Privacidad – Hoofolio

1. Controller

Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany. Email: apps@bitbeans.de (also for privacy requests). We have not appointed a data protection officer because fewer than 20 people are constantly engaged in automated processing of personal data (section 38(1) German Federal Data Protection Act) and no data protection impact assessment is required.

2. In short

– Your horse file (horses, entries, deadlines, photos, documents, contacts, notes) is stored on your device. Without a feature you switch on yourself, this content does not leave your device.

– Cloud backup and device move transmit content only end-to-end encrypted. The keys are on devices, not with us. We cannot read this content.

– With hand over record the handover file is encrypted; the additional PDF is not. You pass both on yourself; protection on the way also depends on the service you choose.

– There is no account, no advertising and no advertising tracking.

– Usage statistics are off until you switch them on.

3. On your device

The app stores your file in an encrypted database on the device. The key is kept in the operating system's key store. The file content is processed on your device; we have no access to it. If you open a handover or backup file via “Open in Hoofolio” or the file picker, the app creates a working copy in the app cache and processes it on the device. While creating and opening a handover, unencrypted working files and the PDF can exist temporarily in the app cache. The app tries to delete working files after the process and leftover copies at later starts; after a cancellation or a deletion error they can stay on the device longer. Hoofolio does not delete the original file or copies held by other apps or recipients. The app asks for permissions only when you use the feature: camera (taking photos, scanning QR codes), photos and files (choosing attachments, saving exports), notifications (reminders). You can withdraw any permission in the system settings.

Widget "Today" (Plus). If you put the widget on your home screen, the app stores a small extract of your open deadlines on the device (type of deadline, horse name, date; never your own deadline titles, medication, notes, measurements, emergency data, other people or costs). It uses its own widget key for this, never the key of your record. If that key is not available on the device, it only stores a neutral extract without names. With the setting "Numbers only" the widget shows no horse names and no deadline types. What the widget shows can be seen by anyone who sees your screen. None of it goes to us.

Deadlines in the calendar (Plus). Only if you switch it on and then allow access to your calendars, the app adds your open deadlines as all-day entries to its own calendar "Hoofolio": the type of deadline and the horse name as title (or neutral "Hoofolio: deadline"), the date and a technical identifier; never your own deadline titles, notes, medication or costs. The app needs the access to find, update and delete its own entries; technically it also covers other calendars, but the app only uses it for its own. These entries are outside the app's encryption, in your device's calendar. If you choose "Only on this phone", they stay in the device's calendar storage (depending on your device backup they are backed up with it); if the device has no such calendar, the app writes nothing until you expressly choose the account calendar. If you choose the account calendar (only possible on iPhone and iPad), its provider may process title, date and identifier as an independent controller under its own privacy policy and transfer them to your other devices; the storage locations and any transfers to third countries are described there. In shared calendars other people can see the entries. We receive none of it. Legal basis for writing into your calendar: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under More > "Widget and calendar" by switching the feature off (the app then removes its entries) or choosing "Remove calendar"; both also work without Plus. Processing already carried out remains unaffected. If the app no longer has calendar access, delete any remaining entries yourself in the calendar.

Tip: do not enter health data about people or details you are not allowed to store.

4. Purchase, subscription and restore (Plus)

Hoofolio Plus is a subscription through the App Store or Google Play. Payment and billing are handled by Apple or Google as independent controllers; we receive no payment data.

To verify and restore purchases, the app creates a random guest ID (no account, no email) and sends it to our server with the product ID, store platform and the technical purchase receipt. This produces the entitlement (grant). Legal basis: Art. 6(1)(b) GDPR. Retention: term of the contract and afterwards until the regular limitation period has expired (Art. 6(1)(f) GDPR, section 195 German Civil Code; legitimate interest: proving and defending claims and protecting against abuse); guest IDs without a purchase 13 months after last use. Purchase and entitlement data stay stored even after "Delete all data" and "Delete cloud backup" (section 17) for this period.

5. Cloud backup (Plus) and device move

If you switch on cloud backup or move a device by QR code, the app uploads an encrypted copy of your file. The server knows only ciphertext, sizes, times and checksums of identifiers. Only your devices know the key (derived from recovery code and passphrase, or from the one-time key in the QR code). Legal basis: Art. 6(1)(b) GDPR; for details about third parties in your file (f) (legitimate interest: backup can only store the whole file you determine, encrypted, and protects you from data loss). Storage location of the files: EU. Retention: cloud backup 550 days after last use, you can delete it at any time; move copy at most 24 hours; it is deleted as soon as the new device has loaded and checked it or the move is cancelled; otherwise it can no longer be retrieved 15 minutes after the complete download and is deleted within the 24 hours. Important: without recovery code and passphrase, neither you nor we can read the backup.

