1. Who we are
Tendle (the "App", "we", "us", "our") is an iPhone app that helps a parent be present with their young child, plus this website. The data controller under Article 4(7) GDPR is:
Nils Schiwora, trading as Nils Schiwora Trading Services Ahornstr. 37 14547 Beelitz Germany
If you have questions about this policy or want to exercise your rights, write to support@tendle.me.
For our business address in Brandenburg, the competent supervisory authority is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg). You can always file a complaint with the authority of your habitual residence (Art. 77 GDPR).
2. What the App does, and how it handles data
Tendle is local-first. It suggests play ideas for children aged 1 to 5 and records the time you spend playing together. An optional Challenge counts your playdays. A weekly plan with reminders helps you keep regular times for play. After a play you can keep an optional memory: a photo, a note, a title and a memory page that the App makes on your device. The optional App protection pauses the apps you chose while you play, using Apple's Family Controls (Screen Time).
There are no user accounts. Full play records, memories, photos, your weekly plan and your chosen apps stay on your device. The limited usage, consent and reminder facts sent for notifications, analytics and Purchase support are described below, alongside optional feedback, research answers, founder chat and subscription services.
2.1 Local storage and limited service data
| Data | Where it lives |
|---|---|
| Photos you add to a memory (optional) | Taken with the camera or chosen in the system photo picker; the App receives only the photo you choose. Stored in the App's private container (excluded from iCloud backup) and analysed only on your device |
| Memory pages | Made on your device from your photo, note and title, and stored in the App's private container (excluded from iCloud backup) |
| Play records: activity, date and recorded duration | Full records stay on device. Limited counts and rounded timing may go to the services described in Section 2.2. |
| Notes and titles you write | Stored on device |
| Challenge progress and history | Full history stays on device. Current progress is sent for enabled Challenge notifications (Section 2.2). |
| Your weekly plan and its time slots | The full plan and scheduled reminders stay on device. Upcoming reminder times can be sent to prevent campaign interruptions (Section 2.2). |
| Your child's name and age range, your name and your onboarding answers | Stored on device. The age range and the answer choices also go to PostHog as events without any name (Section 2.2) |
| Your choice about offer notifications: the choice, the text shown to you and the time | The consent record stays on device; category choices, consent versions and timing are also sent for notification delivery (Section 2.2). |
| Which apps you chose for App protection | Stored by iOS as opaque Family Controls tokens that the App cannot read and that never leave your device |
| The Live Activity | Made on device from your local data; it shows no photos and no notes |
| Your settings (defaults, reminder and notification choices, onboarding and paywall state) | Stored on device. Notification choices and selected service settings are transmitted as described in Section 2.2. |
Photos are optional. You can take a photo with the camera or choose one in the system photo picker. With the picker, the App receives only the photo you choose and cannot see the rest of your library. The App keeps photos and memory pages in its own private container and analyses them only on your device, for example to cut out the subject for the memory page and to find faces and people for its layout. The App does not identify anyone in a photo. A photo or memory page goes to Apple Photos or to another app only when you tap export or share. For export, Tendle requests add-only access and cannot view your library. If iCloud Photos is enabled, Apple may sync exported copies across your devices. Tendle never uploads a photo, note or memory page to its own or another provider's server.
If you used an earlier version of Tendle, your earlier kid-time sessions, photos and streak stay on your device after the update. Before the new version opens them for the first time, the App makes a one-time safety copy of the earlier database on your device. "Delete data" in Settings also removes this copy.
App protection is optional. It uses Family Controls (Screen Time) to pause the apps you select during play. Your selection is represented by opaque OS tokens; the App cannot see which apps they are, and that selection never leaves your device.
2.2 Data handled by service providers
If you send feedback from Settings, the App sends your selected category, message, optional reply email, app version and build number, locale, and current subscription status to our API. Cloudflare Workers and D1 store it for 90 days and then delete it automatically. The email address is used only to reply to that feedback. After each submission, our server sends a short alert email to the founder's inbox through the email service PurelyMail. The alert contains only a random submission ID, the category, the app version and build number, the locale and the subscription status. It never contains your message or your email address. The same applies to research answers in your own words. RevenueCat Customer Center may also collect one predefined cancellation reason; it does not ask for free-form cancellation text.
