Website policy
Website Privacy Policy
Last updated: September 21, 2026
This notice covers the public Farwyn website and browser-based website tools. The Farwyn mobile app has a separate App Privacy Policy.
1. Controller
Tim Gabel, trading as HowtoHabit
Lerchenauer Straße 28
80809 München
Germany
Email: howtohabit.service@gmail.com
2. Website hosting and server logs
The website is hosted using Vercel. When you request a page or asset, technical request data such as IP address, date and time, requested URL, browser/device information, referrer information and security/diagnostic data may be processed to deliver and protect the website. The legal basis is our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) GDPR).
3. Vercel Web Analytics
Where enabled, Farwyn uses Vercel Web Analytics to obtain aggregate information about website use, such as page views, referrers, country, browser and device categories. We do not use this service for advertising personalization. The legal basis is our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR). If a future analytics configuration requires consent or non-essential device storage, it will not be enabled before the required consent is obtained.
4. Privacy choices and optional affiliate measurement
Farwyn stores farwyn-consent-v1 in local storage so the website can remember whether you selected necessary-only use or allowed optional affiliate measurement. This storage is necessary to remember your privacy choice. Optional Impact affiliate measurement is loaded only after you actively allow it. Impact may then process technical usage and attribution data and may use cookies or similar technologies. The legal basis for optional measurement is your consent (Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG). You can withdraw this consent for the future at any time using the website's Privacy settings.
5. Newsletter
If you request the Farwyn newsletter, we process your email address, optional name, optional travel-interest selection, the consent wording/version, timestamps, limited browser information and a one-way hash derived from the request IP address for abuse prevention and consent evidence. Newsletter records are stored in Supabase and confirmation/newsletter emails are delivered using Resend.
Newsletter subscriptions use double opt-in. A new request remains pending until the confirmation link sent to the submitted email address is opened. The confirmation token expires after 48 hours and is stored only as a cryptographic hash. Marketing/newsletter emails are sent only after confirmation. The legal basis is consent (Art. 6(1)(a) GDPR). You can withdraw consent and unsubscribe at any time with effect for the future.
6. Contact form and support
When you use the public contact form, we process the email address you provide, your optional name and your message in order to handle your inquiry. The form is received through a Supabase Edge Function and delivered to our support inbox using Resend; the website contact form does not write the message into the Farwyn app database. Depending on the request, the legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual communication or Art. 6(1)(f) GDPR for our legitimate interest in handling support and general inquiries.
7. Account confirmation and password-reset pages
Browser-based account confirmation, authentication callback and password-reset pages may communicate with Supabase to complete the account action you initiated. Supabase processes the authentication tokens, account/session metadata and technical request data required for that purpose. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR) and our legitimate interest in account security (Art. 6(1)(f) GDPR).
8. Map and creator tools
Some Farwyn browser tools use external technical services only when those tools are opened or used. The Map Overlay Generator can send place-search terms to the OpenStreetMap Foundation's Nominatim service, route coordinates to the public OSRM routing service and map/style requests to OpenFreeMap. Those providers receive the information contained in the respective request together with normal technical connection data such as the IP address and browser/request metadata. Do not enter confidential or unnecessary personal data into public place-search fields.
Specific utility/auth pages may also load open-source JavaScript or CSS from public content-delivery networks such as jsDelivr or UNPKG. These requests disclose standard connection metadata to the CDN operator. These services are used to provide the requested website functionality; the legal basis is our legitimate interest in technically providing those functions (Art. 6(1)(f) GDPR).
9. Service providers and international transfers
Depending on the feature used, website data may be processed by Vercel (hosting and analytics), Supabase (backend/authentication/database infrastructure), Resend (email delivery), Impact (optional affiliate measurement), and the map/routing/CDN services described above. Some providers or their subprocessors may process data outside Germany or the European Economic Area. Where the GDPR requires transfer safeguards, we rely on the provider's applicable contractual safeguards, Standard Contractual Clauses, an adequacy decision or another legally recognized transfer mechanism as applicable.
10. Retention
We retain personal data only for as long as necessary for the relevant purpose and applicable legal obligations. Newsletter data is retained while the subscription is active and as necessary to document consent or withdrawal; pending requests are not used for newsletter marketing. Contact/support correspondence is retained only as long as reasonably necessary to handle the request and any related legal obligations. Browser consent preferences remain on your device until you change them or clear site data. Hosting and security logs are retained according to operational and provider retention settings.
11. Your rights
Where the GDPR applies, you may have rights to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw consent at any time for the future. You also have the right to lodge a complaint with a competent data-protection supervisory authority. For privacy requests, contact howtohabit.service@gmail.com.
12. Changes
This website privacy notice may be updated when website functionality, service providers or legal requirements change. Material changes are published on this page before or when the changed processing goes live.