Privacy

In effect from 23 October 2026. The Norwegian version applies if the two differ.

Riise Service is a sole proprietorship run by Tore Riise. A sole proprietorship is not a separate legal entity, so Riise Service and Tore Riise are the same data controller. In the App Store and on Google Play, Tore Riise or Riise Service may be listed as the developer or seller of Bumerang.

In short

Bumerang stores only what a loan needs to work, and deletes photos and phone numbers when the loan is closed. We don’t sell data, don’t show ads and don’t track you. There are no analytics or crash reporting tools in the app or on the website.

What we store

• Your account: an anonymous identifier from Apple or Google, depending on how you sign in, and your name, not your email address. If you sign in with Apple, we also store a token from Apple that is only used to revoke the sign-in when you delete your account.
• Things and loans: the name of the thing, who borrowed it, when the loan started, any due date, when the thing came back and which reminders were sent.
• Photo: if you take a photo of the thing, a small thumbnail without location (GPS) is stored. Only you and whoever gets the loan link or QR code can see it, and it is deleted when the loan is closed: when the thing is returned, the loan is declined, or you cancel it.
• The borrower: if you borrow something without the app, the name you type and, if you give it, your phone number are stored for that one loan only. The lender can also pick the borrower’s number from Contacts to send a text message. The app doesn’t read the contact list; only the number that is picked is sent to us. The phone number is deleted when the loan is closed.
• Bumerang Plus: if you buy Plus, details of the purchase from the App Store or Google Play (transaction or order number and date) are stored so the purchase follows your account. Apple or Google handles the payment; we never see card details.
• Notifications: if you turn on notifications, a token from Apple, or from Google’s Firebase on Android, is stored that lets us send notifications to your phone. It is deleted when you sign out, delete your account, or when Apple or Google reports that the app has been removed from the phone.

Loans you confirm in the App Clip without an account, or open from a link in the Android app before you have signed in, are remembered on your phone, so the app can take them over later. That stays on the phone.

Why we are allowed to

We process the data of account holders to provide the service you asked for (GDPR Article 6(1)(b)). We process the name and phone number of a borrower without an account because the lender has a legitimate interest in keeping track of what is lent out and being able to send a reminder (Article 6(1)(f)). That is why they belong to that one loan only, and the number is deleted when the loan is closed.

Who sees what

The person you lend to or borrow from sees your name, the thing, the photo and the dates for that loan. No other users see any of it.

Who helps us

• Render (Render Services, Inc.) runs the server and the database. The data is stored in Frankfurt, Germany. Render is a US company and processes the data on our behalf under a data processing agreement based on the EU Standard Contractual Clauses.
• Apple handles sign-in, the purchase of Plus and the delivery of notifications on iPhone. Notifications go through Apple’s notification service and contain names and what was lent. Apple processes this under its own privacy policy.
• Google does the same on Android: sign-in with Google, the purchase of Plus on Google Play and the delivery of notifications through Firebase Cloud Messaging. Notifications contain names and what was lent. Google processes this under its own privacy policy.

How long

Photos and phone numbers are deleted when the loan is closed. Your account, your things and closed loans stay as history until you delete your account.

The server makes a backup every day, and the backups are kept for about a week. Whatever is deleted disappears from them after that. Our hosting provider keeps technical logs, including IP addresses, for a short time for operations and troubleshooting. We don’t store IP addresses in the database.

When you delete your account

Your account, your things, the loans where you are the lender, the photos, the notification tokens and the registration of Plus are deleted, and if you signed in with Apple, the sign-in with Apple is revoked. The Plus purchase itself stays with Apple or Google and can be restored to a new account. On loans you have from others, only your name remains, not linked to you, so the owner still knows who has the thing. How to delete: bumerang.no/slett-konto.

Your rights

You can ask for access to what we have stored about you, and to have it corrected, deleted or handed over in a machine-readable format. You can also object to processing based on legitimate interest, or ask us to restrict it. Write to support@bumerang.no. If you believe we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

The website

bumerang.no uses no cookies and loads nothing from other websites.

Changes

If we significantly change how we handle data, we will say so in the app before the change takes effect.

See also the terms of use.