| Data | Purpose |
|---|---|
| Subscription transaction and entitlement state | Processed by Apple and mirrored through RevenueCat to unlock paid features — see Section 4 |
Explicit product analytics events (e.g. app_started, paywall_viewed) |
Sent to PostHog while Product Analytics is enabled — see Sections 3 and 4 |
| Your answer choices in the onboarding, including your child's age range (e.g. "2–3 years") and what your child needs right now (e.g. "Moving and romping"), and in the optional research questions | Sent to PostHog as product analytics events while Product Analytics is enabled — see Sections 3 and 4 |
| Apple Ads attribution: campaign, ad group and keyword IDs returned by Apple's AdServices framework | Reduced properties are sent once to the install-scoped PostHog profile for Analytics while Product Analytics is enabled. Attribution is disabled for EEA, UK or unknown storefronts and for EEA/UK device regions; the raw token and response are not sent to PostHog or retained by Tendle. No IDFA or cross-app/site tracking. |
| Your own words, if you type them for a research question in the onboarding, with the question, the answer you chose, your language, the app version and your subscription status | Stored by our feedback service (Cloudflare) for 90 days and used only to improve the App — see Sections 3 and 4 |
| Masked mobile session replays | Sent to PostHog while Product Analytics is enabled to diagnose navigation and usability problems; all images (including your photos), notes, displayed text and typed text are masked before transmission |
| Your support message and email address, if you contact support | Used only to answer your request — see Section 4 |
| Purchase-support data: coarse per-day session counts and your "Purchase support" setting | Stored on our API (Cloudflare) so we can answer Apple's refund enquiries — see Sections 3 and 4 |
| Our answer to Apple's refund enquiry (purchase delivered yes/no, trial shown yes/no, our recommendation) | Sent to Apple only when you request a refund from Apple — see Sections 3 and 4 |
| Website request counts (UTC date and fixed page, resource, redirect, campaign, placement, and referrer categories) | Used to assess website and content effectiveness — see Section 4.1 |
Optional research questions. The onboarding asks a few optional questions, for example what Tendle should make easier for you. Your answer choices go to PostHog as events and contain no free text. If you also type something in your own words, the App sends that text to our feedback service with the context listed above. We store no name, email address or device identifier with it, and we do not reply to it. Please do not write names or other personal details in this field.
Purchase support. When this setting is enabled, our API uses the RevenueCat app-user identifier to associate your choice (including its version and source) with coarse daily counts of completed sessions and premium actions, plus flags for active entitlement and entitlement errors. This helps us answer Apple's refund enquiries and prevent refund abuse. We send Apple a limited consumption answer only when you request a refund from Apple; no photos, notes, activity titles or individual-action timestamps are included. Daily usage rows and Apple notifications expire after 730 days. You can object by turning off Purchase support in Settings. This choice is separate from Product Analytics and is preserved when you delete local data.
Notifications in app 2.0. Enabling notifications in onboarding and granting iOS permission turns on ideas, Challenge messages, offers and feedback invitations. Each category can be changed in Settings or Help without a subscription. Product Analytics is independent. Chosen reminders keep your selected schedule on the iPhone.
Our Cloudflare service uses installation and push identifiers, the existing pseudonymous RevenueCat identity, category choices, locale, timezone, app version and verified subscription state. With behavioral categories enabled, it also receives rounded usage/completion times, distinct play dates from the last 30 days and current Challenge progress. Coarse active-play status and upcoming reminder times prevent interruptions, including for offers-only settings. We upload no names, photos, notes, selected apps, activity titles or full play records for notifications. Campaign references do not reuse analytics IDs.
Eligibility is checked before sending; long-inactive paying users receive no discretionary campaigns. We record decisions, provider acceptance and opens. Apple receives the token and notification text; acceptance is not proof of display or reading. Device snapshots are deleted on all-category opt-out or local-data deletion, or after 90 days without sync. Delivery and deduplication records expire after 548 days. Billing identity remains while its push registration or retained delivery history exists.
To compare notification campaigns, our campaign service records eligible test groups, feedback submissions and category opt-outs. For people assigned to a test, it also links purchases, renewals, refunds and estimated proceeds after store fees and taxes using the existing billing identity. This campaign measurement is separate from Product Analytics and continues when that PostHog setting is off. No campaign identity is sent to PostHog. Campaign measurement records are retained for up to 548 days.
