Data protection notes – Hearthkeep

Controller

Christian Tonke
Adelheider Str. 258
27755 Delmenhorst
Germany
Email: christian@tonke.de

Applies to all modules

• No user account. None of the apps requires registration, an email address or a login with me. I do not know who uses the apps.
• Local first. All content is stored in a local database on your device; depending on the app, photos, documents and audio are additionally encrypted with a key in the keychain (iOS Keychain or Android Keystore). Deleting the app removes this data.
• Three classes. (a) Local only: data leaves the device only when you share or back it up yourself. (b) Optional cloud sync: additionally an end-to-end encrypted sync, off by default, via your own iCloud Drive or Google Drive – with no server of mine. (c) Optional server: additionally a self-hosted server for collaboration or web links that you or your team operate. The class is shown at the top of each app section.
• Usage statistics only with opt-in. Every app offers usage statistics that are off by default. If you turn them on, the app counts anonymous, typed events (such as “export created”) exclusively on the device, without content, without identifiers and without transmission to me or any analytics service. There is no advertising, no tracking SDK and no crash reporting to third parties.
• Notifications. Reminders are scheduled as local notifications on the device and need no internet connection. Only apps with a server additionally use push notifications without content.
• Sharing and export only on your request. PDF, CSV, JSON, ZIP or text are created only when you trigger it, with field selection and preview; personal or sensitive fields are deselected by default. Where you share a file is decided in the system share sheet.
• Backups in your hands. Backups are files that you store and restore yourself. Your operating-system backup (iCloud or Google device backup) is subject to Apple's or Google's terms; some apps exclude particularly sensitive data from it.
• Deletion. The settings of every app contain “Delete all data”. This removes database, files and keys on the device; with sync or a server enabled, also the cloud files or the workspace on the server if you confirm it.
• Demo data for trying things out stays on the device and can be removed with one tap.
• Diagnostics. A diagnostic report in the settings contains only technical details (version, device, error codes), no content – and is only sent if you email it to support yourself.

Family Vault

Local, with optional end-to-end encrypted sync via your own iCloud Drive or Google Drive

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Face ID / Touch ID / fingerprint: for the optional app lock.
• Notifications: for local reminders.

Does data leave the device?

Not by default. All content stays on your device; the app has no user account and no server of its own. Data leaves the device only when you share, export or back it up yourself – or when you turn on the optional sync (see below).

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Optional sync via your own cloud

In the settings you can turn on sync between your own devices. On iOS it uses a hidden app folder in your iCloud Drive, on Android the app data folder of your Google Drive (Google sign-in only for that folder, scope drive.appdata). All data is encrypted on the device beforehand with AES-256-GCM; the key is derived from your sync password (PBKDF2-SHA256) and stays in the keychain. Apple, Google and I only see encrypted files. Without your password the data cannot be restored. Sync is off by default and can be switched off at any time; the cloud files can be deleted in the settings.

Estate Overview

Local, with optional end-to-end encrypted sync via your own iCloud Drive or Google Drive

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Face ID / Touch ID / fingerprint: for the optional app lock.
• Notifications: for local reminders.

Does data leave the device?

Not by default. All content stays on your device; the app has no user account and no server of its own. Data leaves the device only when you share, export or back it up yourself – or when you turn on the optional sync (see below).

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Optional sync via your own cloud

In the settings you can turn on sync between your own devices. On iOS it uses a hidden app folder in your iCloud Drive, on Android the app data folder of your Google Drive (Google sign-in only for that folder, scope drive.appdata). All data is encrypted on the device beforehand with AES-256-GCM; the key is derived from your sync password (PBKDF2-SHA256) and stays in the keychain. Apple, Google and I only see encrypted files. Without your password the data cannot be restored. Sync is off by default and can be switched off at any time; the cloud files can be deleted in the settings.

