Favvy.

Privacy Policy

Last updated: July 27, 2026

1. Controller and privacy contact

The controller responsible for Favvy is:

palmstudio GmbH
Pfalzgrafenstraße 38
67434 Neustadt an der Weinstraße
Germany

Represented by Benedikt Falkenstein, Managing Director.

Email: support@favi.link

Favvy is an experimental service available at favvy.link and www.favvy.link for creating and sharing ranked or unranked lists of favorite things.

No data protection officer has been appointed because palmstudio GmbH does not currently consider the statutory appointment requirements to be met. Privacy questions and rights requests can be sent to the email address above.

2. Scope of this Privacy Policy

This Privacy Policy explains how we process personal data when you:

  • visit Favvy;
  • create, use, or delete an account;
  • create or edit a profile;
  • upload a profile or cover image;
  • create, rank, edit, or view lists and list history;
  • follow other users, search profiles, or use the feed;
  • search for songs, artists, or places;
  • request a preview of an external link;
  • consent to optional analytics;
  • contact support, exercise a right, or submit a content notice.

It does not govern a third-party service that you visit through an external link. Those providers publish their own privacy information.

3. Important privacy facts at a glance

  • Favvy requires an account for the current app experience.
  • Favvy uses Firebase email-and-password authentication. We do not receive your password in readable form.
  • Profiles can be public or private. Even a private profile's avatar, display name, and username can currently be found by other authenticated Favvy users through profile search; its lists and timeline remain hidden from other users.
  • Public-profile lists and list history can be shown to other authenticated users and may appear in followers' feeds.
  • Favvy does not sell personal data and does not use personal data for third-party behavioral advertising.
  • Firebase Analytics is optional and is not initialized until you allow the Analytics category in CookieHub.
  • You can delete your account from Settings. The primary account, profile, list, event, follow, and uploaded profile-image records are then deleted as described below.
  • Favvy is not intended for children under 16.

4. Personal data we process

4.1 Website, device, and request data

When you access Favvy, the hosting, delivery, cloud, and security systems may process technical data needed to deliver and protect the service. This can include:

  • IP address;
  • requested URL, HTTP method, response status, and timestamp;
  • referrer information where supplied by the browser;
  • browser type, operating system, device characteristics, and language;
  • request headers and network-routing information;
  • error, diagnostic, performance, security, and abuse-prevention events.

The public Next.js website is hosted by Vercel. Authenticated API requests are handled by Firebase Cloud Functions and related Google Cloud infrastructure.

4.2 Registration, authentication, and session data

When you register or sign in, we process:

  • email address;
  • Firebase Authentication user ID;
  • authentication state and security tokens;
  • account-creation, sign-in, token-refresh, and last-activity information made available by Firebase;
  • security and error information associated with authentication attempts;
  • username selected during Favvy registration.

Your password is submitted directly to Firebase Authentication over an encrypted connection. Firebase processes the credential for authentication; Favvy's application database does not store a readable copy of your password.

The browser uses Firebase storage mechanisms, such as IndexedDB or local storage, to keep the authenticated session you requested. You can end the local session by signing out or clearing browser data.

4.3 Profile and identity data

Your Favvy profile can contain:

  • username and normalized username used for lookup;
  • email address, which is not displayed as a public profile field;
  • optional display name;
  • optional biography;
  • optional avatar and cover image;
  • public or private visibility choice;
  • follower and following counts;
  • profile creation and update timestamps.

Usernames are unique within Favvy. Display names do not have to be unique. Do not include information in a username, display name, biography, or image that you do not want processed according to your selected visibility and Favvy's search behavior.

4.4 Lists, favorites, and historical activity

When you use list features, we may process:

  • list type, title, description, display mode, order, archive state, item count, and timestamps;
  • items added to a list and their ranking or collection position;
  • manually entered titles, text, links, and descriptions;
  • provider identifiers, URLs, images, artist names, album names, place names, formatted addresses, city, country, coordinates, and related metadata for selected items;
  • add, remove, move, and replace events;
  • historical item snapshots used to reconstruct how a list changed over time;
  • the account that created an item or performed a list change.

