Privacy

Website and support

Controller: Georg Kaufmann, Switzerland. Contact: support@tembu.app.

The website code uses no analytics or advertising services and sets no cookies. Your language choice is saved in browser local storage as tembu-lang until you delete the website data. Help checklist progress lasts only while the page remains open.

When a page is requested, the hosting infrastructure receives your IP address and the requested URL. A name in ?from= is part of that URL and may therefore appear in access logs or when a link preview is fetched. The page displays the name and passes it to the app when you select “Open in Tembu”. The website code does not put the name in local storage.

Host: Porkbun LLC, USA. Its contract lists AWS and Cloudflare in the USA and 14-day retention for security-related system and access logs. It includes standard contractual clauses with Swiss adaptations. Source: Porkbun Data Processing Addendum.

Messages to support@tembu.app are forwarded through Porkbun to Tembu's Gmail inbox. We process your sender address, message and any attachments to handle your request. The email providers also receive these data; Google may process them in the USA, among other countries. We manually and permanently delete ordinary support enquiries 14 days after closure, including our replies and the trash. Ongoing cases and records needed to meet legal obligations or resolve a specific legal dispute are retained for as long as required for that purpose.

Private feedback form (once enabled). Cloudflare processes your text, category, source (app or website), optional email and explicitly selected technical details, as well as connection metadata. Turnstile checks submissions for abuse. Reports are saved in Cloudflare D1 and forwarded to Tembu’s private GitHub repository for support. Nothing is published automatically. The text is removed from D1 after successful delivery. Undelivered text expires after 30 days and technical receipts after 60 days. This does not delete GitHub issues, emails or provider backups. The support deletion process above still applies to ordinary closed cases. Without an optional email address we cannot reply personally. Deletion requests: support@tembu.app.

Privacy Policy · Tembu app · Last updated: October 2026 · Version 1.6.2 (Android; release pending)

Scope of app information: The app sections below describe the version prepared for Android 1.6.2. The new consent controls apply only after installing this version; older versions collect Analytics data without this prompt. The consent mechanism was tested on a Samsung. The current interface has not been published as a store release. The website section above applies to all visitors. This website currently offers no public app download. The Android information previews the version in preparation; it does not describe a verified iOS release.

Summary: Tembu has no user account and no server of its own. Your Rumbles, contacts, recordings, photos and drafts are stored on your device. The app uses external services: Google Firebase Analytics (usage data with device and app identifiers), your operating system's speech recognition when you dictate, OpenStreetMap and OpenFreeMap (map and place search) and Expo (app updates); the camera library may send diagnostic data to Google (2.7). Bluetooth proximity detection broadcasts a fixed value computed from your phone number (2.8). If you use your operating system's device backup, app data can be included there (2.15).

1. Controller Georg Kaufmann, Switzerland · support@tembu.app

2. Data processed, purpose, recipients

2.1 Contacts. With the Android “Contacts” permission the app reads names and phone numbers. It keeps local copies (name, phone number, link to Rumbles; the numbers are stored unencrypted in app storage) to assign Rumbles to people and to recognise people nearby or on calls. The copies are not transmitted to Tembu or third parties. The app does not change your contacts.

2.2 Your own phone number and name. If you enter your number in the settings, the app stores it in plain text on the device; it is used for proximity detection (2.8). You can remove it there. You can enter your name for an invitation link (2.12).

2.3 Location. For place reminders the app uses location data (GPS, Wi-Fi), also in the background if you grant the permission. Location and saved places stay on the device. Exception: the map feature (2.4).

