Privacy Policy / Datenschutzerklärung
Last updated: 23 September 2026
1. Who is responsible
This website (about.rumour-app.com) is operated by two joint controllers within the meaning of Art. 26 GDPR:
Mihika Bhawkar and Jonah Kittelmann
Ostender Straße 2A
13353 Berlin
Germany
Email: info@rumour-app.com
Rumour is operated jointly by Mihika Bhawkar and Jonah Kittelmann, Ostender Straße 2A, 13353 Berlin, Germany. We are joint controllers for the processing of your personal data and have agreed in writing how we share our duties under data protection law. You can reach both of us at info@rumour-app.com. You may exercise your rights against either of us, and we will answer together.
2. What we process and why
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Technical access data, namely your IP address, the time of access, the requested page, the referring page and your browser and device type. | We process these data to deliver the website, to keep it secure and to defend against attacks and abuse. | Art. 6(1)(f) GDPR — our legitimate interest in the secure, stable and abuse-free operation of the website. | These data are kept in the short-term server and security logs of our hosting provider. |
| Waitlist sign-up: your email address. | We process your email address in order to notify you when Rumour opens. | Art. 6(1)(a) GDPR — your consent, which you give by submitting the form. | We keep it for 12 months after you sign up, or delete it earlier if you ask us to. |
| Waitlist sign-up: the page you came from, without any browser details. | We process this information in order to understand which pages lead to sign-ups. | Art. 6(1)(f) GDPR — our legitimate interest in understanding which pages lead to sign-ups. | We keep it for 12 months after you sign up, or delete it earlier if you ask us to. |
| Abuse protection for the waitlist: a one-way hash of your IP address together with a counter. | We process these data so that the form cannot be flooded. | Art. 6(1)(f) GDPR — our legitimate interest in protecting the waitlist from automated abuse. | These data are deleted after 24 hours. |
| Cookieless performance measurement by our hosting provider (/~flock.js): aggregated page and performance data, without cookies and without cross-site identifiers. | We process these data in order to see whether the site is reachable and performing well, without tracking individuals. | Art. 6(1)(f) GDPR — our legitimate interest in a functioning, performant website. | These data are aggregated only, and no individual profiles are created. |
| Google Analytics 4: usage statistics such as the pages you view, your approximate location at country or region level, your device and browser type and the referring source. | We process these data in order to understand how the site is used and to improve it. | Art. 6(1)(a) GDPR — your consent, which you give via the cookie banner. | These data are kept for 2 months. |
| Emails that you send to us. | We process your email in order to answer your enquiry. | Art. 6(1)(b) and (f) GDPR — the pre-contractual relationship and our legitimate interest in responding to enquiries. | We keep it for as long as we need it to deal with your request and to meet our legal retention duties. |
3. Who processes data on our behalf
| Processor | Role | Location and transfer safeguard |
|---|---|---|
| Lovable Labs Incorporated. | It provides the website platform, the hosting and the database that holds the waitlist entries. | USA — EU standard contractual clauses (SCCs) and the EU-US Data Privacy Framework. |
| Cloudflare, Inc. | It provides content delivery, security and bot protection in front of the website. | USA — the EU-US Data Privacy Framework, with SCCs as a fallback. |
| Google Ireland Limited. | It provides Google Analytics, and only after you have given your consent. | Ireland, with transfers to the USA under the EU-US Data Privacy Framework. |
| Google Ireland Limited (Google Workspace). | It provides our email inbox. | Ireland, with transfers to the USA on the same basis. |
4. Cookies and similar technologies
| Name | Purpose | Legal basis | Lifetime |
|---|---|---|---|
| __cf_bm | This cookie is used for Cloudflare bot management and distinguishes human visitors from automated traffic. | § 25(2) TDDDG — strictly necessary; Art. 6(1)(f) GDPR. | 30 minutes. |
| __dpl | This cookie assigns your request to the correct deployment of the site. | § 25(2) TDDDG — strictly necessary; Art. 6(1)(f) GDPR. | 24 hours. |
| Scroll position restoration (browser storage) | This entry restores your position when you navigate back. | § 25(2) TDDDG — strictly necessary; Art. 6(1)(f) GDPR. | Session. |
| Your cookie choice (browser storage) | This entry remembers whether you accepted or rejected analytics. | § 25(2) TDDDG — strictly necessary. | Until you clear it. |
| _ga | This cookie is used by Google Analytics to distinguish visitors. | § 25(1) TDDDG and Art. 6(1)(a) GDPR — consent. | About 13 months. |
| _ga_98SENP4J2W | This cookie is used by Google Analytics to keep session state. | § 25(1) TDDDG and Art. 6(1)(a) GDPR — consent. | About 13 months. |
Before you make a choice, no Google Analytics cookie is set and no request is sent to Google. Google is only involved for Google Analytics, and only after you have given your consent.
You can change your choice at any time via “Cookie settings” at the bottom of every page. If you reject analytics or withdraw consent, the _ga and _ga_98SENP4J2W cookies are deleted.
5. Your rights
You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to withdraw consent at any time (Art. 7(3) GDPR), with effect for the future. To exercise these rights, please write to info@rumour-app.com.
Your right to object (Art. 21 GDPR)
Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. An objection is free of charge and can be sent to info@rumour-app.com.
6. Complaints
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin
Germany
7. The Rumour app
This policy covers this website only. The processing of data inside the Rumour app is described separately at rumour-app.com/privacy.