List-event records are used for the timeline and current social feed. If your profile is public, other authenticated users can view your visible lists and recent list changes. If your profile is private, this content is omitted for other users under the current access rules.

4.5 Following, search, and feed data

Favvy may process:

  • which accounts you follow and which accounts follow you;
  • follow and unfollow timestamps and relationship state;
  • username or display-name search terms entered in profile search;
  • search results and the profile you choose to open;
  • feed cursors and list-change stories generated from followed public profiles.

Profile search is available to authenticated users. It returns a limited identity result containing avatar, display name, and username. Public and private accounts can both appear in these identity results so that people can find the correct account.

4.6 Spotify search

When you explicitly submit a song or artist search, Favvy sends the search term, result type, and result limit from its server to the Spotify Web API using Favvy's own application credentials. Favvy does not connect to your personal Spotify account and does not request your Spotify listening history.

Spotify returns catalog information such as track or artist names, artist relationships, album names, images, Spotify identifiers, URIs, and external Spotify URLs. Search responses are shown temporarily. If you select an item, the information needed to display and identify that item is stored in Favvy's catalog and your list history.

4.7 Geoapify place search and Google Maps links

When you explicitly submit a place search, Favvy sends the search text, result limit, and an optional two-letter language code from its server to Geoapify. Favvy does not intentionally include your email address, username, profile content, or browser IP address in the Geoapify request body. Geoapify receives the technical API request from Favvy's server and may log request data under its own service arrangements.

Search results can include a place name, provider ID, formatted address, city or locality, country, category, latitude, and longitude. If you select a result, Favvy stores the normalized place information and creates a Google Maps search URL from the place name and address.

Favvy does not call Google Maps merely to create or display that stored URL. If you choose to open it, your browser connects directly to Google and Google's terms and privacy rules apply.

4.8 Link previews and external websites

When you ask Favvy to preview a link, we process the URL and use Favvy's server to request limited website metadata, such as the page title, description, canonical URL, icon, and preview image. The target website receives a server request identifying FavvyBot and the Favvy website. It normally sees Favvy's server network information rather than a direct preview request from your browser.

Favvy validates protocols, hostnames, resolved IP addresses, and redirects to reduce security risks before fetching a preview. If you add the link to a list, selected preview metadata and the URL are stored with that list item and its history.

If you later open an external link, your browser connects to the third party, which may process your IP address, device data, cookies, and other information independently.

4.9 Profile and cover images

When you select an avatar or cover image, the browser first lets you crop it and creates a reduced image for upload. Favvy's backend then validates the file type and image signature, rotates and resizes the image, and re-encodes it as WebP before storing the processed result in Firebase Storage.

We process:

  • the selected and cropped image content;
  • MIME type, dimensions, and file size needed for validation and processing;
  • account ID used in the storage path;
  • storage object path and generated download-token URL;
  • upload, replacement, and deletion timestamps or logs.

Only the processed output is intended for long-term storage. Re-encoding generally removes metadata that is not required for the output, but you should still avoid uploading sensitive or confidential images. Profile-image download URLs contain an access token and can be accessed by anyone who obtains the URL.

4.10 Support, rights requests, accessibility feedback, and legal notices

If you contact us, we process the information needed to respond, which may include:

  • name, email address, and other contact details you provide;
  • account username or Firebase user ID if needed to locate an account;
  • message, attachments, screenshots, URLs, and correspondence history;
  • information used to verify that a rights requester is entitled to receive account data;
  • the content and handling history of an illegal-content notice or appeal;
  • accessibility feedback and the steps taken in response.

Do not send passwords. Provide only the personal data necessary for the request.

4.11 CookieHub consent management

On favvy.link and www.favvy.link, Favvy uses CookieHub to display the consent interface and remember your choices. Depending on the published CookieHub configuration, this can involve:

  • the cookiehub consent cookie;
  • a random consent token;
  • allowed or denied categories;
  • the URL and widget revision associated with the choice;
  • date and time;
  • country derived from an anonymized IP block;
  • anonymized IP information;
  • browser and operating-system information.

