Translation for information only. The German version is binding. Show German version

Privacy Policy (Datenschutzerklärung)

Last updated: 22 October 2026

This policy applies to the websites at helferino.fun, the Helferino.fun web app and the apps for Android and iPhone.

1. Controller and Contact

ITC International Trade Consult
Owner: Andreas Heuvens
Heinestraße 122
47623 Kevelaer, Germany
Email: hallo@helferino.fun

No data protection officer has been appointed. Please address data protection enquiries directly to the email address given.

2. Websites, App and Technical Connections

• No advertising tracking: We do not use any third-party analytics, advertising or profiling services, do not sell any data and do not load fonts, maps or other content from third-party websites. The map tiles are delivered by our own server.
• No cookies: The websites and the web app do not use cookies. The exception is the operator’s login to the internal dashboard: it sets a technically necessary session cookie that expires after 30 days. In the web app, the browser stores only the encrypted session data locally. This storage is necessary to provide the function you have expressly requested (§ 25(2) no. 2 TDDDG). You can delete it by logging out or via the browser settings. This does not replace logging out on other people’s or shared devices.
• Server logs: When pages are accessed, the server processes the IP address, time, request method, path, response status, browser identifier and referring page. Access tokens and one-time codes are masked in log lines. The logs serve delivery, troubleshooting and attack detection (Art. 6(1)(f) GDPR). They rotate automatically by size; per service, at most three files of 10 MB each are kept. With little traffic, an individual line may therefore remain longer than with heavy traffic. From the server logs we determine daily how often our pages are accessed and how many different visitors they have. For this purpose, the IP address and browser identifier are irreversibly shortened using a key that changes daily; only the daily figures are stored, no addresses (Art. 6(1)(f) GDPR).
• Location: The app only requests your device’s location when you use a function that needs it, such as “You” on the map or a meeting point near you. Helferino.fun does not track your location, and not in the background either. A location is only stored permanently if you yourself set it as the centre of your search radius or as the meeting point of a request.
• Other device permissions: Camera/photo library, microphone and the connection to Bluetooth headsets are used only for the function you have called up (profile picture, call). Helferino.fun does not read your contacts.
• Notifications on the device: Firebase Cloud Messaging is only switched on after system permission for notifications has been granted. In the event of refusal, a later detected revocation or logout, the FCM delivery token and the Firebase installation ID are removed again. In the web app the same applies to browser notifications: they are only switched on after you have allowed them in the browser. They are delivered via your browser’s push service (Google for Chrome, Mozilla for Firefox, Microsoft for Edge, Apple for Safari); this service receives the delivery address and the notification text. In the event of refusal, revocation or logout, the delivery address is removed again.

