Privacy policy

Last updated: 13 October 2026

This page explains which data is processed when you use the iPhone app “Brief verstanden” (Letter Explained) and this website. In short: you don't need an account, there are no ads, no tracking and no analytics tools. We do not store the images and texts you have explained.

1. Controller

2. The app

2.1 Images and texts you have explained

When you have a photo, screenshot or text explained, or have a reply letter drafted, the app sends this content encrypted (HTTPS) to our server. This includes the explanation language you chose, today's date (to calculate deadlines) and, for reply letters, your optional wish (for example “payment by instalments”). Our server forwards the content to our AI service provider Anthropic (Claude), which creates the explanation, and returns the result to the app.

• Purpose: to create the explanation, the scam check or the reply draft.
• Legal basis: Art. 6(1)(b) GDPR (providing the service you requested). Before the first explanation, the app informs you about this and asks for your agreement. If a letter contains special categories of personal data about you (for example health data in a letter from your health insurer), we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time with effect for the future by no longer sending such content.
• Data of other people: letters often contain names and addresses of senders or other people. We only process them as far as necessary for the explanation, based on our and your legitimate interest in understanding mail (Art. 6(1)(f) GDPR).
• Storage: we do not store images, texts or explanations on our server. They are only processed for the duration of the request. Anthropic does not use data sent through its programming interface (API) to train its AI models. Anthropic may keep the data for a limited time (up to 30 days) to detect abuse and ensure safety, and deletes it afterwards.
• Requirement: you don't have to send any content, but without content the app cannot explain anything.

2.2 Random device ID and counters

To count free explanations, the app creates a random ID when it is first started and stores it in your iPhone's keychain. It contains no name, no phone number and no advertising ID. The app sends it with every request. On our server we store only counters for this ID: how many explanations have been used (in total and per month) and how many explanations from purchased packs are left.

• Purpose: to provide the free quota and packs and to prevent abuse.
• Legal basis: Art. 6(1)(b) GDPR; for abuse prevention also Art. 6(1)(f) GDPR (our legitimate interest in keeping the service available and affordable for everyone).
• Storage period: as long as you use the app. If you would like it deleted, write to us.

2.3 Purchases and subscriptions

Purchases and subscriptions are handled exclusively by Apple. Apple processes your payment data as an independent controller; Apple's privacy policy applies. We receive no names and no payment details. To unlock Plus or a pack, the app sends the purchase proof signed by Apple (for example product, transaction number, purchase and expiry date) to our server, where we verify it. To prevent a pack from being redeemed more than once, we store the transaction number of a pack together with the device ID. The legal basis is Art. 6(1)(b) GDPR.

2.4 Data that stays on your iPhone

Saved deadlines, saved explanations and your chosen language stay on your iPhone only. We have no access to them. They are deleted when you delete the app.

2.5 Camera, photos and calendar

The app only accesses the camera, your photos or your calendar when you use the respective function and have allowed it in iOS. Photos are only sent if you select them for an explanation. The app only adds a deadline to your calendar when you tap the button. You can change these permissions at any time in your iPhone settings.

2.6 Technical data when connecting

With every connection our hosting provider Cloudflare processes technically necessary data such as the IP address and time to deliver the request and to defend against attacks (Art. 6(1)(f) GDPR). We ourselves do not keep logs containing the content of your requests.

3. This website

This website uses no cookies, no tracking, no analytics tools and loads no content from third-party servers (the fonts are hosted on our own server too). When you visit it, Cloudflare as our hosting provider processes technically necessary data (IP address, date and time, page address, browser information) in server logs to deliver the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in secure operation). Cloudflare deletes these logs after a short time.

4. Contact by e-mail

If you write to us, we use your e-mail address and message only to answer you (Art. 6(1)(b) or (f) GDPR). We delete them once your request has been dealt with, unless statutory retention obligations apply.

5. Recipients

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – hosting of the website and server (Cloudflare Workers), as processor.
• Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA – creating the explanations with the AI Claude, as processor.
• Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) – App Store, purchases and subscriptions, as independent controller.

We do not sell data and do not pass it on for advertising.

6. Transfers to the USA

Cloudflare and Anthropic are based in the USA. Transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, and/or on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR), which are part of the data processing agreements.

7. Storage periods at a glance

• Images, texts and explanations: not stored by us; kept by Anthropic for up to 30 days for abuse detection.
• Device ID, counters and pack transactions: as long as you use the app.
• Deadlines, explanations and settings in the app: only on your iPhone until you delete them or the app.
• Website server logs: briefly at Cloudflare.
• E-mails: until your request has been dealt with, unless statutory retention periods apply.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Where we process data on the basis of Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation (Art. 21). Simply write to hallo@briefverstanden.app. As we do not keep accounts or store names, we often cannot link data to a person; in that case we will ask how we can identify your data.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

9. No automated decisions

The explanations are created by AI. However, there is no automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). You decide yourself what to do with the explanation.

10. Changes

We update this privacy policy when the app, the website or the law changes. The version published here applies.

The German version of this privacy policy is the authoritative one; this English version is a translation.