Question after a cancellation. Verified voluntary cancellation may lead to one feedback invitation after 24 hours while access remains valid and feedback notifications are enabled. Prior feedback, renewed auto-renewal, quiet-user status, refunds, unknown information and frequency limits may suppress it. The form requires no subscription or purchase. Necessary billing-recovery messages and requested support replies follow separate service rules.
By design, no photo, note, title, file path or memory reference is sent to analytics. Product analytics uses counts, durations, predefined answer choices and device context. Events, reduced Apple Ads attribution and masked replay are linked to a pseudonymous, install-scoped PostHog identifier and profile. We do not add your name or a RevenueCat identifier to that profile. This is linked data in Apple's privacy label, even though no account is required.
Product usage and subscription outcomes. While Product Analytics is on, the App creates a random measurement identifier for this installation. It adds that identifier to product events and sends it, together with the existing pseudonymous RevenueCat app-user identifier, to Tendle's private Cloudflare service. This association does not require notification permission. It lets us compare onboarding choices and product-usage groups with later verified subscription events, including renewals and refunds. It relates to an installation, not a verified person's identity, and does not reconstruct history from before the association.
The RevenueCat identifier is not sent to PostHog, and the measurement identifier is not sent to RevenueCat. Restricted reporting combines pseudonymous group membership from product analytics with our private billing records and returns aggregate results. We do not use this association for cross-company advertising.
Switching Product Analytics off stops new product-event collection and requests deletion of the private association and its linked billing records. If the App is offline, the deletion request is retained for delivery when a connection is available. Local data deletion also retires the association. These actions do not automatically erase previously ingested PostHog history; Section 7 explains how to request that deletion. Minimal revocation markers, without the billing identifier or billing records, prevent delayed uploads from recreating a retired association.
2.3 Optional founder chat
When you start a conversation, we store your messages, an optional name you provide for yourself, and a random installation identifier. We also receive your language, timezone, app/build version and approximate country from the network connection, with capture dates. Country can reflect travel or a VPN. We do not attach child names, photos, notes or play records to support context.
Cloudflare Workers, Durable Objects and D1 provide the chat. To help answer subscription questions, we may verify signed Apple purchase evidence against RevenueCat and retain a minimal, dated plan/status snapshot. This does not create an account, link another conversation, or require Product Analytics. Raw purchase evidence is verified transiently, not retained.
If you enable reply notifications, Apple APNs receives your device token and a generic reply alert. We receive only a coarse active/idle kid-time state to reduce interruptions; background delivery cannot be guaranteed to stop while offline. Operator alerts through PurelyMail and browser push providers contain no message text, name or subscription details.
Messages and associated delivery/event records expire after 90 days. Idle support context and names are removed after 90 days; inactive parent push targets also expire. The on-device cache holds at most 500 messages, for up to 90 days; unsent messages remain until delivered, discarded or deleted. Conversation settings let you delete the conversation and disable reply notifications. Offline deletion clears local content immediately and visibly waits for connection to finish server deletion. A content-free revocation record prevents replay from recreating deleted content. No chat content is sent to analytics or session replay.
2.4 App Store privacy categories
Apple calls data “linked to you” when it is associated with a user, device or profile identifier, even without an account or a name. We declare all the categories below as linked. Optional support and research text can also contain identifying details. None is used for tracking across other companies' apps or websites, and we do not use IDFA.
| Data type | Examples and purposes |
|---|---|
| Name | The name you optionally provide in founder chat; App Functionality (support). |
| Email Address | Your optional reply address for feedback or support; App Functionality. |
| Customer Support | Feedback and chat messages with their support context; App Functionality. |
| Coarse Location | Approximate country/region for analytics and support, and timezone for campaign timing; Analytics, App Functionality, and Developer's Advertising or Marketing (Tendle offers). No GPS or precise location is requested. |
| User ID | RevenueCat and service-assigned user identifiers for subscriptions, Purchase support and campaigns; App Functionality, Analytics, and Developer's Advertising or Marketing. |
| Device ID | Installation identifiers and push tokens for analytics, service delivery and campaigns; App Functionality, Analytics, and Developer's Advertising or Marketing. |
| Purchase History | Purchases, access, renewals and refunds for paid features, support, campaign eligibility and outcome measurement; App Functionality, Analytics, and Developer's Advertising or Marketing. |
| Product Interaction | Product events, onboarding choices, Purchase support counters, category choices, limited play/Challenge timing and notification activity; Analytics, App Functionality, and Developer's Advertising or Marketing. |
| Advertising Data | Reduced Apple Ads attribution associated with the install-scoped PostHog profile; Analytics. |
| Other Usage Data | Masked session replay associated with the install-scoped PostHog profile; Analytics. |
| Other User Content | Optional research answers in your own words; Analytics (product improvement), stored separately from PostHog. |
“Developer's Advertising or Marketing” covers our own offer notifications using the campaign information described in Section 2.2. It does not mean third-party advertising or cross-company tracking. Photos, notes, memory pages and your selected apps are not collected by these services. This release does not include Sentry or transmit crash or performance diagnostics.