6. Passing on (PDF, export, calendar file)

If you share a PDF, an export or a calendar file, the app hands the file to your operating system's save or share function. You decide where it goes (for example email, a messaging app or cloud storage); the recipient's own privacy rules apply there. We receive none of it. A ZIP export contains your attachments unencrypted; the app tells you beforehand.

7. Photos and third-party data

Your file may contain names and contact details of vets, farriers, riding partners or stable operators, and photos showing people. We do not inform these people individually because we cannot read the content and individual notice would be impossible or disproportionate (Art. 14(5)(b), Art. 11 GDPR); this notice is the public information on it.

– For your private file the household exemption usually applies (Art. 2(2)(c) GDPR). If you use Hoofolio professionally (for example a yard or farm), you are responsible for your entries yourself.

– Pass on content (for example as a PDF or export) only if you have the necessary rights. For recognisable people you usually need their consent.

– Handing over a record (for example when you sell a horse): for a handover the app creates an encrypted file with a one-time code on your device; in addition, an unencrypted PDF overview of the selected data can be created. It contains no photos or files and is not identical to the package. You decide yourself what you send and through which service; nothing goes through our servers and we receive neither the file nor the code. Photos and documents (files and document details), contacts and certain name fields, costs, private entries and insurance and purchase documents are switched off by default; the decision maker, cost limit and wishes from the emergency sheet, the owner stated in the passport, the stable place and presence never go along. Names and other details about people can still appear in entries, notes or selected files; the app points this out before creating the package. Only pass on details and pictures of other people if you are entitled to.

– As a rule we cannot fulfil requests from third parties (for example access to "their" data in files) because we do not read content and cannot assign people in it (Art. 11(2) GDPR). Please contact the keeper or the yard; if you give us details that let us make the assignment, we will examine the request.

8. Reminders

The app schedules reminders on the device through your operating system's notification function. Hoofolio uses no push service: we hold no device token, and the content of your reminders does not leave the device for this. You can switch reminders off in the app or in the system settings.

9. Reports

You can report unlawful content by email to apps@bitbeans.de (Art. 16 Regulation (EU) 2022/2065). A report contains the reasons, the exact location and your name and email address (exception: reports on offences under Art. 3 to 7 of Directive 2011/93/EU) so that we can confirm receipt and communicate the decision (Art. 16(4) and (5), Art. 17). We also accept an informal tip without these details. Content in the cloud backup is end-to-end encrypted and not publicly accessible; we cannot read it. Therefore state what allows the assignment (for example the guest ID from settings > "About", time period and type of content). If we cannot assign a report to a backup, we tell you. Legal bases: Art. 6(1)(c) in conjunction with the DSA and (f) (enforcing the terms of use). Retention: rejected reports 90 days after closing; confirmed reports reduced after 90 days to the record of measures and deleted 180 days after the decision.

10. Usage statistics (only with your consent, from age 16)

From the third day after you create your first horse, the app asks once on the "Today" page whether it may send anonymous counters; you can also switch the statistics on and off in settings at any time. The default is off. When switching on you confirm that you are at least 16 (self-declaration); younger users use the app without statistics. What is sent: fixed event names with stage or coarse time bucket, platform, app version, language and installation channel (e.g. store or test version). Examples: "introduction completed", "first horse created", "deadline done", "vet PDF shared", the app's start time, the outcome of the rating request, a return on day 1, 7 or 30 after the first horse, the outcome of a cloud backup or restore (success or type of error) and the way to a purchase (purchase page shown, "Buy" tapped, purchase completed, each with the type of page before). This is sent without guest or device ID and never with horse names, texts, contacts, photos or timestamps of entries. Only the message "purchase completed" travels with the existing purchase session so that our server can match it to the purchase of the same session it has just verified; the message is stored without an ID. With consent the app also names the type of purchase page when a purchase is verified; it is stored with the purchase (attribution, retention as purchase data, section 4). If our server confirms a test purchase (sandbox), the app notes this locally so that test purchases are not counted as real ones. Without a connection, one-off messages stay on the device for at most 30 days and are sent at the next start. The IP address is processed technically on receipt and not stored. Legal basis: Art. 6(1)(a) GDPR, section 25(1) TDDDG; withdrawal at any time in settings, as easily as giving consent (Art. 7(3) GDPR); after that nothing is sent (the app checks the consent right before every message) and waiting messages are deleted unsent. On the device the app stores your decision and, after consent, its time and text version as proof (section 25(2) no. 2 TDDDG). Individual messages 7 days, daily totals at most 120 days.