2.4 Map and place search (external services). When you create or edit a place the app shows a map.

The app loads map tiles from OpenFreeMap (tiles.openfreemap.org). The provider receives your IP address and the requested map sections. According to the provider, usual access logs contain no IP addresses and are deleted after 7 days; in case of misuse the IP address may be logged for up to 30 days; no cookies or trackers are used; a content delivery network (Cloudflare) may be involved.
For place search the app sends the entered search text and the visible map section to OpenStreetMap Nominatim (nominatim.openstreetmap.org), and only when you explicitly trigger the search (the keyboard search key or the magnifier), not while typing. To show an address the app sends coordinates to Nominatim: when a saved place is opened (after about 0.4 seconds) its saved coordinates, otherwise the coordinates of the map centre after you have moved the map with a gesture or chosen a search result; camera moves made by the app itself (start, zoom buttons, position button) do not trigger a lookup. The app makes at most one request per second, caches identical requests and identifies itself to the service with name, version and the contact address tembu.app@gmail.com. For a new place the map is centred on your last known or current location; that alone does not trigger an address lookup. Your IP address is transmitted to the operator with every request. The map shows the attribution “© OpenStreetMap contributors · OpenFreeMap · © OpenMapTiles”.
No contacts and no Rumble content are sent. Without using the map none of this takes place. The terms of the OpenStreetMap Foundation and OpenFreeMap apply.

2.5 Wi-Fi name. When creating a place Rumble the name (SSID) of the connected Wi-Fi may be saved; it stays on the device.

2.6 Microphone, recordings and dictation. Recordings for voice Rumbles are stored as a file on the device. When you dictate, and in parallel to recording a voice Rumble, the app uses the operating system's speech recognition (Android: Google speech recognition). The app does not require recognition to run on the device only. Depending on the device, audio may be transmitted to the provider's servers; its privacy terms apply. The app cannot tell whether recognition is local or over the network.

2.7 Camera and photos. For photo Rumbles you use the camera or select photos; they are stored on the device. The camera library included in the app contains Google ML Kit (barcode scanning); Tembu does not use barcode recognition. According to Google, ML Kit features send diagnostics and usage data (device and application information, performance metrics, per-installation identifiers) to Google over HTTPS. Transmission by the library without use of the barcode feature has not been ruled out in Tembu; it has not been measured separately.

2.8 Bluetooth and proximity of other Tembu users. Proximity detection is off until you switch it on in the settings; your own phone number must be stored for it. When on, your device broadcasts via Bluetooth Low Energy a value the app computes from your phone number and a string fixed in the app (SHA-256, truncated to 12 hexadecimal characters).

The value is always the same for the same phone number (it does not change) and is sent unencrypted. It is short, and any device within radio range, even without Tembu, can receive and recognise it over time; on Android a Bluetooth connection to read the value is also possible (without authentication).
Because the string is part of the app, values can be computed for known or guessed phone numbers and compared with a received value. The value is therefore not anonymous, not encrypted, and not attributable only by people who already know your number.
No Rumble content is transmitted through this identifier. Other Tembu devices compare the value with values of their contacts and show their own locally stored Rumbles on a match.
On Android the app sets the device's Bluetooth name to “Tembu App” when broadcasting starts (restoring the previous name is not provided for; the effect on a device was not observed).
You can switch proximity detection off and remove your number at any time. Bluetooth can also be switched off in the system settings.

2.9 Calls. If you grant the corresponding permission and role, the app compares the number of an incoming call locally with the stored contact numbers to show your Rumbles for that person when you answer. Calls are always let through and not changed. A match is kept locally for at most two minutes; nothing is transmitted.

2.10 Usage analytics (Google Firebase Analytics). Only with your consent: From version 1.6.2 automatic Analytics collection and analytics storage are disabled by default. You may accept or decline; all app features remain available without consent. Updating from an older version does not imply consent. Tembu collects usage statistics under a random installation identifier. Names, e-mail addresses and Rumble content are not transmitted to Analytics. Tembu does not link this identifier to your identity. [Translation of the agreed German wording; the German text is the agreed wording.] For this the app uses Firebase Analytics (Google) with the developer's Analytics account. Sent are

own events without content: “Rumble created” (with type and trigger), “Rumble done” (type), “Rumble deleted” (type), “place created”, “place deleted”;
automatically collected data: an app instance ID, a Firebase installation ID, device and operating system information, language, approximate location (the Analytics setting for detailed location and device data is on; according to the setting description at city level), screen views and app starts;

