Last updated: 28 September 2026
This is a translation; in case of doubt, the German version prevails.
The controller within the meaning of Art. 4(7) GDPR for data processing on this website and in the ThinkSnap web app (thinksnap.de/app) is:
Prof. Dr. Marco Barenkamp
MBSAS.AI Prof. Dr. Marco Barenkamp Advisory
Pastor-Lichtenbäumer-Str. 33
49134 Wallenhorst, Germany
E-mail: kontakt@profbarenkamp.com
This privacy policy also applies to the domains thinksnap.io and thinksnap.me, which redirect to thinksnap.de.
The website and web app are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The server is located in a data centre in Berlin (Germany). IONOS processes the data arising from access and use on our behalf pursuant to Art. 28 GDPR and only on our instructions.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable provision of our service); when you use the web app, additionally Art. 6(1)(b) GDPR.
All connections are encrypted with TLS (HTTPS).
When you access this website and the web app, our web server automatically processes information transmitted by your browser and stores it in log files: IP address, date and time of access, requested page/file, amount of data transferred, HTTP status code, referrer URL, browser type and operating system (user agent).
The web app additionally writes technical application logs (e.g. log-ins, errors and transcription runs with user name and technical identifiers; for transcriptions, the generated title and a short text excerpt may also be logged, but no audio data).
Purpose: delivery of the website and app, stability and security (e.g. defending against attacks), error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
Retention: web server log files are rotated daily and automatically deleted after 14 days. Application logs of the web app are usually deleted automatically after 30 days.
Without your consent, the website only stores what is strictly necessary or what you explicitly request: the cookie cookie_consent (stores your choice in the cookie banner, 365 days) and – if you pick a language in the language selector – the local storage entry thinksnap-website-locale (until you delete it in your browser). The cookies and storage entries of the web app are described in section 7.8. A complete list is available in our cookie policy.
Legal basis: for strictly necessary or requested storage, Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); for Google Analytics, your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Subsequent processing of necessary data is based on Art. 6(1)(f) GDPR.
Withdrawal: you can withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the footer.
Only if you click “Accept” in the cookie banner do we load Google Analytics 4 (measurement ID G-HMSD18C9SV). No connection to Google is established before that.
_ga and _ga_HMSD18C9SV, each up to 2 years.More information: Google privacy policy.
The website only uses fonts, icons (Font Awesome) and flag graphics (flag-icons) delivered from our own server. Visiting the website does not establish any connection to external content delivery networks or to Google Fonts.
Note on the web app: when you open the web app at thinksnap.de/app, the font “Inter” is currently loaded from the Google Fonts service of Google Ireland Limited (address see section 5). Your browser thereby transmits your IP address and technical browser data to Google; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent presentation of the app). You may object to this processing under Art. 21 GDPR; technically, you can prevent the download e.g. with a content blocker – the app then remains usable with a system font.
To use the web app, we process your user name, e-mail address, name and password (stored exclusively as a BCrypt hash), as well as the times of registration and log-in. To confirm your e-mail address and to reset your password, we send you e-mails with one-time links.
Legal basis: Art. 6(1)(b) GDPR (user agreement). Retention: until your account is deleted; the data is then erased unless statutory retention obligations apply.
Instead of a user name and password, you can sign in with your Google or Facebook account. Only when you click the respective button are you redirected to the provider, which thereby receives, among other things, your IP address and learns that you are signing in to ThinkSnap. From Google we receive your name, e-mail address, an account identifier and, where applicable, your profile picture (OpenID Connect scopes “openid”, “email”, “profile”); from Facebook the details of your public profile (name, profile identifier, where applicable profile picture).
We store notes, tags, reminders, uploaded photos/images and shares you set up for other users on our server in Germany in order to provide the app's functions. If you create an API key, authorised programs can use it to access your notes. Shared content is visible to the persons you select.
Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the content or your account.
For certain functions – in particular reading notes aloud – ThinkSnap uses the speech interface of your browser (Web Speech API). Whether this processing takes place on your device or at your browser vendor depends on the browser, the operating system and the selected voice:
This transmission is made by your browser to its vendor (Google Ireland Limited/Google LLC, Microsoft Ireland Operations Limited/Microsoft Corporation, Apple Distribution International Ltd./Apple Inc.) under the vendor's privacy policy; we do not receive any data from these providers and have no influence on their processing. A transfer to the USA is possible; it is based on the EU-US Data Privacy Framework where the respective provider is certified, otherwise on its standard contractual clauses. Our legal basis for providing the function is Art. 6(1)(b) GDPR. If you wish to avoid this, choose a local voice or on-device speech recognition, or do not use the function.
If you activate push notifications (e.g. for reminders or finished transcriptions) and allow them in your browser, we store the push address (endpoint) generated by your browser and the associated keys with your account. Delivery takes place via the push service of your browser vendor (e.g. Google for Chrome, Mozilla for Firefox, Microsoft for Edge, Apple for Safari); the message content is transmitted in encrypted form according to the Web Push standard. A transfer to the USA is possible.
Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in the browser or app settings. Retention: until you unsubscribe from notifications or delete your account.
For confirmation, password reset and service e-mails, we process your e-mail address and name The legal basis is Art. 6(1)(b) GDPR. Our e-mail mailbox and e-mail sending are operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes the data on our behalf pursuant to Art. 28 GDPR. No transfer to third countries takes place in this context.
The web app only uses technically necessary storage (Section 25(2) no. 2 TDDDG): the session cookie JSESSIONID, the cookie THINKSNAP_REMEMBER_ME (only if you choose “Stay signed in”), and entries in local/session storage, IndexedDB and the browser cache for language, theme, sorting, offline use and – if note encryption is enabled – PIN-protected key data. Details can be found in the cookie policy. We do not use any analytics or advertising trackers in the web app.
You can additionally encrypt your notes with a personal PIN. Encrypted notes are stored in encrypted form on our server. Images and audio files are not encrypted.
A transfer to the USA may occur with Google Analytics (only with consent), Google Fonts in the web app, sign-in with Google or Facebook, push services and the online speech functions of your browser. It is based on the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) for certified companies, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR). Hosting and transcription take place in Germany.
Unless a specific period is stated above, we store personal data only for as long as necessary for the respective purpose; account data and content until your account is deleted. Statutory retention obligations remain unaffected.
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until then remains unaffected.
Right to object under Art. 21 GDPR
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal objection to kontakt@profbarenkamp.com is sufficient.
Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
You are neither legally nor contractually obliged to provide us with data. However, without the data requested during registration we cannot provide you with a user account, and without the technically transmitted connection data the website cannot be displayed. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
We use technical and organisational measures to protect your data against manipulation, loss and unauthorised access, including TLS encryption (HTTPS), storing passwords only as BCrypt hashes, access restrictions and regular security updates.
We update this privacy policy when our service or the legal situation changes. The version published here applies (as of September 2026).
For questions about data protection or to exercise your rights: kontakt@profbarenkamp.com
If you contact us by e-mail, we process your e-mail address, your name and the content of your message in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). The e-mails are stored in our mailbox at STRATO GmbH (processor pursuant to Art. 28 GDPR, processing in Germany) and deleted once the enquiry has been dealt with and no statutory retention obligations apply.