This policy covers NoxDoList for Android (package com.noxdolist.app). The Android release is being prepared for Google Play. The Apple version uses different system services. Apple and Android do not sync with each other.
Privacy policy · NoxDoList for Android
Last updated: 31 August 2026
This privacy policy applies to the website app.glassydev.de/apps/noxdolist and the NoxDoList app for iOS, iPadOS, macOS and watchOS (including associated widgets), collectively referred to below as the “App”.
1. Controller
Controller within the meaning of Article 4(7) GDPR:
Dimitri Valjuzenic Brauhausstr. 17 B 26506 Norden Germany
Email (privacy): privacy@glassydev.de Email (general): contact@glassydev.de Email (support): support@glassydev.de
VAT identification number: DE464279698
Further provider details are available in our legal notice.
2. Overview
NoxDoList is a task and shopping list app. Personal data is processed mainly locally on your device. The optional cloud feature (Apple iCloud/CloudKit — synchronization and list sharing) is used only if you enable it. No third-party servers are used for synchronization.
- Tracking: No. NSPrivacyTracking is set to false in the privacy manifest (PrivacyInfo.xcprivacy). No advertising identifiers (IDFA) are requested, no App Tracking Transparency (ATT) prompt is shown, and no analytics, advertising or crash-reporting SDKs are used.
- Sign in with Apple: Not used. No Apple ID authentication APIs (ASAuthorizationAppleID*) were detected.
- Media playback SDKs (VLC family): Not used (no MobileVLCKit, VLCKit or TVVLCKit).
3. Website and hosting
The information pages at app.glassydev.de are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
When you visit the website, connection data may be processed for technical reasons, including your IP address, access date and time, requested URL, HTTP status code, browser type/version and referrer URL (server logs).
Purpose: Provision, stability and security of the website. Legal basis: Article 6(1)(f) GDPR (legitimate interest in a secure, functional website). Retention: In accordance with the hosting provider’s requirements; log data is typically retained for a limited period.
Transfers to third countries: Processing may take place in the USA. Vercel provides appropriate safeguards, including standard contractual clauses. Details: vercel.com/legal/dpa.
4. Processing overview
| Processing | Purpose | Legal basis |
|---|---|---|
| App operation (local) | Tasks, lists, settings, widgets | Article 6(1)(b) GDPR (contract/use) / (f) (app functionality) |
| Location (optional) | Reminder on arrival at a location you select | Article 6(1)(a) GDPR (consent through the system prompt) |
| Photo library (optional) | Recipe ingredient recognition on the device, optional profile photo | Article 6(1)(a) GDPR (consent) |
| Notifications (local) | Reminders and notifications on the device | Article 6(1)(b) / (f) GDPR |
| Recipe import | Retrieval of recipe data from sources you select | Article 6(1)(b) GDPR (import initiated by you) |
| Apple iCloud / CloudKit (optional) | Synchronization and sharing of shopping lists, saved recipes and the weekly plan | Article 6(1)(b) GDPR (enabled by you) |
| Apple MapKit (optional) | Address and map search for business locations | Article 6(1)(b) / (f) GDPR |
| Apple StoreKit | In-app purchases (e.g. Pro version) | Article 6(1)(b) GDPR |
| Website logs (Vercel) | Website operation and security | Article 6(1)(f) GDPR |
5. What data is processed? Local storage
The App stores data primarily on your device, including in:
- UserDefaults (app settings and configuration),
- Files in the application directory (Application Support, Caches).
Typical content: tasks and shopping lists, categories, reminders, location references for geofencing (if enabled), imported recipe information and app settings.
No contacts, calendar or microphone data is accessed. There is no background audio playback and no Bonjour/local network access.
