Skip to content

Legal

Privacy policy

In brief: this website collects as little as possible. Here is exactly what happens — and what does not.

As of October 22, 2026 · applies to this website, not to the app

  • Only a language cookie

    Only your manual language selection is saved in a functional cookie — without tracking.

  • No analytics

    Analytics are disabled by default. No usage data is collected.

  • Local fonts

    Fonts are hosted on our server. No external font services.

  • Demos in your browser

    Demo inputs stay in your browser and are not transmitted.

Data controller

Karl Roth, Kampstraße 6, 20357 Hamburg, Germany
Email: karl@ruvemio.de
The controller is currently Karl Roth as an individual. Once the planned company is established, these details will be changed to that company.

We have not appointed a data protection officer because there is no legal obligation to do so (Art. 37 GDPR, Section 38 BDSG). For questions about privacy, contact us directly at karl@ruvemio.de.

Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers static pages through a global server network, generally from a location near you. Server-side functions such as waitlist registration run in Frankfurt am Main (region fra1).

When you visit a page, Vercel processes technically necessary data: IP address, time, requested address, referrer, browser and device details. The page cannot be delivered without this data. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

Server logs: Vercel logs requests and retains these logs for a limited time, depending on the plan, from a few hours to 30 days; they are then deleted automatically. We use them exclusively for troubleshooting and preventing abuse, and do not combine them with other data.

Waitlist (Early Access)

When you sign up for Early Access and agree to the data-processing notice, we store exactly the following information:

  • your email address (in lowercase, without spaces),
  • a hash calculated from it (SHA-256) to detect duplicate registrations,
  • the time of registration,
  • a randomly generated personal referral code,
  • the code of the referral link, if you arrived through one,
  • the confirmation status (“pending”) and a random confirmation token.

Purpose: informing you about the launch of Ruvemio and Early Access. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Storage location: a Supabase database with servers in Frankfurt am Main (EU region eu-central-1). It stores your email address, a hash calculated from it to detect duplicate registrations, your referral code, the code of the person who referred you if applicable, your registration status, the time and the version of the consent text.

Double opt-in: confirmation through an email link is prepared but not yet active. The website currently sends no emails. Before we write to you, confirmation will be set up and this notice will be updated.

Abuse prevention: to prevent automated waitlist submissions, the server briefly processes your IP address in memory (at most five registration attempts per minute). It is not saved in the waitlist. An invisible form field also helps detect bots.

Retention: we store your details until you withdraw consent or request deletion of your entry, but no longer than twelve months after the app launches in the App Store. We then delete the entire waitlist.

Deletion: write to us at karl@ruvemio.de and we will delete your entry.

Proof of consent: we store the time of registration and the version of the consent text you agreed to. This lets us demonstrate what your consent covered.

No automated decision-making: the waitlist does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Voluntary information: providing your email address is voluntary. Without it, we cannot add you to the waitlist; all other pages on the website work without registration.

Contact by email

If you email us, we process your email address, your name (if provided) and the contents of your message to reply. The legal basis is our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR), or Art. 6(1)(b) GDPR for inquiries relating to a contract. We delete the message once the inquiry has been resolved and there are no statutory retention requirements.

Recipients and service providers

We only share personal data with service providers that work on our behalf:

  • Website hosting: Vercel Inc. (USA). Delivers the pages and processes technically necessary connection data.
  • Waitlist database: Supabase, Inc. (USA). Servers in Frankfurt am Main (region eu-central-1). They store the information described in the waitlist section.

Data-processing agreements under Art. 28 GDPR must be in place for both service providers. The operator verifies their conclusion before the public launch.

Transfers to third countries

Vercel and Supabase are US companies. The waitlist database and registration function run in Frankfurt am Main; access by the providers, for example for support or maintenance, and global delivery of static pages can still involve transfers to third countries. The following mechanisms are intended to safeguard these transfers:

  • Vercel is certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); its data-processing agreement also includes the European Commission’s Standard Contractual Clauses.
  • Supabase bases transfers on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR), which form part of the data-processing agreement.

You can request a copy of the safeguards at karl@ruvemio.de.

Security

The website is delivered exclusively over an encrypted connection (HTTPS). Access to the waitlist is restricted to the server; the database key with extensive permissions is held only on the server and is not visible in the browser. Registration is rate-limited to prevent abuse, and the database is not publicly readable.

Cookies and local storage

For your explicitly selected language, we save the technically necessary cookie “ruvemio_locale” (de/en, 180 days, SameSite=Lax), so IP-based language selection does not override your choice. No language cookie is needed without a manual selection. Your browser also stores two small settings locally:

  • Reduce motion: when you choose “Reduced” or “Full” in the footer, your browser remembers that choice in local storage (key “ruvemio:motion”). “System” removes the entry again.
  • Intro animation: to play the opening animation only once per visit, your browser remembers it for the duration of the session (session storage, key “ruvemio:preloader-seen”).

Analytics

The website includes a prepared analytics interface. It is disabled by default, no analytics service is currently integrated and no usage data is collected.

If it is enabled later, this will only happen with your consent and after this notice has been updated. Only events such as “waitlist opened” would be recorded — never nutrition or health values or inputs from the demos.

Fonts

The Inter and Nunito fonts are embedded locally and loaded from our own server. There is no connection to Google Fonts or other external font services.

Interactive demos

The scanner demo, nutrition dashboard, AI concept demo and other demos use predefined sample data and run entirely in your browser. Anything you enter there is neither transmitted to us nor saved, and disappears when the page is reloaded.

Some links lead to other websites, such as Open Food Facts. Your browser only connects to those sites when you click a link. The privacy policy of the respective website then applies.

Your rights

Under the GDPR, you have the right to

  • access information about your stored data (Art. 15),
  • rectification (Art. 16) and erasure (Art. 17),
  • restriction of processing (Art. 18) and data portability (Art. 20),
  • object (Art. 21) and withdraw your consent with effect for the future (Art. 7(3)).

Contact karl@ruvemio.de to exercise these rights. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.

Changes

If the website changes — for example through an email service, analytics or the App Store launch — we will update this notice beforehand.