Privacy.

for the heartnote app and heartnote.app · 20 October 2026 · the German version (Datenschutzerklärung) is the binding one

1. Who is responsible

2. In short

• We only store what the app needs to work.
• No ads, no tracking, no analytics, no selling of data.
• The app's data is stored in the EU.
• You can export all your data and delete your account right in the app.

3. The website heartnote.app

The website is hosted by Cloudflare (Cloudflare, Inc., San Francisco, USA; EU representative Cloudflare Germany GmbH, Munich). When you visit it, Cloudflare processes the connection data needed to deliver it: IP address, date and time, the page requested, browser and operating system, and the referring page. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running the site securely and reliably). The site sets no cookies, uses no analytics and loads nothing from third parties, fonts included.

4. The heartnote app

4.1 Sign in with Apple

You sign in with Apple. We don't ask for your name or your email. Apple only gives us an identifier that stays the same for our app and says nothing about you. After signing in, your device gets a session key, kept in the iOS Keychain. Our server only stores a hash of it. Sessions end after 180 days without use. Legal basis: Art. 6(1)(b) GDPR (providing the app you want to use).

4.2 What you create in the app

• Profile: your @handle, an optional display name, your timezone (so "today" starts at your midnight) and whether friends may see your shelf.
• Shelf: perfumes in your collection, wishlist or "used to own", with size, type (bottle, decant, sample), a note, and optionally the price you paid.
• Ratings from 0.2 to 5 hearts.
• Wear log: which perfume you wore on which day (at most three a day).
• Friendships and friend requests.
• Catalog contributions: perfumes, brands, bottle sizes, barcodes and photos you add, and whether we approved or declined them, with our reason.
• Reports you send about content.

Legal basis: Art. 6(1)(b) GDPR.

4.3 Who sees what

• Other users can find your @handle and display name, so they can add you as a friend.
• Your friends see your shelf, your ratings and what you're wearing today, unless you turn that off in the app. Only you see what you paid, your cost per wear and your notes.
• We combine everyone's ratings into a community score per perfume. It doesn't show who rated what.
• Perfumes and photos you add to the catalog become visible to everyone once we've reviewed them, without your name. Until then, a new perfume is only visible to whoever added it or has it on their shelf, and a new photo only to you.

4.4 Photos and camera

You pick photos yourself. The app cuts out the bottle on your device, resizes the image and saves it again, which drops all metadata, including where it was taken. Our server removes any metadata left on top of that. The camera is only used to scan the barcode on a box. The camera image is processed on the device and never stored or sent.

4.5 Where the data lives

The app's data is processed by Cloudflare: Workers for the API, D1 for the database, R2 for photos. The database and photo storage are restricted to the EU. We have a data processing agreement with Cloudflare (Art. 28 GDPR). Where data does go to the US, Cloudflare is certified under the EU-US Data Privacy Framework. Sign-in runs through Apple (Apple Distribution International Ltd., Cork, Ireland), and Apple's own privacy policy applies to it as well.

4.6 How long we keep it

We keep your data while you have an account. When you delete it in the app, we immediately delete your profile, shelf, ratings, wear log, friendships, contribution history and every photo that wasn't approved for the catalog. Only catalog entries and approved catalog photos you contributed remain, no longer linked to you. Reports stay without a link to you for as long as we need them to handle them.

Cloudflare backs up the database automatically so it can be restored after a failure. Deleted data can therefore remain in these backups for up to 30 days before it's gone for good. We only touch the backups to recover from a failure.

4.7 Moderation

We review new catalog entries and photos before everyone can see them. The more of your contributions we've approved, the less gets reviewed ("trust level"). If we decline or remove something of yours, the app shows you why (Art. 17 DSA). Legal basis: Art. 6(1)(b) and (f) GDPR (a clean, lawful catalog).

4.8 Minimum age

heartnote is for people aged 16 and over.

4.9 What we don't do

The app has no ads and no tracking or analytics SDKs. It sells no data and builds no advertising profiles. If we add features like notifications or personal recommendations, we'll update this policy first.

5. Email

If you email us, we only use your message and address to handle your request, and delete them afterwards unless the law requires us to keep them.

6. Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Get a copy of your data in the app under "you → export everything we store about you", and delete your account there too. For anything else, email hi@byphil.me.

7. Complaints

You can complain to a data protection authority (Art. 77 GDPR). Ours is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.