6. Permissions (Info.plist)
The App may request the following optional system permissions:
| Permission | Key | Purpose | Retention |
|---|---|---|---|
| Location (while in use) | NSLocationWhenInUseUsageDescription | Optional reminder when you arrive at a location selected for a task (geofencing). Coordinates are processed exclusively locally on the device; they are not sent to our servers and are not used for location-based advertising tracking. | Until you remove the task, location reference or permission, or uninstall the App |
| Photo library | NSPhotoLibraryUsageDescription | Access to photos you select for local recognition of recipe ingredients and an optional profile photo in shared lists. | Processing during access; saved profile photos until deleted in the App |
The relevant functions do not run without your consent in the respective iOS/macOS system prompt. You can withdraw consent at any time in System Settings. No other NS*UsageDescription keys (e.g. camera, microphone, contacts, calendar, local network) are configured.
7. Network connections and external services
The App establishes network connections only when required for features you use.
7.1 Infrastructure we provide
- app.glassydev.de / glassy-dev.de — app website and associated resources.
7.2 Recipe imports initiated by you
You enter a recipe address yourself or open the desired page in the in-app browser. The App has no predefined list of recipe sources and does not automatically search third-party providers: it loads only the URL you open and extracts ingredients from it.
The App code handles some pages with bot protection differently (loading them in the in-app browser instead of fetching them directly), e.g. chefkoch.de, kitchenstories.com, eda.ru, povar.ru and rewe.de. This is purely a technical note, not a preference or a list of sources.
The URL actually accessed depends solely on your selection. The operators of the pages you open are responsible for their content, availability and privacy practices. Pages outside the EEA (e.g. Russian recipe portals) may involve third-country processing for which the respective operator is responsible.
7.3 Apple services
- icloud.com — communication with Apple iCloud/CloudKit when synchronization or sharing is enabled.
System or documentation hosts such as maps.apple.com, developer.apple.com, aws.amazon.com or gesetze-im-internet.de are not accessed by the App as independent services.
8. Cloud services and software SDKs
8.1 Not used
- Analytics (e.g. Firebase Analytics, Google Analytics)
- Advertising networks / AdMob
- Crash-reporting services (e.g. Crashlytics)
- Tracking SDKs / IDFA
- VLC-family media playback SDKs (MobileVLCKit, VLCKit, TVVLCKit)
- Sign in with Apple (ASAuthorizationAppleID*)
8.2 Apple iCloud / CloudKit (optional) — synchronization and shared lists
Provider: Apple Distribution International Ltd. (or the relevant Apple entity in your region), an independent controller under the GDPR.
Purpose: Optional synchronization of your app data (including tasks, shopping lists, saved recipes and weekly plans) between your own Apple devices using the iCloud.com.noxdolist.app container.
Shared lists: Only when you expressly share a shopping list does the App create a CloudKit share in your private iCloud database and generate an invitation link (https://www.icloud.com/share/…). People added through this link can jointly edit the shopping list, saved recipes and weekly plan. Participants’ names/initials and optional profile photos may be visible, as may the name from their Apple account through Apple’s sharing interface.
Data processed: List, recipe and weekly plan content, sharing metadata and, where applicable, participant identifiers used by CloudKit Shares. This data is stored exclusively in Apple’s CloudKit infrastructure; we cannot access the shared database content. No third-party servers (in particular no Google Firebase or Cloud Firestore) are used for synchronization.
Legal basis: Article 6(1)(b) GDPR. Tracking: No.
Ending use: You can disable iCloud synchronization in the App/System Settings and end or leave a shared list in the App at any time; the owner can remove individual participants or revoke sharing entirely. Local content remains on each device.
Transfers to third countries: Processing in the USA is possible. There is no data processing agreement between us and Apple; processing is governed by the Apple privacy policy.
8.3 Apple MapKit (optional)
Provider: Apple, an independent controller.
Purpose: Map display and address search for business locations.
Data processed: Search requests and map usage data are sent to Apple.
Legal basis: Article 6(1)(b) / (f) GDPR. No data processing agreement with Apple.
8.4 Apple StoreKit
Provider: Apple, an independent controller.
Purpose: Processing in-app purchases (e.g. Pro version).
Data processed: Purchase information and transaction IDs, processed by Apple.
Legal basis: Article 6(1)(b) GDPR. No data processing agreement with Apple.
