Privacy

The short version

Annum is an archive of your year. To run that archive, we store the things you save (traces, photos, notes, ratings), the account you use to sign in, and the small amount of metadata needed to keep the service working. We don’t sell your data, we don’t serve ads against it, and we don’t train models on it.

Who's behind Annum

Annum is operated from Munich, Germany. The data controller within the meaning of Art. 4 (7) GDPR is Jonathan Magnis. Postal and contact details are on the Impressum page.

What we store, and why

• Account identity. Email address (or Apple Relay address) and the OAuth provider you signed in with. Required to keep your archive yours.
• Profile. Display name, username, optional bio, avatar, and chosen appearance palette. Public profile fields are visible to anyone who visits annum.life/{username}.
• Traces and entries. Everything you write, upload, or import — titles, descriptions, photos, ratings, dates, tags. This is the archive itself.
• Imports. When you upload a CSV from Letterboxd, Goodreads, or similar, the file is parsed into traces and the original CSV is discarded.
• Cookies and session. A small set of cookies needed to keep you signed in (Supabase auth) and to remember your appearance preference. No tracking pixels, no third-party advertising cookies.
• Logs. Standard server logs (IP, user agent, timestamps) retained for a short window for debugging and abuse prevention.

Who we share it with

We use a small set of subprocessors to run the service. Each is bound by a Data Processing Agreement and only handles the data necessary to do its job:

• Supabase. Database, authentication, file storage. Hosted in the EU (Frankfurt).
• Vercel. Application hosting and edge delivery.
• Resend. Transactional email (magic links, notifications).
• Stripe. Payment processing for paid plans. Receives billing details and payment method data directly; we never see or store your card number.

We do not transfer your data to third parties for marketing, analytics, or model training.

Your rights under GDPR

Because we operate in the EU, you have the rights set out in Articles 15–22 of the GDPR — access, rectification, erasure, restriction, portability, and objection. You can:

• Export. Download your full archive as JSON from Settings → Export.
• Edit. Edit or delete any individual trace, profile field, or photo at any time.
• Delete account. Delete your account from Settings → Danger Zone. This removes your traces, photos, and profile from our systems within 30 days, except where law requires longer retention (e.g. invoicing records).
• Object or restrict. Email the contact address on the Imprint page if you want to restrict or object to a specific processing activity.

You also have the right to lodge a complaint with a supervisory authority. In Germany the relevant authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

How long we keep things

Traces and profile data are kept for as long as your account exists. After deletion, they are removed within 30 days from primary storage and within 90 days from encrypted backups. Email and billing records are retained for the period required by German tax and commercial law (currently up to 10 years).

Children

Annum isn’t designed for people under 16. If we learn that someone under 16 has signed up without parental consent, we will delete the account.

Changes

When this notice changes materially we’ll surface a banner in the app and update the date at the top. The previous version remains available on request.

Contact

Questions about anything on this page: see the contact details on the Impressum page.