Privacy notice

1. Who is responsible?

2. What stays on your device?

Items, quantities, storage locations, categories, notes, movement history, photos, receipts and loan details are stored in the app’s local storage. The current app does not synchronise your inventory with us or with another household member. Typing works without microphone or camera access. Individual entries can be edited or deleted in the app. The 50-entry limit counts records, not individual units. A Pro purchase changes this limit; it does not upload or synchronise your inventory.

Local records remain until you delete them, remove the app’s data through Android or uninstall the app. Backups and files you saved outside the app may remain there separately. Restoring a Pro licence does not restore your inventory.

3. Speech recognition and spoken answers

Microphone permission is requested when you use a speech feature. The app uses the speech service available on your Android device. Depending on the device, service and its settings, speech may be processed locally or sent to that service provider. Its own privacy terms and settings also apply.

The app does not keep an audio recording or upload one to our server. Recognised text can become a local item, location or search query. Spoken answers use your selected speech-output service; whether that service uses a network connection depends on its settings. You may type instead and disable spoken output. Spoken save confirmations can be turned off separately.

4. Camera, photos and selected files

Camera permission is requested only for taking a photo. You can choose an existing picture instead. Item photos are compressed and stored locally; original receipts are stored locally without compression. The current app does not upload these files to os-pixelart. Android may also create a camera image in the device’s media collection; that separate image remains until you delete it there.

5. Feedback you choose to send

“Prepare email” opens your email app with a draft addressed to info@os-pixelart.de, hosted by STRATO. You decide whether to send it and can edit it first. Optional technical details are not selected by default. If you include them, they may describe the app language/version, item count, storage status, online status and device/browser identifier. Item names, locations, photos and receipts are not automatically attached.

We use the sender’s address, message and any voluntary diagnostics to answer requests, investigate errors and improve the app. For agreed test participation, the GDPR basis is Article 6(1)(b); for other voluntary error reports it is Article 6(1)(f), our legitimate interest in answering enquiries and maintaining the app. Please do not send passwords or unnecessary information about other people.

Feedback messages are kept while needed to handle and follow up the issue. After it is resolved, we review whether personal details are still needed and delete unnecessary messages or retain findings without personal identifiers. Legal retention duties or evidence needed for claims may justify longer, purpose-limited retention.

Older test builds, including Builds 34 and 35, prepared drafts to ospixelart.de@gmail.com. An app update changes the recipient; it does not migrate or forward old mail. Google also processes mail sent to that older address, potentially outside the European Economic Area. Google explains its providers and transfer safeguards in its privacy policy and data-transfer information. Your own email provider’s terms also apply.

6. Back up your inventory yourself

The current Android app excludes its data from normal Android app backup. You can manually create and restore a password-protected, encrypted backup file. You choose where to save it using Android’s file picker. If you select a cloud-storage provider, that provider handles the file under its own terms. This is not automatic inventory upload to os-pixelart.

A backup stored only on the same smartphone does not protect against loss or device failure. Keep an additional copy outside the phone and keep the backup password separately. We do not receive that password and cannot recover a forgotten one.

7. Website interest list

New public registrations are closed. This section describes existing interest-list records, not an invitation to register. The voluntary interest list is separate from Google Play testing and is not a purchase or automatic tester admission. It uses the confirmed email address to provide the app information requested at signup. First name and intended use are optional. The GDPR basis is consent, Article 6(1)(a).

A confirmation link lasts 48 hours. The address enters the active list only after you explicitly confirm. Submitted details, consent text/version and signup/confirmation times are retained as evidence. The protected list is hosted on STRATO webspace. Notifications of confirmed signups go to info@os-pixelart.de; addresses are not published or sold.

The form uses a necessary session cookie, an anti-forgery token and temporary keyed IP-address check values to limit abuse. The raw IP address is not stored in the interest list for that purpose. These security values are cleared after 24 hours on later form access. The basis is Article 6(1)(f), our legitimate interest in a secure form.

