Privacy Policy for Noteh - Notes & Checklists

Noteh requires no account or registration and contains no ads and no advertising or marketing trackers. Notes and checklists are stored on your device. We operate no server of our own.

Data leave your device in these cases:

• Error reports to Sentry, when enabled (section 4).
• Optional synchronisation of your notes and checklists via your Google Drive (section 5).
• Contact, store use, operating-system crash reports and ratings (section 6).

A separate privacy policy applies to our website spryloop.com.

Controller under the General Data Protection Regulation (GDPR):

René Fitzkec/o Block ServicesStuttgarter Str. 10670736 FellbachDeutschlandEmail: noteh.app@spryloop.com

The app stores your notes and checklists (titles, content, items, times) and your settings on your device. Neither we nor other apps can read this protected storage. Storage is necessary to use the app (Art. 6 (1) (b) GDPR, § 25 (2) no. 2 of the German TDDDG). On Android, the app needs only the internet permission.

App data are excluded from Google cloud backup and iCloud backup. After reinstalling, your notes and checklists are available only through synchronisation (section 5). Deleting the app or using “Clear app data” in Android settings removes all local data, but no data in Google Drive.

What happens. When error reporting is enabled, the app automatically reports errors and crashes to Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) for diagnosis and repair.

Your switch. Error reports stay off until you enable them: on a fresh installation, as soon as you dismiss the welcome note that points out the error reports; otherwise under “Send error reports” in settings. You can stop sending reports there at any time.

Content of a report. Time, app version, device model, operating system, language, technical device state, error message, program flow and a short history of recent app steps in technical terms. A random installation identifier without name or account details groups reports from the same device; your IP address is transmitted too. The app removes content fields before sending to exclude the content of your notes and checklists. Individual details may still appear unintentionally in error messages.

Legal basis. Art. 6 (1) (f) GDPR; our legitimate interest is to detect technical errors and keep the app working and secure.

Sentry as processor. Sentry processes reports under our data processing agreement and stores them for at most 30 days in its EU region (Germany). Access from the USA is possible; the US company relies on the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses. Privacy: https://sentry.io/privacy/. Transfer safeguards: https://sentry.io/legal/dpa/ (Schedule 3).

Voluntary, off by default. Once enabled in settings, the app automatically synchronises your notes and checklists across your devices.

What is transferred. Your notes and checklists with full content, titles and times. Plus technical synchronisation data without name or account details. Transfers are encrypted using HTTPS.

Storage. In the hidden app data area of your own Google Drive, which no other app can read. The “drive.appdata” permission gives no access to your other Drive files. We have no access to the data.

Google as controller. Google is responsible for storage; in the European Economic Area (EEA), this is Google Ireland Limited, Dublin. Google’s privacy policy applies: https://policies.google.com/privacy. Google may process data outside the EEA, particularly in the USA.

Signing in to Google. Google shows your name, email address and profile picture during sign-in. The app neither stores nor displays these. It stores only a non-reversible checksum of your account identifier to detect account changes.

Legal basis. Enabling synchronisation gives your consent under Art. 6 (1) (a) GDPR; you can withdraw it at any time by switching it off. If you are under 16, please switch synchronisation on only with your parents’ consent.

Switching off and deleting. Switching off only pauses synchronisation on this device. “Delete cloud data” in settings deletes cloud data for all devices and revokes the app’s Google account access; your local notes and checklists are kept. Revoking access in your Google account’s security settings instead leaves cloud data in place. Delete them in Google Drive under “Settings” → “Manage apps” → “Options” → “Delete hidden app data”.

This app’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Email contact. The app can prepare an email with the app name and version in the subject line; you send it yourself. We process the message and sender address to reply (Art. 6 (1) (b) or (f) GDPR). UD Media GmbH, Erkelenz (udmedia.de), stores our emails in the EU as our processor. We delete them once your request is resolved and no retention obligations apply.

Google Play. For downloads, updates and ratings, Google Play processes data under its own responsibility and Google’s privacy notices. We automatically receive operating-system crash reports and aggregated statistics without personal reference and evaluate them to keep the app stable (Art. 6 (1) (f) GDPR).

App Store. For downloads, updates and ratings, the App Store processes data under its own responsibility and Apple’s privacy notices. We automatically receive operating-system crash reports and aggregated statistics without personal reference only with your consent to sharing with app developers under “Analytics & Improvements” in iOS settings (off by default). We evaluate them to keep the app stable (Art. 6 (1) (f) GDPR).

Rating. The app may occasionally ask for a rating through the respective store’s dialog.

You have the rights of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You can withdraw consent at any time without affecting the lawfulness of prior processing based on it (Art. 7 (3) GDPR). An informal message to the address in section 2 is enough. We usually cannot link error reports to a person. For access or erasure, we then need details enabling that link (Art. 11 GDPR).

Objection (Art. 21 GDPR). On grounds relating to your particular situation, you can object at any time to processing we base on Art. 6 (1) (f) GDPR, i.e. the error reports and the evaluation of store statistics. You stop the error reports yourself via the “Send error reports” switch; otherwise an informal message is enough. We will then stop processing the data unless compelling legitimate grounds prevail or the processing serves the establishment, exercise or defence of legal claims.

Complaint. You can complain to a data protection supervisory authority (Art. 77 GDPR). Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, https://www.datenschutz-berlin.de.