3. What Data We Process and Where It Comes From

• Account and security: name, email address, phone number if provided, language setting, email confirmation as well as the confirmation of legal age and the time and version of consent to the AGB. The password exists only as a cryptographic hash. Access, refresh, confirmation and reset processes also process random identifiers, hashes and times.
• Hobby profile: description, profile picture, chosen hobbies, search radius and, if you set it, the centre of the search radius, quiet times for notifications and the ratings given about you.
• Requests and connections: requests with title, description, hobbies, destination, date, number of participants sought, radius as well as approximate and exact meeting point including an optional address; interests, confirmations, agreements, contact feedback, chat messages, ratings, reports and blocks. In addition: watch list, hidden requests, date reminders and the personal notification inbox.
• Automatic translation of requests: The title and description of a request are machine-translated into the other app languages before publication so that users of other languages can read it too. The translation model (an open language model of the Gemma family) runs on the controller’s own computer in Germany; the text reaches it via an encrypted connection and is not passed to any third party, including any cloud service. The translations are stored with the request and deleted with it; the translation computer retains no texts. Chat messages do not reach it.
• Translation of chat messages on your device: In the app for Android and iPhone you can translate a received message if you wish. Language detection and translation run exclusively on your device with Google ML Kit, after the message has been decrypted there. The message text reaches neither us nor Google. The translation is not stored and disappears when the app is closed or when you log out. Before first use, the app asks for your consent. After that it downloads the necessary language packs from Google, and ML Kit transmits to Google information about the device (manufacturer, model, operating system), app name and version, an installation ID, performance and error values as well as the detected and selected languages, never the text. In the browser, chat messages are not translated.
• Chat encryption: Messages are encrypted on the sending device and decrypted on the devices of those involved (end-to-end); the server sees no plain text. It stores ciphertext, public account keys, encrypted private keys and encrypted chat keys. Sender, recipient, request and time remain assigned for delivery and deletion. Private keys are protected with a key derived from your password. On Android, secure device storage can hold them; in the browser they remain only in memory and are unlocked again after reloading. The login password is still transmitted to the server via HTTPS and stored there only as a hash. The protection requires unmodified app, browser and server software as well as secure devices and a strong password.
• Voluntary chat report copies: Only messages you have expressly selected are transmitted to moderation as a readable copy. Without a selection, no chat content is sent. The server cannot independently verify the authenticity of the submitted plain text of an encrypted message.
• Purchases and subscriptions: the Helferino.fun product chosen, status, term, time of purchase and the purchase and subscription IDs of Google Play or the App Store. Helferino.fun does not receive or store your name, means of payment, card or bank account details.
• Notifications: Firebase device ID and the respective notification text. For new chat messages, the sender, request title and the technical chat assignment are transmitted, not the message text or a chat key.
• Calls: IP addresses, ports, connection times and possible network paths are processed temporarily so that the devices can find each other. The content of the conversation is end-to-end encrypted; Helferino.fun does not listen in and records nothing.
• Error reports and support requests: your description, the place in the app, app version, device model, operating system version, time as well as the account’s name and email address. Chat content, request texts, addresses, location data and screenshots are not transmitted.
• Contact form: If you write to us via helferino.fun/kontakt, we process your email address, your message, the time and, if you provide them, your name and subject in order to answer your request; you do not need an account for this. The legal basis is Art. 6(1)(b) GDPR insofar as it concerns a contract with us or its initiation, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The message is sent as an email to hilfe@helferino.fun; STRATO delivers it, we handle it in our self-operated ticket system FreeScout and reply to the address you provided. To prevent mass submissions, we count messages per IP address; this counter expires after one hour at the latest and is not stored with the message. The message remains in the mailbox and in the ticket system until 12 months after the matter is closed.
• Re-deletion protection: When you delete your account, only the random account ID (UUID) with the time of deletion remains stored outside the database for 180 days. Name, email address and content are not contained in this marker. It prevents an older backup from making your deleted account visible again.

The data comes predominantly from you. Other sources are the other side of a connection, other users in the case of ratings and reports, Google or Apple regarding the status of a purchase, as well as the system’s technical assignment and the decisions of moderation.

4. Purposes and Legal Bases

• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): account, hobby profile, feed, map and notifications matching hobbies and search radius, requests including their translation, connections, contact release, chat, calls, ratings, the subscription, notifications and support.
• Consent (Art. 6(1)(a) GDPR): the Firebase device ID and the translation of chat messages on the device with Google ML Kit. The storage and reading of the device ID and of the ML Kit installation ID are additionally based on § 25(1) TDDDG. You can withdraw consents at any time with effect for the future in the app, in the device settings or by email, the chat translation under Profile → “Chat translation on this device”.
• Legitimate interests (Art. 6(1)(f) GDPR): secure and stable operation, rate limits, defence against fraud and misuse, the contact filter on publicly visible texts, moderation, enforcement of rules, error analysis and the assertion and defence of legal claims. In doing so, we weigh these interests against your rights.
• Legal obligations (Art. 6(1)(c) GDPR): obligations as a provider of an online platform under the Digital Services Act (notices, statements of reasons and informing the law enforcement authorities in the event of suspicion of a criminal offence that threatens the life or safety of persons, Art. 18 DSA), retention under commercial and tax law, handling lawful requests from authorities and the secure execution of deletions (Art. 17 and 32 GDPR).

We do not ask for special categories of personal data (Art. 9 GDPR), such as information on religious beliefs, health or sexual orientation, and the hobby catalogue contains no such information. They are not needed for Helferino.fun; we recommend not writing them in requests or in the hobby profile. If you do so nevertheless, you yourself make them accessible to the users who see the request or profile. We then process them only to store, translate and display your text as you intended (Art. 9(2)(e) GDPR). You can change or delete them at any time.

