Back to Fonora

Privacy policy

Last updated: 23 October 2026

Datenschutzerklärung auf Deutsch

This is a translation. If the two versions differ, the German version applies.

The key points in brief

Contents

Who is responsible

Jan Reinhart (Fonora), Hochstr. 54, 60313 Frankfurt am Main

Email: info@fonora.de

In this policy, “we” means Jan Reinhart. This policy covers fonora.de (home page, also in English at fonora.de/en, waiting list, confirmation page, link page for Instagram), the quiz on check.fonora.de, the emails you get from us afterwards, conversations you book with us, and our presence on Facebook and Instagram. The Fonora calling service itself has not launched yet. When it launches, you will get a separate privacy policy for it, and you will then decide separately.

Your right to object

Against advertising. You can object at any time, without giving a reason, to us using your data for advertising. This applies to the report to Meta, our emails with tips, the newsletter and the waiting list emails. We will then stop (Art. 21(2) and (3) GDPR). For our emails, you gave us your consent. There, an objection works like a withdrawal of consent.

Against other processing. We base some processing on our legitimate interest (Art. 6(1)(f) GDPR). You can object to it on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop, unless we have compelling legitimate grounds that outweigh your interests, or we need the data to assert or defend legal claims. We base the following on our legitimate interest:

When we count without an ID, and for the quiz data before your consent, we cannot identify you. So we cannot act on an objection to these for you individually (Art. 11(2) GDPR).

How to object. An informal message to info@fonora.de is enough. For emails, the unsubscribe link at the bottom of the email also works.

Hosting and server log files

Our pages, the quiz and our mailbox info@fonora.de are hosted by bit datacenters GmbH in Germany. When you open a page, the server processes what is technically necessary: your IP address, the time, the web address you opened, the page you came from and the details your browser sends. It writes them into log files. Without this data, the server cannot deliver the page. We also need it to protect the pages against attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 7 days. We have a data processing agreement with the provider (Art. 28 GDPR).

The fonts, images and scripts of our pages are on our own server. Only fonora.de loads anything from other servers: the PostHog scripts (see “How we count visits”).

What we store for protection and as proof

The legal basis in each case is Art. 6(1)(f) GDPR.

The quiz on check.fonora.de

The quiz asks about your situation, for example who you are getting information for and what is on your mind. At the end you get a plan with a guide and a checklist as a PDF. The quiz has two parts: the questions and, if you want the plan, giving your email address. The quiz is in German.

While you answer the questions

As long as you do not give an email address, the quiz stores neither your name nor your email address nor your IP address. Under a random ID for this run of the quiz, it records:

This data goes from our server to PostHog, a service of PostHog, Inc. (USA). We use PostHog’s EU cloud. The servers are at Amazon Web Services in Germany. Because the data comes from our server and not from your browser, your IP address does not reach PostHog. We do not work out a location. We do not send your browser language to PostHog. PostHog stores the data for up to 7 years. PostHog does not allow a shorter setting. In our own database we keep this data, without your answers, for 90 days.

The legal basis is Art. 6(1)(f) GDPR. Our interest: we want to see where people get stuck in the quiz and find errors. Some answers can reveal something about health. That is why we store them only under the random ID: without name, without email address, without IP address and without a cookie. We can only link this ID to a person if you consent at the end. Then we link the answers you have already given to your entry. If you do not consent, we never link them to you, and we cannot give you information about them or delete anything (Art. 11(2) GDPR).

The quiz sets no cookies and stores nothing in your browser’s storage. It does not load fonts, scripts or images from other servers.

If you give your email address

At the end, below the button „Plan kostenlos erhalten“ (Get your plan for free), it says: „Per Klick willigen Sie ein: Wir nutzen Ihre Antworten, auch zur Gesundheit, für Plan, Mails, Warteliste und um Fonora zu verbessern. Widerrufbar.“ (By clicking, you consent: we use your answers, including those about health, for your plan, emails, the waiting list and to improve Fonora. You can withdraw this.) By clicking, you consent. The legal basis is Art. 6(1)(a) GDPR and, because your answers can contain health data, Art. 9(2)(a) GDPR. As proof, we store the wording, the version and the time of your consent (Art. 7(1) GDPR). No law and no contract obliges you to give your email address or to consent. Without both, you will not get the plan.

