Murmel Privacy Policy

Last updated: 11 October 2026

Murmel helps you keep track of the people you care about, record memories, and remember important moments. This Privacy Policy explains how Murmel collects, uses, stores, and protects personal information when you use the Murmel mobile app and related services.

We aim to handle your information transparently and give you meaningful control over it.

1. Who is responsible for your data?

Murmel is operated by Oliver Görtz, an individual based in New Zealand.

Contact: contact@murmel.me

For the purposes of applicable data protection laws, Oliver Görtz is responsible for deciding how and why personal information is processed through Murmel, subject to the legal roles of any other parties involved.

2. Information we collect

Depending on how you use Murmel, we may process the following categories of information.

Account and authentication information

We process information needed to create and maintain your account, authenticate you, and provide access to Murmel. This may include your email address, account identifier, authentication-related information, and account settings.

Murmel uses Keycloak for account authentication. Authentication information is processed through the authentication service.

Friends and contact information

You can create records about people you know. These records may contain names, contact details, dates, notes, relationships, and other information you choose to enter.

This information may relate to people who do not have a Murmel account.

Diary entries, milestones, and calendar moments

Murmel allows you to record personal memories, notes, milestones, and important dates. These records may contain personal information about you and other people, including sensitive information if you choose to include it.

Please consider carefully what you record, particularly when it concerns another person.

Voice recordings and transcripts

If you use Murmel's voice-related features, we may process voice recordings you submit and the resulting transcripts.

Voice recordings may contain your voice and the voices or personal information of other people. Transcripts may contain names and other personal or sensitive information.

Voice transcription uses an external service. The provider, the countries in which it processes data, its retention practices, and whether it uses submitted content to improve its services must be confirmed in the service-specific disclosures associated with this feature.

Information you send us

If you contact us for support, privacy requests, or other enquiries, we process the information you provide so that we can respond.

3. Information we do not intentionally collect

Murmel does not request or collect your device's precise location as a location-tracking feature. You may nevertheless choose to enter place names or location-related information in your records.

Murmel is not intended to be a public social network. Information you enter into your private records is used to provide your personal Murmel experience, subject to the processing described in this Policy.

4. How we use your information

We use personal information for the following purposes:

• Providing Murmel: creating and maintaining your account and providing friends, diary, milestones, and calendar features.
• Authentication and security: verifying your identity, maintaining sessions, preventing unauthorised access, and protecting the service.
• Voice transcription: sending voice recordings to the configured transcription provider and making the resulting transcripts available to you.
• Reliability and improvement: diagnosing crashes, understanding app usage, identifying technical issues, and improving the service through configured analytics and diagnostic tools.
• Support: responding to your questions, requests, and reports.
• Legal obligations: complying with applicable law and handling legal claims where necessary.

We do not sell your personal information.

We do not use your private diary entries or voice recordings for advertising as a stated purpose of Murmel. Any further use of this content, including by a third-party provider, must be assessed and disclosed before it occurs.

5. Legal bases for processing

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases as appropriate to the particular processing activity:

• Performance of a contract: processing needed to provide the Murmel service you request, including account access and core features.
• Legitimate interests: processing reasonably necessary to secure, maintain, troubleshoot, and improve Murmel, where those interests are not overridden by your rights and interests.
• Consent: processing for which consent is required, including where applicable certain optional analytics, device permissions, or voice-related processing.
• Legal obligations: processing required by applicable law.

The appropriate legal basis depends on the actual feature, data, provider, and circumstances. We will not treat consent as a blanket authorisation for unrelated processing.

You can withdraw consent where processing is based on consent. This does not affect processing carried out lawfully before withdrawal.

6. Where your information is stored

Murmel's core data is stored on a local computer. Authentication is provided by Keycloak, which runs on a virtual server hosted by Netcup in Nuremberg, Germany.

Other services, such as voice transcription, analytics, and crash reporting, may process personal information on separate infrastructure. The locations where those services process or store information depend on the providers used.

Where personal information is transferred internationally, we will use appropriate safeguards where required by applicable law. For transfers subject to the GDPR, these may include an adequacy decision or standard contractual clauses. For disclosures subject to New Zealand's Privacy Act 2020, we will assess the requirements of Information Privacy Principle 12.

7. Who may receive your information?

Murmel uses the following third-party services:

• Netcup GmbH: Hosts the virtual server in Nuremberg, Germany, on which Keycloak runs. Netcup may process technical information as necessary to provide and maintain the hosting service. Netcup Privacy Policy.
• OpenAI: Processes voice recordings submitted through Murmel to generate text transcripts using the OpenAI API. OpenAI Privacy Policy and API data usage and retention.

