Privacy in the app

Contents

1. In short
2. Scope
3. Controller
4. Data on your device
5. Status messages
6. WebSync (optional)
7. Sharing appointments and web calendar
8. Weather
9. Events of the day, wish list, flashcards
10. Feedback and ratings
11. Support from the app
12. Error reports
13. Purchases
14. Calendar sync (Android)
15. Permissions
16. Backup, export and sharing
17. Links and embedded pages
18. Server logs
19. Recipients and third countries
20. Retention at a glance
21. Your rights
22. No obligation, no profiling
23. Security
24. Children
25. Changes

As of: 1 November 2026. This policy applies to the “Verdienst Planer” app for Android (Google Play) and iOS (App Store) and to the servers the app talks to. The website has its own privacy policy.

This is a translation for convenience. The German version is authoritative.

In short

Scope

The app is available for Android and iOS. Both work largely the same; where they differ, it says so. The app talks only to my own server at www.davfla.de. It uses services of other providers only where stated below: purchases and ratings via Apple or Google and, on Android, the calendar sync.

Controller

David Illmer (DavFla)
Pfarrer-Krimmer-Weg 1
85447 Reichenkirchen
Germany
Email: support@davfla.de

I develop the website and the app on my own. I am not required to appoint a data protection officer and have not appointed one. Please contact me directly with any privacy question.

The server and the mailbox are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, in data centres in Germany. STRATO processes the data only on my behalf and on my instructions; a data processing agreement under Art. 28 GDPR is in place.

Data on your device

Everything you enter in the app is stored in a database on your device: shifts and working times, pay, tax, premium and expense details, time account, appointments including photos, birthdays, tasks, flashcards, user names and settings.

This may include details that need special protection, such as religious affiliation (church tax), sick days or your date of birth. The app needs them for its calculations. Without WebSync, I learn nothing about them.

Finance overview: The finance data is kept in a separate file that is never transferred. On iOS, it is also excluded from iCloud backup.

System backup: On Android, the app excludes all its data from Google backup and from transfer to a new device. On iOS, the iCloud or computer backup of your iPhone may contain the other app data. You control this in the iOS settings, and Apple’s terms apply. On iOS, the app folder is also accessible through the Files app or a computer, so that you can store backups yourself.

If you delete the app, this data is removed from the device.

Status messages

On start, the app loads a file with current notices from my server, for example a warning about a faulty update or a notice about a new version. Only the technically necessary connection is made; neither an identifier nor the app version is transmitted. The file is evaluated on your device.

Legal basis: Art. 6(1)(f) GDPR (being able to inform you quickly about problems).

WebSync (optional)

WebSync syncs your data between several devices, also between Android and iOS, allows sharing with a partner and serves as a backup. You do not have to use it.

What is transferred and stored

• Account: your email address, your password (stored on the server only as a hash), an account identifier (WebSync ID), the names of your app users, the language and, if you share with a partner, the sharing password and the identifier of the linked account.
• Content: shifts, working times, notes, appointments, tasks and the pay, tax and shift settings of your users. Photos on appointments and the finance overview are not included.
• Device list: For each device, the server stores a random device identifier that is not derived from the serial number or hardware. It also stores platform, app version, protocol level and a label (Android: manufacturer and model; iOS: “iPhone” or “iPad” with four characters of the identifier), and when the device was first and last seen. This lets you see in the app which devices are connected to your account.
• History: When a device overwrites a month or a setting, the server keeps the previous version for 60 days so that it can be restored after an error.
• Failed logins: After a wrong password, the server stores the time, the account identifier and a shortened hash of the IP address to detect password guessing. These entries are deleted after 30 days.

When data is transferred

On login, after changes and when you return to the app. While the app is open in the foreground, it also checks about every 45 seconds whether another device has changed something.

Forgotten password

If you request a new password, the server sends an email with a single-use link to the stored address. The email is sent via STRATO.

Legal basis

Art. 6(1)(b) GDPR (providing the feature you chose). Where special categories of personal data are included (religious affiliation via church tax, sick days as health data), the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give by setting up WebSync. You can withdraw it at any time by deleting your account. Protection against password guessing is based on Art. 6(1)(f) GDPR.

Deletion

You delete your account in the app under Main menu › Settings & data › WebSync with “Delete user”. The server then removes all content, the device list, the history, the calendar links and database copies from error reports for this identifier. The data on your devices is kept. You can also ask me by email to delete your account.

Sharing appointments and web calendar

Partner: If you link two users, the other user sees your non-private appointments. Appointments you mark as private are not shared.

Web calendar: Under WebSync › Share calendar you create a separate link for each recipient. Anyone who knows the link can see your calendar, without password and read-only. Only give it to people you trust. The link contains a random identifier, neither your WebSync ID nor your name. You can revoke each link individually. A link that was never opened expires after 14 days. For each link, the server stores only when it was first and last opened and how often, not by whom.