In detail, the consent means:

We then store:

What PostHog gets from the moment you submit:

Only our database links the ID to your email address. This way we see how different groups use the quiz. PostHog stores the data for up to 7 years. If we delete your entry because you unsubscribe or a time limit runs out, the data stays there under the random ID and can no longer be linked to you. If you ask for deletion, we also delete it at PostHog. PostHog then does not delete it at once, but in one of its next deletion runs. PostHog only acts on our instructions. For this we have signed a data processing agreement (Art. 28 GDPR).

Our program chooses which guides, tips and emails you get, based on your answers. This is an automatic selection of texts. It has no legal effect on you and no other significant consequence.

Confirmation, plan and emails

First we send you an email with a link to confirm (the technical term is double opt-in). This way nobody can sign up someone else’s email address. If you do not click, we remind you once after 24 hours. After 72 hours the link no longer works, and we delete your entry no later than one day after that.

After you confirm, you get your plan. It is on a page that can only be reached through a personal link with a random key, and it comes as a guide and checklist in PDF format. Anyone who knows the link can see your plan. Only pass it on if you want to.

After that we send you three emails: on day 5, on day 10 and on day 14 or a little later. They bring tips, a question for you, an invitation to a conversation and an introduction to Fonora. Seven days after the third email, the welcome email of the newsletter follows. After that we send a newsletter about once a month. For this we add your email address to the newsletter list at Brevo with the note „Quelle: Quiz“ (source: quiz).

To send emails we use Brevo, a service of Sendinblue SAS (Brevo), France. Brevo gets your email address and the content of the emails. The plan and tips are based on your answers and can therefore relate to health. The servers are in France, Germany and Belgium (at OVH and Google Cloud). Brevo keeps sending logs and previews of our emails for 30 days. Brevo only acts on our instructions. For this we have signed a data processing agreement with Brevo (Art. 28 GDPR). For support and protection against attacks, Brevo uses service providers who may also access data from countries outside the EU (see “Transfers to countries outside the EU”).

Brevo counts whether emails are opened and whether links in them are clicked. For this, each email contains an invisible image, and the links briefly pass through a Brevo server. When you open an email or click a link, Brevo gets your IP address and details about your email program, as with any request to a server. In our Brevo subscription this cannot be switched off. We have set Brevo to count opens and clicks only as totals and not to link them to any email address. Before we send the first newsletter, we will set the same for it. If your email program does not load images by itself, Brevo counts no open. The legal basis is Art. 6(1)(f) GDPR. Our interest: we want to see whether our emails arrive or end up in spam. We only see totals, not who opened an email. About you personally, we only see what happens on our own pages: whether you opened your plan or responded there, and which email the link you came through was from.

Unsubscribing: at the bottom of every email after your confirmation there is a link. You tap it and then tap „Abmelden“ (Unsubscribe). Many email programs also show their own button for this. You can also write to info@fonora.de. After that, we will not write to you again. We unsubscribe all entries with your email address and delete them within seven days. So that your unsubscribe keeps working, we keep a check value of your email address, not the address itself. If you were already on our newsletter, your email address stays listed at Brevo as blocked, so that no more emails go to it. If you want that deleted too, write to us. The legal basis for the check value and the block is Art. 6(1)(f) GDPR. Our interest: your unsubscribe must hold.

If you only unsubscribe through the link in a newsletter, Brevo takes you off the newsletter. Our quiz does not learn about this. We then delete your quiz entry as soon as you write to us, otherwise after 12 months without a response (see “How long we store data”).