5. Visibility, Location and Recipients

Until an agreement is reached, other users with a matching hobby see only the information required for searching and selecting: title and description of the request, hobbies, destination, date, number of participants sought, the approximate meeting point and a profile with abbreviated name, picture, description, hobbies and ratings. On the map, requests are shown rounded to a grid, not people; distances appear only roughly. A contact filter removes phone numbers, email addresses, links and messenger names from these publicly visible texts before others see them.

If the creator of a request confirms an interested person, both can write in the chat; there they see each other with an abbreviated name. After the agreement in the app (“We agree”, by both), the two receive each other’s name and email address, and the phone number if both have provided one; the participant additionally receives the exact meeting point including the optional address. Responsible administrators see reports insofar as they have to review them.

Beyond that, data is received only by the following:

• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (hosting): websites, app server, database and map server run on a rented server (VPS) in Germany.
• STRATO GmbH, Pascalstraße 10, 10587 Berlin, Germany (email): sending Helferino.fun emails, for example for address confirmation, the password, cancellations and reports, as well as our mailboxes hallo@helferino.fun and hilfe@helferino.fun. STRATO processes the sender, recipient, content and connection data of the emails on servers in Germany.
• Google Commerce Limited or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Play): If you buy in the Android app, you buy from Google Play. Google processes your payment data for this under its own responsibility. Helferino.fun transmits an identifier derived from your account without name or email address so that the purchase can be assigned to your Helferino.fun account, and receives from Google the product, purchase ID and status, but neither your name nor payment data, in particular no card or account details.
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (App Store): If you buy in the iPhone app, the same applies to the App Store. Processing outside the EEA, in particular in the USA, is possible with both; the EU-US Data Privacy Framework and, where necessary, EU standard contractual clauses apply.
• Google Ireland Limited and Google LLC (Firebase Cloud Messaging): after your permission, the Firebase installation/device ID and the notification text. Processing outside the EEA, in particular in the USA, is possible. Transfers to the USA are covered by the EU-US Data Privacy Framework and, where necessary, EU standard contractual clauses.
• Your browser’s push service (Google, Mozilla, Microsoft or Apple), if you have allowed notifications in the web app: the delivery address and the notification text.
• Google Ireland Limited and Google LLC (ML Kit): only for chat translation and after your consent, the device, app and language information mentioned above, never message content. Processing outside the EEA, in particular in the USA, is possible; the EU-US Data Privacy Framework and, where necessary, EU standard contractual clauses apply.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (STUN/TURN for calls): public IP addresses, ports and connection times. If no direct connection succeeds, the end-to-end encrypted media stream runs as a relay via Cloudflare; Cloudflare cannot decrypt the content of the conversation. Processing takes place via a worldwide network and may include the USA. The basis is the EU-US Data Privacy Framework and, in addition, EU standard contractual clauses under Art. 46(2)(c) GDPR.
• Authorities or courts only insofar as there is a legal obligation, for example the competent law enforcement authorities in the event of suspicion of a criminal offence that threatens the life or safety of persons (Art. 18 DSA).

We handle error reports and support requests ourselves. Apart from STRATO, whose servers emails pass through, no third party is involved. We operate our ticket system (the open-source software FreeScout) and server monitoring ourselves in Germany; we deliberately do not use any external support or error monitoring service. We also translate requests ourselves, without an external translation service. Data is neither sold nor passed on for third-party advertising purposes.

6. Automatic Selection and Ranking

Helferino.fun automatically matches hobby profiles and requests. Hobbies, search radius and its centre, the radius of the request, distance, the limits of the plan, status and duration of a request, quiet times and blocks determine which requests you see and whether a notification is triggered. In the feed, the newest requests are shown first; with the subscription you can additionally filter by date, group size and group. This processing may constitute profiling within the meaning of Art. 4(4) GDPR; it serves the bringing-together of people that is expected under the contract.

There is no exclusively automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR. You can change hobbies, search radius and centre at any time and request a human review via hallo@helferino.fun. Moderation decisions are made by a human.

