Juhupost is currently being reviewed by Google Play. As soon as the app is in the store, we will update this page.

Privacy policy

Juhupost is built so that we learn as little as possible about you: the app has no server of its own; mail and settings live on your devices and in the mailbox with your provider. This page explains exactly which data flows anyway. Last updated: 6 November 2026. The German version is binding.

1. Controller

Thomas Schiffler
Draiser Str. 6
55270 Ober-Olm
Germany

Email: info@juhupost.com

2. This website

The website is hosted on Firebase Hosting by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit it, Google processes technically necessary data: IP address, time, requested address, amount of data transferred, browser and operating system. This serves to deliver and secure the site (Art. 6(1)(f) GDPR). Google processes this data as our processor; a transfer to the USA is possible and covered by the EU-US Data Privacy Framework and standard contractual clauses.

The website sets no cookies, loads no third-party content (fonts are served from our own host) and uses no advertising services.

3. Visitor statistics with Umami

To see which pages are read, we count visits with Umami on our own server (stat.schiffler.eu). Umami sets no cookies and stores no IP addresses; it records the page visited, the referring page, browser, operating system, device type, language and the country derived from the IP address. Individual visitors cannot be recognised; the data does not leave our server. The legal basis is our legitimate interest in an understandable, easily accessible website (Art. 6(1)(f) GDPR). If your browser sends the “Do Not Track” signal, we don't count. The app itself contains no statistics.

4. The app: mailbox and devices

Juhupost connects directly via IMAP and SMTP to the mailbox you create for your child. Mail, address book, approvals and settings live in that mailbox and on your family's devices. The app stores the mailbox password only encrypted on your devices. We have no access to any of this data. Your mail provider is responsible for the mailbox; its privacy policy applies.

You as parents set up the use within your family; it serves personal and family purposes.

5. Setup: finding your provider's servers

So that you don't have to enter your provider's servers by hand, the app looks up the settings during setup: at the provider itself (address autoconfig. of your mail domain, with the email address) and in Thunderbird's public database (autoconfig.thunderbird.net, with the domain only, e.g. “posteo.de”). These servers see your IP address. The legal basis is Art. 6(1)(b) GDPR; you can also enter the servers by hand.

6. Instant alert (with Family)

With Family, your family's devices wake each other when there is something new. For this, a device obtains a push identifier (token) from Firebase Cloud Messaging by Google Ireland Limited. A device that wants to wake others sends the tokens of the other family devices to our relay (Google Cloud, Frankfurt region), which sends each device an empty message without content. Using Firebase App Check and Google Play Integrity, the relay checks that the call comes from the genuine app.

This processes the tokens, the IP address of the calling device and the integrity attestation – never mail, names or addresses. The relay does not store the tokens and logs neither tokens nor IP addresses. The legal basis is Art. 6(1)(b) GDPR (a feature of Family). A transfer to the USA is possible (EU-US Data Privacy Framework, standard contractual clauses). You can switch the instant alert off per device in the parent settings; the device then deletes its token.

7. Buying Family

The purchase runs through Google Play. We receive no payment data. The app only asks Google Play whether a purchase exists for your Google account. Google's privacy policy applies.

8. Camera, dictation and read-aloud

Camera: for photos and for scanning the QR code when pairing. Google ML Kit reads the QR code on the device; according to Google, ML Kit transmits anonymous usage and performance data, no image content.
Dictation: uses your device's speech input. The app only receives the recognised text. Depending on the device, the provider of the speech input (e.g. Google) processes the recording under its own terms.
Read-aloud: uses the device's text-to-speech.

9. Reporting a problem and emailing us

If you write to us, for example via “Report a problem” in the app, we process your email address, your message and an attached log in order to help (Art. 6(1)(b) and (f) GDPR). The log contains no mail content, addresses are shortened, and you see it before sending. We delete the data once the request is settled and no retention obligation applies.

10. Children

Juhupost is intended for children under the supervision of their parents. Only parents carry out the setup. The child view contains no ads and no purchases.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Write to info@juhupost.com. You may also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.