Legal & Privacy Policy

Privacy Policy

We take data protection seriously and keep data collection as minimal as possible.

We do not use tracking or analytics tools or hidden mechanisms.

We process only the data that is necessary to provide the wishlist functionality.

Last updated: October 20, 2026

1. Controller

The controller responsible for data processing on this website is:

Hendrik Harlichs Baakenallee 19 20457 Hamburg Germany

Email: hello@onio.app

No data protection officer has been appointed, as there is no legal obligation to do so.

2. General information on data processing

We process personal data exclusively in accordance with statutory data protection regulations, in particular the General Data Protection Regulation (GDPR).

Personal data means any data by which you can be personally identified.

3. Hosting

Our application is operated on Render .

  • Server location of the application and the database: Frankfurt am Main, Germany
  • All requests to onio.app and web.onio.app pass through Cloudflare's global network (attack protection, delivery). In this process, your IP address may also be processed outside the EU.

A data processing agreement under Art. 28 GDPR exists with the hosting provider where required.

4. Access data and server logs

When the website is accessed, the hosting provider automatically collects technically required information:

  • IP address
  • Date and time of the request
  • Browser type and version
  • Operating system

This data is used exclusively for the technical provision, stability, and security of the website.

Server logs are stored only for as long as required for operational security, error analysis, and abuse detection. Longer retention occurs only if concrete security incidents or legal obligations require it.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure provision)

5. Use of the application

5.1 Use without a user account

You can use parts of the application without registration.

In this case, data is stored exclusively locally in the browser:

  • Wishlists
  • Wishes
  • Settings

This data is not transferred to our servers as long as you do not create a user account.

5.2 User accounts

During registration, we process:

  • Email address
  • Password (stored encrypted)
  • optional: name, profile picture

Processing takes place to provide user functions.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

6. Wishlists and content

During use, the following data may be stored:

  • Wishlists (title, description)
  • Wishes (text, links, images)
  • Timestamps

This data is used exclusively for the functionality of the application.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

7. Sharing wishlists

Wishlists can be shared via an individual link.

  • The links cannot be found publicly
  • They are based on random tokens that are difficult to guess

Anyone with access to the link can view the content (where applicable with limited access, without logging in).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for sharing your wishlists; Art. 6(1)(f) GDPR (legitimate interest in providing shared wishlists) for viewing shared wishlists without an account

8. Reservation function

The application makes it possible to reserve wishes.

The following applies:

  • Reservations are internally assigned to a user account
  • The identity of the reserving person is not shown to other users
  • Only the status (reserved) is visible

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

9. Cookies

We use only technically necessary cookies.

Cookies used:

  • onio.sid
  • Purpose: session management (login)
  • Duration: up to 30 days
  • Type: technically necessary

No tracking or marketing cookies are used.

10. Local storage (LocalStorage)

To provide and configure the application for the user, data is stored in the browser:

  • Wishlists (when used anonymously)
  • Settings (e.g., language)

This storage takes place exclusively locally on your device.

11. Image upload (Cloudinary)

We use Cloudinary for image uploads.

Uploads are sent directly from the browser to Cloudinary (not via our server).

In this process, the following data may be transferred:

  • IP address
  • Image data

Only when you upload an image from your device (for a wish or as a profile picture) does Cloudinary store it on servers outside the EU, in particular in the USA, and deliver it through a global content delivery network. Images added by link, whether you enter the link yourself or take it from the link preview, are not sent to Cloudinary. In that case, we store only the link.

When an image is shown, your browser loads it directly from its source: uploaded images from Cloudinary, images added by link from the website the link points to. That source receives your IP address. This also applies when you only view a shared wishlist.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for uploading images; Art. 6(1)(f) GDPR (legitimate interest in showing shared wishlists in full) for loading images when viewing

12. Email sending (transactional only)

We use Resend for sending emails.

This is limited to functional and system-related emails:

  • Email verification
  • Password reset
  • System notifications

We do not send newsletters or promotional emails.

Emails are sent through servers in Ireland (EU). Resend stores sending data (e.g., recipient address, subject, content and delivery status) and logs in the USA.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in secure system operation)

13. Contact form

You can contact us through the contact form in the application, with or without a user account.

To answer your request, we process:

  • Your message and the topic you selected
  • Your email address
  • The language of the application
  • Browser and operating system, read from the technical data your browser sends
  • Your account ID, if you are signed in

We send this data as one email to our inbox. We do not store it in the Onio database. We do not send a confirmation email to the address you entered.

The email is delivered by Resend, our email provider (see section 12). Resend stores sending data and logs in the USA.

To prevent misuse, we limit the number of messages per IP address. For this purpose, the server holds the IP address in memory for up to one hour. It is not stored permanently.

We keep your message in our inbox until your request is resolved. Then we delete it, unless legal retention obligations apply.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering requests). If your request concerns your user account, also Art. 6(1)(b) GDPR (performance of a contract).

14. Login with Google (optional)

You can optionally log in via Google.

For login purposes, data required for authentication may be transferred from Google to us (e.g., email address and name).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Further information is available in Google's privacy policy .

15. Link preview (link enrichment)

When a link is inserted, the application can generate previews.

For this purpose, the URL is sent to our server and our server retrieves the target page.

In this process, your IP address is not transmitted; only the server IP address is used.

The data is not stored permanently.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

16. Affiliate links

Some links to shops in shared and subscribed wishlists are affiliate links. They are marked "Ad". If you buy through such a link, we receive a commission from the shop. The price does not change for you.

At present, we use affiliate links only for Amazon (Amazon PartnerNet, operated by Amazon Europe Core S.à r.l., Luxembourg).

We only add our partner ID to the link. We do not transmit any information about you, the wishlist, or the wish. We do not record clicks and do not set cookies for this purpose.

When you open an affiliate link, your browser goes directly to the shop's website. The shop can set cookies and recognize that you came from Onio. The shop is responsible for this processing. The Amazon privacy notice applies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in funding the free service)

17. Third-country transfers

The following services process data in third countries outside the EU/EEA, in particular in the USA:

  • Cloudinary: storage and delivery of uploaded images
  • Resend: sending data and logs for emails
  • Google: login with Google
  • Cloudflare (via Render): routing and protection of all requests to Onio

Where an adequacy decision exists for a recipient country, transfers are based on Art. 45 GDPR. In other cases, transfers are based on appropriate safeguards, in particular standard contractual clauses under Art. 46 GDPR.

You can request information about the safeguards applicable in specific cases at hello@onio.app .

18. Retention period

We store personal data only for as long as necessary for the relevant purposes or where legal retention obligations apply.

  • User accounts: until deletion by you or by us
  • Wishlists and wishes: until deletion by you
  • Reservations: until deletion or cancellation
  • Server logs: until purpose no longer applies (security and error analysis), then deleted
  • Contact form messages: until your request is resolved, then deleted

19. Your rights

Under the GDPR, you have the following rights in particular:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR)

20. Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

To exercise your objection right, an informal email to hello@onio.app is sufficient.

21. Competent supervisory authority

Independently of this, you may contact the competent supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information .

22. Obligation to provide data

Certain data is required for registration and use of a user account (in particular email address and password). Without this data, no user account can be provided.

Optional information (e.g., name, profile picture) is voluntary.

23. Automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

24. Changes

We reserve the right to amend this privacy policy in order to adapt it to changed legal requirements or new functions.