Unconfirmed signups are removed after seven days on a subsequent form access. Confirmed entries are kept until withdrawal or until no longer needed; cleanup runs after two years on the next form access. Withdraw consent for the future through the unsubscribe link in the confirmation or later app-news emails, or write to info@os-pixelart.de. Unsubscribing removes the active server entry; you can separately request deletion of messages already in our mailbox.

8. Existing private tester access and licences

Public tester registration is closed. This section explains the existing invited test and restoration of licences already issued. It is not an invitation to join and does not offer a Pro purchase.

The existing test uses a confirmed email address, confirmation time, tester identifier and questionnaire answers. Phone model, Android version and free-text details are optional. These support the agreed test, installation messages, feedback and the promised free local Pro licence. Participation is not newsletter consent and never requires a positive review.

Personal email links, one-time codes and protected retrieval tokens associate access with the right installation. The app sends a random installation ID and the activation code or retrieval token over HTTPS to api.os-pixelart.de. It receives a signed licence and, during a trial, the questionnaire access. This information is pseudonymous, not anonymous: we can link it to the confirmed test account. Please do not share access links or codes.

The trial lasts 30 days from the first licence issue. Submitting the complete, honest questionnaire changes it to permanent free local Pro; critical feedback is treated equally. A connected app retrieves the permanent licence when reopened online. After reinstalling or changing devices, existing participants can request a new personal link through the same confirmed email address. That updates the installation association, not the inventory.

The participant list, answers and licence association are protected on our STRATO VPS in Germany, separate from the interest list. The licence issuer receives a pseudonymous participant identifier, installation ID, licence status and evidence of feedback submission, not the answers or email address. STRATO supplies hosting and transactional test/licence email delivery. These forms do not transfer your app’s inventory, photos or receipts. We do not send questionnaire answers to Google. Google’s own notices apply to Google Play installation or a voluntary Google tester-group membership.

The GDPR basis for requested test participation and the promised Pro gift is Article 6(1)(b). Necessary session cookies, anti-forgery tokens and temporary keyed IP check values protect the forms under Article 6(1)(f). Raw IP addresses are not put in the participant list for that purpose. Security check values are cleared after 24 hours on later access; hosting logs may exist separately.

Unconfirmed signups are removed after seven days and questionnaire answers after twelve months, on the next successful form/server access. Short-lived activation codes expire after ten minutes and are cleaned on later access; these codes are different from personal email access. The minimal email/tester/installation association, feedback-submission time and licence status remain while needed to deliver and restore the promised licence. We review that need; the full questionnaire is not needed permanently.

Google Play Pro purchases and promotional codes

The optional one-time Pro purchase removes the 50-entry limit. A valid Google Play promotional code can grant the same entitlement without a payment. This description does not activate sales or create a promotional-code offer. The free basic version requires neither a Pro purchase nor an account with us. Purchasing or restoring through Google Play requires the Google account that owns the entitlement.

The app sends the Google purchase token, the fixed app/package and product identifiers and a random installation identifier over HTTPS to our licence service at api.os-pixelart.de. The service uses the token to request the current purchase status from Google, checks it and acknowledges valid purchases. Google can return purchase status, product details, acknowledgement status, a test/promotion indicator, transaction timestamps and an order identifier. The service issues a signed licence bound to the installation, valid offline for up to seven days. An online check is then needed again. Existing inventory entries are not deleted when a licence cannot be checked.

This request does not send item names, quantities, locations, notes, photos, receipts, questionnaire answers, a Google password, bank/card details or the Google account email address to our licence service. The purchase token and installation identifier are pseudonymous, not anonymous. The installation identifier is used to bind the returned licence; it is not an advertising identifier.

The purpose is to provide the requested Pro entitlement and restoration, check whether the purchase remains valid, and prevent duplicate or unauthorised activation. For the requested Pro service and restoration the GDPR basis is Article 6(1)(b). Necessary abuse prevention and service protection rely on Article 6(1)(f), our legitimate interest in secure and accurate licensing. If you do not provide the purchase proof needed for verification, that Google Play entitlement cannot be activated or restored through our service; the free basic version remains usable.