Sharing

The share button gives you a link to a short version of your plan. It contains neither your name nor your email address. But it is based on your answers and can reveal something about the situation in your family, including health, for example a fall or a diagnosis. You send the link yourself, through the share menu of your device or through WhatsApp. WhatsApp then opens on your device with a prepared text. We do not learn who you send the link to. We only see whether and when it is opened. The link works as long as your entry exists. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

A conversation with us

In some emails we invite you to a 30-minute video conversation. It is voluntary. The button leads through check.fonora.de/termin to Cal.com, a service of Cal.com, Inc. (USA). When you click on the calendar, you leave our site. There you choose a day and time and enter your name and email address. Without these details, no appointment can be made. Cal.com sends us the booking by email. We delete this email together with the booking.

The conversation takes place in Cal Video, the video room of Cal.com. You get the link with your booking. During the conversation, Cal.com processes your IP address, details about your device, picture and sound, and the name you enter there. You can leave your camera switched off. Cal.com stores the booking in the USA and only acts on our instructions (data processing agreement, Art. 28 GDPR). Cal.com uses its own service providers for the video room.

We do not record the conversation and we do not take notes about you. In your entry we note by hand whether we invited you, which group we assign you to for the conversation, whether you accepted and whether the conversation took place. We also see whether you opened the conversation page. Cal.com does not pass anything on to our quiz program. The legal basis for booking and conversation is Art. 6(1)(f) GDPR. Our interest: we want to talk with you because you want to, and learn how Fonora can help. If you want to talk about health in the conversation, we expressly ask for your consent at the start (Art. 9(2)(a) GDPR). You can withdraw it at any time.

Professionals

If you sign up as a professional, you get the material pack (one-pager and flyer) by email and no further emails. There, the sentence at the button reads: „Per Klick willigen Sie ein: Wir schicken Ihnen das Materialpaket per Mail und nutzen Ihre Antworten, um Fonora zu verbessern. Widerrufbar.“ (By clicking, you consent: we send you the material pack by email and use your answers to improve Fonora. You can withdraw this.) We store your email address, your answers and, if you provide them, your name and organisation. Name and organisation are voluntary and do not go to PostHog. The same time limits as above apply. The legal basis is Art. 6(1)(a) GDPR.

Your own texts

Please do not write names of people in text fields, and no details by which others can be identified. We may copy single sentences from text fields into internal notes, without names and without details that point to you or others.

Details about the person you are getting information for

In the quiz you often say something about another person, for example about your mother: how she is, what she finds hard, what matters to her. This is also that person’s data, often health data. We do not ask for her name or her address. We only learn how you are related to her. We use this data for your plan, your emails and, analysed by groups, to improve Fonora. It goes to the same recipients as your answers: bit datacenters (hosting), PostHog only as codes, and Brevo in the emails to you and to us. We do not contact this person. In our database we store the data as long as your entry and delete it together with your entry. At PostHog, it stays as codes under the random ID for up to 7 years and from then on can no longer be linked to anyone. If you ask for deletion, we also delete it there. The legal basis is Art. 6(1)(f) GDPR. Our interest and yours: you get advice on how to support this person. We protect details about their health like your own: we use them only for these purposes and never with their name. The person has the same rights as you (see “Your rights”). We cannot inform them ourselves, because we do not know them (Art. 14(5)(b) GDPR). That is why this information is here. Please only give the details you want to share for your plan.

Emails to us

When you confirm, we get an internal email with your email address, who you are getting information for, the title of your guide, your situation, your concern, your reservations, a classification of whether you are getting information for a parent or another relative (A) or not (B), and, if you typed them in after the quiz, your own words. This helps us answer you well, improve Fonora and see whether emails arrive. This email also goes through Brevo. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). If you ask for deletion, we also delete this email. Otherwise we delete it after 12 months at the latest. In addition, the server sends us a daily report with figures that cannot be linked to any person.

