In short: Everything you enter in "Where's What?" stays on your device. There is no user account, no cloud, no advertising and no tracking of your behaviour. We never see your places, items or photos.
1. Controller
Daniel Bellmann
c/o POSTFLEX PFX-214-816
Emsdettener Straße 10
48268 Greven, Germany
Email: woistwas@bellmann.solutions
2. What data the app processes
The app stores the data you enter yourself: places (for example rooms, cupboards, boxes), items with name, search terms, type, quantity and note, photos, the "checked out" status, reminders and your settings (language, colour scheme, Premium status). This data is kept exclusively in a local database on your device. It is not transmitted to us or to third parties.
Insofar as any processing by us takes place at all, the legal basis is Art. 6(1)(b) GDPR (providing the app). Local storage on your device requires no processing by us.
3. Permissions
| Permission | Purpose |
|---|---|
| Camera | Taking photos of items and places. Only when you open the camera inside the app. |
| Photos / library | Choosing existing photos. The app only reads the photos you select. |
| Notifications | Reminders for items. They are scheduled locally on the device, no server is involved. |
You can revoke every permission at any time in your device settings.
4. On-device image recognition
After you take a photo, the app suggests names and a type for the item. It uses Google's ML Kit library, which works entirely on your device. Your photos are not sent to Google. However, the library may contact Google servers from time to time to receive bug fixes, updated models and hardware compatibility information, and it sends technical metrics about the performance and utilisation of the library to Google. This may include device information and usage statistics, never content. See the ML Kit Terms and Google's Privacy Policy. The legal basis is our legitimate interest in working and secure image recognition (Art. 6(1)(f) GDPR).
5. Purchases (Premium)
You buy Premium through the Apple App Store or Google Play. Payment is handled entirely by Apple or Google. We receive no payment details, no name and no address. The privacy policies of Apple and Google apply.
To verify and manage purchases we use RevenueCat (RevenueCat, Inc., USA). It processes a random, anonymous user identifier, the store's purchase receipts and technical details such as app version, device type and system language. This identifier is not linked to your name. RevenueCat is certified under the EU-US Data Privacy Framework. See RevenueCat's privacy policy. The legal basis is Art. 6(1)(b) GDPR (performance of contract).
6. Backup and export
You create backups and exports (Excel, CSV) yourself. The file only goes where you send it via the share sheet, for example iCloud Drive, AirDrop or email. The privacy policies of those services apply. We do not receive a copy.
7. No analytics, no advertising, no sharing
The app contains no analytics or tracking tools, no advertising and no social media integration. We do not share data with third parties, because we do not have any.
8. Retention and deletion
Your data stays on your device for as long as you keep it. Delete it in the app under Settings › "Delete all data" or by removing the app from your device. The anonymous purchase identifier at RevenueCat is deleted according to their retention periods.
9. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Since we do not store any personal data about you, these rights are in practice exercised on your device: access and portability via the export and backup features, erasure as described in section 8. For questions write to woistwas@bellmann.solutions.
10. This website
The support pages at bellwerk.com are served by Cloudflare Pages (Cloudflare, Inc., USA, represented in Europe by Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany). When you visit them, Cloudflare processes technically necessary connection data such as your IP address, the time of the request and the page requested, in order to deliver the page and keep the service secure. The legal basis is Art. 6(1)(f) GDPR. Transfers to the USA are covered by a data processing agreement and the European Commission’s standard contractual clauses. No cookies are set and no analytics are used. See the Cloudflare privacy policy for details.
11. Children
The app is not directed at children under 16 and does not knowingly collect data from them.
12. Changes
If the app's features change, for example through an optional cloud backup, we will update this policy and point it out in the app.
Last updated: 18 September 2026