CookieHub's consent log is used to demonstrate and administer consent. CookieHub is deliberately not loaded on localhost, preview, or staging hostnames.

4.12 Optional Firebase Analytics

Firebase Analytics is not initialized until you allow Analytics through CookieHub. If allowed, Google may process analytics information such as:

  • page and session activity;
  • interactions and technical events configured by Firebase Analytics;
  • device, browser, operating-system, language, and approximate-location information;
  • Firebase installation and analytics identifiers;
  • _ga and _ga_* cookies;
  • diagnostic and consent-state information.

We use this information to understand aggregate use, detect product problems, and improve Favvy. We do not use Firebase Analytics for third-party behavioral advertising.

If you withdraw Analytics consent, Favvy disables collection, removes accessible Favvy-domain _ga cookies, and deletes the Firebase installation created for the consented analytics session. Withdrawal affects future processing; it does not undo processing that lawfully occurred before withdrawal.

5. Where profile information is visible

Public profiles

Under the current app design, an authenticated Favvy user can view a public profile's identity, lists, list items, ranking, descriptions, timeline information, and social counts. Recent list changes may be included in followers' feeds.

Private profiles

For another authenticated user, a private profile's lists, timeline, and list-change summaries are hidden. The avatar, display name, username, and social counts can still be shown for identity, search, and follow functionality. The account owner can view and edit their own complete profile.

Copies outside Favvy

Changing a profile to private or deleting content does not automatically remove screenshots, browser caches, search-engine copies, or copies independently made by other people before the change. Current profile routes require authentication, but you should not treat content shared with other users as confidential.

6. Purposes and legal bases

Where the GDPR or equivalent European data-protection law applies, we rely on the following legal bases.

Performance of the user contract — Article 6(1)(b) GDPR

We process account, authentication, profile, list, ranking, timeline, follow, feed, provider-search, link-preview, image, session, and support data where necessary to create and perform your Favvy account and provide features you request.

Consent — Article 6(1)(a) GDPR

We rely on consent for optional Firebase Analytics and any other processing that is expressly presented as optional and consent-based. You can withdraw consent through Cookie settings without losing core Favvy functionality.

Legitimate interests — Article 6(1)(f) GDPR

We process appropriate technical, security, support, diagnostic, abuse-prevention, legal-defense, and limited service-improvement data where necessary for our legitimate interests in:

  • operating a reliable and secure experimental service;
  • protecting accounts, infrastructure, users, and third parties;
  • detecting errors, fraud, spam, scraping, and misuse;
  • responding to support and resolving disputes;
  • understanding and improving non-analytics operational performance;
  • establishing, exercising, or defending legal claims.

We balance these interests against the rights and reasonable expectations of affected individuals.

Compliance with legal obligations — Article 6(1)(c) GDPR

We process and retain information where necessary to comply with laws, binding orders, tax or corporate record obligations, data-protection duties, and platform obligations such as handling valid notices concerning illegal content.

Protection of vital interests and public-interest cooperation

In exceptional emergencies, processing may be necessary to protect someone's vital interests under Article 6(1)(d) GDPR or to cooperate with competent authorities on another applicable legal basis.

7. Recipients and service providers

We disclose personal data only where needed for the purposes described above, where you direct us to do so, or where law permits or requires it.

Google Firebase and Google Cloud

Google provides Firebase Authentication, Firebase Data Connect backed by Cloud SQL for PostgreSQL, Firebase Storage, Cloud Functions, logs, and optional Firebase Analytics. Data Connect is configured in the europe-west3 region and the Functions API in europe-west1. Other Firebase services can use global infrastructure; Firebase Authentication is operated from US data centers according to Firebase's service information.

Google generally acts as a processor for customer data used to provide Firebase and Google Cloud services. For Analytics and certain service-generated data, Google may also process information under its own terms and responsibilities.

Firebase privacy and security information

Vercel

Vercel Inc. hosts and delivers Favvy's Next.js website and may process request, network, performance, security, deployment, and diagnostic data. Vercel's primary processing facilities are in the United States and its data-processing terms provide transfer mechanisms for protected data.