Estate Management

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Emergency Folder

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Emergency profiles with details you enter yourself as self-declared information (e.g. date of birth, blood type, allergies, pre-existing conditions, medications, insurance), emergency contacts, copies of documents such as ID or health card, and action cards. This information is particularly sensitive; the app stores it AES-256 encrypted with the key in the device keychain, and it stays on the device only. The app evaluates nothing and gives no medical advice. The emergency button only opens the phone app; you confirm the call yourself.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph a document such as an ID or health card.
• Photos: only when you pick an image yourself as a document copy.
• Face ID / Touch ID / fingerprint: to unlock the emergency folder if you turn on the app lock.
• Notifications: to remind you of expiring documents or review dates.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Family Hub

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Handovers (Care)

Local, with an optional self-hosted server – run by you, your team or your family

What the app stores locally

Care circles (cared-for person, members, roles), daily handoffs with summary, observations without diagnosis, tasks, appointments and next steps, confirmations, a history, and documents (photos or files) you add yourself. Documents are stored encrypted.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph a document such as a plan or a letter.
• Photos: only when you pick an image yourself as a document.
• Notifications: to remind you of tasks and – with a server – to notify you about new handoffs (push, without names or content).

Does data leave the device?

Not by default. Without a server all content stays exclusively on your device; there is no user account with me. Data leaves the device only when you share or back it up yourself – or when you connect the app to a server (see below).

Backup: a backup file that you store and re-import yourself; it leaves the device only via the share sheet to a destination of your choice. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Optional server

A circle works entirely on one device, for example a family tablet. Only when you choose “Share circle” does the app connect to a family server. The shared circle's content goes there: handoffs, observations, tasks, documents, member names and roles, and the devices' push tokens. Transport is TLS encrypted, but the content is not end-to-end encrypted on the server – whoever runs the server can technically read it. Invitation and pairing codes are stored only as hashes; push notifications and logs contain no content.

Push notifications are delivered via Expo's Push Service (with Apple or Google push behind it). For this the server stores a push token of your device; the notifications contain no names and no content.

No server is preset – as delivered, the app works entirely on your device. You can enter your own server in the app at any time. The server is designed as an open-source package (Docker) for self-hosting, for example on a NAS or VPS. Whoever runs the server is responsible for the data stored there. I have no access to data on servers run by you or your team. If I operate the preset server myself, I process the data listed above solely to provide the service to you, do not pass it on and do not analyse it. Pairing works via QR code or short code instead of a user account; you can disconnect in the app and have the entire workspace including files deleted from the server.

Health & Routines

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Photos: only when you pick an existing photo yourself.
• Face ID / Touch ID / fingerprint: for the optional app lock.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Parenting Organizer

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Calendar: only when you transfer appointments.
• Face ID / Touch ID / fingerprint: for the optional app lock.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Pet Health

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Pet Care

Local, with an optional self-hosted server – run by you, your team or your family

What the app stores locally

Care circles with members and roles, pets with profile and feeding plan, the care log (who fed, walked, watered, gave medication and when), handoffs, tasks, photos and documents such as vaccination records. For walks only duration, distance and a roughly rounded starting point are stored. Photos are stored encrypted.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph your pet, an entry or a document such as a vaccination record.
• Photos: only when you pick an image yourself for a pet or an entry.
• Location (while in use): to measure the distance of a walk – only if you switch it on for that walk.
• Notifications: to remind you of feedings and tasks and – with a server – to notify you about entries by others (push, without names or content).

Does data leave the device?

Not by default. Without a server all content stays exclusively on your device; there is no user account with me. Data leaves the device only when you share or back it up yourself – or when you connect the app to a server (see below).

Backup: a backup file that you store and re-import yourself; it leaves the device only via the share sheet to a destination of your choice. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Optional server

A circle also works on a single device. For several people to collaborate, the app connects to a circle server. Pets, care log, handoffs, observations, tasks, documents, member names and push tokens go there. Transport is TLS encrypted; content is not end-to-end encrypted on the server. Sitter links show only the fields the circle owner releases; invitation codes are stored only as hashes, push notifications and logs contain no content.

