Privacy policy
Last updated: September 8, 2026
This is a courtesy translation. Only the German version of this privacy policy is legally binding.
Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Option Wohlstand GmbHHeilbronnerstraße 150
70191 Stuttgart
Deutschland
Email: kontakt@shourney.com
shourney.com is a brand of Option Wohlstand GmbH.
No data protection officer has been appointed, as there is no legal obligation to do so under Art. 37 GDPR in conjunction with § 38 BDSG (in particular, fewer than 20 people are constantly engaged in the automated processing of personal data, and our core activity does not involve the large-scale processing of special categories of data).
General information on data processing
We process personal data exclusively within the framework of applicable data protection law, in particular the GDPR and the TTDSG.
Personal data means any information relating to an identified or identifiable natural person (e. g. name, email address, IP address).
Hosting & technical infrastructure
Our website and platform are operated by the following providers:
- Hetzner Online GmbH
- STRATO AG
Processing takes place predominantly on servers within the European Union. Data processing agreements pursuant to Art. 28 GDPR are in place with these providers.
When you access our website, server log files are processed automatically, in particular:
- IP address
- Date and time of access
- Pages / files accessed
- Browser and operating system information
This processing serves to ensure the security, stability and functionality of the website.
Retention period: max. 14 days. Legal basis: Art. 6 (1) (f) GDPR.
Registration & user accounts
Using our platform requires creating a user account. In doing so we process, in particular:
- Email address
- Password (stored only in hashed form)
- Optionally, a name or voluntary profile information
- Uploaded files and content
- Jointly planned trips and travel data
This content is not publicly visible and is accessible only to authorised users (e. g. invited fellow travellers).
After a user account is deleted, personal data is erased within 30 days at the latest, unless statutory retention obligations apply.
Legal basis: Art. 6 (1) (b) GDPR.
Use by minors
Our platform is not directed at persons under the age of 16. Within our services we collect and process personal data exclusively from users who have reached the age of 16.
Should we become aware that personal data of persons under 16 has been processed, we will erase that data without undue delay, unless statutory retention obligations prevent this or further processing is necessary on overriding legitimate grounds.
Signing in with Google
Users may optionally register or sign in using a Google account. In doing so we receive from Google, in particular:
- Name
- Email address
- A unique Google ID
Using the Google login is voluntary and offered purely for convenience. Registration with an email address is available as an alternative.
This may involve a transfer of personal data to the USA. Such transfers take place on the basis of appropriate safeguards (EU standard contractual clauses and the EU-US Data Privacy Framework).
Legal basis: Art. 6 (1) (a) GDPR (consent).
File uploads & collaborative planning
Users may upload files and edit content together with other authorised users. Responsibility for uploaded content lies with the respective users.
We ask that you do not upload special categories of personal data (e. g. health data).
Legal basis: Art. 6 (1) (b) GDPR.
Contact form & email contact
When you contact us via the contact form or by email, we process the data you provide solely in order to handle your enquiry.
Legal basis:
- Art. 6 (1) (b) GDPR (pre-contractual / contractual enquiries)
- Art. 6 (1) (f) GDPR (other enquiries)
Affiliate marketing
Affiliate links are used on our website. We count clicks on these links in the travel planner on our server (see analytics): most links redirect to the partner through our server, and for direct links your browser reports the click to us. We do not set any cookies through them and we do not transmit personal data to our partners; the link only carries an identifier of where it was shown (e.g. form, journey card or reminder email). Only once you follow such a link may the partner set cookies or comparable technologies on their own website. Their privacy notices apply in that case.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in funding our free service).
Tracking & analytics
Pirsch Analytics
We use Pirsch Analytics to measure reach and usage of our planning features — cookie-free analytics software provided by Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany.
- Measurement happens entirely on the server. No analytics script runs in your browser.
- No cookies are set and no cross-device or cross-site profiles are created.
- We transmit the IP address, browser information and language for technical measurement. Pirsch uses the IP address to derive a hash and does not store it in plain text. For asynchronous PDF exports, we temporarily retain the sanitized request context, including IP address and browser information, in our Redis cache for at most 30 minutes and delete it when consumed.
- Processing and storage take place on servers in Germany. No transfer to third countries occurs.
- We measure page views and successful journey creation and saving, creation of itinerary items (transport, accommodation, activity, restaurant and miscellaneous), addition of Google Places results, invitation delivery, PDF generation and clicks on partner links. Additional categories are limited to authentication status (yes/no), the source google_places for Google Places, and the partner and the placement where the link was shown for partner links. Names, email addresses, journey contents and record IDs are not transmitted as event data. Access tokens and private record numbers are masked in URLs and internal referrers; only sanitized campaign parameters are retained. External referrers are reduced to scheme and host, and fragments are removed.
A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly reach and product usage measurement). Shourney does not create analytics cookies or persistent visitor or user identifiers.
Use of artificial intelligence (OpenAI API)
We use the OpenAI API to provide AI-assisted features.
- Processing takes place only on the user's initiative
- Transmitted content is not used for training purposes
- No automated decisions with legal effect
This may involve a transfer of personal data to the USA. Processing takes place on the basis of EU standard contractual clauses. Despite appropriate safeguards, access to data by US authorities cannot be ruled out.
Legal basis: Art. 6 (1) (b) GDPR.
Data backups
Regular backups are made to ensure data integrity. These may contain personal data and are overwritten or deleted within 30 days at the latest.
Retention periods
Personal data is stored only for as long as is necessary for the respective purpose or as long as statutory retention obligations apply.
Rights of data subjects
Data subjects have the right at any time to:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object (Art. 21 GDPR)
- Withdraw consent that has been given
There is also a right to lodge a complaint with the competent supervisory authority: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Changes to this privacy policy
We reserve the right to amend this privacy policy in order to reflect legal or technical changes.