Datenschutzerklärung

1. Controller

Redd Apps India Private Limited, NYN Arcade, Survey No. 55, Plot No. 108, Lumbini Avenue, Gachibowli, Hyderabad, Telangana 500032, India. Represented by Saraswathi Nanded, Managing Director. Email: [email protected], contact form.

2. Questions about your data

For any question about your data, write to us at [email protected].

3. What we process on this website, and why

3.1 Visiting inwst.com

inwst.com is a static website. It sets no cookies and loads no content, fonts or scripts from other companies. If you pick Light or Dark in the footer, your browser remembers that choice in its local storage (the word “light” or “dark” under the key “theme”). It is never sent to us, and clearing your browser data removes it. To deliver pages and keep the service secure, the web server and our network provider process technical data such as your IP address, the page requested, date and time, and your browser's user agent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Retention: server and access logs are kept for at most 30 days, then deleted.

3.2 Waitlist and email list

If you join the waitlist, or leave your email address on a tool, a lesson, the money calendar, the sample chapter or a “Tell me when pre-orders open” form, we store your email address, the time you signed up, which part of the site you used, what you asked to hear about (for example new lessons, a tool, calendar reminders, or pre-orders of a pack) and, if the link you followed had them, its campaign tags (utm parameters), and send one confirmation email (double opt-in). When you confirm, we store the time and a hashed (not readable) form of your IP address as proof of consent. The survey after confirming is optional. Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time with the unsubscribe link in every email. Retention: unconfirmed sign-ups are deleted after 30 days; confirmed ones are kept until you unsubscribe. Unsubscribing deletes your entry and survey answers, with one exception: if you are a founding member (one of the first 1,000 people who confirmed), we keep your entry, marked as unsubscribed, with your email address and founding number, so that we can honour the founding perks. You get no more emails. If you want it deleted as well, write to us (section 6).

We send emails to the list with Listmonk, open-source newsletter software that we run ourselves on a server in the EU; no other company receives the list. Confirmed addresses are copied there with the topics you signed up for, your language and, for founding members, the founding number. When you unsubscribe, your address is deleted there too; a founding member's address stays there, blocked, so that no email reaches it.

If you choose “Continue with Google”, you are sent to Google, which tells us only your email address and that Google has verified it. Because the address is already verified, we don't send a confirmation link; your click on the button is your consent. No Google code is loaded on inwst.com before you click. Google's own privacy policy applies to your sign-in with Google (Google Ireland Limited, Dublin).

3.3 Contact form

If you write to us, we store the topic, your message, your email address, an optional name, the time and a hashed form of your IP address (for abuse prevention), and use them only to answer you. Legal basis: Art. 6(1)(b) and (f) GDPR. Retention: 12 months after your message, then deleted.

3.4 Free calculators

Everything you type into a calculator stays in your browser and in the page link. It is not sent to us. The transfer-cost calculator fetches only the public ECB reference rate for the date you choose. To see how the calculators are used, each calculator page sends anonymous events to our own server: that you started using it, that a result was shown, and that you joined the list from it. They carry only the name of the calculator, never a number you typed or a result. They are sent and kept like the Money Health Check events described in 3.5 (random id in the page's memory only, legal basis and retention as there).

Lesson pages send the same kind of anonymous event when you open a lesson, when you reach its end and when you open the free tool it links to: the lesson, its track and the tool's name, nothing else. The “Tell me when pre-orders open” buttons send one event with the name of the pack and the page the button is on. The money calendar's .ics files are plain files on inwst.com: a calendar app that subscribes to them fetches them from time to time like any page (see 3.1), and they send nothing back.

Across inwst.com we also count visits with the same kind of anonymous events, sent to our own server: which pages are opened; the site whose link brought you here (only its name, such as google.com, and only if it is another site); the campaign tags in that link (its utm parameters, such as the name of the campaign), if it has them; whether the link came from an ad click (only that fact, never the ad click's identifier); clicks on our buttons; which sections of a page were seen; and how far the page was scrolled (a quarter, half, three quarters or all of it). No other part of the link is sent. To tell visits apart without a cookie, our server computes a pseudonymous code from your IP address, your browser's user agent and a random value that changes every day and is deleted after that day, so codes from different days can't be matched. Your IP address is processed only for that moment and is never stored. Nothing is stored on your device: no cookie, nothing in local or session storage. When you sign up, we note which campaign or site first brought you that day (at campaign level only). Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which pages and campaigns work). Retention: the events are kept only as long as we need them for these counts and are then deleted; we use them only as weekly counts.

