Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website under the General Data Protection Regulation (GDPR) is:

Patrick Gratza
Wolkersdorfer Hauptstraße 90
91126 Schwabach
Email: hello@robomi.app

A data protection officer has not been appointed, as the statutory requirements for a mandatory appointment (Art. 37 GDPR, § 38 BDSG — German Federal Data Protection Act) are not met — the operator is a sole individual with no employees, whose core activity does not involve large-scale processing of special categories of data or systematic monitoring.

2. Overview & scope

This privacy policy applies exclusively to the website robomi.app (this marketing and information site, including the beta waitlist). It does notapply to the Robomi iOS app itself — the app's own data processing (e.g. habit data stored locally on your device) is not the subject of this document.TODO: If the app has its own privacy policy, or maintains a separate App Store "Privacy Nutrition Label," link/reference it here.

This website is deliberately kept lean: there is no user account, no login, and no payment processing — only a voluntary email sign-up for the beta (section 4). This text is adraft and will be revised and reviewed before final publication.

3. Hosting: Cloudflare

This website is hosted and delivered as a Cloudflare Pages project viaCloudflare (Cloudflare, Inc., USA), including the small server function behind the waitlist (a Cloudflare Pages Function). Cloudflare acts as ourdata processor in this respect. When you access the website, Cloudflare processes technically necessary data such as IP address, date and time of access, and user agent, in order to deliver the website reliably and securely (functional server logs, DDoS protection). A Cloudflare Workers KV data store used as a technical fallback for the waitlist is described in section 4.

Because Cloudflare, Inc. is a US company, this processing involves a transfer of data to a third country (the US). This is based on the EU-US Data Privacy Framework or, where applicable, Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46 GDPR.

A data processing agreement with Cloudflare is in place under theCloudflare Data Processing Addendum (DPA) (available atcloudflare.com/dpa), which forms part of the terms of service accepted upon sign-up (the Self-Serve Subscription Agreement) and applies automatically — no separate agreement needs to be concluded.

4. Beta waitlist

When you sign up for the Robomi iOS beta through the form on this website, we collect the following data:

• Data processed: your email address, the time of sign-up, and your consent status.
• Purpose: to inform you about the status of the Robomi beta and send you your TestFlight access once it's ready.
• Double opt-in: After submitting the form, you first receive a confirmation email. Only once you click the confirmation link it contains is your email address actually added to the waitlist. Without that confirmation, nothing further happens with your address.
• Legal basis: your consent pursuant toArt. 6(1)(a) GDPR, which you give by checking the confirmation checkbox when submitting the form.
• Abuse protection: To prevent mass use of the form or flooding other people's inboxes with confirmation emails, we store your IP address and your email address on submission only as an irreversible hash value created with a secret key, for no longer than 1 hour (IP) or 10 minutes (email); they are then deleted automatically. The legal basis is our legitimate interest in operating the waitlist securely (Art. 6(1)(f) GDPR).
• Withdrawal: You can withdraw your consent at any time, informally, e.g. by messaging hello@robomi.app or via the unsubscribe link in the emails. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Storage period: The email address is stored until consent is withdrawn, but no longer than 12 months after the end of the beta phase; it is then deleted. A shorter period applies to the technical KV fallback (see below).

For sending the confirmation email and managing the waitlist, we use the email service provider Brevo, offered by Sendinblue SAS (trading as Brevo), 106 boulevard Haussmann, 75008 Paris, France. Brevo acts as ourdata processor under Art. 28 GDPR and processes/stores your email address solely to manage the waitlist and to send the confirmation and informational emails.

Because Sendinblue SAS is a French, and therefore European, company, your data is processed within the European Union (Brevo operates servers in France and Germany, among other locations). No transfer to a third countrytherefore takes place.

Technical fallback: Should sending via Brevo occasionally fail for technical reasons, your email address is temporarily saved in aCloudflare Workers KV data store so that your sign-up is not lost (Cloudflare, Inc., USA, acting as processor per section 3, including the information given there on the third-country transfer). This KV store is not the primary storage location, but a pure fallback for the rare error case. Addresses stored there are deleted automatically after 90 days at the latest; if we complete your sign-up manually before then (you will receive the confirmation email), we delete the entry right away.

A data processing agreement (DPA) with Brevo is in place under Art. 28 GDPR, based on the Brevo Data Processing Agreement, which forms part of Brevo's General Conditions of Use and applies automatically upon use of the Brevo account.

5. Cookie and local storage

Language cookie: On your first visit to the home page, we send you to the German or English version based on your browser's language setting. So that this happens only once and your own language choice is respected afterwards, we set the cookierobomi_seen (content: just the value "1", lifetime: 1 year). It contains no personal information, is only sent back to robomi.app and is not used for tracking. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; technically necessary to show you the requested page in your language). You can delete the cookie in your browser at any time.

Theme setting: For the light/dark display (theme), your browser stores a setting in localStorage. This is a purely technical, display-necessary local storage on your device — it never leaves your browser, is not transmitted to us or any third party, and enables no tracking or recognition across different websites. No consent is required for this (purely functional, technically necessary storage).

6. No tracking, no external services

This website deliberately avoids common privacy pitfalls:

• We set no tracking or marketing cookies — apart from the language cookie in section 5, there are no cookies.
• We use no analytics or statistics software (no Google Analytics, no Meta/Facebook Pixel, no comparable service).
• We load no resources from external third-party servers or CDNs: fonts (Inter, Bricolage Grotesque), images, and even the WASM runtime for the Robi animation (Rive) are served exclusively from robomi.app itself (self-hosted). As a result, visiting this page transmits your IP address to no other third party — other than our hosting provider Cloudflare (section 3).
• Beyond the infrastructure described in section 3 (hosting via Cloudflare) and section 4 (waitlist: Brevo as processor, Cloudflare Workers KV as a technical fallback), there are no connections to further third-party providers.

7. Your rights as a data subject

Subject to applicable law, you have the right at any time to:

• Access the personal data we hold about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure of data we hold about you (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Objection to our processing of your data (Art. 21 GDPR), and
• Data portability (Art. 20 GDPR).

Where processing is based on consent (see section 4), you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent supervisory authority in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
Website:www.lda.bayern.de

8. Contact for privacy requests

For all questions and requests regarding data protection — access, rectification, erasure, withdrawal of consent, or any other inquiry — please contact:hello@robomi.app.

9. Last updated & changes

We will update this privacy policy whenever the data processing on this website changes (e.g. if the waitlist storage provider changes, or new features are added). The version current at the time of your visit applies.

Last updated: September 29, 2026 (draft).

See also

Imprint