Privacy policy

In short

We collect what is needed to make a group card, deliver it and get paid for it. We show no advertising, use no tracking cookies and sell no data. Photos never go to AI or analytics. Organizers can delete a card at any time, and cards are deleted 24 months after delivery. The details follow below.

Who is responsible

The controller under the GDPR is Mücahit Gürbüz, Südostallee 120, 12487 Berlin, Deutschland. Email: hallo@junto.cards. Phone: +49 176 83258742.

This policy covers Junto at junto.cards: the website, the card pages, the emails we send and printed books. It explains what data we process, why, on which legal basis, who receives it, how long we keep it and what your rights are.

Junto has three roles. The organizer creates a card and shares its link. Contributors write messages and can add photos. The recipient receives the finished card. This policy applies to all three.

What we process

We process only what Junto needs to work, and what you choose to add.

• Organizer account: if you want to keep access to your cards, your email address, which you confirm with a 6-digit code, or the account ID and email address that Google or Apple share with us when you sign in with them. An account is optional.

• Anonymous session: when you create or contribute to a card without an account, your browser gets an anonymous session with a random ID. It lets you come back to your card or your message on the same device.

• Card content: the card title and occasion, display names, messages, photos, drawings you photograph, and the recipient's thank-you reply.

• Photos: your browser resizes each photo and removes its metadata, including EXIF data such as location and camera details, before upload. We never receive the original file.

• Recipient: the recipient's name and, if the organizer uses scheduled email delivery, the recipient's email address.

• Card settings: the theme, language, delivery date and method, whether photos are allowed, hidden messages and similar settings.

• Payments: order ID, plan, amount, currency, status and date. Stripe processes your card or other payment details. We never see them.

• Printed books: the shipping name and address, and the print file of the card that the printer needs.

• Notification emails: if you ask to be notified, for example when a card is delivered, your email address and that choice.

• Writing help: the text you send to “Write one for me”, see the section on AI below.

• Reports: when someone reports content, the report, the reason and the reported content.

• Technical data: IP address, time, page, browser type and error details in server logs, and the data described under analytics and error monitoring below.

Why we process it and on which legal basis

• To provide Junto under our contract with you: creating and sharing cards, collecting messages and photos, delivering the card by link, QR code or email, the thank-you reply, accounts, payment, printed books, export and deletion (Art. 6(1)(b) GDPR).

• Photos that show other people: with the consent of the people shown or their parents or guardians, which the uploader confirms (Art. 6(1)(a) GDPR).

• Notification emails for contributors: only with your consent (Art. 6(1)(a) GDPR). Every email has a link to stop them.

• Security, bot protection, abuse prevention, error monitoring and cookieless analytics to improve Junto: our legitimate interest in a secure, stable and useful service (Art. 6(1)(f) GDPR).

• Keeping payment records and invoices as tax law requires (Art. 6(1)(c) GDPR with §147 AO).

• Answering authorities and handling legal claims where the law requires it (Art. 6(1)(c) and (f) GDPR).

You can withdraw any consent at any time, by email or with the link in our emails. This does not affect processing that happened before. You are not required by law to give us data. Without the data a feature needs, you cannot use that feature.

Your right to object

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons that arise from your particular situation (Art. 21 GDPR). We then stop, unless we show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. Write to hallo@junto.cards.

Photos, children and people shown

Junto is made for adults. Children take part through a parent, educator or teacher. Cards for a Kita or school suggest drawings instead of photos of children.

Before you upload a photo, you confirm that everyone shown, or their parents or guardians for children, agreed. Only upload photos you are allowed to share.

Organizers can switch photos off for a card. Photos never go to an AI provider or to analytics. Anyone who sees a card can report a message or photo, and we remove content that breaks the rules or the law.

If you appear in a photo on a card and did not agree, ask the organizer to remove it, use the report button, or write to hallo@junto.cards.

Writing help with AI

“Write one for me” suggests a message when you ask for it. It uses Anthropic's Claude models through the Vercel AI Gateway. Nothing is sent unless you use the feature.

We send only the occasion, the recipient's first name, your relationship to the recipient, the tone you choose and your own draft, if you wrote one. We never send photos, other people's messages, email addresses or payment data.

Vercel and Anthropic process this data as our processors. Under their terms, this data is not used to train AI models. [To verify: current Anthropic and Vercel AI Gateway terms on training and retention.]