If you write to us

If you send us an email, we store your message and your email address in order to reply. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for an enquiry about a contract. Our interest: we want to answer your question. We delete the message as soon as your matter is dealt with and there is no duty to keep it.

If you come via an ad

Meta shows our ads on Facebook and Instagram. Meta’s privacy policy applies to this: facebook.com/privacy/policy. On our pages we do not use a Meta pixel or any scripts from Meta or Google. From the link, we learn which ad you clicked.

Report to Meta. If you click one of our ads on Facebook or Instagram, Meta adds a click ID to the link. The quiz reads it from the link. Our server then reports two events to Meta: when you submit the quiz with an email address that is not yet registered with us (“Lead”), and when you confirm your email address (“CompleteRegistration”). For this it sends the following to Meta Platforms Ireland Limited (Ireland):

We do not send your email address, your name, your IP address or your answers. If you do not come via one of our ads, for example via a normal post, we report nothing.

What Meta learns from this. Meta can link the report to the Facebook or Instagram account you clicked with. Meta then learns that, after clicking our ad on the topic of dementia, you submitted the quiz and confirmed your email address.

Who is responsible for what. For the reports on our ads, Meta acts as our processor (Art. 28 GDPR). This means: for this, Meta only acts on our instructions. This is set out in Meta’s data processing terms: facebook.com/legal/terms/dataprocessing. Meta also uses the report for its own purposes: to deliver ads, to build audiences and to improve its own services. For collecting and sending the report for these purposes, we are jointly responsible with Meta Platforms Ireland Limited (Art. 26 GDPR). This is set out in Meta’s Controller Addendum: facebook.com/legal/controller_addendum. What Meta does after the data is sent is Meta’s sole responsibility. You can exercise your rights with us and with Meta. Meta may transfer data to Meta Platforms, Inc. in the USA (see “Transfers to countries outside the EU”).

Legal basis. Art. 6(1)(f) GDPR. Our interest: we want to measure whether our ads reach people who want the plan. And we want Meta to show our ads more to such people. That way we do not spend money on ads that achieve nothing.

Objection. You can object to the report at any time without giving a reason. A message to info@fonora.de with your email address is enough. We then keep a check value of your email address and report nothing more for it. The legal basis for this check value is Art. 6(1)(f) GDPR. Our interest: your objection must hold. We cannot get back from Meta what has already been reported. In your Meta account, under “Your activity off Meta technologies” (in German: „Deine Aktivitäten außerhalb der Meta-Technologien“), you can disconnect such data from your account.

How long. We delete the click ID, the time you arrived and the user agent on our side as soon as you have confirmed your email address. If you do not confirm, we delete them with your entry. In the server log files, the click ID is part of the web address opened, until the log files are deleted after 7 days.

Facebook and Instagram

We run a page on Facebook and a profile on Instagram. The provider is Meta Platforms Ireland Limited (Ireland). If you visit our page there or react to posts, Meta processes your data, also for its own purposes such as advertising, and uses cookies for this. We have only little influence on this. What Meta does is described for Facebook at facebook.com/privacy/policy and for Instagram at privacycenter.instagram.com/policy.

Statistics. Meta gives us statistics about our page and our profile, for example how many people saw a post. We do not get details about individual people. For the statistics of our Facebook page, we are jointly responsible with Meta (Art. 26 GDPR). This is set out in Meta’s Page Insights addendum: facebook.com/legal/terms/page_controller_addendum. Which data Meta uses for this is described at facebook.com/legal/terms/information_about_page_insights_data. Under this addendum, Meta informs you and fulfils your rights. You can also contact us. We forward your request to Meta without delay, within seven days at the latest. By its wording, the addendum only applies to Facebook pages. Meta does not offer a separate addendum for our Instagram profile. We assume that we are jointly responsible with Meta there too. We accept requests about this and forward them to Meta. The legal basis for our part is Art. 6(1)(f) GDPR. Our interest: we want to know which posts reach people.

