Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our privacy policy listed below this text.

Who is responsible for collecting data on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Notice regarding the responsible party" in this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, by you providing it to us. This may, for example, be data that you enter during registration or in a contact form. Other data is collected automatically or with your consent when you visit the website by our IT systems. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website. Other data may be used to analyse your user behaviour. Insofar as contracts can be concluded or initiated via the website, the transmitted data is also processed for contract offers, orders or other order requests.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time with effect for the future. Furthermore, you have the right, under certain circumstances, to request the restriction of the processing of your personal data. In addition, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this as well as any further questions on the subject of data protection.

2. Hosting

We host the content of our website with an external provider. The personal data collected on this website is stored on the servers of the host. This may primarily include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations towards our potential and existing users and customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). Insofar as a corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Our host will only process your data insofar as this is necessary to fulfil its performance obligations and will follow our instructions with regard to this data. We use the following host:

Order Processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done. We point out that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Notice Regarding the Responsible Party

The party responsible for data processing on this website is:

• Phone: 040 – 69 63 86 3 - 20
• Email: moin@elbcloud.de

The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (e.g. names, email addresses or the like).

Data Protection Officer

We have appointed a data protection officer.

• Phone: +49 177 3100249
• Email: datenschutz@elbcloud.de

Storage Period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place after these grounds cease to apply.

General Information on the Legal Bases for Data Processing on This Website

Insofar as you have consented to the data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, insofar as special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR. Insofar as you have consented to the storage of cookies or to access to information on your terminal device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of Section 25(1) TDDDG. Consent can be revoked at any time. If your data is required for the performance of a contract or for carrying out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data insofar as it is necessary to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. You will be informed about the legal bases applicable in each individual case in the following paragraphs of this privacy policy.

Recipients of Personal Data

Within the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary within the scope of fulfilling a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest pursuant to Art. 6(1)(f) GDPR in passing on the data, or if some other legal basis permits the data transfer. When using processors, we only pass on personal data of our customers on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the data processing carried out up to the revocation remains unaffected by the revocation.

Right to Object to the Collection of Data in Special Cases and to Direct Marketing (Art. 21 GDPR)

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged breach. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, Correction and Deletion

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this as well as any further questions on the subject of personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time regarding this. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data took place / takes place unlawfully, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

SSL / TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or requests that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data Collection on This Website

Cookies

Our web pages use so-called "cookies". Cookies are small data packets and do not cause any damage to your terminal device. They are stored on your terminal device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted after the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or until they are automatically deleted by your web browser.

Cookies can originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies within web pages. Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them (e.g. the storage of your login status). Other cookies can be used to analyse user behaviour or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions you have requested (e.g. for the login function) or to optimise the website (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. Insofar as consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

Cookie Consent (Consent Banner)

This website uses its own (first-party) consent tool ("cookie banner") to obtain your consent to the storage of certain non-necessary cookies or to the use of certain technologies and to document this in a data-protection-compliant manner. When you access the website, you can make your selection: you can accept all optional cookies, reject them, or specifically allow individual categories. Necessary cookies that are essential for the technical operation of the website (e.g. for storing your login status) are set without consent. The cookieless reach measurement (see "Reach Measurement"), by contrast, is not based on consent but on our legitimate interest; you can object to it using the same tool. In our apps the banner does not open by itself; maps and embedded players are loaded there, as on the website, only after your consent or your click.

Your selection is stored exclusively locally in your browser as well as in a first-party cookie on your terminal device, so that we do not have to ask you for consent again on a renewed visit. No data is transmitted to third parties in this process. You can revoke or adjust your consent at any time with effect for the future by calling up the cookie settings again – via the "Cookie settings" link in the footer of the website, in your account menu or, in our apps, below the sign-in and registration.

The consent is stored in order to be able to demonstrate the legally required consents for the use of certain technologies. The legal basis for this is Art. 6(1)(c) GDPR.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this, the server log files must be collected.

Error Log

If a technical error occurs while you use this website – on our server or in a function executed in your browser (e.g. when creating an image for sharing) – we store, for the purpose of fixing it, the technical error message, the page affected (without query parameters), the browser identifier (user agent), the version of our software, and the date and time. Your IP address is not stored, no link to a user account is made, and e-mail addresses are removed from error messages. Identical errors are grouped and merely counted. No cookies are set and no information is stored on or read from your device; § 25 TDDDG therefore does not apply. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in the error-free operation of the website. Error entries that have not recurred for 90 days are deleted automatically.

Reach Measurement (Cookieless, Self-Hosted Statistics)

To measure the reach of our services and to improve their discoverability (search engine optimisation), we collect usage data with a statistics function we operate ourselves. When a public page is accessed, we process: the page accessed, the origin of the visit (only the domain of the referring page, e.g. a search engine), the browser identifier (user agent, among other things to detect automated access), the selected display language, and the date and time of the access. In addition, we count how often individual links and buttons on public pages are clicked; for this we store only the page, the label of the element or the link destination (for external destinations only the domain) and a daily counter — without a pseudonym and without any association with a visit. Pages in logged-in areas (e.g. the dashboard) are not recorded. The only exception is the place search when adding a place: there we count, per calendar day and display language, how often a search was made, how often a search returned no results and how often adding the place oneself was then chosen – solely as counters, without the search term, without the IP address and without any link to your account or your visit. No third-party providers are used and no data is transmitted to third parties.

The measurement works without cookies and without storing or accessing information on your device; Section 25 TDDDG therefore does not apply. Your IP address is not stored. To approximate the number of visitors, we calculate a short-lived pseudonym (hash) from the IP address, the browser identifier, the respective calendar day and a secret key. Because the calendar day is part of the calculation, the pseudonym changes every day; anyone who does not know the key can neither attribute it to you nor link it across several days. The key itself does not change and is held by us. Technically, we could therefore recalculate the pseudonym for a combination of IP address and browser identifier already known to us; the data is thus pseudonymous, not anonymous. We do not carry out any such attribution; in particular, we do not combine the statistics with the server log files. Within one calendar day we evaluate the page views of a pseudonym only in aggregate, to see on which pages visits begin, in which order pages are viewed and on which page visits end (entry and exit pages, visit duration). No usage profiles are created. The collected raw data is deleted automatically after 90 days at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of usage in order to improve the content, technology and discoverability of our services. The measurement does not require consent and therefore starts with the first page view, before you have made a selection in the cookie banner. You can object to it at any time with effect for the future by choosing "Necessary only" in the cookie banner or by disabling the "Statistics" category in the cookie settings; your visit will then no longer be counted on this device.