9. Transfers to third countries
Personal data may be transferred to countries outside the European Economic Area, in particular in the following cases:
| Recipient / host | Country (typical) | Reason | Safeguards / responsibility |
|---|---|---|---|
| Vercel Inc. | USA | Website hosting (app.glassydev.de) | Standard contractual clauses — vercel.com/legal/dpa |
| Apple (icloud.com — iCloud/CloudKit, MapKit, StoreKit) | Possibly the USA, among others | Apple services you enable | Apple acts as an independent controller; safeguards according to Apple’s privacy information; no data processing agreement with us |
| kitchenstories.com | Possibly a third country, depending on the operator | Only for a recipe import you initiate | The respective operator is responsible; no SCCs or data processing agreements concluded by us |
| eda.rambler.ru, edimdoma.ru, povar.ru | Russia / third countries | Only for a recipe import you initiate | The respective operator is responsible; no SCCs or data processing agreements concluded by us |
| api.chefkoch.de | Germany (generally EEA) | Only for a recipe import you initiate | The respective operator is responsible |
Important notes:
- Connections to icloud.com occur only when you actively use iCloud/CloudKit synchronization or sharing. Apple is an independent controller; we do not provide separate SCCs to Apple.
- Recipe hosts (kitchenstories.com, eda.rambler.ru, edimdoma.ru, povar.ru) are contacted only at your express selection. Any third-country involvement, especially for Russian hosts, depends on the operator. We have not invented or concluded data processing agreements or standard contractual clauses with these public recipe providers.
- For connections within the EEA (e.g. api.chefkoch.de), we generally do not need to document a third-country transfer; the respective provider is responsible for data protection when data is retrieved.
10. Retention periods
- Local app data: Until the App is uninstalled or you delete content in the App.
- Location data (geofencing): Locally on the device until you remove the task, location reference or permission.
- CloudKit data: While iCloud synchronization or sharing is active; deletion through App/System Settings, ending or leaving the share, or Apple’s iCloud management.
- Website logs (Vercel): According to the hosting provider’s retention periods.
- Support requests: Generally up to 3 years after a request is closed, unless statutory retention obligations require otherwise.
11. App Store, privacy labels and PrivacyInfo.xcprivacy
The App Store privacy labels and PrivacyInfo.xcprivacy file are consistent with this policy:
| Feature | Details |
|---|---|
| Tracking (NSPrivacyTracking) | false |
| Required Reason APIs | UserDefaults, DiskSpace, FileTimestamp |
| Data types collected (App Store) | According to the categories recorded in App Store Connect (including usage-related content for cloud/sync features and, where permission is granted, location and photos) |
No data is shared with third parties for tracking or advertising purposes.
12. Your rights
You have the following rights against the controller:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
- Withdrawal of consent (Article 7(3) GDPR), with effect for the future; for example, location or photo permission can be withdrawn at any time in System Settings
To exercise your rights, simply contact privacy@glassydev.de. For CloudKit data, you may also need to use deletion functions in the App and Apple’s iCloud settings.
13. Right to complain to a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
State Commissioner for Data Protection of Lower Saxony Prinzenstraße 5 30159 Hannover Germany
Email: poststelle@lfd.niedersachsen.de Website: https://lfd.niedersachsen.de
14. Security
We use technical and organizational measures appropriate to the risk, in particular:
- TLS-encrypted network connections,
- Apple sandbox isolation of the App,
- Access control through operating system permissions (location and photos only with your consent).
Absolute security cannot be guaranteed for internet and cloud services.
15. Minors
The App is not intended for children under 16. We do not knowingly collect personal data from minors under 16. If you become aware of such data as a parent or guardian, please contact privacy@glassydev.de.
16. Changes to this privacy policy
We update this policy when the App, services used or legal requirements change. The current version is available at:
https://app.glassydev.de/apps/noxdolist/privacy.html
17. Legal notice
Provider identification: https://app.glassydev.de/apps/noxdolist/imprint.html