Privacy policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer; the conditions of Art. 37 GDPR and § 38 BDSG do not apply to us.

This policy covers two things that are technically unrelated: the Cozysweep iOS app (section 2) and the website cozysweep.com (section 3).

2. The app

Cozysweep keeps your content on your device and in your own iCloud account. We run no server of our own, hold no user account, and have no access to that content. There is nothing to sign up for.

What the app creates

• rooms, tasks and their schedules
• tasks you completed, skipped or postponed, with a timestamp
• your coin balance, the decorations you bought, your companion
• settings such as reminder times and appearance
• in a shared home, additionally: each member’s first name and role, and who completed which task

Nothing beyond that is collected — no surnames, no dates of birth, no addresses, no contacts, no photos, no location, no health data.

Where it is stored

Your content is stored locally on your device and synchronised through Apple’s iCloud service CloudKit into the private database of your own iCloud account. That synchronisation is a relationship between you and Apple and is governed by Apple’s terms and privacy policy. None of it is ever transmitted to us.

iOS encrypts the data stored on your device. That protection only takes effect if a device passcode (or Face ID / Touch ID) is set up. We can neither enforce nor verify that — it is in your hands.

Sharing a home

Sharing a home works through Apple’s sharing mechanism, inside the iCloud accounts of everyone involved. It is invite-only; there is no public access. The first name shown to other members comes from that Apple share. Everyone in a home can see its rooms, tasks and completions.

A child in a home is kept as a profile inside the adult’s data — no separate Apple account and no additional iCloud identity is created.

Completion history stays

Who completed a task is recorded permanently within the home. Those entries are not removed retroactively, because otherwise a shared home’s history could be rewritten after the fact. If someone leaves a home or is removed, their profile disappears from the member list and from every assignment — but their first name remains visible on the tasks they already completed.

That remaining history can be removed completely: the owner of the home deletes the home, which removes all associated data from the iCloud zone.

Notifications

Reminders are scheduled and triggered locally on your device. The app asks for permission only at the point in the flow where it actually needs it. To keep a shared home in sync, the app also relies on Apple’s CloudKit notifications; those are contentless signals sent by Apple, not messages from us.

Purchases and subscription

All purchases run through Apple’s StoreKit. Apple is your counterparty and handles payment, invoicing, VAT and refunds. The app stores no purchase history — it only reads whether a valid entitlement exists. No payment data reaches us.

No tracking, no third-party components

The app contains no analytics tool, no crash reporting service, no advertising and no third-party component. There is no cross-app tracking, which is why no tracking permission dialog appears. Apart from Apple we use no processors. The app’s privacy label on the App Store states accordingly that no data is collected.

Children

The app is not directed at children under 13.

3. This website

cozysweep.com sets no cookies, embeds no third-party content and measures no visitor behaviour. That is why there is no consent dialog: nothing beyond what is technically necessary is accessed on your device (§ 25 (2) no. 2 TDDDG).

Hosting

The website runs at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. The host processes the data listed below on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.

Server log files

When you request a page, your browser transmits technically necessary information that the web server records:

• IP address
• date and time of the request
• the address requested and the response status code
• amount of data transferred
• the referring page, if your browser sends one
• browser and operating system identification

We need this to deliver the page at all, to trace faults, and to detect and repel attacks. It is not combined with other data and not used to identify individuals. The legal basis is our legitimate interest in a secure and functioning service (Art. 6 (1) (f) GDPR). Logs are deleted automatically after seven days.

Encryption

The site is served over HTTPS only. Certificates are obtained automatically from Let’s Encrypt.

Fonts

Nunito and Nunito Sans are served from our own server. Loading the site creates no connection to Google or any other font provider.

Contact by email

There is no contact form on this website. If you email us, we process what you send in order to answer you. The legal basis is Art. 6 (1) (b) GDPR where a contract is involved, otherwise Art. 6 (1) (f) GDPR. We delete messages once the matter is settled, unless a statutory retention period applies. Our mailbox is hosted by IONOS SE, Montabaur, Germany.

4. Legal bases

Where we process personal data, we rely on:

Art. 6 (1) (f) GDPR — legitimate interest

Server log files for delivery, fault tracing and defence against attacks; answering general enquiries.

Art. 6 (1) (b) GDPR — contract

Answering enquiries that concern a contractual relationship.

Art. 6 (1) (c) GDPR — legal obligation

Retention where the law requires it.

For the content inside the app we need no legal basis, because we do not process it: it never leaves your device and your iCloud account in our direction.

We transfer no data to countries outside the EU and the EEA. Your use of iCloud and the App Store is governed by your relationship with Apple. There is no automated decision-making, including profiling.

5. Your rights

You have the following rights towards us:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing we base on a legitimate interest (Art. 21 GDPR)

In practice this concerns the server log files and any emails you send us — that is all we have. The content from the app is yours: you delete it by removing the app, deleting the associated iCloud data, or, as the owner of a shared home, deleting that home. We cannot give you access to app content, because we have none.

If you wish to complain, you may contact any data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, in Stuttgart.

6. Contact

For privacy questions and to exercise your rights, reach us at developer@aqlis.de or by post at the address in section 1.

7. Changes to this policy

We update this policy whenever something described here changes in the app or on the website — for instance when a new service is added. The version published on this page is the one that applies; the date at the top shows its current state.

8. Binding version

This is a translation provided for convenience. In case of doubt or discrepancy, the German version at cozysweep.com/datenschutz prevails.