Privacy Policy

for the “qapto” app · As of September 30, 2026 · Convenience translation – the German version is the legally binding one.

Controller

WarenWerk GmbH, Otto-Lilienthal-Str. 2a, 55232 Alzey, Germany
Email: info@qapto.net · Telephone: +49 6731 8998690

No data protection officer has been appointed, as the legal requirements for this are not met.

1. The principle

qapto needs no user account — you don't have to sign in anywhere, and without signing in we know neither your name nor your email address. Your entries, lists, photos, receipts, remembered facts and learned preferences are stored exclusively on your iPhone. We are technically unable to view them.

2. What stays exclusively on your device

• Your entries: tasks, appointments, reminders, notes, journal, shopping and other lists.
• Photos, receipts and documents: image and text recognition run entirely on your iPhone. No photo is transmitted. Only references to images in your photo library are stored. Note: text the app extracts from a photo and that you accept — such as a place name — may later become part of a request to the AI service (section 4).
• Read aloud: speech output runs entirely on the device.
• Remembered facts and learned preferences: stored locally, viewable, editable, deletable; learning can be switched off. Exception: a limited excerpt is sent along with requests (section 4).
• Diagnostic log: purely local. It leaves your device only if you export and share it yourself. It may contain the wording of your dictations — review it before sharing.

3. Speech recognition (dictation)

When you dictate, your iPhone converts the recording into text. If your device supports on-device speech recognition for your language, the recording does not leave your device — the app explicitly requests this mode. If your device or language does not support it, iOS transmits the recording to Apple's speech recognition servers; Apple's privacy terms then apply. The app shows you which mode is active. No audio recording is ever transmitted to us or to the service providers named in section 4 — only the finished text arrives there. If you dictate on the Apple Watch, the Watch records your voice only during the deliberate recording and transmits the recording, encrypted, to your iPhone; there it is converted into text as described above and then deleted immediately.

4. AI assistant: what is transmitted and to whom

When you dictate something to the assistant, ask it a question or have it revise a suggestion, the following is transmitted: the text of your request, the most recent conversation history with a short summary, an excerpt of your remembered facts (at most 40 entries / 800 characters) and learned preferences (at most 10 / 300 characters), your profile name and home town, and matching entries from your own memory.

Not transmitted: audio recordings, photos, your GPS position, your address book, your complete database of entries or receipts.

The chain of recipients

The request first goes to our own relay service, operated on the infrastructure of Cloudflare (data center in the EU). From there it passes via the service of Rork and the Vercel AI Gateway (Vercel Inc.) to one of the model providers: Google (Gemini), OpenAI (GPT), Anthropic (Claude) or Perplexity (research). The app decides automatically which provider is used, depending on the task.

What our relay service logs: only form — type of request, status code, length in bytes, duration, an error code and a random transaction number. No request text, no response, no coordinates are logged, not even in the event of an error and not even truncated. Every response carries the instruction not to cache anything.

Identifiers: the requests contain no device or installation identifier. The app's access key is the same for all installations and identifies the app, not you. For technical reasons, however, the services involved do know the IP address of your device.

Legal basis: Art. 6 (1) (b) GDPR — the processing is necessary for the performance of the user contract; without it the assistant cannot respond.

Third-country transfer: the providers named process data partly in the USA. The basis is the adequacy decision on the EU-US Data Privacy Framework and/or standard contractual clauses under Art. 46 GDPR.

Your responsibility: the assistant processes what you tell it. Do not dictate anything to it that you would not want to give to an external service provider. Capturing, lists, receipts, photos and searching your own memory also work without this transmission.

5. Web research and place search

When the assistant researches for you, the search query formed by the model is transmitted via the same chain to Perplexity, together with the current date and — if stored — your home town as text, so that results fit your region.

If you search for places with ratings, our relay service transmits the search term and — if you have allowed location access — your approximate position to Google Places, so that results are near you. These coordinates are neither stored nor logged by us; they are passed through for this one request and then discarded.

6. Apple services

• Maps and route calculation: to search for places and calculate travel times, place names as well as your current position and destination are transmitted to Apple's map services.
• Calendar and Reminders: with sync enabled, the app exchanges entries directly with the Apple apps on your device. Whether this data is synchronized with your iCloud is decided by you in the iOS settings. For location-based reminders, the coordinates of the place are written into the reminder and thus also travel through your iCloud.
• Speech recognition: see section 3.
• App Store: subscriptions and purchases are processed via Apple.