Push notifications are delivered via Expo's Push Service (with Apple or Google push behind it). For this the server stores a push token of your device; the notifications contain no names and no content.

No server is preset – as delivered, the app works entirely on your device. You can enter your own server in the app at any time. The server is designed as an open-source package (Docker) for self-hosting, for example on a NAS or VPS. Whoever runs the server is responsible for the data stored there. I have no access to data on servers run by you or your team. If I operate the preset server myself, I process the data listed above solely to provide the service to you, do not pass it on and do not analyse it. Pairing works via QR code or short code instead of a user account; you can disconnect in the app and have the entire workspace including files deleted from the server.

Pickups

Local, with an optional self-hosted server – run by you, your team or your family

What the app stores locally

Family circles with guardians, children (first name, facility and group only), facilities, authorised pickup persons (name, photo, ID hint, optional code word), pickups with time window, approvals, pickup codes and an immutable history. Photos are stored encrypted; keys and codes live in the keychain.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you scan the QR code of a pickup pass or take a photo of a pickup person for the facility.
• Photos: only when you pick a picture of a pickup person yourself.
• Face ID / Touch ID / fingerprint: to protect the app and pickup codes if you turn it on.
• Notifications: to remind you of pickups and – with a server – to notify you about approvals and confirmations (fixed texts such as “Pickup confirmed”, without names).

Does data leave the device?

Not by default. Without a server all content stays exclusively on your device; there is no user account with me. Data leaves the device only when you share or back it up yourself – or when you connect the app to a server (see below).

Backup: a backup file that you store and re-import yourself; it leaves the device only via the share sheet to a destination of your choice.

Optional server

A circle works entirely on one device, including offline codes that a parent checks in the app. Links for pickup persons, the facility's verification page and approval by two guardians require the server. The shared family circle's data goes there: children's first names, pickup persons with photo, time windows, facilities, approvals and push tokens. Transport is TLS encrypted but not end-to-end – the facility has to be able to see the pickup person's name and photo. Pickup, invitation and pairing codes are stored only as hashes; audit log and logs contain no content.

Push notifications are delivered via Expo's Push Service (with Apple or Google push behind it). For this the server stores a push token of your device; the notifications contain no names and no content.

No server is preset – as delivered, the app works entirely on your device. You can enter your own server in the app at any time. The server is designed as an open-source package (Docker) for self-hosting, for example on a NAS or VPS. Whoever runs the server is responsible for the data stored there. I have no access to data on servers run by you or your team. If I operate the preset server myself, I process the data listed above solely to provide the service to you, do not pass it on and do not analyse it. Pairing works via QR code or short code instead of a user account; you can disconnect in the app and have the entire workspace including files deleted from the server.

School Documents

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

• Camera: only when you photograph or scan something.
• Photos: only when you pick an existing photo yourself.
• Face ID / Touch ID / fingerprint: for the optional app lock.
• Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

App stores

When downloading and using an app through the Apple App Store, Google Play or the Aptoide app marketplace, Apple, Google or Aptoide process data independently, for example to operate their stores, install apps, provide updates and handle purchases. On Aptoide we publish primarily our iOS apps. Read more in the Apple Privacy Policy and the Google Privacy Policy.

Legal basis

Where I process personal data at all – for example when you email me or when I operate a preset server myself – this is done to fulfil the usage relationship (Art. 6(1)(b) GDPR) or on the basis of my legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Processing on your device, in your own cloud or on a server you operate takes place without my involvement.

Your rights

Subject to applicable law, you have rights of access, rectification, erasure, restriction, portability and objection. You may also lodge a complaint with a data-protection supervisory authority. Because the apps work without an account, I can neither view nor delete data on your device – you do that yourself via “Delete all data” or by uninstalling the app. Questions can be sent to christian@tonke.de.

Last updated: September 2026