or scripts send to your personal link as push notifications to your phone and keeps them in a history. We only process personal data as far as this requires. We show no ads, use no analytics or tracking services and do not sell data. You do not need an account with a name or email address.
3. Hosting
Our servers (app interface, website, email delivery) are operated on our behalf by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO uses its own sub-processors, in particular IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; STRATO publishes the current list at strato.de/agb/auftragsverarbeiter. The servers are located in data centres in the European Union. A data processing agreement under Art. 28 GDPR is in place with STRATO.
Legal basis: Art. 6(1)(b) and (f) GDPR.
4. Website and server log files
Each time the website or the interface is accessed, the web server automatically stores the IP address, date and time, requested address, status code, amount of data transferred and browser or client identifier. This is necessary to deliver the service, detect errors and fend off attacks. Log files are deleted after 7 days. The website does not set cookies.
Legal basis: Art. 6(1)(f) GDPR.
5. The Ding Dong app
5.1 Account without sign-up
On first launch, the app creates an account without a name or email address. We store an account number, the language setting (for texts generated by the server), the plan, the time of creation and last use, and a hash of the random access key that the app keeps securely on your device (iOS: Keychain, Android: encrypted app storage).
Legal basis: Art. 6(1)(b) GDPR.
5.2 Channels and links
For each channel we store its name, symbol, a random link, optional template texts, settings (muted, hide content) and usage counters. Anyone who knows the link can send you messages. You can renew the link at any time; the old link then stops working immediately.
5.3 Messages
When a device, service or script calls your link, we store the title and text of the message, the type of call (e.g. link call, webhook), a hash used to merge repeats, the delivery status and the time. You, or the services you set up, decide what a message contains. Please do not send particularly sensitive data via Ding Dong.
Messages are deleted automatically after 7 days in the free version and after 365 days with a subscription. You can delete individual messages, entire channels or your account in the app at any time.
Once the monthly quota of the free version is used up, further messages are rejected and not stored. We only count how many messages were rejected so we can show this in the app.
To prevent abuse, we limit the number of calls per link, per network and per email address. For this we only store cryptographic hashes for at most 24 hours.
Legal basis: Art. 6(1)(b) GDPR; abuse prevention Art. 6(1)(f) GDPR.
5.4 Push notifications
To send you push notifications, we store your device's push token, the platform (iOS or Android) and, on iOS, the environment. Push notifications are delivered via the platform providers' services:
- iOS: Apple Push Notification service of Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
- Android: Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
This transmits the push token, the title, a preview of the text (at most 200 characters) and internal message and channel numbers to the respective provider. With the channel setting “Hide content in push”, only “New message” is transmitted instead of the text. A transfer to the USA cannot be ruled out; Apple Inc. and Google LLC are certified under the EU-US Data Privacy Framework (EU Commission adequacy decision, Art. 45 GDPR). We delete invalid push tokens automatically.
Legal basis: Art. 6(1)(b) GDPR. You can turn off push notifications at any time in your system settings.
5.5 Email address for recovery (optional)
You can add an email address to your account to restore it on another device later. We send a six-digit one-time code to that address; the code is valid for 15 minutes and only stored as a hash. We store the confirmed address and the time of confirmation. Emails are sent through our own mail server at STRATO. You can remove the address in the app at any time.
Legal basis: Art. 6(1)(b) GDPR.
5.6 Subscription
You buy the subscription through the App Store (Apple Distribution International Ltd., Ireland) or Google Play (Google Ireland Limited). We do not receive payment data. We receive a transaction ID or purchase token, the product, the environment (e.g. test purchase) and the expiry date from the app or the store. We verify this information directly with the store (App Store Server API, Google Play Developer API) on purchase, when the app starts and when the store notifies us of changes such as renewal, cancellation or refund.
Legal basis: Art. 6(1)(b) GDPR.
5.7 Export and deletion
In the app you can export all data of your account as a file and delete your account with all channels, links and messages immediately. You cancel a running subscription separately with the respective store. Accounts without a registered device that have not been used for 180 days are deleted automatically.
6. Retention overview
| Data | Deletion |
|---|---|
| Messages | after 7 days (free) or 365 days (subscription), or earlier by you |
| Account, channels, push token, email address | when you delete them; accounts without a device after 180 days of inactivity |
| One-time codes | after use, at the latest after 15 minutes |
| Rate limit hashes | after 24 hours |
| Server log files | after 7 days |
| Subscription data | with the account; where required for accounting, after the statutory periods |
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can exercise many of these directly in the app (export, delete). Otherwise, write to us at support@jappsd.de.
You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
8. No automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
9. Changes
We update this privacy policy when the service or the legal situation changes. The version published here applies.
Last updated: 1 November 2026