Privacy policy
How this website and our apps handle your data—in short: as little as possible, and none of it for advertising or tracking.
Last updated:
This page is also available in German: Deutsche Fassung
At a glance
Our apps and this website are built so that as little data as possible is created in the first place—and the data that is created stays where it belongs: with you.
- No user accounts: our apps do not run an account system of their own.
- No ads, no tracking and no analytics tools—neither in the apps nor on this website.
- Your app content stays on your device (and possibly in your device backups) or, if you choose, in your private iCloud storage. We never receive a copy.
- We set no cookies of our own on this website and load no third-party content. Cloudflare, which delivers the website for our host, may set technically necessary security cookies to protect it (see No cookies of our own).
- As a rule, we only receive personal data when you send us an email.
Below, we explain in detail which data is processed and when, on which legal basis, and what rights you have. This is how we meet our information obligations under Art. 13 of the General Data Protection Regulation (GDPR). Each of our apps also has its own complete privacy policy (see Our apps).
Controller
The controller responsible for data processing on this website and in our apps within the meaning of the GDPR is:
We are not legally required to appoint a data protection officer. For any questions about privacy, you can reach us directly at info@aploapps.com.
This website
Hosting and server log files
This website is hosted by Render, a service of Render Services, Inc., USA (“Render”), and is served exclusively over an encrypted connection (HTTPS). Each time you open a page, your browser automatically transmits technical information. Render and Cloudflare, which Render uses to deliver the website (see below), may process the following data in server log files, in particular:
- IP address of the requesting device
- date and time of access
- HTTP method (such as “GET”), the host name and the address (URL) requested
- response status (such as “200” or “404”) and response time
- technical request identifiers
- browser type, browser version and operating system (user agent)
- the previously visited page (referrer), if your browser sends it
This data is needed to deliver the website to you and helps us keep it secure and stable, for example by detecting and fending off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing this website securely and reliably. We do not combine log data with other data and do not use it for analytics or marketing.
Render processes this data, first, on our behalf to deliver the website to you (data processing under Art. 28 GDPR), under Render’s Data Processing Addendum(opens in a new tab), which forms part of Render’s Terms of Service. Where Render processes the data on our behalf, it may use it only on our instructions to deliver the website. Render does not state a fixed retention period for these logs; what counts is how long they are needed to deliver and secure the website. Second, under that agreement Render also processes usage data from its services—such as where a connection comes from and goes to, and activity logs—as an independent controller. Render uses this data in particular to detect and prevent fraud, security incidents and misuse, to run its own business operations and to comply with legal obligations. Render does not state a fixed retention period for these own purposes either; according to its privacy policy, it keeps device and IP data for as long as it needs it to keep its systems working properly, and longer where the law requires. We have no access to these logs and do not store any log data ourselves.
As Render is based in the United States, personal data may be transferred to the US. Render is certified under the EU-U.S. Data Privacy Framework(opens in a new tab), so such transfers are based on the European Commission’s adequacy decision of July 10, 2023 (Art. 45 GDPR). Where that decision does not apply, the EU Standard Contractual Clauses agreed with Render apply (Art. 46(2)(c) GDPR). For more information, see Render’s privacy policy(opens in a new tab).
Render delivers the website through the content delivery network of Cloudflare, Inc., USA, which Render uses as a subprocessor(opens in a new tab). Your request, and with it your IP address, therefore first reaches a Cloudflare server, which either serves the page or forwards the request to Render. Cloudflare is also certified under the EU-U.S. Data Privacy Framework(opens in a new tab), so any transfer to the US is likewise based on the European Commission’s adequacy decision (Art. 45 GDPR). For more information, see Cloudflare’s privacy policy(opens in a new tab).
No analytics, no tracking, no cookies of our own
We do not set any cookies on this website ourselves. We use no analytics or statistics services, no tracking pixels, no ad scripts and no social media plugins, and we do not embed videos, maps or any other content from third-party servers.
Cloudflare, which Render uses to deliver and protect the website (see Hosting and server log files), may in individual cases set technically necessary security cookies, for example to fend off automated traffic (bots), for rate limiting or for a security check. Cloudflare classifies these cookies as strictly necessary (see Cloudflare’s list of cookies(opens in a new tab)). We do not use them for analytics or advertising. Storing these cookies on your device and accessing them is permitted without consent under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) because it is strictly necessary for us to provide the website to you securely. The legal basis for the related processing of personal data is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the website securely and reliably.
Because we use nothing that requires your consent, you will not see a cookie banner here.
Fonts and images
All fonts, images and graphics are delivered through our hosting at Render, including the Cloudflare content delivery network it uses (see Hosting and server log files). Beyond that, your browser sends no requests to third parties when you visit this website—in particular none to Google Fonts or to public content delivery networks for fonts or scripts.