Messages. If you write to us on Facebook or Instagram, we reply there. The legal basis for our part is Art. 6(1)(f) GDPR. Our interest: we want to answer your message. Meta stores the conversation by its own rules. In our inbox there, we delete the message as soon as your matter is dealt with. Please do not write to us about health there. Write to info@fonora.de instead.

The fonora.de pages: waiting list

If you sign up for the waiting list, we pass your email address to Brevo (details under “Confirmation, plan and emails”). We also pass on the language of the page and the source, for example Instagram, if your link contained it or you came through our page for Instagram. Brevo sends you an email with a link. Only when you click it is your email address on our list, and we write to you: when Fonora launches, and now and then about our progress. If you do not click, Brevo does not add you to the list, and you get no further email from us. This way nobody can sign up someone else’s email address (double opt-in).

Since 23 October 2026 we do not store your email address on our web space. We only get a short email to info@fonora.de with language, source, time and whether the confirmation email went out, without your email address. If Brevo does not accept the sign-up, you see an error message, and your email address is not stored anywhere. What our server reports to PostHog in the process is described below under “What our server counts”.

Brevo stores your email address, the language, the source and when you confirmed. Brevo counts opens and clicks in these emails as described above, only as totals and without any link to your email address.

The legal basis is your consent (Art. 6(1)(a) GDPR). For the waiting list we need your email address. You do not have to give it. Without it, we cannot write to you. You can withdraw your consent at any time: with the link at the bottom of every email or with a message to info@fonora.de. Until then, your email address stays on the list at Brevo. After that, we will not write to you any more, and your email address stays listed at Brevo as blocked for as long as we send emails through Brevo, so that no more emails go to it. The legal basis for the block is Art. 6(1)(f) GDPR. If you want that deleted too, write to us.

If you signed up before 23 October 2026, a different text applied. In that case your email address is in a list on our web space, not in the publicly accessible part. We only use it to let you know once at launch, and we do not send you updates. After that we delete it, by 31 December 2027 at the latest. The legal basis is your consent (Art. 6(1)(a) GDPR).

The fonora.de pages: how we count visits

We count visits to fonora.de with PostHog (details above, separate project, EU cloud, servers at Amazon Web Services in Germany).

Without your consent, PostHog stores nothing on your device. We do not set cookies. This applies before you choose in the banner, and also if you decline. If you choose “Decline”, your browser only remembers this choice (see “Privacy settings”).

This is how we count: when the page loads, your browser fetches scripts from eu-assets.i.posthog.com and sends the count to eu.i.posthog.com. PostHog gets your IP address and details about your browser, as with any visit to a web page. From these, together with a random value that changes every day, PostHog creates a number. PostHog does not store the IP address. We do not work out a location from it. The next day, we cannot recognise you.

We count:

For each of these, we store:

What you write in the form does not go to PostHog.

The legal basis is Art. 6(1)(f) GDPR. Our interest: we want to know how many people the site reaches and whether it works. If you choose “Decline” in the banner, we keep counting your visit in this way, without recognising you. If your browser sends “Do Not Track” or “Global Privacy Control”, we treat this like “Decline”: the banner does not appear, and we also count without recognising you.

PostHog only acts on our instructions. For this we have signed a data processing agreement (Art. 28 GDPR). PostHog staff may access the data from countries outside the EU, for example for support (see “Transfers to countries outside the EU”). PostHog keeps the counts for up to 7 years. PostHog does not allow a shorter setting. We do not pass this data on to ad networks.

The fonora.de pages: if you accept in the banner

Then we analyse your use in more detail. With “Accept”, we also record your visit (see “Recording your visit”). Under “Settings” you can choose only the detailed measurement. PostHog stores an ID in a cookie and in your browser’s storage. This lets us see which visits belong to the same browser. We also see:

We do not record texts you type. We do not link this data to your name, your email address or your entry on the waiting list.