Browser cache (service worker)

This website uses a so-called service worker, a script that your browser registers on your first visit. It creates a cache in your browser's storage. On the first visit, it stores in advance only an offline notice page and an icon of the website (less than 50 KB in total). Everything else is stored only while you browse, as soon as it is loaded: program files and fonts of the website, images, the data of pages you open or that your browser preloads, other responses from our server, and content from other servers that is embedded in our pages, such as map tiles. Each of these entries expires no later than a set time after it was last used: content from other servers after one hour, page data, program files and other responses from our server after 24 hours, fonts after 7 days and images after 30 days. Expired entries are not deleted immediately, but only the next time the service worker accesses the same part of the cache, i.e. only when you use the website again; until then, they remain on your device. If an expired entry happens to be needed again at that moment, it may be used once more. The service worker does not store complete pages, the dashboard, the feed or responses from our interfaces (/api). The purpose is faster page loading and, if the connection drops, a notice page instead of a browser error message. If you use the website while signed in, the cached page data and images may also include content from your account.

The cache is stored exclusively on your device; its content is not transmitted to us or to third parties. You can delete it at any time by removing the stored website data for shinelists.com in your browser; in our apps it is deleted together with the app. Insofar as personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in fast page loading and a clear notice when the connection drops.

Inquiry by Email, Telephone or via the Contact / Support Form

If you contact us by email, telephone or via a contact or support form, your inquiry including all personal data arising from it (name, inquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6(1)(b) GDPR, insofar as your inquiry is connected with the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), insofar as this has been requested; consent can be revoked at any time.

The data you send to us remains with us until you request its deletion, revoke your consent to its storage, or the purpose for the data storage no longer applies (e.g. after your request has been completely handled). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Bug reports and ideas that you send while signed in via “Report a bug or idea” are stored together with your details, the page they relate to, your browser's identifier (user agent), attached images and the comments that you and our team write about them. We delete them, including attachments and comments, twelve months after they were settled or rejected and nobody has written anything further about them; at your request, earlier. If you delete your account, they remain until then without any link to your account.

Reports about content

If you report content to us – while signed in via “Report” or without an account via our page “Report content” –, we store your report: which content it concerns, the reason and your explanation, for “Report” together with your account, on the “Report content” page together with the name and email address if you provide them. In addition, we store our decision and the reasons for it. We need this information to examine the report, to inform you and the person whose content is affected about our decision, and to be able to examine a complaint against the decision. The legal basis is the fulfilment of our obligations under the Digital Services Act (Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065) and our legitimate interest in traceable moderation (Art. 6(1)(f) GDPR).

We delete decided reports twelve months after our last decision on them. If someone lodges a complaint against a decision, we examine the report again; while this is ongoing, we do not delete it, and the twelve months start again with the new decision. This also applies to the notices that our automated review of public texts gives to our team. Reports you submitted while signed in via “Report” are also deleted together with your account; reports via the “Report content” page remain until the period expires, without any link to your account.

Registration on This Website

You can register on this website to use additional functions (e.g. your own profile, lists, reviews and recommendations). We use the data entered for this purpose only for the use of the respective offer or service for which you have registered. The mandatory information requested during registration (in particular email address, password and a display or user name) must be provided in full. Otherwise we will reject the registration.

To confirm your registration and to protect against misuse, we use a double opt-in procedure: after you sign up, you receive an email with a confirmation link. Your account is only activated after you have confirmed your email address via this link. Entries you create while signing up remain private until then. We store the time of the sign-up and of the confirmation in order to be able to trace any possible misuse. For accounts created on or after 7 October 2026, the following also applies: if the address is not confirmed within 14 days and you have never signed in during that time, we automatically delete the account together with these entries. Never-confirmed accounts created before that date are also deleted automatically once the same 14 days have passed, provided that no sign-in is recorded for them and they contain no content whatsoever – no entries (whatever their visibility), no profile details, photos or connections to other users. Accounts with content remain in place.

Alternatively, you can sign in without a password using a code we send you by email. The code has six digits and is valid for ten minutes and only once; we do not store it in plain text, only as a cryptographic check value together with your email address, and delete it when it is redeemed or at the latest one day after it expires. If there is no account for your address yet, we create one when you redeem the code — with your email address, a randomly generated username and no display name; your profile stays empty until you add something yourself. Entering the code replaces confirmation via a link. Any password previously set for this address but never confirmed is discarded, because it cannot be established who set it. Accounts without a password confirm deletion with a code sent to their address.

You can change the email address of your account in the settings. You confirm the change with your password; for accounts without a password, signing in within the ten minutes before is enough, otherwise a code sent to your current address; we send a confirmation link, valid for 24 hours, to the new address. Until it is confirmed, we store the new address together with this link; if it is not confirmed, we delete both at the latest one day after it expires. Only upon confirmation does the new address replace the previous one in your account. We then send a notice of the change to the previous address, in which the new address appears only in abbreviated form, so that you notice a change that did not come from you. The legal basis is the provision of your account (Art. 6(1)(b) GDPR) and, for the notice to the previous address, our legitimate interest in the security of your account (Art. 6(1)(f) GDPR).

If you ask us by email to delete your account – for example because you can no longer sign in – we first send a link to the email address stored in your account, valid for 24 hours and only once; you use it to confirm the deletion yourself. Until then we store the link only as a cryptographic check value together with the identifier of your account; we delete it together with your account or at the latest one day after it expires. If you can no longer reach this address or your account has none, we only delete it if you credibly show with at least two independent pieces of evidence that it belongs to you, for example with non-public details about your account; we do not ask for a copy of your ID for this. We keep a record of each of these steps: when it took place, who carried it out on our side and whether you deleted the account yourself via the link or we did; in the second case also which kinds of evidence were available, and a short reason without content from your account or your message. Your account appears in it only as a cryptographic check value of your username, not with your name or email address. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 12(6), Art. 17 and Art. 5(2) GDPR: we must make sure that the request comes from you and be able to prove that we have dealt with it. We delete the record after three years.

In addition, we store for your account the time of your last login and the day of your last visit while signed in (only the most recent value in each case, which is overwritten the next time). We use this information to keep your account secure, to recognise accounts that are no longer in use and to evaluate the use of our service in aggregated form (e.g. how many accounts were active in the last 30 days). We do not store a log of your individual page views, your IP address or details about your device for this purpose. The legal basis is our legitimate interest in a secure and properly functioning service (Art. 6(1)(f) GDPR). This information is deleted when your account is deleted.

The processing of the data entered during registration is carried out for the purpose of performing the usage relationship established by the registration and, if applicable, for initiating further contracts (Art. 6(1)(b) GDPR). The data collected during registration is stored by us for as long as you are registered on this website and is subsequently deleted. Statutory retention periods remain unaffected.

Sign-in with Google or Apple (single sign-on)

Instead of using an email address and password, you can also register or sign in with an existing Google or Apple account ("Sign in with Google", "Sign in with Apple"). The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Use is voluntary; registration with an email address and password remains available to you at any time.

