Last updated: 24.06.2026
This Privacy Policy explains how Otternway UG (haftungsbeschränkt) processes personal data when you use the Hovytory mobile application, related web links, and the backend services required to operate Hovytory.
Hovytory is a home inventory application that helps you organize spaces, rooms, containers, and items in your home and collaborate with other users in shared spaces.
We take the protection of your personal data seriously and process personal data in accordance with applicable data protection laws, in particular the General Data Protection Regulation (“GDPR”).
If you have questions about this Privacy Policy or about our processing of personal data, you can contact us at info@otternway.com.
The controller responsible for data processing described in this Privacy Policy is:
Otternway UG (haftungsbeschränkt)
Amtsgericht Tostedt (Germany)
HRB 211390
Otternweg 3
21629 Neu Wulmstorf
Germany
Email: info@otternway.com
This Privacy Policy applies to:
This Privacy Policy does not govern third-party services that you use outside Hovytory, such as Apple App Store, Google Play, Google Sign-In, Apple Sign In, or your email provider, except to the extent we receive data from or share data with those services as described below.
Depending on how you use Hovytory, we may process the following categories of personal data:
We do not receive your full payment card details. Payments are processed by Apple and Google through their app store systems.
We collect personal data in the following ways:
We process personal data for the following purposes:
Under the GDPR, we rely in particular on the following legal bases:
We process personal data where necessary to provide Hovytory to you, including:
We rely on consent where required, including for example:
You can withdraw consent at any time with future effect. Withdrawal does not affect processing that was lawful before withdrawal.
We process personal data where necessary for our legitimate interests, provided those interests are not overridden by your interests or fundamental rights. This includes:
We may process personal data where necessary to comply with legal obligations, including tax, commercial, consumer-protection, or law-enforcement requirements.
Hovytory uses Firebase Authentication and may support sign-in methods such as Google Sign-In, Apple Sign In, email magic links, and limited internal reviewer sign-in flows.
When you sign in, we process the identity data required to authenticate you and to create or maintain your Hovytory account. We may store your email address, display name, provider identifier, and account linkage data.
If you use email magic links, we process your email address to send the sign-in email and complete authentication.
Hovytory lets you create and manage inventory data and collaborate with other users in shared spaces.
This means we process:
If you share a space with other users, certain data may be visible to those users, such as your display name, avatar, and activity entries associated with your actions in the shared space.
Hovytory allows you to add images to inventory objects and to your profile. Depending on the feature, you may either choose an existing image from your device or use your device camera.
If you upload or capture an image:
Camera access is only used when you actively choose a camera-based feature, such as taking a picture or scanning a code. We do not access your camera continuously in the background.
If you enable push notifications, we process:
We use this data to send transactional, activity, sync-trigger, and reminder notifications. Depending on your settings, notifications may include information such as space names, item names, item identifiers, and item expiry or best-before information.
You can disable push notifications at any time in your device settings and may be able to change in-app notification preferences in Hovytory.
Hovytory stores some data locally on your device so the app can start reliably, work with limited connectivity, cache media, remember preferences, and synchronize changes. This may include inventory data, profile data, local images or image references, sync state, search index data, analytics consent state, and authentication-related state.
Local data is normally cleared or reduced when you sign out or delete your account, but operating-system backups, device-level caches, and third-party platform behavior may be outside our direct control.
Hovytory uses tools from Firebase for analytics, performance monitoring, messaging, and crash diagnostics. The backend may also use operational monitoring and error-reporting tools such as Sentry and OpenTelemetry.
Analytics and performance monitoring are disabled by default in parts of the app and are enabled when you grant analytics consent. If you grant consent, we may process pseudonymous usage events, screen interactions, app version, device type, and related telemetry to understand how Hovytory is used and how it performs.
We may process crash and error information to detect, investigate, and fix bugs, improve reliability, and protect the security of Hovytory. Crash reports may include technical device data, app version, operating-system version, and error context.
Security telemetry may include hashed or redacted identifiers, route categories, rate-limit events, request metadata, and similar operational data. We use this data to detect abuse, secure accounts, investigate failures, and protect the service.
Hovytory uses RevenueCat to help manage subscription products, entitlements, purchase restoration, and subscription state across platforms.
For subscription management, we may share and receive:
Apple and Google process payment transactions directly through their app stores. We do not store your full payment card details.
RevenueCat may send billing-related events to our backend so we can update subscription status and apply premium limits and entitlements in Hovytory. Our backend may store webhook event IDs and webhook payload data to prevent duplicate processing, audit entitlement state, handle disputes, and restore access.
We may disclose personal data to the following categories of recipients where necessary:
Based on the current Hovytory setup, this may include in particular:
We only share personal data to the extent necessary for the relevant purpose and, where required, on the basis of appropriate contracts such as data processing agreements.
Some of our service providers may process personal data outside the European Union or the European Economic Area. Where this occurs, we take appropriate steps to ensure an adequate level of data protection, for example by relying on adequacy decisions or Standard Contractual Clauses where required.
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless longer retention is required or permitted by law.
Examples:
Some third-party service providers, including Firebase, Apple, Google, RevenueCat, and infrastructure providers, may apply their own retention periods to data they process on our behalf or as independent providers. We configure and use those services in line with the purposes described in this Privacy Policy.
If you request deletion of your account or personal data, or use an in-app account deletion feature where available, we will delete or anonymize relevant account-linked backend data unless legal obligations, legitimate security interests, backup retention, billing or fraud-prevention needs, or the need to preserve shared records for other users require continued retention. Account deletion may involve separate deletion steps in our backend and in Firebase Authentication. If one technical step fails, we may need to complete the remaining deletion step after the initial request. You can request account deletion through the app or through our website account deletion page.
If you have participated in shared spaces, certain records of collaborative activity may remain visible to other members where necessary to preserve the integrity, security, or history of shared content.
We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These measures may include:
No method of transmission or storage is completely secure. However, we take reasonable steps to protect your personal data.
Subject to applicable law, you may have the right to:
To exercise your rights, please contact us at info@otternway.com.
You also have the right to lodge a complaint with a data protection supervisory authority. For us in Lower Saxony, the competent authority is Die Landesbeauftragte fuer den Datenschutz Niedersachsen. You may also contact the supervisory authority responsible for your place of residence or workplace.
We do not use your personal data for automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Subscription entitlements and free-limit checks may be processed automatically to decide whether a product feature is available under your current plan, but these checks implement the service contract and app-store subscription status.
Hovytory is not directed to children under the age at which parental consent is required under applicable law. We do not knowingly collect personal data from children in violation of applicable law. If you believe that a child has provided personal data to us unlawfully, please contact us.
We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. The version published at the relevant policy URL or otherwise made available to you in connection with Hovytory will apply.
If changes are material, we may provide additional notice inside the app, by email, or through other appropriate means.