7. Subscription, purchases and the spending cap

Subscriptions and credit purchases run exclusively through the Apple App Store. We receive no payment data — no card number, no billing address, no name.

So that paid cloud features have a reliable monthly cap, we keep an account without a name for each paying installation on a server in Frankfurt am Main (Supabase, EU region). It holds:

• a pseudonymous identifier: a hash value salted with a secret, which we compute from the purchase identifier of your subscription. The original Apple identifier never leaves our relay service and is not stored.
• your usage level for the current month and your purchased credit,
• one ledger line per paid action: type of action (such as “research” or “place search”), amount, time and a random transaction number,
• for credit purchases, the Apple transaction number and the pack purchased — this prevents a purchase from being credited twice.

What is expressly not stored there: no content, not a word of your dictations, no entries, no location data, no name — and no email address, as long as you do not voluntarily link your account (section 14).

Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract) and Art. 6 (1) (f) GDPR (legitimate interest in abuse and cost control).

In the App Store privacy label this data appears as “User ID”, “Purchase History” and “Product Interaction”, each for app functionality and without tracking.

8. No advertising, no tracking

qapto contains no third-party advertising, analytics or tracking components, no crash reporter and no third-party SDK. We create no usage profiles and pass on no data for advertising purposes. This has been confirmed by a complete review of the source code.

9. Retention period

Your content stays on your device until you delete it or uninstall the app. We retain the account and ledger data named in section 7 for as long as your subscription exists, and beyond that as far as commercial and tax retention periods require. Data of a voluntary link (section 14) remains until you unlink or delete it in the app; voluntarily sent examples (section 15) are deleted automatically after 90 days. How long the services named in sections 4 and 5 retain requests is governed by their terms.

10. Children and young people

qapto is intended for persons aged 16 and over. Younger people should use the app only with the consent of a parent or guardian. Paid subscriptions require full legal capacity or the consent of a legal representative. We collect no age information and cannot verify age.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Most of this you can do directly in the app: view and delete entries, remembered facts and learned preferences individually, switch off learning, export your data. For the account and ledger data named in section 7, contact info@qapto.net. Please have the purchase identifier of your subscription ready — without it we cannot match the nameless account.

Right to lodge a complaint: State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany.

12. No legal, tax or health advice

The assistant can be wrong and does not replace professional advice. Amounts and deadlines from receipts are machine-recognized and may be incorrect — check them. Information on warranty or guarantee periods is a non-binding assumption.

13. Notice on artificial intelligence

qapto is an AI assistant. What you dictate or ask is processed by an artificial intelligence — it can be wrong, which is why it shows you every suggestion for confirmation before anything is saved.

14. Optional linking with Apple or Google

In the settings you can optionally link your allowance account (section 7) with “Sign in with Apple” or “Sign in with Google”. Purpose: to find your allowance and purchases again on another device. No function of the app requires this link.

When you link, our sign-in service (Supabase Auth, EU region) takes the provider identifier and email address transmitted by Apple or Google (with Apple, a relay address if you choose) and stores the assignment to your pseudonymous account as well as the number of linked devices. The app itself only sees your email address in masked form. Without your separate tick, your email address is not used for product information; the tick is off by default and can be withdrawn at any time. Content — entries, dictations, photos — is not transmitted by linking.

Legal basis: Art. 6 (1) (b) GDPR for the link (performance of the contract at your request), Art. 6 (1) (a) GDPR for product information (consent). Unlinking and deletion: at any time in the app (“Unlink” detaches only this device; “Delete account and contact details” removes the link, the contact details and the sign-in account — allowance, purchases and your entries on the device are retained).

15. Optional examples for improvement

If qapto has misunderstood a dictation, you can tap “Not understood correctly” on the card. Only if you have additionally switched on “Send examples to improve” in the settings (off by default) is this one example transmitted to us: the transcript of this turn, the misunderstood card and the newly generated card, whether you accepted the new card, device type, iOS version, app version and the language set. Not transmitted are identifiers from your Apple account or subscription, other entries, calendar data, photos, diagnostic logs and your location.

The example carries a randomly generated installation identifier that serves solely to comply with your request for deletion; it is not linked to your Apple account, your subscription or your other data. Legal basis: Art. 6 (1) (a) GDPR (consent). Withdrawal: at any time via the same switch; in addition, you can tap “Have sent examples deleted” there. Recipient: WarenWerk GmbH; processors: Supabase (database, EU region) and, for the second attempt at breaking down the dictation, the same service providers as in section 4. Retention: 90 days from receipt, then automatic deletion.