7. Storage Period and Deletion

We store data only for as long as the respective purpose, legal obligations or the defence against claims require:

• Sessions: access tokens are valid for 15 minutes, refresh tokens for at most 30 days and password reset identifiers for 30 minutes. When logging out account-wide, all sessions and the stored push identifier are invalidated. When logging out on one device, only that device’s session ends; if it was the device for push notifications, the push identifier is also removed.
• Visibility of requests: A request is visible for 28 days from posting, with the subscription 90 days. Each new contact request resets the period to its full length, but never shortens it.
• Requests and connections: If there was a confirmation, we delete the request with its connections as soon as its visibility ends. If there was an agreement, we close the request when its visibility ends and delete it only 7 days later, so that both sides can rate each other. Those involved are notified 3 days before the automatic deletion. If you delete a request yourself, we delete it permanently 28 days later. Requests that expire or are cancelled without confirmation are deleted 28 days after expiry or cancellation; since there is no chat and no contact data for them, without prior warning.
• Chats: 28 days after the confirmation with which the respective chat opens, even if the request lasts longer; if the request ends earlier, together with the request. The creator of the request can clear a chat beforehand. After resetting a forgotten password, you can no longer open your previous encrypted messages. After your express confirmation, they are deleted for both sides 3 days later; until then, the other person can continue to read and report them. Requests and contacts remain. With a normal password change where the previous password is known, the chat keys and messages are preserved.
• Notifications: 28 days. Watch list, hidden requests, blocks and date reminders remain until you delete the entry or the account.
• Support, contact form and error reports: 12 months after the matter is closed.
• Firebase: In the event of revocation, logout or account deletion, we delete the stored delivery token on our side. The app switches off automatic regeneration and calls on Firebase to delete the delivery token and installation ID. Google states up to 180 days for removing the data associated with this installation ID from live and backup systems.
• Chat translation: translations only in memory until the app is closed; language packs and consent until you switch off chat translation in the profile or remove the app.
• Account and hobby profile: until you delete your account. Insofar as information on purchases belongs to the accounting records that must be kept by law, it is kept separately for eight years from the end of the calendar year; profile or content data are not part of this.
• Reports of rule violations: until the review has been completed and thereafter insofar as necessary for the assertion or defence of claims. The regular limitation period is three years and generally begins at the end of the year. When an account is deleted, name and contact details in the report are removed; reason, time and processing status remain in anonymised form. Voluntary chat report copies are an exception: they may contain personal data and are kept separately for up to 180 days from transmission, even if the chat or an account involved is deleted beforehand. After that, the copies are removed automatically; for backup copies, the additional rotation mentioned below applies. The release is not a publication; responsible administrators see the copies in order to process the report.
• Database backups: in the regular backup cycle after 60 days at the latest. They are separate from the running system; the spatially separate copy is additionally encrypted. If a scheduled clean-up run fails, the deletion is carried out at the next successful run. Before a restored system is released, accounts from the re-deletion journal are completely removed again.
• The minimal re-deletion marker consisting of account ID and time remains for 180 days and is then deleted automatically. It thus outlasts any database backup still in existence.

8. Mandatory Information and Consequences of Not Providing It

For an account we need name, email address, password, the confirmation of legal age and consent to the AGB; without this information we cannot offer an account. The phone number is voluntary; without it, chat and calls remain within the app, and the email address is shared upon agreement. Without hobbies in the profile, the feed shows no requests. Location and other profile information are only required for the function chosen in each case. You buy the subscription in the Helferino.fun app via Google Play or the App Store; without an account there, no purchase is possible.

9. Your Rights and Complaints

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consents at any time with effect for the future. Statutory retention obligations and Art. 17(3) GDPR may limit the immediate complete deletion of individual information.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the assertion or defence of legal claims.

You delete your account under “Profile → Delete account”, also without the app at helferino.fun/konto-loeschen.html. You create a copy of your data under Art. 15 under “Profile → A copy of my data” and choose the destination yourself in the share dialog; we do not send such a copy unencrypted by email.

You can lodge a complaint with any data protection supervisory authority, in particular with the authority of the EU state in which you live, or with the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Please address questions and the exercise of your rights to hallo@helferino.fun.