eyondPrivacy policy
Draft, October 2026. To be reviewed by a lawyer before the public launch.
This is an English translation for convenience. The German-language version is legally binding; Austrian law applies.
This policy explains which personal data is processed when you use the “Beyond” app and its server (Art. 13 GDPR).
1. Controller
Vilsmeier IT Solutions, owner Andreas Vilsmeier, Thörleweg 2a, 6632 Ehrwald, Tyrol, Austria, phone +43 5673 94115, e-mail: info@learnbeyond.app. A data protection officer is not required by law and has not been appointed.
2. Principles
- Beyond is funded solely by unobtrusive, contextual advertising. Ads depend only on the topic of the posts shown, not on you as a person.
- There is no tracking, no advertising IDs, no third-party analytics or advertising SDKs, and no sharing of your data for advertising purposes.
- There are no paid features and no payment data.
3. What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Username, display name, password (only as a scrypt hash), bio, profile picture, interests, “private profile” setting | Providing your account | Art. 6 (1) (b) GDPR (contract) |
| E-mail address, time of confirmation | Confirming the account, resetting the password, important account notices; one account per mailbox as protection against spam | Art. 6 (1) (b) and (f) GDPR |
| Private messages, message requests and their status (accepted, declined) | Messages between users | Art. 6 (1) (b) GDPR |
| Which posts were shown to you (at most 30 days) and your likes and comments | Order of your feed: content you have already seen moves further down | Art. 6 (1) (b) GDPR |
| Muted and blocked accounts, bell for new posts | Your settings for other accounts | Art. 6 (1) (b) GDPR |
| Posts, images, videos (Shorts), comments, likes, follows, saved posts | Platform features | Art. 6 (1) (b) GDPR |
| Notifications and your notification settings | Informing you about activity | Art. 6 (1) (b) GDPR |
| API keys (only as a hash), time of last use | Automation via the public API | Art. 6 (1) (b) GDPR |
| Reports, moderation decisions with reasons, suspensions | Safety, enforcement of the terms of use, obligations under the DSA | Art. 6 (1) (c) and (f) GDPR |
| Hash values (fingerprints) of texts, at most 2 days | Detecting duplicate posts and spam waves | Art. 6 (1) (f) GDPR |
| IP address and time of requests (server log) | Operation, abuse prevention, rate limiting | Art. 6 (1) (f) GDPR |
| Time of consent to the terms of use | Proof | Art. 6 (1) (c) and (f) GDPR |
For advertising we only count how often an ad was shown and tapped in total. These counters contain no link to individual people.
Images: Uploaded images are re-encoded on your device and on the server. All metadata is removed in the process, in particular GPS location and camera data.
Videos (Shorts): Videos (at most 60 seconds) are trimmed and downscaled on your device and converted into several quality levels on the server so that they play smoothly on any connection. All metadata is removed in the process, in particular the recording location (GPS) and device data. The uploaded original file is deleted after conversion. Uploaded videos that are not published are deleted after 24 hours at the latest.
Private messages: Our moderation team only sees private messages if one of them has been reported, and then only the reported message with a few messages before and after it. Messages are not end-to-end encrypted on the server.
Bot protection: When you sign up, your device solves a small computing task (proof of work). No personal data is processed for this and no third-party services are involved.
Moderation: Reports are handled by the provider's staff in a protected administration area. Every decision is logged with its reasons and communicated to you.
4. Retention
- Account data and content: until you delete them or your account. Deleting the account in the app immediately removes profile, posts, images, videos, comments, likes and notifications from the live system.
- Backups: overwritten on a rolling basis after 30 days at the latest.
- Server logs with IP addresses: at most 14 days.
- Reports and moderation decisions: up to 6 months after completion, as far as necessary for complaints under the DSA.
5. Recipients
Your public content (profile, posts, comments) is visible to other signed-in users. The server is operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) as a processor, location Nuremberg; backups are stored at Hetzner in Helsinki (Finland). Images and videos are stored in the object storage Cloudflare R2 with storage location in the EU and delivered from there via media.learnbeyond.app. All requests to learnbeyond.app pass through the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) as a processor. Cloudflare protects the service against attacks and automated access and delivers images faster; for technical reasons your IP address and the request data are processed (Art. 6 (1) (f) GDPR, legitimate interest in secure and stable operation). A transfer to the USA is possible in this context. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the EU standard contractual clauses from Cloudflare's data processing agreement apply [to check before launch: conclude or accept the data processing agreements with Hetzner and Cloudflare].
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can change or delete much of your data directly in the app. For anything else, write to us at the e-mail address above.
You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
7. Minimum age
Beyond is intended for people aged 16 and over.
8. Changes
We update this policy when the app changes. The current version is available in the app and at /legal/datenschutz.