On the website, you are redirected to a sign-in page of the provider for this purpose. In our apps for iPhone and Android, sign-in instead takes place via the sign-in function of your device or of the provider. In both cases we do not learn your password with the provider. The provider confirms the sign-in to us with a signed sign-in token; from it we take a permanent identifier of your account with the provider, your email address together with the information whether the provider has verified it, and – if transmitted – your name as the display name of a newly created account. With Apple, you can choose to hide your email address; we then receive a relay address generated by Apple. We do not take over a profile picture from the provider. We store the identifier and the technical sign-in data (tokens) issued when signing in via the website with your account so that we recognise you the next time you sign in. If you sign in with Apple in our iPhone app, we exchange the one-time sign-in code that Apple issues in the process for such tokens with Apple and likewise store them with your account, so that we can also revoke the sign-in with Apple at Apple when your account is deleted. If an account with the same email address verified by the provider already exists, we link the sign-in to that account.

The provider learns that you are signing in to ShineLists and processes the sign-in as an independent controller under its own terms. Personal data may be transferred to the USA in the process. Google LLC is certified under the EU-U.S. Data Privacy Framework; according to its own information, Apple bases transfers from the EU on the European Commission's standard contractual clauses.

Signing in via external services and the associated data processing are carried out on the basis of your consent (Art. 6(1)(a) GDPR) and our legitimate interest in a simple and secure sign-in option (Art. 6(1)(f) GDPR). Insofar as consent has been requested, it can be revoked at any time with effect for the future. The link ends when your account is deleted; you can additionally remove access in the account settings of the provider. The provider's data protection provisions apply to the data processing by the respective provider: Google (https://policies.google.com/privacy) and Apple (https://www.apple.com/legal/privacy/).

Invitation links and the connection to the inviting person

Users can recommend ShineLists to others. Such an invitation link contains the inviting person's username as a parameter (“?ref=…”). When you open such a link, we store that username in a first-party cookie (“sl_ref”) on your device. The cookie contains only that username — no device identifier and no information about your behaviour on this website. It expires after 30 days, cannot be read by scripts (httpOnly) and is deleted once it has been redeemed.

Storing it is necessary so that the invitation can still be attributed if you do not register immediately or take the detour via a third-party sign-in (single sign-on) — without it, the attribution would be lost on the way to the provider. We therefore consider this cookie strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG); it is set without consent.

If you then create an account, we record the inviting person with your account. An invitation already recorded is not overwritten: the first one counts.

Once your email address has been confirmed — or you have signed in via a third-party provider that has already confirmed it — two things happen: your account follows the inviting person's account, and that person receives a notification (in the application and, if they have enabled it, additionally as a push message) containing your display name or username and a link to your public profile. We also credit them with experience points (game points without monetary value).

The following is deliberately ONE-directional. The inviting person does not automatically follow you back; that remains their own decision. Content you share only with mutually connected people is protected as a result. If you and the inviting person have blocked each other, neither a connection nor a notification is created.

The legal basis is our legitimate interest in ensuring that people who already know each other do not remain unconnected on a service that lives on personal recommendations (Art. 6(1)(f) GDPR). You can undo the following in your account at any time; the record of the inviting person is removed at the latest when your account is deleted.

If the entry link also carries a channel marker (parameter “src=…”, for example “wishlist”), we record it once as the origin of your account. It consists of a short, fixed keyword, contains no information about you as a person, is not passed on to third parties and serves solely our own aggregated analysis of which entry pages accounts come from (Art. 6(1)(f) GDPR).

Shared wishlist, promises and group chat

Signed-in users can share their wishlist via a link. The link contains a random, unguessable string; the page behind it is excluded from search engines. Only wishes that are not marked “private” and have not been taken off the list are visible there, along with freely worded wishes (for example “olive oil for frying”). An occasion date can optionally be added, which then appears on the page and in the link preview.

Anyone who receives the link can see the wishes without signing in. Since 3 October 2026, seeing what has already been promised, promising a wish yourself (“I'll give this”), joining a group gift or bringing something along, and taking part in the group chat have only been available to people who are signed in — including with Google, Apple or a code by email — and never to the person whose wishlist it is. This is the only way we can stop them from posing as a guest and taking a look. Promises made without an account before then are still recognised by a first-party cookie (“sl_wish_gift”) containing a randomly generated string, valid for one year and not readable by scripts (httpOnly); in our database we store only a cryptographic hash of it, which does not allow us to identify you. We no longer set new cookies of this kind. The cookie is necessary for the function you requested (Section 25(2) no. 2 TDDDG).

We assign your promises to your account so that you can find them on any device on which you are signed in. Promises you made earlier in a browser without an account are linked to your account only when you explicitly click to do so, and only for the wishlist concerned; in doing so we remove the browser identifier from those promises. Guest promises on other lists remain separate.

You may voluntarily provide a display name (for example “Grandma”) so that the other recipients of the link can coordinate among themselves; as the organiser of a group gift, also a short note to the other givers. These entries are freely chosen and are not checked by us; your account name is never shown in place of the display name. Without a name, your promise appears anonymously.

Group chat: every shared wishlist has a chat for everyone who opens it while signed in — never for the person whose wishlist it is, not even after the occasion. Anyone who opens the list while signed in is listed as a participant. For this we store the participation, up to when you have read the chat, whether you have muted it, a name you may choose for this chat, as well as your messages (text, optionally a photo, a reply to another message or a reference to a wish) and your reactions. The other participants see your messages, your reactions, your name in the chat (if you have not chosen one, your display name or username) and your profile picture. We reduce photos in size before storing them and remove their metadata (such as the location where they were taken); they are not public and are delivered only to signed-in participants of this chat and, if a message is reported, also to our team (see below). We let you know about new messages with a notification, including as a push message if you have allowed this; it names neither the sender nor the content nor the person whose wishlist it is, comes at most once until you look in again, and does not come at all if you mute the chat. You can edit your own messages for 15 minutes and delete them at any time; the text and photo are then removed immediately. If the person whose wishlist it is resets their link, all previous participants are removed from the chat. We delete messages together with photos and reactions twelve months after they were sent, and immediately when you delete your account; the entire chat ends with the account of the person whose wishlist it is. If you report a message via “Report” on the message or via “Report a problem”, our team can remove individual messages. To decide on a report, our team sees the reported message with the name of the account it came from, the details of your report (for “Report” also your username) and, where needed, the previous history of this chat without photos; for a report via “Report” also the photo of the reported message, while the report is open (Art. 6(1)(f) GDPR). If one of two participants has blocked the other, neither sees the other’s messages and reactions any more. If you block a person from within the group chat, we store the chat name under which they wrote there with this block, so that your block list and your data export show this name instead of their username. Otherwise, the legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR). Your own messages appear in the data export for your account.