The ID can link your visits over months. Because our site is about dementia, this could reveal something about health in your family. That is why we expressly ask first. The legal basis is Art. 6(1)(a) and Art. 9(2)(a) GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). You can use the site fully without consenting. You can withdraw your consent at any time under “Privacy settings”. The analysis up to your withdrawal remains lawful.

Your consent is valid for 6 months. If you come back after that, we delete the ID. If you do not come back, it stays in your browser’s storage until you clear it. The cookie expires 180 days after your last visit at the latest.

The fonora.de pages: recording your visit

With “Accept”, we record your visit, like a film of the page. The recording also shows mouse movements and which files the page loads, without their content. All texts and all input fields are hidden in it. We leave out the form completely. In the banner, under “Settings”, you switch the recording on or off separately.

Recordings stay at PostHog for 30 days. Only Jan Reinhart sees them. We do not pass on any recording. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time.

The fonora.de pages: what our server counts

If you sign up for the waiting list, our server reports the result to PostHog as a number: sign-up accepted or failed, plus whether the confirmation email and our notification email worked. It does not send an email address or an ID from your browser, only the source of your link, if it had one. This also happens if you decline. The legal basis is Art. 6(1)(f) GDPR. Our interest: we want to notice when signing up does not work.

Privacy settings

At the bottom of every page on fonora.de there is “Privacy settings”. There you can change your choice at any time: Open privacy settings. On the privacy policy and the legal notice, the banner does not appear by itself. On the link page for Instagram (fonora.de/bio) it does not appear at all, so that you can tap the cards straight away. There we count without consent, as described above. If you have already agreed, your consent also applies there. From there, the link „Datenschutz-Einstellungen“ (Privacy settings) leads to our privacy policy. There you open the settings with one click.

Your browser remembers your choice in an entry named fonora_consent. It contains your choice, the date, the version of the banner text and whether you chose recording, but no ID. It is only created when you click in the banner, including “Decline”, so that we do not ask again at every visit. The legal basis for this entry is § 25(2) no. 2 TDDDG: it is necessary so that we can respect your choice. After 6 months we ask again, and also if the banner text changes. The entry stays until you choose again or clear your browser’s storage.

If you withdraw your consent, we count nothing more on this page. From the next page on, we count as after “Decline”: without an ID. If your browser does not allow storage, we cannot remember your choice. Then we do not measure in more detail, and declining only applies to the current page.

If you agree, the following is also stored on your device:

Without JavaScript, this site counts nothing, and the banner does not appear.

Who gets your data

We do not sell data. Only these recipients get your data:

Otherwise we only pass on data if a law requires it.

Transfers to countries outside the EU

For the USA, the basis is the EU adequacy decision on the EU-US Data Privacy Framework, as far as the recipient is certified under it. You can check whether it is at dataprivacyframework.gov/list. Otherwise, and for other countries, the basis is the EU standard contractual clauses in the contracts with the providers. You can ask us for a copy of the standard contractual clauses.

How long we store data

Your rights

You have the following rights towards us:

An informal message to info@fonora.de is enough. We reply within one month. To give you information about your quiz data, we need the email address you signed up with. The person you are getting information for in the quiz has the same rights.

No law and no contract obliges you to give us data. Without your email address, we just cannot send you a plan or emails.

We cannot link a visit to a person if we count it without an ID. Then we cannot give information and cannot delete anything (Art. 11(2) GDPR). If you tell us the ID from your cookie, we can find your data. Write to us about this. We will explain where to find the ID.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live or work. The authority for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit): datenschutz.hessen.de.

Security

The connection to our pages is encrypted (HTTPS). Only Jan Reinhart has access to our database. Emails travel encrypted between the servers, as far as your provider supports this. But an email is not end-to-end encrypted. So please only write to us what you would also be happy to send by email.

Children

The quiz and the waiting list are meant for adults.

Changes

If something changes on our pages or in how things work, we update this policy and give the date at the top. If we want to use your data for something new, we tell you beforehand. Where the law requires it, we ask for your consent.