Last updated: 18 September 2026
1. Controller
Dimitri Valjuzenic Brauhausstr. 17 B 26506 Norden Germany
Email (privacy): privacy@glassydev.de Email (general): contact@glassydev.de Email (support): support@glassydev.de Website: https://app.glassydev.de VAT identification number: DE464279698
Controller under the General Data Protection Regulation (GDPR) for the “Betriebskostenhelfer” app (also called “Nebenkosten” in the project) for iOS and macOS (collectively the “App”).
2. Overview
“Betriebskostenhelfer” provides local entry, management, calculation and evaluation of service charge and billing data on your device. It is designed as an offline app without tracking, advertising SDKs or analytics services from the provider.
Tracking: No tracking is implemented within the meaning of Apple App Tracking Transparency (ATT) or the information in PrivacyInfo.xcprivacy (tracking=false). No tracking signals or advertising frameworks are used.
Login: No login through Sign in with Apple or other external authentication services is required. No corresponding authentication mechanisms were detected in the App’s technical footprint (authMechanisms: none detected).
Local vs. cloud: Content you enter is processed and stored mainly locally on the device. The provider operates no backend server of its own for app features and has no access to your locally stored billing data.
Important: The App is a technical calculation and overview tool. It does not replace legal, tax or property rental advice. Results depend on your input and should be professionally reviewed where needed.
3. Website and hosting
The privacy policy, legal notice and other app information are provided at https://app.glassydev.de. The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA).
Visiting the website may involve processing technically necessary connection data, particularly IP address, access date and time, requested URL, browser type/version, operating system and, where applicable, referrer URL. The purpose is technical provision, delivery and security of the website.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in a secure, functional web presence).
When Vercel acts as a processor, data may be transferred to the USA. Vercel provides appropriate safeguards, including standard contractual clauses (SCCs). Details: https://vercel.com/legal/dpa
The App’s core features do not require you to visit this website.
4. Processing overview
| Processing | Purpose | Legal basis |
|---|---|---|
| Local storage of billing data and settings | App features (entry, calculation, management) | Article 6(1)(b) GDPR |
| Camera access (optional) | Photographing a meter to recognize its number and reading | Article 6(1)(b) GDPR |
| In-app purchases through StoreKit | Processing optional paid features (Pro version) | Article 6(1)(b) GDPR |
| Information website | Legal notice, privacy policy, app information | Article 6(1)(f) GDPR |
| Support communication (voluntary) | Handling your inquiry | Article 6(1)(b) or (f) GDPR |
5. What data is processed? Local storage
The App processes data you enter or data derived from it, stored locally on your device. We distinguish the following types of processing:
5.1 Information required for calculation
| Category | Examples | Relation to individuals |
|---|---|---|
| Billing data | Periods, cost types, cost items, total costs | Generally not personal data |
| Area and consumption values | Living area, consumption, unit-days, person-days | Generally not personal data |
| Allocation data | Allocation keys, tenant shares, utilities, meter readings | May indirectly relate to individuals |
5.2 Optional or voluntary information
| Category | Examples | Relation to individuals |
|---|---|---|
| Labels | Property or item names | May be personal data if names are included |
| Tenant information | Tenant ID, tenant name (if entered by you) | Personal data where individuals are identifiable |
| App settings | Options and display preferences you select | Generally not personal data |
| Camera data (optional) | Meter photos for text recognition | May be personal data if identifiable people or apartment references are visible |
5.3 Technical storage locations on the device
The following local storage mechanisms were detected in the App’s technical footprint:
- UserDefaults — app settings and configuration
- Files (Application Support / Caches) — persistent app data and cached content
No Keychain use for authentication was detected.
5.4 Data not requested
No location, microphone, contacts, address book or Health data is requested. The photo library is not read using full library permission. You may optionally select an existing image with the system photo picker (PhotosPicker); selection takes place outside the App’s process.
6. Permissions
The App requests the following permissions when you use the relevant feature:
| Permission | Info.plist key | Purpose |
|---|---|---|
| Camera | NSCameraUsageDescription | Photographing a meter to automatically recognize its number and reading |
Text recognition in meter photos (Apple Vision) runs entirely on the device. Neither the photo nor recognized text is sent to the provider or a server. The photo stays in the App sandbox and can be deleted or replaced in the App.
Other iOS/macOS usage descriptions (e.g. location, microphone, local network, Bonjour, background audio) are not configured. Background Audio, Local Network and Bonjour are not requested.
7. Network and external services
No confirmed external URL hosts (confirmedURLHosts) were detected for the App’s runtime. Core features (entry, calculation, local storage) work without a network connection.
Code scan artifacts: An automated scan may incorrectly classify Swift property names as “domains” (e.g. 0.abrechnungsartraw, 0.mieterid, 1.gesamtkosten). These are not external internet services and the App does not contact them. No data is transmitted to these apparent hosts.
