Privacy Policy

1. Data Controller

Frank Fehrenbacher
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach, Germany
Email: see Imprint

2. What Echo Is

Echo is a self-hosted feedback and bug-report widget, embedded into the websites and apps of nuumoo (e.g. watchmycalendar). This page describes both the processing that happens on this page itself and the processing that happens when someone submits a report through an Echo widget on any nuumoo app.

3. Submitting a Report

When you submit feedback or a bug report through an Echo widget, the following is processed:

• The message text you write
• An email address, only if you choose to provide one, for a reply
• The page URL the widget was embedded on
• Optional technical diagnostics text and file attachments (screenshots, logs), only if the submitting app offers and you use that option
• Browser locale, as sent by your browser

Submission is entirely voluntary and requires you to actively write and send the report. No data is collected in the background before you submit. Legal basis: Art. 6(1)(a) GDPR (consent through the active send action) or Art. 6(1)(f) GDPR (legitimate interest in receiving and resolving bug reports).

4. Replies and Email Threading

If you provided an email address, an administrator's reply is sent to you by email from an address specific to your report, so that further replies from you are automatically matched back to the same report. Incoming replies are read via IMAP and stored as part of the report's history. Legal basis: Art. 6(1)(b)/(f) GDPR (responding to your report).

5. Spam Protection

A hidden honeypot field and a short-lived, in-memory rate limit by IP address are used to reduce automated spam submissions. The submitting IP address is held briefly in memory for this purpose only, is not written to the database, and is discarded automatically after a short time window. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

6. GitHub Issue Sync (Optional, Per App)

If the app you reported to has GitHub issue sync configured, an administrator may manually turn your report into a GitHub issue. In that case, the report's message, optional diagnostics, and a link back to the report are transmitted to GitHub, Inc. (a Microsoft company, USA), and any status changes or comments on that issue are synced back automatically. This only happens for reports an administrator actively chooses to forward. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in tracking and resolving reported issues in our existing engineering workflow).

7. Website Analytics (Umami)

For anonymous, aggregated usage statistics of this website we use Umami, self-hosted on our own infrastructure within the EU. Umami does not use cookies, does not build cross-device profiles, and does not store full IP addresses. No data is transferred to third parties or third countries. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous analytics without personal reference).

8. Hosting and Infrastructure

This service is hosted with Webtropia (EU); outgoing and incoming email is handled via Infomaniak (EU). Both providers are bound by a data processing agreement (Art. 28 GDPR).

9. Retention Period

Reports are retained until no longer needed to address them. Where the operator of a specific app has enabled automatic retention limits, reports older than that configured window are deleted automatically, regardless of status.

10. Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing. You also have the right to lodge a complaint with a data protection supervisory authority.

11. Changes

This privacy policy will be updated when Echo's functionality changes.

Last updated: August 2026.