Vercel Privacy Notice and Vercel Data Processing Addendum

CookieHub

CookieHub ehf., Iceland, provides the consent-management interface, cookie declaration, and consent log. Primary application and consent-log data is stored in the EEA; a globally distributed content-delivery network processes technical delivery data.

CookieHub Privacy Policy

Spotify

Spotify AB provides catalog search results for tracks and artists through the Spotify Web API. Favvy uses application credentials and does not connect your personal Spotify account.

Spotify Privacy Policy and Spotify Developer Policy

Geoapify

Geoapify, operated by KEPTAGO LTD, provides place-search results. Geoapify states that successful API-request data is generally retained for no longer than 24 hours to produce usage statistics, while its infrastructure and security providers may process technical request data.

Geoapify Privacy Policy

Email, domain, and professional advisers

Our email and domain infrastructure providers process communication and routing data when you contact support@favi.link. Accountants, legal advisers, insurers, security specialists, or other professional advisers may receive limited information where reasonably necessary and subject to confidentiality or legal duties.

Authorities and affected parties

We may disclose data to courts, law-enforcement bodies, regulators, tax authorities, or other competent authorities where legally required or permitted. When handling a content notice or dispute, limited information may be shared with the person who submitted the notice or the affected user where required for procedural fairness, while protecting information that must remain confidential.

Corporate transactions

If Favvy or relevant business assets are reorganized, sold, transferred, or merged, data may be disclosed under appropriate confidentiality and data-protection safeguards. Users will be informed where required.

8. Third-party links and independent controllers

When you choose an external link, your browser communicates directly with the third party. Spotify, Google Maps, linked websites, browser vendors, and other external services may then act as independent controllers and may receive your IP address, device information, cookies, account information if you are signed in to their service, and interaction data.

Favvy does not control those independent data practices. Review the destination's privacy information before using it.

9. International data transfers

Favvy is operated from Germany, but some providers and subprocessors process data outside Germany or the European Economic Area, including in the United States.

Where Chapter V GDPR applies, transfers are based as appropriate on:

  • an adequacy decision by the European Commission, including the EU-US Data Privacy Framework where the receiving organization and transfer are covered;
  • the European Commission's Standard Contractual Clauses;
  • additional contractual, technical, and organizational measures;
  • another legally permitted transfer mechanism or a narrow statutory derogation.

No transfer mechanism eliminates all risks associated with foreign laws and government access. You may contact us for more information about the safeguards relevant to a particular processing activity.

10. Retention

We retain personal data only while it is needed for the stated purpose, while your account remains active, or for a longer period where law, security, dispute handling, or the establishment, exercise, or defense of legal claims requires it.

Account and profile data

Account, profile, visibility, and current social data is retained while the account exists. You can edit supported profile information or delete the account from Settings.

Lists and list history

Lists, list items, ranking state, and historical list events remain while the account exists or until a supported deletion removes them. Historical events are retained because timeline and feed functionality depends on them.

Catalog information that is also used by another person's list can remain after your account is deleted, but the account-specific list membership and event relationship is deleted. Provider catalog metadata that no longer has a list reference is eligible for orphan cleanup.

Provider searches and previews

Transient Spotify, Geoapify, and link-preview responses are used to show results. Favvy stores the selected result and relevant metadata only when you add it to a list or when short-lived operational logs are required. Providers retain their own API logs under their policies and service arrangements.

Uploaded images

The current avatar or cover image remains while it is assigned to the account. Replacing or deleting an image triggers deletion of the previous Firebase Storage object when it belongs to Favvy's configured bucket. Failed cleanup operations can be retried or resolved operationally.

Authentication and browser storage

Firebase Authentication data remains while the authentication account exists. Local session data remains until sign-out, expiry, account deletion, or browser-data clearing, subject to Firebase's security mechanisms.