11. Feedback and support

If you write to us or use the feedback feature ("More" > "Send feedback"), we process your message, the optional email address for a reply and the app version, platform, language, originating screen and a random request number (prevents duplicate delivery); no content of your file is sent. The message is stored on our server (category hosting, section 14) and a notification with these details goes to our support mailbox. Without a connection the message stays on the device for at most 30 days (after that it is deleted unsent at the next opening) and is sent at the next start or send; "Delete all data" removes it. This temporary storage is necessary for the sending you asked for (section 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR where your request concerns the user agreement or a purchase, otherwise Art. 6(1)(f) GDPR (legitimate interest: answering requests, fixing errors). Please do not send us health information about people or data of other persons. Retention: on the server 90 days after receipt (automatic deletion), copies in the mailbox until 90 days after the request is closed; we keep the record of handling data subject requests (without content) for 3 years (Art. 6(1)(c), (f) GDPR, section 195 German Civil Code). The mailbox is run by an email service provider (category email, Ireland/USA, safeguard see section 14).

12. Security and abuse protection

To protect against overload and abuse we limit requests. For this we store only a hash of the IP address (SHA-256) and the guest ID, for 7 days (Art. 6(1)(f) GDPR). All transmissions are encrypted with TLS.

13. QR scanner

When you move to a new device and when you take over a handed-over record, you scan a QR code or type the code; the same applies to connecting further devices of your own once the app offers it. The app opens the camera for this only on the respective scanning page and only after your permission. The code is recognised only on the device: on iPhone and iPad with the operating system's image recognition, on Android with recognition built into the app without any network service. While scanning and recognising, neither the camera image nor the code is transmitted, not to us and not to third parties; the code stays in memory until the process ends. What happens with the recognised code afterwards is described in the respective section (move: section 5, handover: section 7).

14. Recipients and third countries

Hosting, storage, server and security (purpose: server, database, encrypted files; location: EU, provider based in the USA; safeguard: adequacy decision (EU-US Data Privacy Framework) where the provider is certified, otherwise standard contractual clauses). Stores, Apple and Google (purpose: purchase, billing, restore; independent controllers, worldwide; their own privacy notices, no processing on our behalf). Email service (purpose: support mailbox; location: Ireland/USA; safeguard: adequacy decision (Data Privacy Framework) where certified, otherwise standard contractual clauses).

We name the individual providers on request (Art. 15 GDPR, apps@bitbeans.de). You also receive a copy of the safeguards on request. We do not sell data, create advertising profiles or use advertising tracking. There is no decision based solely on automated processing with legal effect.

15. Retention at a glance

Your file on the device: until you delete it. Guest ID and grant: contract term plus limitation period; without a purchase 13 months after last use. Cloud backup: 550 days after last use, deletable at any time. Move copy: at most 24 hours. Reports: 90 or 180 days (section 9). Statistics: individual messages 7 days, daily totals at most 120 days. Feedback and support: server 90 days after receipt, mailbox 90 days after closing; record without content 3 years. Abuse protection: 7 days.

16. Teenagers

You can use Hoofolio from age 13. Consent to statistics is possible only from 16. Purchases run through the stores and adults' accounts.

17. Your rights

You have rights of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21) under the GDPR. Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation. You can withdraw consent with effect for the future. Providing the data is not required by law; without guest ID and purchase receipt we cannot verify Plus.

How to exercise them without an account: Delete all data (settings; deletes everything on the device and your cloud backup on the server, if you are offline the app retries the deletion on the server at every start with a connection until the server confirms it; a Plus subscription is cancelled separately in the store), Delete cloud backup (in cloud backup; deletes only the copy on the server, also after Plus has ended; purchase and entitlement data remain under section 4) and export are in the app (settings). For access and other requests write to apps@bitbeans.de; state the guest ID from the app (settings, "About") so we can assign your data. Complaint: to a data protection authority, for our registered office the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Users outside the EU (for example United Kingdom, Japan, South Korea, USA) have comparable rights under their law; use the same route. We do not sell personal data and do not share it for advertising.

18. Changes

If features or data flows change, we adapt this notice. The date is at the top.