Privacy PolicyFluff for iPhone and Mac

Who is responsible

PlusMinusEight UG (haftungsbeschränkt)
c/o Gentges, Uhlandstraße 13, 10623 Berlin, Germany
info@plusminuseight.de

Without sync

Fluff works without an account. Your lists, sections and tasks are stored only in the app on your device, and we don't receive them.

With sync

Sync is optional. When you turn it on in Settings → Sync and sign in with Apple, we process:

Your account: an account ID from Apple and the email address you chose to share: your own address, or a private relay address if you picked “Hide My Email”. We don't receive your name.

Your lists: the names of your lists and sections, your tasks with their titles, order and completion, and when they were created and changed. That's what lets your iPhone and Mac show the same lists.

Technical data: records of sign-ins (time, account ID, email address) and the server's request logs, which include your IP address. They keep the service secure and help us find errors.

We process your account and lists to provide sync, as part of our agreement with you (Art. 6(1)(b) GDPR), and the technical data in our legitimate interest in a secure, reliable service (Art. 6(1)(f) GDPR).

Sync runs on Supabase, which stores this data for us as our processor, on servers in the USA (Ohio). Transfers to the USA are covered by the EU Standard Contractual Clauses in Supabase's data processing agreement. Apple handles the sign-in itself, under Apple's Privacy Policy.

Turning sync off and deleting your account

Turning sync off signs you out. Your lists stay on the device and in your account, so they come back when you sign in again.

To delete your account, open Settings → Sync → Delete account. This deletes your account and all of its lists and tasks right away, on our servers and on that device. What's left is technical: the records of past sign-ins, and the IDs of deleted items (without their content), which other devices use to remove them too. We keep these only as long as security and sync need them. Request logs are deleted after a few days.

If you've already deleted the app, email us and we'll delete your account for you.

Theme fonts

The Fluff theme uses the fonts built into your device. If you pick the Warm Orange or Cherry Bomb theme, the app downloads that theme's font once from Google Fonts, a service of Google. Google then receives your IP address. We use this in our legitimate interest in showing the theme you chose (Art. 6(1)(f) GDPR). Google is certified under the EU-US Data Privacy Framework; see Google's Privacy Policy.

Beta testing with TestFlight

If you test Fluff through Apple's TestFlight, Apple shares information about the beta with us: your name and email address if we invited you by email, your device model and system version, how often the app is used, crash reports, and any feedback and screenshots you send. We use it to fix bugs and improve Fluff, in our legitimate interest (Art. 6(1)(f) GDPR). Apple's TestFlight terms describe what Apple collects.

Email

If you email us, we use your address and message to answer you. The services that carry our email are listed in the website's Datenschutzerklärung.

Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. Write to info@plusminuseight.de.

You can also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes

If Fluff starts handling data differently, we'll update this page and the date below.