Storing your color scheme preference
If you explicitly choose a light or dark color scheme using the switch in the header, your browser saves that choice in your device’s local storage (localStorage) so your preferred appearance is kept the next time you visit. It is a single entry called “theme” whose value is “light” or “dark”; it never leaves your device and is not transmitted to us or anyone else. You can remove it at any time in your browser settings, for example by clearing the stored data for this website; the site then follows your device’s setting again.
This storage is strictly necessary for a feature you have explicitly requested and is therefore permitted without consent under Section 25(2) no. 2 TDDDG. Insofar as any personal data is processed at all, the legal basis is Art. 6(1)(f) GDPR.
Links to app stores and other websites
This website contains links to app stores and to other external sites. A connection to the respective provider is only established once you click such a link; from then on, that provider’s privacy policy applies—on the App Store, Apple’s Privacy Policy(opens in a new tab).
Links to our apps on the App Store include campaign parameters such as “ct” (for example, “ct=website”). This lets Apple show us, in App Store Connect, aggregated figures on how many page views and downloads came from our website. We cannot identify individual people from this.
Our apps
Our apps work without a user account. The content you create in an app is stored locally on your device—and, in apps that offer it, optionally synced with iCloud. We do not run an account system or a database of our own for app content, we do not include ad networks, and we do not use third-party analytics or tracking services. We do not sell data from our apps.
Each app has its own complete privacy policy. Here is a summary for each app:
German Citizenship Explained
The app works fully offline and requires no registration. We ourselves receive no personal data through the app, use no tracking and show no ads. Up to version 1.5, the app’s name on the App Store is “Der Einbürgerungstest App”; the app’s privacy policy applies to every version.
Presence: Invoice & Proposal
Presence works without an account: contacts, notes, proposals, invoices, payments, expenses, attachments, your business profile (including your logo and photo) and your digital business card are stored on your device and—if iCloud sync is on, which it is by default—in your private iCloud storage. The app connects only to Apple’s services, never to our servers. We never see or sell your data.
Radar: Subscription Tracker
Renewal Radar stores your contracts, subscriptions, memberships and reminders on your device and—if iCloud is on for the app—in your private iCloud storage. The app does not connect to your bank account, does not scan your email and connects only to Apple’s services, never to our servers or anyone else’s. We never see or sell your data.
US Citizenship & Civics Test
The app requires no account. Your progress, settings and results are stored only on your device. To keep answers current, the app downloads public information from senate.gov and USA.gov and, from version 1.2, from our website aploapps.com. Like any website, these servers receive your device’s IP address and see which page is requested (for USA.gov, your state’s page); the app sends them no account, ZIP code or other personal data. From version 1.2, answers you say out loud or write by hand are checked on your device only and are never recorded or sent.
Aluneli
No account, no ads, no tracking and no third-party analytics, and we run no servers for the app. What you enter stays on your iPhone and, if you use it, your Apple Watch, and in your own backups if you back up your devices; we never receive a copy. Apple Health is optional and part of the free app: with your permission, the app reads your weight, body-fat percentage and waist circumference, only on your device, and writes nothing to Apple Health.
iCloud sync (CloudKit)
Some apps let you sync your data via iCloud across your devices that use the same Apple Account. Technically, they use Apple CloudKit for this. Your data is then stored in the private database of your Apple Account and transmitted and managed by Apple. We have no access to this private database and never receive a copy of your data.
Sync is optional. You can turn it off for each app at any time in your device’s iCloud settings; where supported, the app then continues to work locally only. Processing by Apple is governed by Apple’s Privacy Policy(opens in a new tab).
Permissions on your device
Some features need access to parts of your device—for example notifications for reminders, the microphone and speech recognition for answers you say out loud, the camera for scanning, Face ID or Touch ID for an app lock, or Apple Health. These permissions are granted through the operating system’s standard prompt. You decide whether to allow them and can revoke them at any time in your device’s Settings. Our apps use any access you grant only for the feature concerned.
Downloads, in-app purchases and subscriptions
You get our apps from Apple’s App Store. Apple is responsible for downloads, your Apple Account and payment. Our released apps offer optional paid features as a subscription, some also as a one-time purchase.
Purchase, payment, renewal, cancellation and refunds are handled entirely by Apple through the App Store. We never receive payment details such as card or bank information, nor the names or contact details of buyers. The app merely checks through Apple’s purchase interface (StoreKit) whether a purchase is valid in order to unlock the relevant features. Apple provides us with aggregated sales reports that do not identify individuals.