Promises and the group chat remain hidden from the person whose wishlist it is — that is the point of the feature. If an occasion is set, on the day after the occasion — once it is over everywhere in the world — they learn which wishes were promised under which display name, so that they can say thank you; the page points this out before every promise. So that promises stay hidden from them before then even when they open their own link while signed out, we store a further first-party cookie in their browser (“sl_wish_mine”, one year, httpOnly) containing a non-reversible identifier of their account (neither a link nor an account ID in plain text). It is set when they manage the link or are signed in in that browser, and it can hold the identifiers of several people who use the same browser. This cookie can only hide information, never reveal it. Someone who shares a browser marked in this way and is signed in there with their own account can confirm that they are not the person whose wishlist it is; afterwards this browser shows the status to any other account signed in there — the page points this out beforehand. We remember this confirmation in a further first-party cookie (“sl_wish_seen”, one year, httpOnly) containing non-reversible identifiers of the links concerned. Without signing in, we do not send the status to your browser at all. Both cookies are necessary for the function (Section 25(2) no. 2 TDDDG).

After promising a gift, you can download a calendar file that reminds you before the occasion. We generate it at your request and do not store it. It names neither the person nor the gift, but it does contain a link to the wishlist — so anyone who can read your calendar can see that you are getting something for this list. If the person takes a wish you had promised off their list, we store a notice with the wish's title for you, which you see on your next visit and can dismiss; with an account you additionally receive a notification that does not name the wish and is not sent as a push message. If the account of the person who made the wishes is deleted, their list disappears together with all promises on it; with an account you then receive a notification naming the titles of the wishes you had promised, without the person's name and not as a push message – unless the occasion for which you made your promise has already passed. Older calendar files (up to 2 October 2026) contained a personal link that allowed your promises to be found again in another browser; we only accept such links until the occasion of the respective promise.

With an account, we also send a reminder of your promise to your confirmed address a few days before the occasion. It names the person whose wishlist it is and the date, but neither what nor how much you promised, and it only contains a link to the wishlist if you know it through that link. For this, we store on the promise when the reminder was sent, and on the shared link when it was last reset. The legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR); the reminder contains no advertising. You can unsubscribe at any time via the link in every email — without signing in — or in your settings.

We also count how often a shared link has been opened. Only a number on the link itself is stored — no information about who opened it.

The legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR) and our legitimate interest in a working coordination among gift-givers (Art. 6(1)(f) GDPR). The person whose wishlist it is can disable or reset their link at any time. A promise is deleted as soon as you withdraw it or the wish leaves the list (fulfilled, deleted, set to private or hidden); after the occasion, the person can also release it as “not received”. At the latest 60 days after the occasion it was made for, we delete a promise; if others are still taking part in the promise whose occasion is later or not set, the longest-standing of them takes over the promise and the previous person's details are deleted. For promises without an occasion, we delete the display name and the note after twelve months; the promise itself remains until it is withdrawn or the wish leaves the list, because otherwise nobody would be warned against buying it twice. We delete notices about removed wishes after 90 days. To prevent anyone from blocking a list with made-up promises, we additionally store with each promise a pseudonym of the network it came from — a hash of the IP address (for IPv6 only the leading part that identifies the connection), the wishlist concerned, a key that is not stored in the database and a random secret that is valid for one day only and deleted after two days; after that the pseudonym can no longer be linked to any IP address. The only exception are backup copies of the database, which we keep for emergencies and overwrite on a rolling basis; we do not use them to link pseudonyms. We do not store the IP address itself. We delete the pseudonym after seven days. If abuse is reported to us, our team can remove individual promises, display names or notes (Art. 6(1)(f) GDPR). If you are signed in with us, your promises additionally appear in the data export for your account. If you delete your account, we remove your display name, your note and the network pseudonym from your promises and end your participation in other people’s group gifts; if others are taking part in one of your promises, the longest-standing of them takes it over. Your remaining promises stay in place without any link to you, so that nobody buys the same wish twice.

Tip links for trip planning (without an account)

Signed-in users can create a tip link for a trip and share it, for example, in an Instagram story. The link contains a random, unguessable string, stays open for 24 hours (it can be extended or ended early at any time) and is excluded from search engines. The page shows only the person’s name, profile picture and destination – no travel dates and no travel plan.

Anyone who opens the link can send a tip without an account and without an email address: a place or a link, optionally a reason and a freely chosen name that we do not check. Only the person who created the link can see it. If they add a tip to their travel plan, their travel companions see the place, the reason and the name there.

When you send a tip, we place a first-party cookie (“sl_tipp_gast”) containing a randomly generated string in your browser, valid for seven days and not readable by scripts (httpOnly). In our database we store only a cryptographic hash of it; it serves solely to let you see, name and withdraw your own tips (Section 25(2) no. 2 TDDDG). To prevent abuse, we use your IP address and your browser identifier only transiently, as a hash that changes daily and is held in memory; they are not stored. We count visits to the link only as a number on the link itself.

The page loads no analytics or advertising services and no external media; that is why no consent banner appears there. Tips that are not added are deleted 30 days after the tip round ends, together with the link; if the trip is deleted, the link and the tips disappear immediately. The legal basis is the provision of the function used by the person with an account (Art. 6(1)(b) GDPR) and our legitimate interest in allowing tip-givers to share without an account (Art. 6(1)(f) GDPR).

Asking for recommendations (questions, answers and Shines)

Signed-in users can ask others for recommendations on our “Recommendations” page (for example, “Which sneakers for every day?”), answer such questions and link up to five products, places, apps or public lists in both questions and answers. For this we store the text, the chosen visibility, the links, the time and the assignment to your account. What is linked is the entry from our catalogue or the public list, not your own review: the thread shows only its name, image and a short detail such as the brand or city, and for lists the username of the person the list belongs to. When you link something, we first suggest your own entries; only you see these suggestions.

For each question you decide who sees it. “Public” means that anyone who visits the page can view the question and all answers to it, even without an account. “Friends only” means that only your friends — people you follow who also follow you — can see and answer the question. Visible in each case are the display name or username and profile picture of the people asking and answering, the time, the texts, the links and the number of Shines. If one of two people has blocked the other, neither sees the other's questions and answers, and neither can answer the other's questions. Questions from people you follow may also appear at the top of the feed for a while; friends-only questions only for friends. The pages are marked for search engines as not to be indexed.

When you ask a question, up to 50 of your friends receive a notification with your name and the beginning of the question, also for a public question. For every answer from someone else, the person who asked receives a notification with the name of the person answering and the beginning of the answer or, if it has no text, the names of what was linked. With a Shine you show that you like a recommended entry or an answer. Others see only the number; whoever recommended the entry first or wrote the answer receives a notification with your name. If you link something in an answer, this also counts as your Shine for it. In addition, the thread shows for each recommended entry who recommended it first. Notifications appear in the application and, if the recipients have allowed this, as push messages (see “Push notifications”). We also automatically check public questions and the answers to them for rule violations, but not friends-only questions (see “AI-assisted product capture”).