Analytics

Analytics data is retained according to the Firebase/Google Analytics retention setting in effect for Favvy. Favvy's retention policy is not to configure user-level event data for longer than 14 months; a shorter provider default or earlier deletion can apply. Aggregated reporting that no longer identifies an individual event can be retained longer. Analytics cookies currently have a maximum declared lifetime of approximately 400 days unless deleted earlier.

Consent records

The CookieHub consent cookie is configured for up to 365 days. CookieHub consent-log entries are retained for up to 12 months unless a different lawful configuration or preservation requirement applies.

Logs

Hosting, Functions, database, security, and error logs are retained according to the configured provider plan and the operational need for debugging, security, abuse prevention, and service reliability. Routine request logs are intended for short operational retention. Records connected with a security incident, abuse investigation, binding order, or legal claim may be isolated and retained longer.

Support, rights requests, and content reports

Routine support correspondence is generally retained for up to three years after the matter is closed. Privacy-rights requests, illegal-content notices, moderation decisions, appeals, and related evidence may be retained for up to three years after closure, or longer if needed to comply with law, demonstrate handling, prevent repeated abuse, or address a dispute.

Backups and legal holds

Deleted records can remain temporarily in encrypted or access-restricted backups until the relevant backup is overwritten or expires under the provider's backup lifecycle. Backups are not used to recreate a deleted account during ordinary operations. Specific records can be preserved longer when required by a binding legal hold or statutory obligation.

11. Account deletion

The in-app Delete account action currently instructs Favvy to:

  • delete feed entries connected with the account;
  • delete activity events connected with the account;
  • delete list events created by or attached to lists owned by the account;
  • delete the account's list items and lists;
  • delete follow relationships involving the account;
  • delete username reservations and the Favvy user/profile record;
  • clean up catalog records that are no longer referenced;
  • delete the current avatar and cover image from Favvy's Firebase Storage bucket on a best-effort basis;
  • delete the Firebase Authentication user.

Deletion is permanent for the active service records and cannot be undone through Favvy. Limited information may remain in provider backups, security logs, consent records, correspondence, legally preserved evidence, or copies independently made by other users as explained in this Policy.

If an image cleanup fails while the main account deletion succeeds, we may use technical records to locate and remove the orphaned object. Contact support@favi.link if the deletion flow returns an error or you believe account data remains visible.

12. No sale, behavioral advertising, or data brokerage

Favvy does not sell personal data for money. Favvy does not share personal data for cross-context behavioral advertising and does not operate as a data broker. It does not currently display third-party advertising or build advertising profiles.

If this business model changes, we will update this Policy and introduce any required notice and opt-out controls before the new processing begins.

13. Children

Favvy is not directed to children under 16, and the Terms require users to be at least 16. We do not knowingly create accounts for younger children.

If you believe that a child under 16 has created an account or supplied personal data, contact support@favi.link. We may request limited information to verify the request and will delete or restrict the relevant data where required.

14. Special-category and highly sensitive data

Favvy is designed for ordinary preference lists, not for storing health records, government identifiers, financial-account credentials, precise private-location histories, biometric templates, criminal records, or other highly sensitive information.

Favorite lists, biographies, images, or follows can nevertheless reveal interests, beliefs, health-related preferences, sexuality, or other sensitive inferences. Do not deliberately submit special-category personal data about yourself or another person unless you have a lawful basis and genuinely intend to share it under the selected visibility. Favvy does not require such data to provide the core service.

15. Automated decision-making

Favvy does not currently use personal data to make solely automated decisions that produce legal or similarly significant effects concerning users. Search ordering, feed grouping, image processing, abuse controls, and provider-result ranking can involve automated rules, but they are not intended to make legally significant decisions.

Favvy does not create advertising profiles.

16. Security

We use technical and organizational measures appropriate to an experimental online service, including encrypted transport, managed authentication, authorization checks, server-side ownership validation, restricted database operations, processed image uploads, link-preview network protections, provider access controls, and account-deletion controls.

No system is completely secure. You are responsible for using a unique password, protecting your device and email account, signing out on shared devices, and notifying us promptly if you suspect unauthorized access.

Do not send passwords or authentication tokens to support. If a security issue could put others at risk, contact support@favi.link with a clear description and avoid public disclosure until there has been a reasonable opportunity to investigate.