The tools that calculate on our server are different: the Indian income checker, the German filing check and pension refund check, and the NRI tools send your answers to our server. See 3.8.

3.5 Money Health Check

The answers you type into the Money Health Check stay in your browser: they are not sent to us, not stored on your device and not added to the page link. The page fetches the public ECB euro–rupee reference rate. If you ask for your results by email, we receive your email address and the results only (bands, ratios and totals rounded to 1,000 euros or rupees, and, when the euro–rupee mix is shown, the retirement country you picked, which it is compared with), never the amounts you typed or your age; we send the results in one email and don't store them. Your address is handled as described in 3.2 (legal basis: consent, Art. 6(1)(a) GDPR). To see how the check is used, the page sends anonymous events to our own server: which step you completed, that you finished the check, how many checks were in common ranges, whether any amount was in rupees (yes or no), which lesson or tool you opened next, and that you asked for the email, opened the app or shared the page. They never carry an answer: no amount, no age, no country you picked, no email address. Each batch has a random id that exists only in the page's memory during your visit, so that the steps of one visit can be counted together. It is not stored on your device (no cookie, nothing in local or session storage) and is gone when you reload or close the page. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the tool). Retention: the events are kept only as long as we need them for these counts and are then deleted; we use them only as weekly counts.

3.6 “Ask an AI” buttons

These open ChatGPT, Claude or Perplexity in a new tab with a question that contains only the address of our page, never your inputs. What happens there is governed by those providers' own privacy policies.

3.7 Videos in lessons

Some lessons can include a short video hosted on YouTube. Nothing is loaded from YouTube until you press play: the page shows a play button, not an embedded player. When you press play, your browser loads the video from YouTube's privacy-enhanced mode (youtube-nocookie.com), operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube then receives your IP address, the address of the lesson page and technical data about your browser, and may store information on your device while the video plays. Google may transfer data to Google LLC in the US. Legal basis: your consent by pressing play, Art. 6(1)(a) GDPR and § 25(1) TDDDG. See Google's privacy policy at policies.google.com/privacy.

3.8 Tools that calculate on our server: the Indian income checker, the German filing and pension refund checks, and the NRI tools

The Indian income checker works out on our server where Indian income generally goes in a German tax return. When you press the button, your answers (the kinds of Indian income and the approximate amounts, tax deducted in India, the tax year, whether you lived in Germany all year and the month you arrived or left, joint or single filing, how much of the saver's allowance is used, and whether you gave your bank a tax residency certificate) are sent to our server once, used only to calculate the result shown to you, and not stored. They are not logged, the result is not cached, and the service's error logs leave them out. To limit abuse, the server counts requests per IP address for one minute. The page also sends the anonymous events described in 3.4 (that you started, got a result, or joined the list), with the tool's name only. If you ask to be emailed from the page, we receive your email address and where you signed up (see 3.2), never your answers. Legal basis: Art. 6(1)(b) GDPR (you ask us to calculate the result) and Art. 6(1)(f) GDPR for the abuse limit. While the checker shows no tax estimate, it doesn't ask whether you pay church tax (the answer could reveal a religious affiliation): it calculates as if you don't, and sends no federal state. If the checker ever asks about religious affiliation, it will first ask for your explicit consent.