You can delete your questions and answers and withdraw Shines at any time. Deleting a question deletes the whole thread, including other people's answers to it; as the person who asked, you can also delete individual answers in your thread. Deleting an answer also removes the Shine that your link created, unless you recommend the same thing in another answer; Shines that others have given to the same entry remain. If a linked list is no longer public, it no longer appears in any thread. Our team can remove questions and answers that violate our rules, for example after a report via “Report” (Art. 6(1)(f) GDPR). Beyond that, there is no fixed deletion period: questions, answers and Shines remain stored until they are deleted, at the latest until your account is deleted; this also deletes your questions together with other people's answers to them. Deleting a question also removes all notifications sent about it; deleting an answer removes the notification about it as well as the notifications about Shines for it or for an entry it was the first to recommend. This applies to all recipients, including when our team removes a question or answer or when it is deleted together with the account it belongs to. However, we cannot recall push messages that have already been sent. Your questions, answers and Shines appear in the data export for your account. Otherwise, the legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR).

Check-ins (visits to places)

If you check in at a place you have added, we store a check-in, i.e. a visit on that day. If you check in with “I'm here” on the page of the place or in the view “Where are you right now?”, the page requests your device's current location — only after you confirm the prompt of your browser or operating system (see “Place and address search”); the check-in works just the same without it. From the transmitted position, our server calculates the distance to that place. We store only this distance and the accuracy of the location reported by your device, each in whole metres, as well as the “on site” marker if the distance, taking the accuracy into account, is small enough. We do not store your coordinates, and we do not pass them on to third parties to calculate the distance. All other visits carry no such measurement — for example visits that you add retrospectively or whose date you correct, and the visit that counts when, after “You made it!”, you rate a place you had added as a wish. If you open the check-in view “Where are you right now?”, it also suggests places near you; for this, our server queries the Overpass API with your position (see “Place and address search”).

The sole purpose is this marker: it shows whether your device was near the place when you checked in, and it is based only on the information from your device; distance and accuracy make it traceable why it was set or not. For your own visits, only you see the marker. Others only see it counted together and without names: in the “What to order?” section on the page of the place and on overview pages for individual dishes, and there only for visits to public entries for which dishes were given. We do not display distance and accuracy to anyone; they only appear in the data export for your account. All three details belong to the respective check-in and are deleted with it: when you withdraw the check-in, when you delete your entry for the place, and with your account. The legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR); the location request itself only takes place with your confirmation (Art. 6(1)(a) GDPR).

Order of events and places near you

When you are signed in, the “Discover” page shows you events and recommended places in your area. So that what is more likely to interest you appears further up, the page calculates on each visit, from your own activity, which kinds of events and places you prefer. Only the categories (for example concert, market or nightlife) are taken into account: of the events for which you tapped “I'm in” in the last twelve months, of the places where you checked in in the last twelve months, and of the places you recommend — including those only you can see. The result only affects the order. However, because the page shows only a limited number of events and places, it thereby helps decide which of them appear first or at all. It only works within your selection: for events, within the radius, time period and categories you have chosen; for places, within the radius; nothing outside this is added as a result. When sorting, a preferred category counts at most as if it were half as far away; the actual distance is always displayed. In addition, events for which you tapped “I'm in” appear before all others on their day. Above the events, the page names the categories by which they were sorted.

We do not store this profile; it is recalculated on each visit and serves only your own view. Other users see neither your “I'm in” taps nor the order in which events and places are shown to you. We store your “I'm in” taps (event, category and time) as well as the radius, time period and categories you choose, so that these settings apply on all your devices. You withdraw a tap by tapping again; if an event is deleted, we keep your tap only with its category and time. We delete a tap twelve months after you made it, but not before the event is over. As long as no location from your device is available, the page estimates the centre of your area from the location of the places you added most recently; this too is calculated only for the respective visit. When your account is deleted, we delete all of this data. The legal basis is our legitimate interest in showing you events and places in an order that suits you (Art. 6(1)(f) GDPR).

Legal notice for creators without their own website

Users who need a legal notice (Impressum) but have no website of their own — creators, for example — can store the text of their legal notice and, if they wish, their own privacy information with us in their account settings (“Legal” section). As soon as such a text has been entered, we publish it at the address of the profile with the suffix “/impressum” or “/datenschutz” and link to it at the end of the profile. A legal notice usually contains a name, postal address and contact details such as an email address or telephone number. The pages can be accessed on the website without signing in so that the provider identification (Section 5 DDG) is easy to reach, but are marked for search engines as not to be indexed; they are not translated automatically. The person who stored the content is responsible for it. We store the texts until they are changed or cleared, at the latest until the account is deleted; they appear in the data export for the account. The legal basis is the provision of the function used (Art. 6(1)(b) GDPR).

Update subscriptions on creator profiles (email)

On public creator profiles, visitors can subscribe to updates from the respective creator by email. For this purpose, we process the email address entered, the selected display language and the times of sign-up and confirmation. For verification, we use a double opt-in procedure: the subscription only becomes active after you click the confirmation link in the email sent to you; the stored timestamps serve as proof of consent.

We make the confirmed email address available to the respective creator (viewable and exportable in their dashboard) so that they can inform their subscribers about news. It is not passed on to any other third parties, nor is it used for ShineLists' own advertising.

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). You can revoke it at any time with effect for the future by using the unsubscribe link in the email or by contacting us; upon unsubscribing, your address is deleted from the subscriber list. Unconfirmed entries are not used for updates. If you do not confirm an entry, we delete it 14 days after we last sent you the confirmation email. We check once a day whether entries are due for deletion; deletion may therefore take place up to a day later.

Reminders for drops (“Remind me”)

Anyone with an account can create a dedicated page for their own release, such as a song or a video, or for an event; we call it a “drop”. Until the start, this page shows the “Remind me” form unless the creator has switched it off. You can use it to be reminded of the drop by email, even without an account. For this purpose, we store the email address entered, the drop, the language in which you use the page (so that our emails reach you in that language), a randomly generated key for the links to confirm and unsubscribe, and the times of sign-up, of the last change to the entry, of confirmation and of sending the reminder. For verification, we use a double opt-in procedure: we first send you an email with the title of the drop, the name of the creator and a confirmation link; the reminder only becomes active once you complete the confirmation via this link. The stored timestamps serve as proof of your consent.