3. Why we process it (legal bases)
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Running the App's core features on your device | Performance of a contract — Art. 6(1)(b) |
| Processing your App Store subscription | Performance of a contract — Art. 6(1)(b) |
| Sending local reminders and notification categories you turned on, including offers | Consent — Art. 6(1)(a). Local reminders stay on your device; campaigns use the service described in Section 2.2. You can withdraw by category in Settings. |
| Minimized product analytics and measuring campaign results | Our legitimate interest — Art. 6(1)(f). Product Analytics controls PostHog events, attribution, replay and the private product/billing association. Campaign outcome measurement is separate, as described in Section 2.2; you can object using the contact details in Section 7. |
| Aggregate website measurement to assess page and resource effectiveness | Our legitimate interest — Art. 6(1)(f). You can object using the contact details in Section 7. |
| Optional research questions in the onboarding (answer choices and optional free text) to improve the App | Our legitimate interest in improving the App — Art. 6(1)(f). Typing your own words is optional. Answer choices follow your Product Analytics setting (Section 7). |
| Asking by push notification why you cancelled, to improve the App | Our legitimate interest in improving the App — Art. 6(1)(f). You can turn off notifications at any time in the iOS Settings (Section 2.2). |
| Answering a support request you send us | Performance of a contract / our legitimate interest — Art. 6(1)(b)/(f) |
| Meeting legal retention duties (tax, accounting) | Legal obligation — Art. 6(1)(c) |
| Answering Apple's refund enquiries and protecting against refund abuse | Our legitimate interest — Art. 6(1)(f), Recital 47. You can object at any time in Settings ("Purchase support", Section 7). |
4. Service providers and recipients
We use a small number of processors. Because Tendle is local-first, most of what you do never reaches any of them.
| Provider | Role | Region | Notes |
|---|---|---|---|
| Apple Inc. | App distribution and App Store subscription processing | USA (with EU sub-processors) | Apple receives purchase and refund metadata directly from you under Apple's own privacy policy. Family Controls (Screen Time) is an Apple system; your app selection is held by iOS as opaque tokens. Apple's push service (APNs) delivers the push notifications our server sends (Sections 2.2 and 2.3). |
| RevenueCat | Managing the subscription entitlement and exposing it back to the App | USA | We use RevenueCat as the subscription source of truth. It processes App Store transaction metadata, the product identifier, the entitlement status, and a RevenueCat-issued app-user identifier. While Product Analytics is enabled, immediately before checkout it also receives the coarse paywall placement and configured variant so we can compare purchase surfaces. It receives no PostHog or per-presentation identifier. It does not receive your photos. |
| PostHog | Product analytics for the iOS App and aggregate website measurement | EU — eu.i.posthog.com |
The iOS App sends explicit pseudonymous product events and masked session replays by default under our legitimate interest. Replays reconstruct App screens, taps, and navigation to help us identify usability problems; all images (including your photos and the App's own illustrations), notes, displayed text and text inputs are masked before transmission, and replay logs and network telemetry are disabled. You can object at any time by switching off Product Analytics in Settings. Screen/lifecycle/element autocapture and the direct RevenueCat–PostHog identity integration remain disabled. The separate private product/billing association is described in Section 2.2. Events are associated with a pseudonymous, install-scoped profile so PostHog can show coarse country/region and standard device context. We do not add a name, account identity, RevenueCat identifier, your child's name, or free text to that profile. Onboarding answer choices, such as your child's age range, are sent as events (Section 2.2). No photo, child name, note, custom text or file path is included; free text from research questions never goes to PostHog. This website does not use session replay. |
| Vercel Inc. | Hosting for this website | Vercel Edge Network globally | Standard request data (IP address, user agent) flows through Vercel logs for abuse prevention. |
