Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
RAW Productions GmbH, Äußere Bayreuther Str. 59, 90409 Nürnberg, Germany
Email: info@rawproductionsgmbh.de

Further details are given in our imprint.

As a data subject you have the following rights at any time:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Our website runs on our own infrastructure on the premises of RAW Productions GmbH (self-hosting). When you visit it, access data transmitted by your browser is processed automatically in server log files (including IP address, date and time, page requested, browser type). This serves the secure and stable operation of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Media (such as images and videos) is delivered through the content delivery network of Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg). Your IP address is transmitted to AWS to deliver the content. Storage takes place primarily in the EU region (Frankfurt); as this is a globally distributed CDN, a transfer to third countries cannot be ruled out and is safeguarded by appropriate guarantees (standard contractual clauses). A data processing agreement is in place. Legal basis: Art. 6(1)(f) GDPR.

We use storage that is technically necessary for operation (for example, to keep you signed in) on the basis of Art. 6(1)(f) GDPR. Services that are not necessary (for example, statistics) are only activated with your consent via our consent banner. Your choice is stored locally in your browser; you can withdraw it at any time by deleting the website data stored locally.

If you consent, we use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure reach. Pseudonymous usage data is processed; IP anonymisation is enabled. A transfer to third countries (including the USA) cannot be ruled out.

Legal basis: Art. 6(1)(a) GDPR (consent). The Google tag is only loaded after you have agreed.

You can withdraw your consent at any time with effect for the future. More information: policies.google.com/privacy.

If you join our waiting list, we process your email address to inform you about the launch of the app and related news.

Sign-up uses the double opt-in procedure: after you sign up, we send you an email with a confirmation link. Only once you open that link do we add you to the mailing list. If you do not confirm within 14 days, we send no further messages to that address.

Legal basis: Art. 6(1)(a) GDPR (consent).

Every message contains an unsubscribe link with which you can withdraw your consent at any time with effect for the future; an email to us is also sufficient. After withdrawal, we keep your address only to document the unsubscription and to prevent further mailings.

Emails are sent via Amazon Simple Email Service (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg) in the EU region Frankfurt (eu-central-1). A data processing agreement is in place; see also section 3.

You can create an account to use protected areas. Authentication is handled by Amazon Cognito (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg) in the EU region Frankfurt (eu-central-1) using the OpenID Connect standard. In doing so we process, among other things, your email address and sign-in data. A data processing agreement is in place; see also section 3.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

For paid offers (subscriptions), payments are processed by third-party providers: RevenueCat, Stripe and – within the apps – the Apple App Store and Google Play. The data collected in the process is governed by the terms of the respective provider.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Content you enter in the journal, the dream journal, the workbook or in exercises, as well as your answers to the app’s opening questions, is stored so that we can provide these features to you. We also store your progress (for example, where you paused a meditation) and the content you save. This content is private and intended for you alone. It is stored with Amazon Web Services in the EU region Frankfurt (eu-central-1); see section 3.

Legal basis: Art. 6(1)(b) GDPR. You can delete your entries at any time.

When you first open the app, it asks you a few questions (for example, what brings you here). To ask a follow-up question where appropriate, and to sum up at the end what you said, we transmit your answers to the AI model Claude by Anthropic, PBC (548 Market Street, San Francisco, CA 94104, USA) as a processor. Anthropic does not use this data to train its models. The transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). The result is stored in your account and is deleted with it.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

You can upload a profile picture voluntarily. It is stored with Amazon Web Services (S3) in the EU region Frankfurt and delivered to you only through time-limited, signed links. You can remove or replace it at any time; replaced pictures are deleted.

Legal basis: Art. 6(1)(a) GDPR (consent given by uploading).

If you allow notifications in the app, we store a device-specific push token to send you the daily reminder and notices about new content. Delivery takes place via the push service of Expo (650 Industries, Inc., USA) and via the Apple Push Notification service or Google’s Firebase Cloud Messaging. For transfers to the USA, these providers rely on the EU-U.S. Data Privacy Framework or standard contractual clauses. You can turn notifications off at any time in the app or in your system settings; the token is then deleted.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can delete your account yourself at any time: in the app under “You” → “Delete account”, or on the website in the settings. This deletes your login, your profile and profile picture, all journal, dream and exercise entries, your progress and your purchase record at RevenueCat. Invoices and payment records that must be kept by law remain with the respective payment provider. Deleting your account does not cancel a running subscription. More information: homecoming-journey.com/delete-account.

We process personal data only for as long as is necessary for the purposes stated or as required by statutory retention periods. The data is then deleted.

We update this privacy policy whenever changes to our data processing require it. The current version published here applies.