After your confirmation, we send you a single reminder by email: for a release at the time the creator has specified as the release date, for an event around 24 hours before the specified start. If you only confirm after that time, it is sent with the next check after your confirmation. We check once an hour which reminders are due; the email may therefore arrive up to an hour later. It contains the title of the drop and a link to its page. If the drop has already ended by then or is no longer published, we do not send a reminder. If sending fails, we try again at the next check. In their dashboard, the creator only sees how many confirmed reminders there are for their drop, but not your email address. We do not pass your address on to them or to any other third parties, nor do we use it for our own advertising.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can revoke it at any time with effect for the future by using the unsubscribe link contained in each of these emails – including the reminder itself – or by contacting us; when you unsubscribe, we delete the entry completely. If the drop or the creator's account is deleted, we delete all reminders for it. Apart from that, we delete entries after fixed periods: if you do not confirm an entry, we delete it 14 days after we last sent you the confirmation email; until then, we use it only for that email. After the reminder has been sent, we delete the entry 30 days later. If no reminder has been sent 30 days after the specified start of the drop, for example because the drop had ended or was no longer published by then, we delete the entry as well. No entry remains stored for more than two years after your confirmation, even if the drop starts later. We check once a day whether entries are due for deletion; deletion may therefore take place up to a day later. You do not need an account with us for the reminder; it is tied solely to your email address. If you have an account with the same, confirmed address, your reminders appear in the data export for that account. If you delete that account or change its address, the reminders are not affected; a reminder that is still pending will still be sent to the address with which you signed up.

Photos uploaded by users

Users can upload their own photos to reviews, visits (check-ins), products and profiles. Photos may contain personal data — both in the image (people depicted) and in the file metadata (EXIF: time of capture, device model and, depending on the device settings, GPS coordinates).

On upload we remove the file metadata server-side before the image is stored; only the image orientation is applied beforehand. The place and time of capture can therefore no longer be read from a photo stored with us. If this cleaning fails technically, the upload is aborted rather than the original file being stored.

Under our Terms of Use, only your own photos may be uploaded, and recognisable people must have consented to publication (Sections 22, 23 KUG, Art. 6(1)(a) GDPR); the person uploading is responsible for obtaining that consent. The legal basis for storing and displaying the photos is the performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in operating the platform (Art. 6(1)(f) GDPR). Photos set to public are accessible to anyone and may — including by other users — be used in automatically generated sharing images for social networks; details are set out in Section 8 of the Terms of Use and in our Photo Rules.

Photos are deleted when the associated contribution or the user account is deleted; product photos in the shared catalog are retained in accordance with Section 8 of the Terms of Use. If you appear in a photo and do not want to, or if your photo was uploaded without permission, you can report this to us without a user account — we remove affected images without undue delay after review.

• Report a photo (no account needed)
• Photo Rules

Publishing photos on Instagram (Meta)

We run our own Instagram channel on which we present places. We create the posts for it in our admin area and transmit them to Instagram through the official programming interface. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

What is transmitted are the photos that go into the post, the caption of the post — including a review text written by you, where it is carried over into the caption — and the name and location of the place being presented. This is personal data in particular because the photos come from you and we credit you as the author wherever the format allows. For the transfer we place the finished image files publicly for a short time, because Instagram downloads them itself; we delete them again immediately afterwards.

The legal basis is solely your consent (Art. 6(1)(a) GDPR), which you give separately in your account settings and can withdraw there at any time with effect for the future. Without that consent we transmit none of your photos to Instagram. We do not use photos showing recognisable people for such posts.

By transmitting them we grant Meta the rights of use that Meta requires for publication under its terms — in particular a worldwide, royalty-free, transferable and sub-licensable right to use the transmitted content. Your consent therefore expressly covers this grant of rights as well; details are set out in Section 8 of the Terms of Use.

Meta then processes the transmitted content as a separate controller under its own terms; we have no influence over that processing. This involves a transfer to the USA. We base it on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Meta Platforms, Inc. is certified, and in the alternative on standard contractual clauses pursuant to Art. 46(2)(c) GDPR as well as on your explicit consent pursuant to Art. 49(1)(a) GDPR.

If you withdraw your consent or delete your account, we will not use your photos for any new posts. A post already published initially remains on Instagram; at your request we withdraw it as far as this is possible and reasonable for us. So that we know at all which post contains which photos, we record for every published post: its identifier and address on Instagram, the caption, the photos used, the account they come from, and the time and person of the release. This record serves solely as evidence and for withdrawal; it is deleted once the post no longer exists.

Further information on data processing by Meta can be found in Instagram's privacy policy at: https://privacycenter.instagram.com/policy

5. Plugins and Tools

Maps (OpenStreetMap & CARTO)

The interactive maps embedded on this website are based on the map data of the "OpenStreetMap" (OSM) project. The provider of the OpenStreetMap data is the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The map tiles themselves — the image sections your browser loads — are not delivered by OpenStreetMap but by CARTO.

All interactive map views (including the places radar, trip planning, place selection, SUP tours and user-created maps) load their map tiles from the service "CARTO" (CARTO, Inc., New York, USA, and CARTO DB S.L., Madrid, Spain). Here too, your IP address is transmitted to the respective tile server when the tiles are loaded. Insofar as personal data is transferred to the USA in the process, this takes place on the basis of your explicit consent (Art. 49(1)(a) GDPR): the tiles are only loaded after you have consented to the "External media" category or have actively loaded the respective map by clicking on it; we hereby draw your attention to the possible data protection risk of a transfer to the USA without an adequacy decision.

When you load such a map, among other things your IP address and further information about your behaviour on this website is transmitted to the servers of the map tile service (tile server). For this purpose, the provider may, under certain circumstances, store cookies in your browser or use comparable recognition technologies.

Non-interactive map images (e.g. the overview map on place pages and the map in trip reports), by contrast, are generated on our own server from OpenStreetMap tiles and delivered from our own domain. Your browser does not establish any connection to OpenStreetMap or CARTO in the process; your IP address is not transmitted to those services.

The use of these maps is carried out in the interest of an appealing presentation of our online offerings and easy findability of the places we indicate on the website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Insofar as a corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Map tiles are only loaded after you have consented to the "External media" category or have actively loaded the respective map by clicking on it (two-click solution). Without your consent, no map tiles are retrieved from third-party servers and no IP address is transmitted to OpenStreetMap or CARTO.

Further information on the handling of user data can be found in the privacy policy of OpenStreetMap at: https://wiki.osmfoundation.org/wiki/Privacy_Policy

Place and address search (geocoding via our server)

For the place and address search (e.g. when creating a place, in the surroundings search or when using "Use current location") we use geo services based on OpenStreetMap: the geocoding service "Nominatim" of the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, the service "Photon" of komoot GmbH, Friedrich-Ebert-Straße 27, 14469 Potsdam, Germany, as well as further OpenStreetMap-related services (the Overpass API of FOSSGIS e. V., Germany; OSRM routing).

These services are queried exclusively by our server: your browser does not establish a direct connection to the providers, and your IP address is not transmitted to them. Only the content required for the request is transmitted — the search text you entered or, for the location feature, the coordinates your device sends to our server with your consent (prompt of your browser or, in our apps, of your operating system). In the apps, the operating system determines the position with its own location services according to your device settings; we only receive the coordinates. An adequacy decision of the EU Commission exists for the United Kingdom (Art. 45 GDPR).