Your locally stored billing data is not automatically transmitted to the provider or cloud services operated by us.
Note: Connections to Apple system services (e.g. StoreKit purchases or optional iOS/macOS backups) are processed by Apple as an independent provider; see Section 8.
8. Cloud services and SDKs used
8.1 Not used
The following categories are not integrated into the App:
- Analytics, tracking or advertising SDKs
- Provider-operated crash-reporting services
- Social media SDKs
- VLC-family media playback SDKs (MobileVLCKit, VLCKit, TVVLCKit)
- Provider-operated cloud synchronization services (e.g. own backend, provider-integrated CloudKit)
8.2 Apple StoreKit (in-app purchases)
The App uses Apple’s StoreKit for optional in-app purchases (Pro features; detected in ProStore.swift). Purpose: processing paid Pro features and unlocking purchased entitlements on the device.
Payment processing, billing data and any related personal data are processed exclusively by Apple as an independent controller. Legal basis for using Pro features: Article 6(1)(b) GDPR (performance of a contract).
The provider receives no complete payment details (e.g. credit card numbers). Transaction confirmations and entitlement information may be processed on the device to unlock purchased features.
The provider has concluded no data processing agreement with Apple; processing follows Apple’s privacy information: https://www.apple.com/legal/privacy/
Tracking through StoreKit: StoreKit is not used for tracking within the meaning of ATT; tracking=false in the privacy manifest remains unchanged.
8.3 Apple system services and backups
If you enable a device or iCloud backup in System Settings, app data may be backed up within Apple systems. The provider has no access and does not process these backups.
The provider does not integrate CloudKit or MapKit for the App’s core features.
9. Transfers to third countries
During normal App operation (local processing), the provider makes no transfers of your billing data to third countries.
Exception — website hosting: Visiting https://app.glassydev.de may transfer technical connection data to Vercel Inc. (USA); see Section 3. Vercel’s SCCs apply: https://vercel.com/legal/dpa
Apple services: StoreKit or system backups may involve processing by Apple in third countries. The provider concludes no separate DPA or SCCs for this; Apple’s rules apply.
The provider has concluded no DPAs/SCCs with Apple or public EPG/stream hosts, as those services are not used. The apiDomains entries detected in the scan (Swift property names) do not constitute third-country transfers.
10. Retention periods
- Locally in the App: Billing data, settings and optional meter photos stay on your device until you delete them in the App or uninstall it.
- Website logs (Vercel): Stored according to the host’s requirements; details: https://vercel.com/legal/privacy-policy
- Support requests: Deleted after resolution and no later than 3 years, unless statutory retention duties require otherwise.
11. App Store, Privacy Nutrition Labels and PrivacyInfo.xcprivacy
The privacy information in App Store Connect and PrivacyInfo.xcprivacy is consistent with this policy:
- Tracking: false — the App does not track you across other providers’ apps and websites.
- Required Reason APIs: Access to UserDefaults is declared and used exclusively for internal app settings and features.
- Collected Data Types: The privacy manifest declares no collected data types (NSPrivacyCollectedDataTypes is empty). All billing, tenant and photo data remains on the device and is not collected by the provider. App Store Connect correspondingly states “Data Not Collected”.
The canonical URL of this privacy policy is: https://app.glassydev.de/apps/nebenkosten/privacy.html
12. Your rights
You have the following rights against the controller where the statutory requirements are met:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection (Article 21 GDPR)
As app data is stored locally on your device, you can generally access, rectify and delete it directly in the App or by uninstalling it.
Withdrawal of consent (Article 7(3) GDPR): where processing is based on consent, you may withdraw it at any time with future effect.
To exercise your rights, simply email: privacy@glassydev.de
13. Supervisory authority
You have the right to complain to a data protection supervisory authority. The authority responsible for the controller based in Lower Saxony is:
State Commissioner for Data Protection of Lower Saxony Email: poststelle@lfd.niedersachsen.de Website: https://lfd.niedersachsen.de
14. Security
The provider uses state-of-the-art technical and organizational measures, in particular:
- iOS/macOS app sandbox to isolate app data from other apps
- TLS encryption when accessing the information website
- Your device controls (device lock, biometric unlock) to protect local data
Absolute security cannot be guaranteed in digital systems. Please secure your device appropriately.
15. Minors
The App is intended for adults or users aged 16 and over who manage service charges in rental or ownership arrangements. It is not intended for children under 16. The provider does not knowingly collect minors’ data.
16. Changes to this privacy policy
The provider may update this policy when the App, legal requirements or technical requirements change. The current version is available at:
https://app.glassydev.de/apps/nebenkosten/privacy.html
Material changes will be indicated in the App or on the website where required.
17. Legal notice
Provider details are available in the legal notice:
https://app.glassydev.de/apps/nebenkosten/imprint.html