The licence database stores an encrypted purchase token, its one-way check value, purchase status, a test indicator and the times of the last and next check. It does not store the full Google response, order identifier or an inventory. We keep the minimal purchase proof while needed to provide and restore the continuing entitlement and verify its status. Uninstalling the app does not end ownership of a one-time purchase and does not delete this server record. There is currently no automatic age-based deletion for these purchase records. Deletion requests and records no longer needed for an active entitlement are assessed individually. If the entitlement has ended and no specific legal duty or necessary claim-related evidence requires retention, the proof is removed; any necessary exception is limited to its stated purpose and explained when a request is answered. We do not apply a blanket accounting-retention period to every purchase token.

Google handles payment or redemption in Google Play; we do not receive payment-card or bank details from that window. Google receives the token, app/product identifiers and the technical connection data of our server for verification, not your inventory or the installation identifier from our licence request. Google’s own processing is described in its privacy policy and data-transfer information, including processing outside the EEA and its stated transfer safeguards. STRATO supplies the protected licence-server infrastructure. Our server-backup rules also cover purchase proofs.

To request access, correction or deletion, use the contact method below. Please name the app and whether the request concerns a Google Play purchase or an existing tester licence. Do not send a password, full purchase token, private key or payment-card data by email. We agree a proportionate way to locate the record if necessary. Deleting a purchase proof from our server is not a Google refund or a cancellation of the Google account; a later restoration can send the proof again and create a new minimal record. An already issued offline licence may remain valid until its expiry. Your inventory is separate and can only be deleted on your device. We do not make decisions with legal or similarly significant effects through automated profiling.

Automatic Google purchase notifications

As of 22 October 2026, receipt and forwarding of the purchase notifications described here are switched on following private acceptance testing. Public tester registration and paid Pro sales remain closed; the app has not been publicly released. This section describes the operating purchase-notification service. The purchase verification and restoration described above are separate and remain available.

Google Play reports changes to purchases and Pro entitlements through Google Cloud Pub/Sub to our licence service on the STRATO VPS. Notifications can contain app/product identifiers, a purchase token, event time, a technical message identifier, purchase, refund or revocation status and, depending on the notification, an order identifier. Special manual refund reviews may also include a review token and reason. Optional obfuscated account/profile identifiers are not copied into the new case store. These identifiers and purchase proofs are pseudonymous, not anonymous. This notification flow does not include inventory entries, quantities, storage locations, notes, photos, receipt files or questionnaire answers.

The purposes are accurate provision and restoration of Pro, handling purchase changes and necessary refund reviews. The GDPR basis for the requested Pro service and restoration is Article 6(1)(b). Necessary abuse prevention and service protection rely on Article 6(1)(f), our legitimate interest in secure and accurate licensing. A notification does not replace checking the current purchase status with Google. Manual refund decisions are not submitted automatically. The free basic version requires no Pro purchase.

Google Cloud processes message contents as a processor. On 22 October 2026, we accepted the Google Cloud Data Processing Addendum for Customers, version dated 8 June 2026. STRATO provides the server and operator mailbox under the existing data-processing arrangements. Google's own processing of Google Play purchases is a separate service covered by the Google privacy notices linked above.

Frankfurt (europe-west3) is configured as the only Google Cloud storage region for our purchase-notification channel's message contents. This content policy does not cover all Google metadata, transit, support or Google Play processing. It is not a promise that all Google data is processed only in Germany. Processing outside the EEA may occur depending on the service and subprocessor. The Google Cloud addendum contains international-transfer provisions, including Standard Contractual Clauses or alternative transfer mechanisms where its conditions apply. See Google's subprocessor information and transfer safeguards. Technical acceptance has been completed for the purchase-notification service described here.