Links from older app versions (with “uid=” in the link) contain your WebSync ID and cannot be revoked individually. Create a new link instead and only pass on that one.

Legal basis: Art. 6(1)(b) GDPR.

Weather

For the weather forecast, the app sends the place you selected in the app to my server: place name, postcode, federal state and the coordinates of that place from the built-in list of places. There is no GPS location. My server fetches the forecast for these coordinates from Apple WeatherKit and caches it for the place, so that other users at the same place get it too. Apple receives only the coordinates of the place from my server, no information about you, your device or your IP address. Weather data: Apple Weather.

Legal basis: Art. 6(1)(b) GDPR (the weather display you use).

Events of the day, wish list, flashcards

• Events of the day: For the day view, the app loads events for that calendar day from my server. Only day and month are transmitted.
• Wish list (Android): If you vote on a feature request, only the vote for that entry is transmitted, without any identifier.
• Flashcard counter (Android): When you open the flashcards (Mandukin), the app calls an address on my server at most once a day. The server only counts how often this happened that day. It stores neither IP address nor identifier nor any content of your cards.

Legal basis: Art. 6(1)(b) GDPR; for the counter Art. 6(1)(f) GDPR (knowing whether the feature is used).

Feedback and ratings

Now and then the app asks whether you like it. If you tap Rate, the App Store or Google Play page opens; on Android sometimes Google’s rating window appears directly in the app. You submit the rating to Apple or Google.

If you write feedback in the text field instead, the app sends your text, the app version, on Android the Android version, and a timestamp to my server, which forwards it to me by email. On iOS, a random installation identifier that the app creates on first start is included; on Android, a new random identifier for each submission. Do not write anything in the text you do not want me to see.

If you choose to enter your email address (with WebSync active, your WebSync address is suggested and you can delete it), it is sent along so I can reply to you directly. Without an email address, I cannot reply. The legal basis for this is Art. 6(1)(b) GDPR (answering your request).

Legal basis: Art. 6(1)(f) GDPR (reading your feedback and improving the app).

Support from the app

Under Main menu › Help › Support, the app opens your email program with a prepared email to support@davfla.de (Android) or supportios@davfla.de (iOS). Nothing is sent until you tap Send in your email program. Below your text there is technical information so that I can help you faster: app version, device model and operating system, whether the full version is unlocked, the names of your app users with the number of their entries, whether WebSync is set up (without password) and the file names in the app folder. You can read and delete this information before sending.

If you choose “Send database”, the app attaches your database (on iOS that of the active user, on Android the main database). It contains all entries and settings, but not the finance overview.

How I handle emails, including AI-assisted reply drafts, is described in the website privacy policy. Attachments are not sent to the AI service; the technical information in the email text is.

Legal basis: Art. 6(1)(b) or (f) GDPR. If an attached database contains special categories (church tax, sick days), the legal basis is your consent under Art. 9(2)(a) GDPR, which you give by attaching it.

Sharing data with support

Instead of attaching the database to an email, you can send it directly to my server under Main menu › Help › Support with “Share data with support”. Nothing is sent unless you tap it. “What is in my data?” shows you beforehand exactly the file that would be sent.

• Content: on Android a copy of the app database with all app users, from which the WebSync password is removed first; on iOS a copy of the database of the active app user. It contains shifts, entries, appointments, to-dos and settings, never the finance overview. In addition, the identifier of your data, the platform and the app version.
• Storage: transferred encrypted (HTTPS) and stored encrypted on my server in Germany. The app shows a share code that is included in your support email. Only I, as support, see the data.
• Period: the share is deleted automatically after 14 days. If clarification takes longer, I can extend it, at most up to 60 days after sharing.
• Deletion: at any time yourself with “Delete share” in the same place; it is then removed from the server immediately.

Legal basis: your consent under Art. 6(1)(a) GDPR, and for special categories (church tax, sick days) under Art. 9(2)(a) GDPR. You give it with “Share” and withdraw it with “Delete share”.

Error reports

Error reports are sent to my server only with your consent. They help me find crashes and calculation errors.

Android

• Serious error: A window asks whether you want to send the report. If you want me to reply, you can enter an email address and a note. If you tap Send, the app also sends a copy of your app database (all users with shifts, entries and settings, plus the colour settings, without the finance overview), so that I can reproduce the error.
• Minor error: A bar appears at the bottom with “Send”, “Always send” and “Don’t send”. No database is included here. With “Always send” or the switch “Send error reports automatically” under Main menu › Settings & data › App settings, minor errors are sent from then on without asking, at most five per session. You can turn the switch off at any time.