The NRI tools (which residence tests apply to you, the TDS refund checklist, the ITR form conditions, and selling property in India) work the same way: they work out the result on our server, and when you press the button your answers are sent there once, used only to calculate the result shown to you, and not stored. They are not logged, the result is not cached, and the service's error logs leave them out. The answers are: for the residence tests, your citizenship, the days you were in India in the tax year and in earlier tax years, the earlier years in which you were a non-resident, whether you left India for work abroad or as ship crew or came on a visit, whether you are liable to tax in another country and, if you enter it, your Indian income (asked only of Indian citizens and persons of Indian origin); for the TDS refund checklist, the country you live in, the days you were in India, the kinds of Indian income with approximate amounts and the tax deducted from them (for rent also the municipal taxes and home-loan interest, if you enter them), and whether you gave your bank a tax residency certificate; for the ITR form conditions, your residential status, the kinds of Indian income and whether tax was deducted; for selling property, whether you sell as a non-resident, the sale price, what you paid, the dates you bought and sold, whether you have a certificate for a lower deduction and, if you enter it, the tax the buyer deducted. The abuse limit, the anonymous events (with the tool's name only) and an email sign-up from the page work as described above for the Indian income checker; a sign-up from these pages also asks for news for NRIs. Legal basis: Art. 6(1)(b) GDPR (you ask us to calculate the result) and Art. 6(1)(f) GDPR for the abuse limit.

The German filing check and the German pension refund check work the same way. The filing check sends your answers about the tax year 2026: where you lived, whether wage tax was taken from your salary, whether you were married and where your spouse lived, your nationality if your spouse lived in another EU or EEA country, your tax classes, and yes, no or not sure to these questions: whether you worked for more than one employer at the same time; income without wage tax; wage-replacement benefits (Elterngeld, Kurzarbeitergeld or Krankengeld) or foreign income a tax treaty exempts, asked together in one question; an allowance entered in your wage tax data; a refund of health or care insurance contributions; the letter S on your wage tax certificate; capital income that no German bank taxed; a loss carried forward from an earlier year; and whether the tax office asked you to file. The benefits question names sickness benefit (Krankengeld) together with other benefits and treaty-exempt income, so a yes doesn't say which of them you received. If the check ever asks about sickness benefit on its own, it will first ask for your explicit consent. The pension refund check sends your nationality, the country you live in, whether you are insured in the German pension insurance or a scheme abroad, whether you have reached the standard retirement age, and yes, no or not sure to the questions about a certificate of coverage and a foreign pension. While the rules behind them are in review, neither asks for amounts or numbers of months. The pension refund check doesn't ask whether you received a benefit from the pension insurance, such as medical rehabilitation (the answer could reveal data concerning your health). If the check ever asks about such benefits, it will first ask for your explicit consent. As with the Indian income checker, the answers are sent once when you press the button, used only to calculate the result shown to you, not stored and not logged; the same abuse limit, anonymous events and legal bases apply.

3.9 Your inWst account

If you create an account in the app (app.inwst.com), we store your email address, your password as a salted hash (never the password itself) or, if you choose “Continue with Google”, your Google account ID, the name and the link to the profile picture that Google shares, and that Google has verified your address; an optional name, when you confirmed your email address, when you last signed in, and the part of the site you came from (for example a tool or a lesson). To protect your account we also count failed sign-in attempts and lock the account for a while after repeated failures. If you sign up with an email address and password, we send one email to confirm the address. Legal basis: Art. 6(1)(b) GDPR (providing the account you asked for). Retention: until you ask us to delete your account; then the account and everything in it are deleted, and backups expire as described in section 4. To limit abuse, sign-in and sign-up attempts are counted per IP address, and sign-ups also per email address (as a hash, not readable), for up to an hour.

3.10 Statements and tradebooks you upload

Uploading is optional; the lessons, tools and the Money Health Check work without it. From a bank or card statement (PDF) we read the date, amount, payer or payee and description of each transaction, the statement period and the file name. From a broker's tradebook we read the date and time, symbol, ISIN, exchange, product type, buy or sell, quantity and price of each trade and the broker's reference numbers for it; other columns are ignored. Files you upload are deleted as soon as they are read; only the transactions or trades in them are kept. Before 25 September 2026 the original file was kept as well. Those earlier files are still stored on our servers in Germany and in our backups until we delete them; you can ask us to delete yours at any time. A PDF password is used only to open the file and is never stored or logged. The transactions and trades are stored in your account on our servers in Germany and are visible only to your account (enforced by the database), until you delete them or ask us to delete your account. Legal basis: Art. 6(1)(b) GDPR (showing you your own numbers, as you asked).

From a statement that prints the balance after each transaction, we also store the balance after its last transaction and its date, for your net worth and the Money Health Check in the app. Storage, visibility, retention and legal basis are the same as for the transactions.

