Privacy Policy – iOS & Android App

Anwesenheit — Attendance App Last updated: April 11, 2026

Florian Ludwig Software Engineering (“we”, “us”, “our”) operates the Anwesenheit mobile application for iOS and Android (the “App”) and the push notification relay service at push.anwesenheit.app (the “Push Service”). This Privacy Policy explains what personal data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive (2002/58/EC).

The App connects to your own Nextcloud server, which may have the Anwesenheit Nextcloud server app installed. All appointment and attendance data is processed exclusively on your Nextcloud server — we have no access to it. This Privacy Policy covers only the data processed by the mobile App and our Push Service.

Contact:
Florian Ludwig Software Engineering
Email: hello@anwesenheit.app
Website: https://anwesenheit.app

1. Overview of Our Architecture

Anwesenheit is a companion app for Nextcloud. Understanding our architecture is key to understanding our privacy practices:

• Your Nextcloud Server — All appointment, attendance, and user data is stored on your own Nextcloud instance, which is controlled by you or your organization’s administrator. We have no access to this data.
• Our Push Service (push.anwesenheit.app) — A relay that forwards encrypted push notifications from your Nextcloud server to your mobile device. It also handles license verification.
• The Mobile App — Connects to your Nextcloud server and receives push notifications. Stores credentials locally on your device.

We never have access to your Nextcloud credentials, appointment data, attendance records, or personal content.

2. Data Controller and Processor Roles

Under Art. 4(7) and Art. 4(8) GDPR, we explicitly define the following roles:

We do not collect any analytics, telemetry, or app usage data. Therefore, no controller or processor role arises for such categories — they simply do not exist.

In accordance with Art. 5(2) GDPR (accountability principle), we maintain records of processing activities for our Push Service and can provide these upon request by a supervisory authority.

3. Data Categories and Legal Classification

Under GDPR, data processed in our systems falls into the following categories:

4. Data on Your Nextcloud Server

The App communicates with your Nextcloud server to display appointments, submit responses, manage check-ins, and perform other attendance-related functions. All of this data — including appointment details, attendance responses, user information, and file attachments — is processed and stored exclusively on your own Nextcloud instance.

We, the developer, have no access to this data. Your Nextcloud administrator is the data controller for all data on your Nextcloud server. For questions about this data, please contact your Nextcloud administrator.

5. Data We Process (Push Service & License Server)

The Push Service at push.anwesenheit.app is operated by us. Below is a complete list of data we receive and store.

5.1 Device Registration Data

When you enable push notifications, the following data is sent to our Push Service:

Necessity assessment (Art. 6(1)(b)): Each data element above is strictly necessary for the technical delivery of the push notification service. Without the device identifier and FCM token, notifications cannot be routed. Without the RSA public key and signature, device authentication — and therefore secure operation — is impossible. Without the server URL, license verification cannot function. No alternative means of providing this service with less data exists.

5.2 Push Notification Relay

When your Nextcloud server sends a push notification:

• We receive the encrypted notification payload (subject, signature, priority, type)
• We cannot read the notification content — it is encrypted with RSA-2048 by your Nextcloud server and can only be decrypted by the private key stored on your device
• We forward the encrypted payload to Google Firebase Cloud Messaging (FCM) for delivery
• We log the delivery status (sent/failed) and any FCM error codes for operational purposes

5.3 License and Subscription Data

5.4 Delivery Log (Operational Data)

For each notification we relay, we log:

• Device identifier (pseudonymous)
• Notification type (e.g., “appointment_created”) — but not the notification content
• Delivery status (sent/failed/token_expired)
• Error messages from FCM (if delivery failed)
• Timestamp

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in monitoring service reliability, diagnosing delivery failures, and detecting abuse.

Retention: 12 months, then automatically deleted.

5.5 Legitimate Interest Assessment (Art. 6(1)(f))

Where we rely on legitimate interest as a legal basis, we have conducted the following balancing test:

You have the right to object to processing based on legitimate interest at any time (Art. 21 GDPR). See Section 12 for how to exercise this right.

6. Data Processed by the Mobile App

6.1 Local Storage on Your Device

The App stores the following data locally on your device (in the system keychain / secure storage):

• Nextcloud credentials: Server URL, login name, app password — never transmitted to us
• RSA key pair: A 2048-bit key pair generated on-device for push notification encryption
• Device identifier and signature: For push service authentication
• Push configuration: FCM token, push proxy URL, server public key
• Preferences: Display order, accent color, push notification toggle
• License cache: Cached license status (tier, member limit, expiration)

6.2 Data Sent to Your Nextcloud Server

The App communicates with your Nextcloud server to:

• Authenticate via Nextcloud Login Flow v2 (credentials stay between you and your server)
• Fetch and manage appointments, responses, check-ins
• Search for users, groups, and teams
• Manage iCal feed tokens
• Browse files for attachments (via WebDAV)
• Register for push notifications via Nextcloud’s notification system

All communication with your Nextcloud server uses HTTPS and Basic Authentication. We have no access to this traffic.