The Android advertising ID is no longer collected in this version (collection is switched off in the app configuration, the related permissions are removed). The advertising-related consent defaults of the Analytics configuration (ad storage, user data for advertising, ad personalisation) are set to "denied" in this version; storage for usage statistics is allowed only after your explicit consent. In addition, the app configuration allows Firebase to collect the Android ID (configuration flag). Collection of the Android ID is therefore permitted by configuration; whether and when it is transmitted has not been measured separately. These identifiers are pseudonymous, not anonymous. You can withdraw or give consent at any time under Settings → Usage analytics. Withdrawal stops further collection and resets the local analytics identifier. It does not automatically delete data already sent to Google or affect the lawfulness of processing before withdrawal. Your choice is stored locally with a version and timestamp and may be included in device backups. App events discarded before consent are never sent later. Tembu shows no advertising, has no advertising SDK and no link between the Analytics account and Google Ads; “Google signals” is not enabled.

Settings of the Analytics account: Since 25 October 2026 the following are switched off in the developer's settings: Google's use of Firebase service data to improve services outside Firebase, the data sharing for “Google products & services”, “Modeling contributions & business insights” and “Recommendations for your business”, and ad personalisation (in all regions). Analytics evaluation for Tembu and technical support remain on (Google staff may access data at the developer's request to resolve issues). Before 25 October 2026 the use of Firebase service data, “Modeling contributions & business insights”, “Recommendations” and ad personalisation were on; the change applies from the time of the change and does not retroactively delete data already processed. Whether and to what extent Google used data from the app for its own purposes before the change, Tembu cannot show.

Retention: For user-level and event-level data in explorations and funnel reports, retention is set to 14 months (user data, extended on new activity) and 2 months (event data); aggregated standard reports are not covered. Other retention under Google's own terms remains unaffected. Processing is carried out by Google, also in the USA.

2.11 App updates (Expo). On start and when returning to the app, the app asks Expo (u.expo.dev) for app updates. Transmitted are: platform, app version, update channel, details of the installed app version, a random installation ID of the app (EAS client ID; it persists until the app data is deleted and can be restored by a device backup) and your IP address. If the app's update module falls into an emergency start, for example because of damaged data, the module's error message (at most 1024 characters) is sent with the next request. General crash reports of the app are not transmitted. There is no switch for this.

2.12 Sharing and inviting. If you choose “Share” in another app and select Tembu, the app stores the shared text, link or image as a Rumble on your device. The app creates an invitation link with your name (tembu.app/join?from=…) only when you send it through your device's share menu; it goes to the recipient you choose. When the link is opened or fetched for a preview, the site tembu.app is requested, and the name in the link may appear in logs of the site operator or the preview service. See “Website and support” for hosting details.

2.13 Drafts, notes, backup copy and export. Unsaved input (text, photo) and notes on completed Rumbles are stored on the device; drafts are deleted when you save or cancel, leftover draft photos after seven days. The app keeps a local backup copy of the Rumbles to restore damaged data. You can export damaged raw data to a folder you choose; the file then contains your Rumble content and stays outside the app's storage until you delete it.

2.14 Reminders and notifications. Reminders are scheduled locally through the operating system. The permission “Alarms & reminders” only affects the precision of the time. Notifications contain the text of your Rumble; your phone may forward them to a paired watch.

2.15 Operating-system device backup. The app allows Android backup (Auto Backup). If you have enabled it, app data (Rumbles, contact copies, your stored phone number, photos, recordings, the installation ID of 2.11; up to 25 MB) can be backed up to your Google account and restored on a new device. According to Google's Android documentation, cloud backups on devices running Android 9 or later are end-to-end encrypted (using the device PIN, pattern or password) if you have enabled backup and set a screen lock; Tembu does not require encryption. This statement does not apply to the direct device-to-device transfer when switching devices. Tembu has no access to the backups; Google's rules apply.

3. Permissions. The Android permissions (contacts, location including background, microphone, camera, Bluetooth, phone state, notifications, alarms) are technical access permissions of the operating system. You can withdraw them at any time in the device settings; the affected feature then stops working. From version 1.6.2 usage analytics (2.10) has its own optional consent prompt in Tembu, separate from system permissions.