| Cloudflare | Tendle API, purchase attribution, feedback, chat, Purchase support and campaigns | Global infrastructure | Workers and D1 store minimized purchase-attribution snapshots for up to 730 days only when Product Analytics was enabled at checkout; these snapshots contain no RevenueCat App User ID or PostHog ID. Separate services process feedback and research text (90 days), Purchase support (730 days), and founder chat (Section 2.3, also using Durable Objects). The campaign service uses its own installation/billing links, consent, limited usage and timing, and verified purchase information for delivery, Tendle offer eligibility and campaign measurement (Section 2.2). The retention periods in Section 6 apply to each service separately. A separate product-measurement service holds the installation/billing association and prospective billing records described in Section 2.2, governed by the Product Analytics setting. |
| PurelyMail | Sending short alert emails from our server to the founder's inbox | USA | Used after each feedback, each research answer in your own words, and for founder chat alerts (Section 2.3). A feedback alert contains only a random submission ID, the category, the app version and build number, the locale and the subscription status. A chat alert contains only a fixed text and a link to the inbox. No alert contains your message, your email address or your name. |
We do not sell your data or use it for advertising that tracks you across other companies' apps or websites. If offers are enabled, Tendle uses the limited campaign data described in Section 2.2 to choose eligible offers about Tendle and measure their results.
4.1 This website
Website measurement runs through server-side requests to PostHog's EU service. The site does not load an analytics SDK in your browser or set analytics cookies. We count eligible HTML requests for public pages, PDF requests, and first-party app-link redirects. Recognized bots, prefetch requests, byte-range requests, and requests marked Do Not Track or Global Privacy Control are excluded. Some automated or repeated requests may still be counted.
Each event records its UTC date and fixed categories: the page or resource path, app-link campaign and placement, and a broad referrer category. PostHog also records when it receives the event. Reports group events by UTC date. All events use one shared counter ID, and PostHog does not create a person profile from them. The event sent to PostHog contains no visitor, session, or device ID, cookie or local-storage value, IP address, user-agent, full referrer, or query string.
When testing homepage headlines, we also count the fixed experiment name, variant (A, B or C) and page language. Eligible page requests are randomly assigned a variant; we do not store your assignment. App links carry the same variant as a campaign category. No visitor or session identifier is created.
For download links, the fixed categories also include the referring platform, our public account label, link placement (bio, story, message or website), page language, broad browser/device category, and whether a store-link request was triggered by a button or an automatic redirect. These labels describe the shared link, not the person using it. They remain in the link when you open it in another browser. We do not join those browser visits. Apple campaign links allow separate, aggregated download reporting in App Store Connect, subject to Apple's reporting thresholds; website requests are not proof of an install.
These are request counts. They do not identify unique people, confirm that a PDF finished downloading or an app was installed, or show an individual journey. In-site navigation that does not request a new HTML document is not counted. Play-idea filter choices stay in your browser and are not counted. Homepage QR codes link directly to the App Store, so their scans are not counted. A QR code on the download page opens the same labelled download page; the resulting page request is counted, without identifying it as a unique scan.
Your browser still sends ordinary request information, including its IP address, user-agent, and referrer, to Vercel for hosting. Vercel's handling of that information is separate from the limited count events sent to PostHog.
5. International transfers
Apple, RevenueCat and PurelyMail are based in or operate from the United States.
PostHog uses its EU region (eu.i.posthog.com) for analytics storage for both
the iOS App and this website. Restricted reporting may process pseudonymous
group membership in Tendle's Cloudflare service as described in Section 2.2. The
processor terms for the non-EU processors have been confirmed for launch.
Transfers to non-EU recipients rely on Standard Contractual Clauses adopted by
the European Commission, plus supplementary measures where required by Schrems
II. Where a provider participates in the EU-US Data Privacy Framework, we also
rely on its current certification as an additional safeguard.