17. Your privacy rights

Depending on the law that applies, you may have the right to:

  • obtain information about processing;
  • request access to personal data and receive a copy;
  • correct inaccurate or incomplete data;
  • request deletion;
  • restrict processing;
  • receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where portability applies;
  • object to processing based on legitimate interests;
  • withdraw consent at any time for future processing;
  • lodge a complaint with a supervisory authority;
  • not be subject to certain solely automated decisions;
  • appoint an authorized representative where local law permits.

You can edit supported profile fields and delete your account in Settings. For other requests, email support@favi.link.

We may ask for information reasonably necessary to verify identity and protect the account. We will not request more verification data than needed. If a request concerns another person or an authorized representative, we may request proof of authority.

GDPR requests are normally answered within one month. That period can be extended by up to two further months for complex or numerous requests, in which case we will provide notice. Requests are generally free, but manifestly unfounded or excessive requests may be refused or subject to a lawful fee.

18. Right to complain

You may complain to the data-protection authority in the EU or EEA country of your habitual residence, workplace, or the alleged infringement.

The supervisory authority responsible for palmstudio GmbH's establishment is:

The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Germany

Postal address: Postfach 30 40, 55020 Mainz, Germany
Email: poststelle@datenschutz.rlp.de
Website: https://www.datenschutz.rlp.de

We would appreciate the opportunity to address your concern directly, but contacting us first is not a condition for filing a complaint.

19. Additional information for California and other US residents

Where a US state privacy law applies, the categories of personal information processed during the preceding 12 months can include identifiers, internet or electronic-network activity, account and profile information, user-generated content, social relationships, selected catalog and location information, approximate location inferred by analytics, and support or legal correspondence. The sources and purposes are described throughout this Policy.

Favvy does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Favvy does not knowingly sell or share personal information of people under 16. We do not offer financial incentives for personal information.

Subject to applicable thresholds, exceptions, and verification rules, residents may request access, a copy, correction, deletion, or information about categories and recipients, and may appeal a refusal where local law provides that right. We will not unlawfully discriminate against a person for exercising a privacy right. Submit requests to support@favi.link.

Because Favvy does not engage in the sale, cross-context behavioral-advertising sharing, or targeted advertising described above, it does not currently provide a separate opt-out link for those activities.

20. Cookies and browser storage

Detailed information about CookieHub, authentication storage, Firebase Analytics cookies, purposes, durations, and preference controls is available in the Cookie Policy.

You can reopen CookieHub through Cookie settings in Favvy's footer or Legal page. Browser controls can also remove stored data, but blocking necessary authentication storage may prevent sign-in or session restoration.

21. Sources of personal data

We receive data:

  • directly from you when you register, edit, upload, search, create content, follow, report, or contact us;
  • automatically from your browser, device, and use of Favvy;
  • from Firebase and other processors operating Favvy infrastructure;
  • from Spotify, Geoapify, and external websites when you request provider search or link previews;
  • from other users when they follow you, report content, or submit content that refers to you;
  • from authorities or third parties in connection with lawful notices, safety matters, or disputes.

22. Whether information is required

Email, password processing, username, authentication identifiers, and necessary technical request data are required to create and operate the current Favvy account. If you do not provide them, we cannot create or authenticate the account.

Display name, biography, avatar, cover image, lists, follows, provider searches, and Analytics consent are optional. Some features naturally cannot work unless you provide the information needed for that feature.

23. Changes to this Privacy Policy

We may update this Policy when Favvy's features, providers, legal requirements, or processing practices change. The current version will be posted here with a new Last updated date.

If a change materially affects registered users or the basis on which data is processed, we will provide an additional notice through the service or by email where appropriate and legally required. We will request new consent before beginning processing that requires consent and is not covered by an existing valid choice.

24. Contact

For privacy questions, rights requests, account-deletion concerns, or complaints, contact:

support@favi.link

palmstudio GmbH
Pfalzgrafenstraße 38
67434 Neustadt an der Weinstraße
Germany