The legal basis is the performance of the user agreement or the provision of the feature you requested (Art. 6(1)(b) GDPR) as well as our legitimate interest in a functioning place search (Art. 6(1)(f) GDPR). The location determination itself only takes place after your explicit confirmation of the prompt of your browser or operating system (Art. 6(1)(a) GDPR) and is not stored permanently. One exception is the "Practical info" feature (e.g. adding a toilet): if you choose "My location" there, the determined position is stored as the location of the facility you add and shown publicly on the city page together with your username — as information about that facility, not as your whereabouts. You can remove the entry yourself at any time. For check-ins, we store only the distance to the place and the accuracy of the location instead of the position (see "Check-ins (visits to places)").

YouTube and Spotify players (two-click solution)

Users can embed videos from YouTube and music from Spotify in their profiles. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (YouTube, embedded via the more privacy-friendly domain youtube-nocookie.com) and Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.

Simply visiting a page with such a player does NOT transmit any data to YouTube or Spotify: the players are only loaded after you have consented to the "External media" category or have actively started the respective player by clicking on it (two-click solution). Only then does your browser establish a connection to the respective provider; in doing so, your IP address and, where applicable, further device information are transmitted, and the provider may use cookies or comparable technologies. In the case of YouTube, data may also be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can revoke your consent at any time with effect for the future by deactivating the "External media" category in the cookie settings (link in the footer or in your account menu); players and maps that have already been loaded are then removed immediately. The privacy policies of Google (https://policies.google.com/privacy) and Spotify (https://www.spotify.com/legal/privacy-policy/) apply.

Our apps for iPhone and Android

The ShineLists apps for iPhone and Android display this website in an embedded browser window; this privacy policy therefore applies in full to the use of the apps. So that our server can deliver pages suitable for the app, the app includes an identifier ("ShineListsApp" with a version number) in the browser identifier (user agent). Without signing in, the app only shows sign-in, registration, password reset, email address confirmation, the page for confirming and unsubscribing from our emails, the legal texts, the content reporting procedure, the help page, the instructions for deleting an account, shared wishlists (see "Shared wishlist, promises and group chat") and shared availability calendars ("When are you free?"), which, apart from the name and profile picture of the sharing person, only show on which days they are free or busy, without destinations or other travel details. In addition to the website, the app uses the following functions of your device, which are described in the respective sections: push notifications via the service of the operating system (see "Push notifications"), sign-in with Apple or Google via the sign-in function of the device (see "Sign-in with Google or Apple"), the location prompt of the operating system (see "Place and address search" and "Check-ins (visits to places)") and, for photos, the system's image picker and, on the iPhone, the camera and saving images to your photo library; we only receive the photos you select or take, and the app does not access your other photos (see "Photos uploaded by users"). On Android, the app also uses the system share menu; for this it stores the image to be shared in the app's cache on your device, and you decide yourself in the share menu who receives it. You can revoke the permissions for notifications, location, camera and photo library at any time in the settings of your device.

Push notifications (browser and apps)

Signed-in users can subscribe to notifications (e.g. about new messages or activities) as web push notifications. The subscription only comes about if you explicitly confirm the corresponding prompt of your browser. For technical reasons, delivery takes place via the push service of the respective browser manufacturer (e.g. Google, Mozilla or Apple); the contents of our notifications are transmitted in encrypted form so that the push service cannot read them.

In our apps, delivery takes place via the push service of the operating system: on the iPhone via Apple's Apple Push Notification service (APNs), on Android via Google's Firebase Cloud Messaging (FCM). If you turn on notifications in the app, your operating system first asks for your permission. If you agree, the push service assigns a device identifier (push token), which we assign to your account together with the platform (iPhone or Android) and store. With each notification, we transmit this identifier as well as the title, text and target page of the notification to the push service. Unlike with web push, these contents are not encrypted in a way that prevents the push service from reading them; the transmission itself is encrypted. Personal data may be transferred to the USA in the process; Google LLC is certified under the EU-U.S. Data Privacy Framework, and according to its own information, Apple bases transfers from the EU on the European Commission's standard contractual clauses.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can deactivate push notifications at any time in the notification settings of your account, in your browser's site settings or in the notification settings of your device; the stored push address or device identifier is then deleted or no longer used. We remove device identifiers that have become invalid automatically; all of them are deleted when your account is deleted.

Tips & news by email

Signed-in users can, during registration or in their account settings, opt in to receive an email about once a week with tips on ShineLists features and news about our service. To choose a fitting tip, we evaluate which features the account has already used (e.g. whether places, products, lists or trip reports have been created). No usage profile beyond that is created, and the selection has no further effect on the account. We store the time of consent, the version of the consent text and which tips were sent when.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). Consent is voluntary and not a condition for using the account. You can revoke it at any time with effect for the future — via the unsubscribe link in each of these emails (without signing in) or in your account settings. After revocation you will receive no further tip emails; we keep the record of the consent given and of the emails sent as proof of lawfulness until the account is deleted.

Externally hosted images in user content

In isolated cases, user content may contain images that are not stored with us but with an external provider (e.g. when an advertising partner stores an image address from its own shop). When such a page is displayed, your browser loads the image directly from the respective external server; in doing so, your IP address is transmitted to that server. We do not transmit any further data and suppress the transmission of the originating page (referrer policy "no-referrer"). The legal basis is our legitimate interest in displaying the content posted by users (Art. 6(1)(f) GDPR). Profile pictures and photos that users upload to us, by contrast, are stored entirely on our own servers.

Web Fonts (Local Hosting)

This website uses so-called web fonts for the uniform display of typefaces. These fonts are loaded locally from the delivery directory of our application when the page is accessed and are not reloaded from the servers of third parties (e.g. Google). No connection to third-party servers takes place in this process; your IP address is not transmitted to third parties for this purpose.

The legal basis for embedding the fonts locally is our legitimate interest in a uniform and data-minimising presentation of our online offering (Art. 6(1)(f) GDPR).

Automatic Translation (Microsoft Azure AI Translator)

To make user-generated content (e.g. reviews as well as descriptions of places, events and products) understandable for visitors in their display language, we use the machine translation service "Azure AI Translator". The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When a user opens content in a language in which it is not yet available, only the relevant text content is transmitted to the service's EU endpoint for the purpose of translation and processed there. No further personal data (e.g. name, username or your IP address for identification purposes) is transmitted. Translations that have already been created are cached by us, so that a text only has to be transmitted once per language.

According to the provider, the transmitted texts are processed solely to carry out the translation, are not stored permanently and are not used to train models ("no trace"). The processing takes place on servers within the European Union.

