Privacy policy

This policy covers the websites mygnom.com and mygnom.de and the Gnom app with the Gnom figure.

Last updated: 12 November 2026

1. Controller

More company details are in the legal notice. For questions about data protection and to exercise your rights, write to contact@easyweek.io.

2. Websites mygnom.com and mygnom.de

Hosting and server logs

The website runs in our own Kubernetes cluster on dedicated servers of Hetzner Online GmbH in Germany. For every request the web server (nginx) writes a server log with the technical data of the request: IP address, time, requested address, status code, amount of data sent, previous page (referrer) and browser identifier (user agent).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

DNS at Cloudflare

Name resolution (DNS) for the domains is provided by Cloudflare. Website traffic does not pass through Cloudflare: the domains point directly to the servers at Hetzner.

Fonts from Google Fonts

The website loads its fonts (Dela Gothic One, Figtree and Silkscreen) from Google Fonts, that is from fonts.googleapis.com and fonts.gstatic.com. Your browser connects to Google servers and transmits your IP address and the technical data of the request.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a consistent presentation of the website.

No cookies, no analytics

The website sets no cookies and uses no analytics, tracking or advertising services. We do not take pre-orders yet: the website sends no form data.

3. Gnom app and figure

Account and sign-in

Your account is kept by useruid, our sign-in service (api.useruid.com). The account holds your email address, first name, last name, phone number, time zone and language. You sign in with a one-time code sent to you by email.

At sign-in, Cloudflare Turnstile (embedded through api.mygnom.com/captcha.html) checks that the sign-in is not automated. Cloudflare processes your IP address and technical data of your device for this.

The legal basis for the account is Art. 6(1)(b) GDPR (use of the app), for Turnstile Art. 6(1)(f) GDPR (protecting the sign-in against abuse).

Voice commands

The figure records your voice only while you hold its button. The recording goes to the Gnom server (api.mygnom.com, on the same hosting as the website). These services take part in the answer:

• Speech recognition: Cloudflare Workers AI (model whisper-large-v3-turbo) receives the recording and returns the recognised text.
• Classifying the request: TypeSafe (api.typesafe.ai) receives the recognised text.
• Answer: Anthropic (Claude) receives the recognised text, your recent commands and matching memories as context, your name, your email address and the names of your connected EasyWeek workspaces.
• Speech output: OpenAI (model gpt-4o-mini-tts) receives the text of the answer and turns it into speech.

We do not store recordings of your voice. The legal basis is Art. 6(1)(b) GDPR.

What we store

The Gnom database holds:

• Command history: the recognised text, the answer, the tools called, the language and the processing times of each command.
• Memories: what you ask the figure to remember.
• Account settings: languages, the name the figure calls you and the chosen voice.
• Data of your figures: device ID, firmware user agent, name, volume, time until sleep, time of the last connection and the link to your account (account ID and email address).
• A cache of spoken answers (text and audio of the figure's answer). It is not linked to any account.

Connected services: EasyWeek

You can connect your EasyWeek account to Gnom through OAuth. We store the access tokens encrypted (AES-GCM) and use them only for actions in the EasyWeek workspace you chose. For these actions Claude (Anthropic) calls the EasyWeek interface with this access.

App permissions

• Camera: only to scan the QR code on the figure.
• Bluetooth: only to hand the Wi-Fi network to the figure. The Wi-Fi password goes encrypted to the figure only and never reaches our server.

4. Retention and deleting your account

We do not delete command history and memories automatically: the app's data is kept as long as your account exists.

You can delete your account at any time:

• in the app under Account > Delete account, or
• by email to contact@easyweek.io.

Deleting the account removes your command history, memories, settings and connected services. Your figures are unlinked from your account. Your useruid account is deleted as well.

5. Recipients and transfers to third countries

These service providers process data for us:

• Hetzner Online GmbH, Germany: servers of the website and of the Gnom server.
• Cloudflare, Inc., USA: DNS, Turnstile at sign-in, speech recognition (Workers AI).
• Google, USA: website fonts (Google Fonts).
• TypeSafe AI, Inc., USA: classifying requests.
• Anthropic, USA: answers (Claude).
• OpenAI, USA: speech output.

The basis for transfers to the USA, as the providers state it:

• Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). Should the certification lapse, standard contractual clauses apply.
• Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• TypeSafe: the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) under TypeSafe's data processing addendum.
• Anthropic: the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) under Anthropic's data processing addendum.
• OpenAI: under OpenAI's data processing addendum, OpenAI Ireland Limited processes data from the EEA. Transfers outside the EEA rely on standard contractual clauses (Art. 46(2)(c) GDPR) or an adequacy decision.

6. Your rights

Under Art. 15 to 21 GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), notification of recipients (Art. 19), data portability (Art. 20) and to object (Art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

An email to contact@easyweek.io is enough.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.