Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Personal data is processed regularly only with the user's consent or on the basis of a legal permission (Art. 6 Para. 1 GDPR).

3. The todump app – content

All entries, notes, and reminder settings are stored exclusively on your device. There is no user account and no login. We have no access at any time to the content you enter in the app.

4. In-app usage analytics (PostHog)

The todump app collects anonymous usage statistics to improve features and the user experience. This includes interaction events (e.g. whether reminders are enabled, whether notifications are opened or snoozed) as well as technical device data: operating system and version, device manufacturer, device model, device type (smartphone/tablet), and screen resolution. The content of your entries or notes is never transmitted.

Data is transmitted to PostHog, Inc. and processed on servers within the European Union (host: eu.i.posthog.com). A data processing agreement is in place with PostHog. The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in anonymized analysis of usage behavior to improve the service). Data is not shared with advertising networks or used for advertising purposes.

You can disable usage analytics at any time in the app settings under Usage analytics. The deactivation is saved permanently. When you disable analytics, the deactivation itself is transmitted once as a final event (with no further details) — after that, no data is transmitted at all.

5. iOS interest signup

On this website, you can sign up under "Notify me for iOS" to be notified by email once the todump iOS beta starts. Data is transmitted only when you actively fill out and submit this form.

This stores your email address, your IP address, the time of signup, and the website language active at that time. The IP address is used exclusively to limit the number of signups per connection (maximum of two) to prevent abuse of the form. The data is stored in a file on our own server and is not shared with third parties.

The legal basis is Art. 6 Para. 1 lit. a GDPR (consent through actively submitting the form) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in preventing abuse with regard to the IP address). The data is deleted once we have notified you about the start of the iOS beta, and at the latest once the beta phase has ended. You can withdraw your consent at any time with effect for the future by sending an email to [email protected].

6. In-app purchases (RevenueCat)

Purchases within the todump app (todump Pro) are processed via the RevenueCat service (Revenue Cat, Inc., San Francisco, USA). RevenueCat stores an anonymous, device-bound user ID as well as purchase and transaction data to manage the Pro status and make purchases restorable across devices. The actual payment processing is handled exclusively by the Apple App Store or Google Play.

The legal basis is Art. 6 Para. 1 lit. b GDPR (performance of a contract). Since RevenueCat is based in the USA, data is transferred to a third country; the basis for this is standard contractual clauses (SCCs) pursuant to Art. 46 Para. 2 lit. c GDPR. A data processing agreement is in place with RevenueCat. For more information, see revenuecat.com/privacy.

7. In-app support and error reports (Sentry)

The todump app provides a form for voluntary support requests and error reports in the settings under Support & Contact. Data is transmitted only when you actively fill out and submit this form. In that case, the information you provide (name optional, email address, message, and an optional screenshot you select from your photo library) is transmitted together with technical details about the app and device version. Access to the photo library happens only upon your active selection; only the image you choose is transmitted.

The app performs no automatic crash, session, or performance tracking and sends nothing to Sentry in the background. The service provider is Functional Software, Inc. (Sentry), San Francisco, USA. The data is processed on servers within the European Union (Frankfurt region). A data processing agreement is in place with Sentry; for the transfer to the US-based company, standard contractual clauses (SCCs) pursuant to Art. 46 Para. 2 lit. c GDPR serve as an additional basis.

The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in handling support requests and improving the app) or Art. 6 Para. 1 lit. b GDPR insofar as the request serves the performance of a contract. For more information, see sentry.io/privacy.

8. Server log files

When you access our website, our hosting provider automatically collects information in so-called server log files, which your browser transmits to us automatically. This includes: browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server request, and IP address.

This data is not merged with other data sources. The collection of this data is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website.

9. Cookies and local storage

Our website uses cookies and comparable storage technologies for technical operation and statistical analysis of usage. Details on the tools used can be found in the sections below. No tracking for advertising purposes or sharing with advertising networks takes place.

10. Web analytics (Matomo)

This website uses Matomo (formerly Piwik), an open-source software for statistical analysis of visitor access. Matomo is operated on our own server; the data collected is not shared with third parties.

The following data is processed: truncated IP address (the last two octets are anonymized before storage), pages visited, time spent, browser and operating system used, country of origin, and referrer URL. Matomo also sets analytics cookies (_pk_id, retention 13 months; _pk_ses, retention 30 minutes) to distinguish sessions.

The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in anonymized analysis of usage behavior to improve the service). You can object to collection at any time by enabling Do Not Track in your browser (Matomo respects this setting) or adjusting your browser's cookie settings.

11. Hosting

This website and the associated API are hosted by a provider with server locations within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider, ensuring that personal data is processed exclusively according to our instructions and in compliance with the GDPR.

12. SSL/TLS encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock icon in your browser bar.

13. Retention period

Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. Server log files are deleted as soon as they are no longer needed for operational security; the retention period of analytics cookies is stated in Section 9. Statutory retention obligations remain unaffected.

14. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing (Art. 15 GDPR). You also have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us.

15. Data protection contact

For questions about the collection, processing, or use of your personal data, or to request information, correction, blocking, or deletion of data, please contact: [email protected]