7. ePrivacy Directive Compliance (Art. 5(3) Directive 2002/58/EC)

The App accesses and stores information on your terminal equipment (mobile device). Under Art. 5(3) of the ePrivacy Directive, this requires either consent or technical necessity for the service explicitly requested by the user.

We do not use cookies, advertising identifiers, or any form of tracking that would require consent under the ePrivacy Directive. All local storage serves the direct technical function of the service that the user has explicitly requested.

8. Third-Party Services and Sub-Processors

8.1 Sub-Processor List

We use the following sub-processors to deliver our service:

8.2 Firebase Cloud Messaging (Google)

• Data shared with Google: Your device’s FCM token (a technical identifier for push delivery) and the encrypted notification payload (opaque to Google)
• Data NOT shared with Google: Decrypted notification content (we don’t have it), Nextcloud credentials, appointment data
• Firebase Analytics is disabled — we have explicitly turned off all analytics and advertising features in our Firebase configuration
• Transfer mechanism: Google LLC participates in the EU–U.S. Data Privacy Framework (DPF), certified under the framework. Additionally, Google’s Cloud Data Processing Addendum with Standard Contractual Clauses (SCCs) applies.
• Google’s privacy policy: https://policies.google.com/privacy

8.3 RevenueCat

• Data shared with RevenueCat: A pseudonymized user ID in the format {nextcloud-hostname}_{username}, purchase tokens from Apple App Store or Google Play
• Data NOT shared with RevenueCat: Appointment data, attendance records, personal content, Nextcloud credentials
• RevenueCat is only active when subscription features are used
• Transfer mechanism: Standard Contractual Clauses (SCCs) pursuant to the European Commission’s decision of June 4, 2021 (Commission Implementing Decision (EU) 2021/914). RevenueCat also participates in the EU–U.S. Data Privacy Framework. As a supplementary measure under Schrems II, we note that only pseudonymized identifiers and purchase transaction data are shared — no sensitive personal data, no content data, and no data that would be of interest for government surveillance purposes.
• RevenueCat’s privacy policy: https://www.revenuecat.com/privacy/

8.4 Apple App Store / Google Play Store

In-app purchases are processed through Apple or Google’s payment systems. We do not receive or store any payment card details. Apple and Google handle all payment processing under their own privacy policies. These are independent controllers for payment data — not our sub-processors.

8.5 Data Processing Agreements (Art. 28 GDPR)

We ensure that:

• Data Processing Agreements (DPAs) are in place with all sub-processors listed above
• Sub-processors are contractually bound by confidentiality obligations and, where applicable, Standard Contractual Clauses
• Sub-processors do not have access to unencrypted personal content data

8.6 Changes to Sub-Processors

We will update this Privacy Policy when adding or changing sub-processors. Material changes (new sub-processors or changes in data shared) will be communicated by updating the “Last updated” date and, where appropriate, through the App. The current sub-processor list is always available in this Privacy Policy.

9. Data We Do NOT Collect

• No analytics or telemetry
• No crash reporting
• No usage tracking or behavioral profiling
• No location data
• No contacts, camera, microphone, or photo access
• No advertising identifiers or ad tracking
• No email addresses (we only see Nextcloud user IDs and display names via the push registration)
• No browsing history

10. Data Retention

Stale device cleanup: Devices that have not refreshed their push registration in 365 days are automatically deleted. A pre-stale warning push notification is sent at approximately 330 days.

11. Data Security (Art. 32 GDPR)

We implement the following technical and organizational measures:

• End-to-end encryption: Push notification content is encrypted with RSA-2048 on your Nextcloud server and can only be decrypted on your device. Our Push Service and Google FCM cannot read notification content.
• Cryptographic device authentication: All push service operations (registration, deletion, license checks) are authenticated via RSA-SHA512 signatures, preventing unauthorized access.
• Secure credential storage: Nextcloud credentials are stored in the platform keychain (iOS Keychain / Android Keystore), not in plain text.
• HTTPS: All network communication uses TLS 1.2+ encryption.
• Server hosting: Our Push Service is hosted on Scalingo, a European PaaS provider with data centers in France, subject to EU data protection law.
• Database: PostgreSQL with encrypted connections.
• Access control: Push Service infrastructure access is restricted to the operator (Florian Ludwig Software Engineering). No third-party staff have access to the database or server.
• Least-privilege design: Infrastructure components are configured with minimal permissions required for their function.
• Regular review: We review security controls and access permissions based on risk level.

12. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding data processed by us (i.e., data on our Push Service):

• Right of access (Art. 15) — Request a copy of your personal data we hold
• Right to rectification (Art. 16) — Request correction of inaccurate data
• Right to erasure (Art. 17) — Request deletion of your data (“right to be forgotten”)
• Right to restriction (Art. 18) — Request that we restrict processing of your data
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interests
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time
• Right to lodge a complaint — You may file a complaint with your local data protection authority

For data stored on your Nextcloud server, please contact your Nextcloud administrator.

12.1 How to Exercise Your Rights

To exercise your rights regarding data on our Push Service:

1. Contact us at hello@anwesenheit.app with your request.
2. Identity verification: Since we only store pseudonymous device identifiers (not names or email addresses), we will ask you to provide your device identifier or to send the request from the same email address used for subscription purchases, so we can locate your data without requiring excessive additional personal data (Art. 11 GDPR).
3. Response time: We will respond to your request within one month of receipt (Art. 12(3) GDPR). If the request is complex or we receive a high volume of requests, we may extend this by a further two months, in which case we will inform you within the first month.
4. Format: We will provide information in a commonly used electronic format (e.g., JSON or PDF).
5. Escalation: If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

13. Data Deletion

You can delete your data from our systems in the following ways:

• Disable push notifications in the App — this sends a deletion request to our Push Service, removing your device registration
• Log out of the App — deletes all local data (credentials, keys, preferences) from your device
• Uninstall the App — removes all local data; push registration will be automatically cleaned up after 365 days of inactivity
• Contact us at hello@anwesenheit.app to request manual deletion of any data associated with your device or server

14. Data Breach Notification (Art. 33 & 34 GDPR)

In the event of a personal data breach affecting data processed by our Push Service:

• Supervisory authority notification (Art. 33): We will notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of affected individuals.
• Data subject notification (Art. 34): If the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay. Given that our Push Service primarily handles pseudonymous identifiers and encrypted payloads, the threshold for high risk to individuals is expected to be low in most scenarios.
• Notification method: We will notify affected users via the email address associated with their subscription (if available), or through a notice in the App.
• Internal breach register (Art. 33(5)): We maintain an internal register of all personal data breaches, including facts, effects, and remedial actions taken, regardless of whether notification to the supervisory authority is required.

15. Data Protection Impact Assessment (Art. 35 GDPR)

We have assessed whether a Data Protection Impact Assessment (DPIA) is required for our processing activities. Our assessment considered:

• Push Service processing: Involves pseudonymous device identifiers, encrypted payloads (opaque to us), and technical delivery logs. The data is not sensitive, not large-scale behavioral tracking, and not systematic monitoring of publicly accessible areas.
• License management: Involves organizational identifiers (server URLs) and pseudonymized subscriber IDs. This is standard commercial processing.
• Cross-border transfer: Limited to pseudonymized identifiers sent to RevenueCat (US) and FCM tokens sent to Google. Supplementary measures (SCCs, DPF, data minimization) are in place.

Conclusion: Based on the nature, scope, context, and purposes of the processing, and applying the criteria of Art. 35(3) GDPR and the relevant supervisory authority guidelines, we have determined that our processing does not meet the threshold for a mandatory DPIA. The processing does not involve systematic and extensive profiling, large-scale processing of special categories, or systematic monitoring of publicly accessible areas. We will reassess this determination if our processing activities change materially.

16. Data Protection by Design and by Default (Art. 25 GDPR)

We implement data protection principles throughout the design and operation of the Service:

• Encryption by default: Push notification payloads are end-to-end encrypted (RSA-2048). We cannot access content data by design.
• No access to Nextcloud content: Our architecture ensures that appointment data, attendance records, and user-generated content remain exclusively on the user’s Nextcloud server. We have no technical means to access this data.
• Minimal metadata processing: We process only the technical identifiers strictly necessary for push notification delivery and license verification.
• Separation of control domains: Data responsibilities are clearly separated between Nextcloud server (user/admin controlled), Push Service (our responsibility), and mobile device (user controlled).
• Privacy-preserving defaults: The App does not enable any optional data sharing, analytics, or tracking. Push notifications must be explicitly enabled by the user.

17. Automated Decision-Making (Art. 22 GDPR)

We do not perform:

• Automated individual decision-making
• Profiling as defined under Art. 4(4) GDPR
• Any processing that produces legal effects or similarly significantly affects users based on automated processing

License tier enforcement (active user count limits) is a straightforward contractual rule, not an automated decision within the meaning of Art. 22 GDPR.

18. Hosting and Data Location

19. Children’s Privacy

Our App is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this document. For significant changes (such as new sub-processors, changes to legal bases, or new categories of data collected), we may provide additional notice through the App.

We encourage you to review this Privacy Policy periodically.

21. Contact

For any questions or concerns about this Privacy Policy or our data practices:

Florian Ludwig Software Engineering
Email: hello@anwesenheit.app
Website: https://anwesenheit.app

This Privacy Policy applies to the Anwesenheit mobile app (iOS and Android) and the push notification relay service at push.anwesenheit.app.