Murmel's core data is stored on a local computer. Murmel does not use cloud storage, cloud backups, analytics, or crash-reporting services.

Depending on the service and applicable terms, providers may process information on our behalf or act as independent controllers for certain processing.

We do not disclose personal information to other Murmel users simply because you have entered it into the app. Any future sharing feature would require appropriate product behaviour and privacy disclosures.

8. How long we keep your information

Murmel is designed to help you maintain a personal record of the people and moments that matter to you. We retain your information according to the following principles.

• Account information: retained while your account is active. When you request account deletion, we delete your account information unless we are required or permitted by law to retain certain information for longer.
• Friends, diary entries, milestones, and calendar moments: retained until you delete them or request account deletion.
• Voice recordings: stored on self-hosted infrastructure using Garage object storage and retained until you delete them or request account deletion.
• Transcripts: stored in Murmel's database so you can read them later. They are retained until you delete them or request account deletion.
• Authentication information: stored by Keycloak while your account is active and deleted as part of account deletion, subject to any necessary and lawful retention.
• Technical and security logs: retained only for as long as reasonably necessary for security, troubleshooting, and operation of the service.

Murmel's core data and voice recordings are stored on self-hosted infrastructure rather than in a third-party cloud storage service. However, voice recordings are sent to OpenAI for transcription, and OpenAI may retain data it processes according to its own policies and applicable terms.

When you delete information, we will remove it from the relevant active storage, subject to any applicable legal obligations or technical limitations.

9. Your privacy rights

Depending on your location and applicable law, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to a relevant privacy or data protection authority.

These rights are subject to applicable legal conditions and exceptions. For example, deletion may not be possible where we must retain information to comply with a legal obligation or establish, exercise, or defend legal claims.

To exercise your rights, email contact@murmel.me. Please describe your request and identify the account concerned. We may ask for reasonable information to verify your identity before disclosing or changing personal information.

We will respond within the time limits required by applicable law.

10. Deleting your account

To request deletion of your Murmel account and associated personal information, contact:

contact@murmel.me

We will verify the request and explain or carry out the applicable deletion process. We will delete personal information that is no longer needed, subject to legal retention requirements and other applicable exceptions.

Some information may remain temporarily in backups, security logs, or records we are legally required to retain. Where relevant, information held by external providers may need to be deleted through their respective systems or processes.

Account deletion does not automatically guarantee immediate removal from every backup or third-party system. We will handle those records in accordance with applicable law and the relevant retention arrangements.

11. How we protect your information

We use self-hosted infrastructure and service providers to operate Murmel. We aim to protect personal information through reasonable technical and organisational safeguards designed to reduce the risk of unauthorised access, loss, misuse, alteration, or disclosure.

No internet-based service can guarantee absolute security. You should use appropriate account security measures and avoid recording information that you do not want processed by Murmel or its configured service providers.

If a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including notification obligations where required.

12. Information about other people

Murmel is a private app for keeping personal notes about the people in your life. Information you enter about friends, family, and other people is private to your account and is not visible to other Murmel users.

Please use these features considerately and avoid recording information about others that is unnecessarily sensitive or that you have no appropriate reason to keep.

13. Children's privacy

Murmel may be used by people of different ages. We handle personal information in accordance with applicable privacy laws, including any additional requirements that apply to children.

Where required by law, we will obtain appropriate parental or guardian authorisation before processing a child's personal information. If you have questions or concerns about a child's use of Murmel or their personal information, please contact us.

14. Cookies and similar technologies

Murmel may use cookies, local storage, and similar technologies where necessary to provide authentication, maintain sessions, protect security, and support the app's functionality.

Murmel does not use advertising cookies or analytics tracking.

The specific technologies used depend on the platform and services involved. Where consent is legally required for non-essential cookies or similar technologies, we will obtain it before using them.

15. Changes to this Policy

We may update this Privacy Policy to reflect changes to Murmel, its providers, or applicable law.

We will update the “Last updated” date when we make changes. Where required, we will notify users of material changes or obtain consent for new processing activities.

16. Contact and complaints

For privacy questions, access or correction requests, deletion requests, or complaints, contact:

Oliver Görtz
Email: contact@murmel.me
Country: New Zealand

If you are in the European Economic Area, you may also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, workplace, or the place of the alleged infringement.

If you are in New Zealand, you may contact the Office of the Privacy Commissioner at privacy.org.nz if you believe your privacy rights have been interfered with.

This Policy describes the intended scope of Murmel's privacy practices. It must be kept accurate as the app, infrastructure, and service providers change.