Unacknowledged Pub/Sub messages remain available for retry delivery for no more than seven days. Acknowledged messages are not retained additionally; extra topic retention and exports to BigQuery or Cloud Storage are not configured. Full messages do not enter the application log. This does not promise immediate physical deletion of every Google system copy.

The additional delivery store keeps only check values, fixed outcomes and timestamps. It cleans these up after seven days on the next start or later processing. The separate case store encrypts the required order identifier, review token, reason and event time. Open cases remain while needed for handling; expiry of a response deadline does not delete them automatically. After an explicit confirmation of external handling, encrypted case contents are removed from the active store. Minimal deduplication check values and timestamps are removed after 30 days on the next cleanup run. Open cases require review for continued necessity. These periods do not change retention of the existing purchase database described above.

Operator alerts go only to info@os-pixelart.de at STRATO. They contain fixed error descriptions, timestamps and counters, not order numbers, purchase tokens, review tokens or inventory contents. Delivered alert metadata and inactive technical counters are cleaned up after seven days on a later run; unsent alerts and unresolved manual cases remain until handled. This technical period is not an automatic deletion period for the email mailbox. The agreed procedure for these operator alerts and related Google backlog alerts requires prompt handling of unresolved manual-review cases and a review of continued necessity at least weekly. Google response deadlines start at the event time, not email receipt. Thirty days after documented clarification of an incident, its alert emails undergo a manual deletion review. Open cases and specifically required evidence for claims are excluded; necessary exceptions are documented. The mailbox is not cleaned up automatically.

Old encrypted data can remain in server backups until the rotation described above. Completed deletions must be reapplied after a restoration. The existing contact details and rights of access, correction, deletion and objection also apply to purchase-notification data. Use the privacy contact; do not email full purchase or review tokens. Ongoing operation remains limited to the purchase-notification service described here.

9. Hosting and server backups

STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, processes hosting and email data on our behalf under the agreed services. STRATO provides its data-processing agreement and subprocessor information. Visiting the site creates necessary connection information, such as IP address, time and requested URL, for operation and security. STRATO states that its webhosting security logs retain IP addresses for up to seven days. This statement is about STRATO webhosting, not a verified retention period for every log on our separately administered VPS.

The website uses no advertising/analytics services or external fonts. Tester/licence services use HTTPS, restricted access and protected storage. Encrypted server backups include test registrations, answers, licence associations, purchase proofs and operating configuration, not inventories uploaded from your app. An additional encrypted copy is kept on the controller’s protected computer in Germany, not an additional public cloud service.

For the current purchase-verification route, the VPS web server has HTTP access logging disabled and discards its route error log. It does not forward the phone’s IP address to the licence application. The web server still needs the connection address transiently to deliver the response and limit abusive request rates. This is not a promise that every operating-system or hosting-security log is disabled.

The VPS retains the latest 14 backup states and the additional computer the latest 30. Rotation happens on successful backup/retrieval, so outages or a switched-off computer can delay cleanup. Backups are not active mailing lists. Deleted data may remain until the relevant backup rotates out; previously completed deletions must be reapplied if a backup is restored. These safeguards rely on Article 6(1)(f), our legitimate interest in security and recoverability.

10. Request access, correction or deletion

Write to info@os-pixelart.de. For an existing tester account, use its confirmed address where possible; a Google Play buyer does not need to create a tester account. Describe the request, but do not send passwords, full purchase tokens or personal access codes. We check only the identity information needed to locate the record.

Deleting an existing tester-licence association prevents automatic future restoration; it does not remotely remove a permanent licence already saved in your app. Only you can remove local app data on your device. Backup copies can retain deleted server records until rotation as explained above.

11. Your rights and updates

Where the applicable legal conditions are met, you may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, and withdraw consent for the future. You may complain to a data-protection authority, including the Thuringian Commissioner for Data Protection and Freedom of Information. Rights available under the law where you live are not limited by this notice.

We update these notices when functions, processing or applicable requirements change. The app, Google Play listing and this notice must be checked together before a public release.