4. Legal bases. Under Swiss data protection law, we observe purpose limitation, proportionality and data security. Optional analytics from Android 1.6.2 requires your consent. Where the GDPR applies, analytics relies on Article 6(1)(a). Processing necessary to provide an app function you request relies on Article 6(1)(b); secure website operation and general enquiries rely on Article 6(1)(f), reflecting our interests in security and communication. Legally required retention relies on Article 6(1)(c). Optional analytics is not required to use the app. System permissions are technical access permissions and do not replace data protection consent. This notice does not claim retrospective consent for older app versions.

5. Recipients and third countries. Google (Firebase Analytics; the operating system's speech recognition; possibly ML Kit diagnostics, 2.7), Expo (app updates), OpenStreetMap Foundation (Nominatim), OpenFreeMap and its delivery network; when sharing and inviting, the recipient or service you choose; for the Bluetooth broadcast (2.8) any device within radio range. Google and Expo may also process data in the USA. For covered transfers to Google LLC and 650 Industries, see the adequacy arrangements below; for website hosting, see “Website and support”. Tembu does not sell Rumble content; Tembu does not have it.

Verified addition to section 5 (26 October 2026): Google LLC is listed as active in the US register for the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. Expo (650 Industries, Inc.) is listed for both as “Active – Re-certification under Review”. This concerns covered transfers to the certified US companies; it does not replace assessment of each processing purpose and provider role. Official register; Google; Expo. Expo publishes no fixed deletion period for EAS Update end-user data, instead referring to the period needed for its purposes. The precise contractual classification of update telemetry remains unresolved.

6. Retention and deletion.

You delete individual Rumbles and places in the app; you remove your phone number in the settings.
The normal settings of the app contain no “delete everything” function; “Reset data” sits in a developer menu and does not remove all data (not: places, recording and photo files, drafts, backup and raw copies, contact copies). Uninstalling the app removes its local storage.
Not deleted by uninstalling: exported files, backups in your Google account, and data at Google, Expo, OpenStreetMap and OpenFreeMap. Privacy questions and further deletion requests: support@tembu.app. From version 1.6.2 the app opens support@tembu.app under Settings, “Privacy & deletion requests”.
Analytics data at Google: Tembu currently cannot attribute analytics data to a person, because the app does not display the associated identifier and Tembu does not collect additional data to match requests. For user-level and event-level data in explorations and funnel reports the periods in 2.10 apply (extendable on new activity); aggregated standard reports are not subject to these settings, and their retention is not stated here.

7. Your rights. Under Swiss law you may request access and correction and, subject to statutory conditions, deletion, cessation of processing or data delivery/portability. You may contact the FDPIC. Where the GDPR applies, its conditions govern your rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and complaint to a supervisory authority (77). You may object to processing based on legitimate interests on grounds relating to your particular situation (21). Consent may be withdrawn at any time for future processing. Contact: support@tembu.app. Tembu cannot access the local app storage. See section 6 on the inability to associate analytics data with a person. There are no automated decisions producing legal or similarly significant effects.

8. Security. The app does not itself encrypt its local data and relies on the operating system's protection. Transfers to Firebase, Expo, OpenStreetMap and OpenFreeMap use encrypted connections (HTTPS/TLS). The Bluetooth broadcast is unencrypted (2.8).

9. Children. Tembu is not directed at children under 13; we do not knowingly collect data from children.

10. Changes. Changes to this policy are marked with a new date and version; the current version is available at this address. [Notification in the app is not evidenced in the tested build and is not promised.]

Note on earlier versions. Android version 1.6.0 (build 31) was configured so that Firebase could collect the Android advertising ID and contained the related permissions; place search there started while typing, without a limit of one request per second and without a cache, and the map attribution was hidden. The advertising-related consent defaults were also set to "granted" there. The changes in version 1.6.1 apply from that version and do not retroactively delete data collected earlier.

To help