Content of a report: error text and technical trace (stack trace), app version and package name, device manufacturer, brand and model, Android version and security patch level, language, time zone and device time, screen size, memory and free storage, network type, whether WebSync is set up, the identifier of your data, the number of your users, the table and file names in the app folder and a technical log of the last steps in the app. The log may contain names of your app users and rules.

iOS

If the app crashes, it asks once on the next start whether the report may be sent. It contains the technical error message with time, the app version, “iPhone” or “iPad”, the iOS version and the language. No database, no identifier, no entries.

Both platforms

Legal basis: your consent under Art. 6(1)(a) GDPR, and for special categories in the database copy under Art. 9(2)(a) GDPR. You give it by sending or with “Always send” and can withdraw it at any time for the future.

Retention: I keep reports and database copies as long as I need them to find the error and delete them afterwards. On request I delete them immediately. Write to support@davfla.de, ideally with your WebSync ID.

Purchases

You buy the full version in the App Store (Apple) or on Google Play. Payment and billing are handled entirely there, and the privacy policies of Apple or Google apply. I receive no payment details, no name and no address.

Apple and Google notify my server about purchases, refunds and test purchases. These notifications contain transaction details such as product, time, transaction number and type of event, but no information about you as a person. I keep them for my accounting and cannot attribute them to a device or a WebSync account.

The app remembers on the device whether the full version is unlocked. On iOS, the start of the trial period is also stored in the device keychain so that it does not restart after reinstalling. If you use WebSync, a purchase also applies on your other devices. For this, the unlock status is synced with your settings.

Legal basis: Art. 6(1)(b) GDPR (performing the purchase) and Art. 6(1)(c) GDPR (tax retention obligations).

Calendar sync (Android)

On Android, you can have shifts and appointments written to a calendar on your device, for example your Google Calendar. This is off until you set it up. The app then writes to the calendar on the device and reads appointments from it for display. If the calendar belongs to a Google account, Android syncs it with Google, and Google’s terms apply. My server is not involved.

Permissions

Every permission is optional. Without it, only the feature in question is missing.

Android

• Internet: for WebSync, weather, status messages and the other requests described here.
• Read and write calendar: only for the calendar sync, and only once you set it up.
• Notifications: for reminders, the shift alarm and flashcards.
• Exact alarms, full-screen notification, access to Do Not Disturb, vibration, wake lock, foreground service, start after reboot, exemption from battery optimisation: so that the shift alarm rings on time and reliably.
• Google Play billing: for buying the full version.

iOS

• Photos: to add a photo to an appointment. The photo stays on the device and is not transferred with WebSync. The app does not use the camera.
• Notifications: for reminders of appointments and shifts. They are created on the device; the app does not use push messages via a server.

Backup, export and sharing

Backup files, PDF reports (such as the pay overview or the tax report) and shared content go wherever you send them yourself, for example by email, messenger or to a cloud. The terms of the respective provider apply to these channels. Such files can contain sensitive details, and backups also contain your appointment photos. The finance overview is not included in the app’s backups.

Links and embedded pages

Some menu items open third-party pages, but only when you tap them. Schicht-Wissen (www.schicht-wissen.de, also as a forum) is loaded in a window inside the app. Wikipedia, the sources of the statistics (such as Destatis or Eurostat) and the store pages open in the browser or the store. The respective provider receives the usual connection data such as your IP address, and their privacy policy applies. The help is built into the app and loads nothing from the internet.

Server logs

My server keeps no access log. If a technical error occurs during a request from the app, the web server writes it to an error log with time, IP address and requested address; the log is deleted after 14 days (Art. 6(1)(f) GDPR, secure operation).

Recipients and third countries

With Apple and Google you are a customer yourself, and their privacy policies apply. Transfers to Anthropic in the USA are covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which are part of Anthropic’s contract terms. Beyond that, I pass on data only if I am legally obliged to. I do not sell data and do not use it for advertising.

Retention at a glance

Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): which data I hold about you.
• Rectification (Art. 16 GDPR) of incorrect data.
• Erasure (Art. 17 GDPR), unless a retention obligation applies.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): your data in a common, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future. Processing up to that point remains lawful.

Right to object (Art. 21 GDPR): Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. I will then stop processing the data unless I can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

A short email to support@davfla.de is enough. So that I do not hand out data to the wrong person, I may ask for something like your WebSync ID.

Complaints: You can lodge a complaint with any data protection supervisory authority. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

No obligation, no profiling

You are under no legal or contractual obligation to provide data. Without the respective details, only the feature concerned is unavailable. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

The pay and tax calculation is an estimate on your device. It decides nothing about you and is not transmitted to me.

Security

All connections to my server are encrypted via HTTPS (TLS). Access to the server and the admin area is password-protected, and WebSync account passwords are stored only as hashes. No system is perfectly secure, but I keep the server up to date and check it regularly.

Children

The app is aimed at working people and not at children under 16.

Changes

If the app changes, for example through new features that transfer data, or if the legal situation changes, I will update this policy. The version published here applies; the date is at the top.