3.11 Investments and balances you enter yourself

In the app you can enter your investments and savings by hand; this is optional. For each account we store what you enter: its name, the provider as you label it, the kind of account (for example a fixed deposit, PPF or EPF, gold bonds, a broker account, crypto or property), the country, the currency, whether an Indian account is NRE or NRO, the date you opened it and your notes. For each holding we store what you enter: its name as you label it, the kind of asset (for example shares, a fund, gold, a deposit or cash) and its country, its ISIN or other identifier if you enter one, the number of units, the price per unit and the value, what you paid for it if you enter that, the currency and the date the value is from; for a deposit also the interest rate, the maturity date and how the interest is paid out. A property value is your own estimate. You can also enter the balance of a bank account on a date; we store the amount and the date. inWst fetches no prices: every value comes from you or from a file you upload, with its date. We use these entries only to show you your own numbers (totals, how they are spread, your net worth and how it changed, and the Money Health Check in the app), converted with the ECB reference rate. They are stored in your account on our servers in Germany and are visible only to your account (enforced by the database), until you change or delete them or ask us to delete your account. Legal basis: Art. 6(1)(b) GDPR (showing you your own numbers, as you asked).

You can also enter transactions by hand for an account: for each we store its kind (a buy, a sale, a dividend or IDCW, interest, a fee or tax withheld), the date, the instrument as you label it and its ISIN or identifier if you enter one, the units and the price per unit for a buy or a sale, the amount and the currency. For a deposit you can say which of your bank accounts receives its interest, and link the interest and tax lines of your statements to it; we store the link, not a copy of the lines. Storage, visibility, retention and legal basis are the same as for your other entries above.

If you tell us in the app which bank, broker or file you would like inWst to read, we store the kind (bank or broker), the name you typed and, if you give it, the country, with your account. We count these requests to decide which import comes next, without looking at who asked. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in adding the imports people need). Retention: until you ask us to delete them or your account.

4. Recipients and processors

• Hosting: IONOS SE, Germany (EU). The website, the app, the API and the database all run on IONOS servers in Germany, and the data of people who use inWst is never stored outside the EU.
• Network and security: Cloudflare, Inc. sits in front of the website, the app and the API: it delivers the pages, protects against attacks and handles the encrypted HTTPS connection (TLS) before passing requests on to our server. Cloudflare also stores our encrypted offsite database backups in Cloudflare R2, with EU jurisdiction.
• Email: Amazon Web Services EMEA SARL (Luxembourg), Amazon Simple Email Service in the EU (Frankfurt, eu-central-1) region, for the emails we send: waitlist and account confirmation emails, welcome emails, Money Health Check results, and contact-form notifications.
• Sign-in with Google: Google Ireland Limited (Dublin), only if you choose “Continue with Google” (see 3.2 and 3.9). The sign-in uses Google's OAuth service.

We don't use an outside error-monitoring service.

Backups: the database is backed up every day. Backups are kept on our server for 14 days, and as encrypted offsite snapshots in Cloudflare R2 (EU): one a day for 14 days, one a week for 8 weeks and one a month for 12 months. Data deleted from the database stays in these backups until they expire.

We keep a list of all processors and have a data processing agreement with each. We do not sell or rent personal data and do not use it for advertising.

5. Transfers outside the EU

Redd Apps India Private Limited is based in India. Where our team in India accesses personal data to run and support inWst, this is a transfer to a country without an EU adequacy decision. The data itself stays stored on our servers in Germany. You can ask us how this access is protected (section 6).

Amazon Web Services, Cloudflare and Google are headquartered in the US. Where we can choose, data is processed in the EU: emails are sent from Amazon SES in Frankfurt (eu-central-1), and our backups are stored in Cloudflare R2 with EU jurisdiction. A transfer to the US can still happen when traffic passes through Cloudflare's global network and when you sign in with Google. These transfers rely on the EU–US Data Privacy Framework, Standard Contractual Clauses, or both.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to [email protected]. You also have the right to complain to a data protection supervisory authority, for example the one where you live.

7. No automated decisions

We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

8. Changes

We update this policy when the website or the law changes. The date at the top shows the latest version.