We use this service in our interest in providing the content of our online offering in multiple languages and with the lowest possible barriers. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

A data processing agreement (DPA) is in place with the provider; the data protection terms form part of the Microsoft Products and Services Data Protection Addendum (DPA). Further information can be found in the Microsoft privacy statement at: https://privacy.microsoft.com/en-us/privacystatement

AI-assisted product capture (Microsoft Azure OpenAI Service)

When creating a product, logged-in users can upload a photo or paste a link and have the name, brand, description and category suggested from it. For these suggestions we use the "Azure OpenAI Service". The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

The function runs only when you trigger it. Only the product photo you uploaded or the address you pasted and the publicly retrievable details of the linked product page (title, description) as well as our category list are transmitted; when you type a product name into the form, the entered text may additionally be transmitted to suggest catalogue products that already exist; likewise the search term on the results page of our search, in order to find places and products by meaning rather than wording alone. No further personal data (e.g. name, username or your IP address for identification purposes) is transmitted. The suggestions are shown to you for review and are only applied when you save.

In addition, we generate short image descriptions (so-called alt texts) once for the place and product photos shown on the platform, so that people using a screen reader can grasp the image content. For this, a downscaled copy of the respective photo is transmitted to the service together with the name of the place or product; no details about the uploading person are sent along. The description is deleted as soon as the photo is deleted. The legal basis is our legitimate interest in an accessible service (Art. 6(1)(f) GDPR).

Also only at your request, you can have a text draft suggested in the editor of a trip report. For this, your journal notes from the trip period, the places contained in the report with your own reviews, your visit days and recorded dishes as well as any existing report texts are transmitted to the service — without your name or username. The draft is shown to you and only becomes part of the report once you adopt and save it; your journal notes remain unaffected and private. The legal basis is the provision of the function you requested (Art. 6(1)(b) GDPR).

Also only at your request, you can have the AI trip planner suggest a day-by-day plan for a trip. For this, the details you enter there — destination, travel dates, selected interests, pace, travel group, budget range and an optional free-text field with wishes — are transmitted to the service, without your name or username. The suggestion is stored in your account so that you can open it again later and save it as a trip; it is only visible to you and is deleted together with your account. The legal basis is the provision of the function you requested (Art. 6(1)(b) GDPR).

To meet our obligations to detect illegal content or content that violates our rules (cf. Art. 16 et seq. Digital Services Act), we automatically check newly published public user texts (reviews, comments, product questions and answers, public requests for recommendations and the replies to them; questions visible to friends only are not checked) with the Azure OpenAI Service for spam, advertising, hate speech, harassment and similar violations. Only the text itself is transmitted — no name, username or other account data. The automatic check does not remove any content: it merely creates a notice for our team, which reviews and decides every case itself; no decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. The legal basis is our legitimate interest in a safe and rule-compliant service (Art. 6(1)(f) GDPR).

According to the provider, the transmitted content is not used to train models and is not shared with other customers. Processing takes place on servers within the European Union. To detect abuse, the provider may store inputs and outputs for up to 30 days.

The legal basis is the provision of the function you requested (Art. 6(1)(b) GDPR) and our legitimate interest in simple, low-error capture of product data (Art. 6(1)(f) GDPR). Please do not upload photos for this function in which other people are recognisable.

A data processing agreement (DPA) is in place with the provider; the data protection terms form part of the Microsoft Products and Services Data Protection Addendum. Further information can be found in Microsoft's privacy statement at: https://privacy.microsoft.com/en-gb/privacystatement

Affiliate links to travel offers (GetYourGuide, Booking.com)

On our Discover page, when you search for a city we display a link to matching activities and tours from the provider GetYourGuide. We show the same link on our city pages, on individual place pages (there either for tickets to that place or for activities in the surrounding city) and in the trip planner on an activities card for your destination as well as for the idea places you have collected. The respective search term forms part of the search URL — depending on the surface, either the city or place name from our database or the destination you entered yourself. The provider is GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany.

Simply loading our page does NOT transmit any data to GetYourGuide and does NOT set any GetYourGuide cookies. It is a plain reference (hyperlink), not an embedded feature – we do not load any scripts, maps or other content from GetYourGuide on our page. Consent via the cookie banner is therefore not required for this.

Only when you actively click the link are you forwarded to getyourguide.com. The link contains a partner identifier (the "partner_id" parameter) so that GetYourGuide can attribute any booking made there to us and we receive a commission for it (affiliate program). In doing so, GetYourGuide may set cookies or comparable technologies on its own website; GetYourGuide is solely responsible for this. Its privacy policy applies: https://www.getyourguide.com/c/privacy-policy/

We link to the hotel search of the provider Booking.com (Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, Netherlands) on the accommodation card in the trip planner, at the end of published trip reports and on individual place pages. The same applies here: it is a plain reference (hyperlink) — loading our page does not transmit any data to Booking.com and no Booking.com content is loaded on our page. Only when you actively click the link are you forwarded to booking.com. What is transmitted as part of the search URL depends on the surface: in the trip planner the search parameters you entered (destination, dates, number of travellers), on trip report and place pages merely the destination or city name from our database and the language of the page you are viewing. The Booking.com partner programme is operated via the affiliate network CJ Affiliate (Commission Junction LLC, USA): the click is then forwarded to booking.com via a CJ tracking domain (e.g. anrdoezrs.net), or the link contains a partner identifier, so that a booking made there can be attributed to us and we receive a commission. CJ may set cookies or comparable technologies on its own domains; CJ is solely responsible for this, and data may be processed in the USA. This processing only takes place once you actively click the link and thereby visit the domains of CJ or Booking.com; insofar as we ourselves transfer personal data to the USA, this takes place only on the basis of suitable safeguards pursuant to Art. 46 GDPR (EU standard contractual clauses) or your explicit consent (Art. 49(1)(a) GDPR). CJ's privacy notice applies (https://www.cj.com/legal/privacy-policy-services), and Booking.com's privacy policy applies to the data processing on booking.com: https://www.booking.com/content/privacy.html

Amazon partner programme (Amazon Associates)

We participate in the Amazon partner programme (Amazon Associates / Amazon PartnerNet). Buy links to amazon.de that users or we have stored on product, profile and list pages may therefore contain our partner identifier (the "tag" URL parameter). We only add this identifier if the stored link does not carry a partner identifier yet; we label such links as advertising. The provider is Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg.

Here too, it is a plain reference (hyperlink): loading our page does NOT transmit any data to Amazon, no Amazon content is loaded on our page and no Amazon cookies are set. Only when you actively click the link are you forwarded to amazon.de; Amazon can then attribute an order made there to us via the partner identifier so that we receive a commission. Amazon is solely responsible for the data processing on amazon.de; its privacy notice applies: https://www.amazon.de/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ

Notice pursuant to the programme's participation requirements: As an Amazon Associate we earn from qualifying purchases.

The legal basis for providing these affiliate links is our legitimate interest in financing our offering (Art. 6(1)(f) GDPR). We label such links as advertising. To minimise the referrer information transmitted to the providers when clicked, the links carry the rel="noreferrer" attribute.

Source

Parts of this privacy policy were created on the basis of sample texts from eRecht24 and adapted for ShineLists.