The suggestion is only a suggestion. You decide whether to use, change or discard it. Junto makes no decision about you that has legal or similarly significant effects (Art. 22 GDPR).

Cookies and local storage

Junto uses no advertising, no ad pixels and no tracking cookies. We store only what is technically necessary for the service you asked for in cookies or your browser's local storage:

• your session, so you stay signed in or keep your anonymous session;

• the name you last used as a contributor, so you do not have to type it again;

• your language;

• an autosaved draft of your message, so it is not lost if the page reloads.

This storage is allowed without consent because it is strictly necessary (§25(2) No. 2 TDDDG). You can delete it in your browser at any time. You may then lose access to cards you created without an account.

Analytics and error monitoring

• Vercel Web Analytics and Speed Insights count page views and measure loading speed without cookies and without identifying you.

• PostHog helps us understand which features are used. In the browser it works without cookies and without persistent identifiers. Some events are sent from our server with a pseudonymous user ID, never with your name, email address, messages or photos.

• Sentry reports technical errors so we can fix them. Session replay is off, or fully masked on card pages, so card content is not recorded.

The legal basis is our legitimate interest in a working, improving service (Art. 6(1)(f) GDPR). You can object at any time.

Who receives data

These service providers process data for us as processors under a data processing agreement, with standard contractual clauses where needed:

• Supabase (Supabase, Inc., USA): database, sign-in and file storage. Data is stored at AWS in Frankfurt, Germany (eu-central-1).

• Vercel (Vercel Inc., USA): hosting of the website and card pages, server functions in Frankfurt (fra1), Web Analytics, Speed Insights, BotID bot protection and the AI Gateway.

• Stripe (Stripe Payments Europe, Ltd., Ireland): payment processing and tax calculation (Stripe Tax). Stripe also acts as an independent controller for its own legal duties, such as fraud prevention and financial regulation, under its own privacy policy.

• Resend (USA): sends our emails, such as sign-in codes, scheduled card delivery and notifications.

• PostHog (PostHog Inc., USA): product analytics in its EU cloud in Frankfurt.

• Sentry (Functional Software, Inc., USA): error monitoring in its EU data region.

• Cloudflare (Cloudflare, Inc., USA): Turnstile bot protection on sign-in.

• Anthropic (Anthropic, PBC, USA): the writing help described above, through the Vercel AI Gateway.

• Prodigi (Prodigi Group Ltd, United Kingdom): printing and shipping of printed books. It receives the print file and the shipping address.

Other recipients:

• Google and Apple, if you sign in with them. They act under their own terms and privacy policies.

• People with the card link see the card's messages, photos and display names. The organizer sees all contributions and can hide messages. The recipient sees the delivered card, and contributors see the recipient's thank-you reply.

• Authorities and courts, only where the law requires it.

We do not sell your data and do not share it for advertising.

Transfers outside the EU

We store card data in the EU. Some providers are based in the USA or can access data from there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR). For Prodigi in the United Kingdom, the transfer relies on the Commission's adequacy decision for the United Kingdom. You can ask us for a copy of these safeguards.

How long we keep it

• Messages and photos: deleted 24 months after the card is delivered. [To verify: retention for cards that are never delivered.]

• Cards: organizers can delete a card at any time. Its messages, photos and settings are then deleted.

• Account: when you delete your account, we delete your account and your cards with all their content.

• Notification emails: until you unsubscribe or the card is deleted.

• Payment records and invoices: as long as tax law requires, up to 10 years (§147 AO). [To verify: since 2025, accounting vouchers such as invoices must be kept for 8 years.]

• Shipping data for printed books: as long as needed for delivery and warranty claims, and as tax law requires.

• Server logs: only for a short time, [NUMBER] days.

• Reports: as long as needed to handle the report and any dispute about it.

Your rights

Under the GDPR you have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time (Art. 7(3)).

You can do much of this yourself: export your data or delete your account on your account page, and delete a card in its settings. For anything else, write to hallo@junto.cards. If you contributed without an account, tell us which card and message it is about so we can find it.

You have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the law was broken. The authority responsible for us is [Data protection supervisory authority of the operator's German federal state, with website].

Security

Data is encrypted in transit. Access rules in the database decide who can see and change each card. Anyone with a card link can open the card, so share it only with people who should see it. No system is fully secure.

Changes

If we change this policy in a way that matters, we tell organizers with an account by email before it applies. The date at the top shows the current version.