6. How long we keep your data
| Category | Retention |
|---|---|
| Photos, memory pages, play records, notes, Challenge history, weekly plan, settings and the safety copy of earlier data (on device) | Until you clear them with "Delete data" in Settings, or delete the App |
| Subscription and entitlement records (Apple / RevenueCat) | Held by Apple's account records and RevenueCat for subscription history until deletion is requested |
| Minimized purchase-attribution snapshots (Tendle / D1) | Up to 730 days |
| Private product/billing associations and linked billing records (Tendle / D1) | Associations expire after 450 days without refresh; billing records are retained for up to 450 days. Opt-out or local data deletion requests earlier deletion. Minimal revocation markers without billing identifiers/records remain to prevent delayed uploads recreating a retired association. |
| Feedback and research answers in your own words (Tendle / D1) | Deleted automatically after 90 days |
| Legacy 1.x cancellation-feedback and delivery records (Tendle / D1) | Deleted automatically after 90 days; the 2.0 campaign records use the periods below. |
| Push registration: installation ID, RevenueCat user ID, device token (Tendle / D1) | Until Apple invalidates the token, then up to 90 days. Campaign and chat state have their own deletion rules below and in Section 2.3. |
| App and website analytics events | PostHog currently reports a provider-controlled retention window of up to 84 months; we are working to shorten it |
| Masked mobile session replays | Up to 30 days in PostHog |
| Support correspondence | Only as long as needed to resolve your request and to meet legal obligations |
| Subscription and invoicing records | Up to 10 years where required by German tax and commercial law (§ 147 AO, § 257 HGB) |
Additional service retention:
| Category | Retention |
|---|---|
| Campaign device snapshots | Deleted on all-category opt-out or local-data deletion, or after 90 days without sync. |
| Campaign delivery, deduplication, test assignments, purchase/refund/renewal measurement and outcomes | Up to 548 days. Reconciliation snapshots remain only while their campaign subject is retained. |
| Minimal campaign billing identity/state | While the push registration or retained delivery history exists. Minimal sequence/deletion records remain only while the corresponding push installation exists to reject late requests. |
| Purchase support daily usage and Apple refund notifications | Up to 730 days. |
| Founder chat messages and associated records, idle support context/names and inactive push targets | 90 days, as detailed in Section 2.3. |
7. Your rights
Under the GDPR you can:
- Ask for confirmation of what we process about you and a copy of it (Art. 15)
- Have inaccurate data corrected (Art. 16)
- Have your data deleted (Art. 17), subject to legal retention duties
- Restrict processing while a dispute is open (Art. 18)
- Receive your data in a portable, machine-readable format (Art. 20)
- Object to processing based on legitimate interest, including analytics (Art. 21)
- Withdraw any consent you gave us at any time, with effect for the future (Art. 7(3))
- Lodge a complaint with a supervisory authority (Art. 77)
Because Tendle is local-first, you control most of your data directly: Settings → Delete data removes from your device the photos, memory pages, play records, notes and titles, Challenge history, weekly plan, your settings (except your Product Analytics and Purchase support choices) and the safety copy of earlier data. It also requests deletion of the founder chat conversation (Section 2.3) and campaign device state. When offline, server deletion is retried when a connection is available. Turning off all notification categories also removes campaign device state; minimal retained delivery, billing and campaign measurement records follow the periods in Section 6. Copies you exported to Apple Photos or shared with other apps are not affected. Feedback and research answers you already sent are deleted after 90 days, and product analytics data follows PostHog's retention (Section 6). To exercise any other right, email support@tendle.me. We aim to respond within 30 days (Art. 12(3)). See the Support page for the practical steps.
8. Children
Tendle is a tool for the parent and is not directed at children under 16. We do not knowingly process data of users under 16 without verifiable parental consent (Art. 8 GDPR). The App does not ask a child to create an account or hand over personal data. Your child's name and photos stay on your device and are never uploaded; session replays mask all images. The age range you choose is sent as an analytics event, without any name, while Product Analytics is enabled. If you believe a child has used the App in a way that gave us their data, write to support@tendle.me and we will delete it.
9. Security
The App's sensitive content — your photos, memory pages, notes, app selection and play records — stays on your device. We use HTTPS for all traffic to our service providers, rely on Apple's app sandbox and on iOS keychain/secure storage where applicable, and limit internal access on a need-to-know basis. No system is perfectly secure. If you become aware of a vulnerability, please report it to support@tendle.me.
10. Changes to this policy
We will post material changes here and, where the change affects you (for example, a new processor handling your data), notify you in the App at least 14 days before the change takes effect. The date at the top of this page shows when it was last revised.
11. Contact
For all privacy questions and rights requests:
Nils Schiwora trading as Nils Schiwora Trading Services Ahornstr. 37 14547 Beelitz Germany Email: support@tendle.me