This is an English translation for convenience. The German version (Datenschutzerklärung) is the legally binding one.
The following gives a simple overview of what happens to your personal data when you use ElternArchiv. Personal data is any data that can be used to identify you personally.
Who is responsible for data collection on ElternArchiv?
Data processing is carried out by the operator; contact details can be found below under
"Data controller".
How do we collect your data?
ElternArchiv has no open sign-up. Your most important piece of data is the personal access code you
receive from the organiser (requested manually via WhatsApp, see below). Technically necessary data such
as the session cookie and rate-limiting entries are created automatically as you use the site.
What do we use your data for?
Solely to restrict access to an event's videos to invited families and to make abuse (automated
guessing of codes) harder.
What rights do you have regarding your data?
You have the right at any time to request, free of charge, information about the origin, recipient and
purpose of your stored personal data, as well as the right to have this data corrected or deleted.
Details in section 6.
This application (website, database with event/code/video metadata) runs on a server operated by All-Inkl (ALL-INKL.COM – Neue Medien Münnich, Germany). The videos themselves are not stored or played on this server, but are provided exclusively as links to YouTube (see section 5.5). A data processing agreement exists between Optimello and All-Inkl under Art. 28 GDPR.
Ronny Thamm
Optimello — Marketing & Design
Mooshamer Feld 10
94496 Ortenburg, Germany
Phone: +49 1512 1187036
Email: info@optimello.de
Events remain accessible for a maximum of 3 months from creation. After that, the event, its access codes and video links are automatically and completely deleted. The organiser can also delete an event earlier in the admin area. Rate-limiting entries are automatically deleted after a short time (see section 5.3). Unless a more specific storage period is stated here, your data remains with us until the purpose for processing it no longer applies.
In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged breach.
ElternArchiv is a private, password-protected archive for videos of individual events (e.g. karate exams, school performances, weddings). There is no open sign-up — access is exclusively via a personal access code issued by the organiser, per event or family.
Access codes are issued per event to restrict access to the videos to invited families. Codes are stored exclusively as a cryptographic hash (Argon2id/bcrypt) — the plain-text code is shown only once in the admin area after creation and is never stored anywhere afterwards. The organiser can optionally add a freely chosen label (e.g. a family name) to tell codes apart.
After successfully entering a code, a technically necessary session cookie (ea_session) is
set, which allows access for the duration of the session without re-entering the code. It is used
exclusively for access control, not for tracking, and is never shared with third parties.
To make automated guessing of access codes harder, a hash generated from the IP address (HMAC, not the plain-text IP) is stored together with the event code and a timestamp whenever an attempt fails. These entries are automatically deleted after a short time (routinely within 24 hours).
So the organiser can tell whether an access code has been shared beyond the intended household, every successful login and every video download stores the same one-way hash generated from the IP address (HMAC, not the plain-text IP, no location/geolocation determination) together with the access code used. The admin area only shows a count of distinct hash values per code ("used from how many networks") — a hint, not proof, since e.g. switching between WiFi and mobile data within the same family also produces multiple hash values. These entries are deleted once the associated event is automatically removed after expiry (see "Storage period" above).
The videos themselves (title, description, video file or, for YouTube videos, the video ID) are filmed, prepared and uploaded or linked by Optimello on behalf of the respective organiser. Videos may show recordings of people (including children). The legal basis for publishing them in the protected archive — in particular the consent of the people shown or their legal guardians — is the responsibility of the commissioning organiser, who decides on how the event is run and organised and is the contracting party of the people filmed, not Optimello.
You currently request your access code manually via WhatsApp (Meta Platforms Ireland Limited). The "Message us on WhatsApp" button opens a chat with a pre-filled message; the details you send there (e.g. the child's or family's name, phone number) are processed directly by WhatsApp/Meta according to their privacy policy and are not stored in this application. The access code sent back to you is stored exclusively as a hash in the database (see section 5.1).
The coffee-fund button links to an external PayPal.me link (paypal.me/optimello) for a voluntary donation that is not linked to access. Payment processing takes place entirely at PayPal and is subject to PayPal's privacy policy (PayPal (Europe) S.à r.l. et Cie, S.C.A.). We have no influence over this processing and receive no automated data from it.
Videos are provided exclusively as links to unlisted YouTube videos; clicking one opens YouTube in a new tab. There is no embedding or playback on this page itself. However, a connection to Google's servers (Google Ireland Limited) may be established once you start watching. Google/YouTube's privacy notices apply.
You have the right to:
To exercise these rights, contact: info@optimello.de
Last updated: July 2026