Apple’s terms and Privacy Policy(opens in a new tab) apply to processing by Apple.
Crash reports and statistics from the stores
If you have agreed on your device to share analytics with app developers, Apple provides us with crash reports and usage statistics for our apps. This data is collected and processed by Apple; according to Apple, the data developers receive does not identify you personally (Device Analytics & Privacy(opens in a new tab)). We cannot link it to any individual ourselves and use it solely to fix bugs and improve the stability of our apps. You decide in your device’s analytics settings whether to share data with developers and can change this at any time; Apple explains how at the same link.
Contacting us by email
When you email us at info@aploapps.com—for example with a general question, a question about an app or a privacy request—we process your email address, your name (if provided) and the content of your message, including any details you choose to share, such as your device model, system version or screenshots. We use this data only to handle your request and reply to you.
The legal basis is Art. 6(1)(b) GDPR where your request relates to the use of our apps or a purchase, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering inquiries. We handle requests concerning your data protection rights to meet our legal obligations (Art. 6(1)(c) GDPR).
We keep your message only for as long as we need it to handle your request and any follow-up questions, or to establish, exercise or defend legal claims. If an email becomes part of the records we must keep under tax law, the statutory retention periods apply, in particular under Section 147 of the German Fiscal Code (Abgabenordnung, AO): six years for business letters received and copies of those sent, eight years for accounting vouchers such as invoices, and ten years for books and records. The legal basis for this retention is Art. 6(1)(c) GDPR. While only a statutory retention obligation remains, we block the data from any other use. Once neither a purpose nor a legal obligation remains, we delete it.
Launch notifications
For apps that have not been released yet (currently Aluneli), you can ask us by email to let you know when they launch. For this, we store your email address and the name of the app solely for this purpose and write to you once at launch. We do not send newsletters.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by sending the email. You can withdraw it at any time with effect for the future, for example with a short email to info@aploapps.com. We delete your address once we have notified you, after you withdraw your consent, or if it becomes clear that the app will not be released.
Our mailbox
Emails to info@aploapps.com arrive in our Microsoft 365 mailbox. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Microsoft stores and transmits your messages and our replies on our behalf (data processing under Art. 28 GDPR), under the Microsoft Customer Agreement and Microsoft’s Data Protection Addendum(opens in a new tab). We buy the service through GoDaddy; under GoDaddy’s terms, it is subject to the Microsoft Customer Agreement, including its data protection terms. The legal bases are the same as for handling your request.
Under its Data Protection Addendum, Microsoft also processes certain data for its own business operations incident to providing the service, such as billing and account management, internal reporting and financial reporting. Microsoft is an independent controller for this processing; according to Microsoft, it does not access the content of the mailbox for these purposes and does not use the data for profiling or advertising.
GoDaddy provides the authoritative DNS services for our domain aploapps.com, which among other things route email sent to our address to Microsoft, and is involved in provisioning and administering our Microsoft 365 account. Which data GoDaddy processes in this context, and in which data protection role, depends on the services booked and the account configuration.
Microsoft stores the contents of our mailbox (messages and attachments) only in data centers in the EU. Even so, personal data may also be transferred to the United States and to other countries outside the EU and EEA in which Microsoft or its subprocessors operate. Under Microsoft’s Data Protection Addendum, such transfers are subject to the EU Standard Contractual Clauses between Microsoft Ireland Operations Limited and Microsoft Corporation (Art. 46(2)(c) GDPR). In addition, Microsoft Corporation, Redmond (USA), is certified under the EU-U.S. Data Privacy Framework(opens in a new tab), so transfers to it are also covered by the European Commission’s adequacy decision (Art. 45 GDPR). For more information, see Microsoft’s privacy statement(opens in a new tab).
Your rights
Where we process personal data about you, the GDPR gives you the right to:
- access the data we process about you (Art. 15 GDPR)
- rectification of inaccurate or incomplete data (Art. 16 GDPR)
- erasure of your data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability—receiving your data in a structured, commonly used and machine-readable format (Art. 20 GDPR)
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)
Right to object under Art. 21 GDPR
Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
To exercise your rights, simply send an informal email to info@aploapps.com. Because most data in our apps lives on your device, in your device backups or in your private iCloud storage, you can often view and delete it yourself—the page Delete your account and data explains how.
Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)—in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de(opens in a new tab)
Further information
No obligation to provide data
You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary connection data, however, this website cannot be displayed, and without your email address we cannot reply to you.
No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Changes to this privacy policy
We update this privacy policy whenever our apps, this website or the legal requirements change. The version currently published on this website applies; you can see when it was last changed under “Last updated” at the top. This privacy policy is also available in German; both versions have the same content.