Legal

Data protection notes – Keystone Home

Supplementary notes to the general Data protection for the Keystone Home apps (Wohnen & Eigentum) by Christian Tonke. One section per app: what is stored locally, which permissions are used and why, and whether data leaves the device.

Contents

Modules

Controller

Christian Tonke
Adelheider Str. 258
27755 Delmenhorst
Germany
Email: christian@tonke.de

Applies to all modules

  • No user account. None of the apps requires registration, an email address or a login with me. I do not know who uses the apps.
  • Local first. All content is stored in a local database on your device; depending on the app, photos, documents and audio are additionally encrypted with a key in the keychain (iOS Keychain or Android Keystore). Deleting the app removes this data.
  • Three classes. (a) Local only: data leaves the device only when you share or back it up yourself. (b) Optional cloud sync: additionally an end-to-end encrypted sync, off by default, via your own iCloud Drive or Google Drive – with no server of mine. (c) Optional server: additionally a self-hosted server for collaboration or web links that you or your team operate. The class is shown at the top of each app section.
  • Usage statistics only with opt-in. Every app offers usage statistics that are off by default. If you turn them on, the app counts anonymous, typed events (such as “export created”) exclusively on the device, without content, without identifiers and without transmission to me or any analytics service. There is no advertising, no tracking SDK and no crash reporting to third parties.
  • Notifications. Reminders are scheduled as local notifications on the device and need no internet connection. Only apps with a server additionally use push notifications without content.
  • Sharing and export only on your request. PDF, CSV, JSON, ZIP or text are created only when you trigger it, with field selection and preview; personal or sensitive fields are deselected by default. Where you share a file is decided in the system share sheet.
  • Backups in your hands. Backups are files that you store and restore yourself. Your operating-system backup (iCloud or Google device backup) is subject to Apple's or Google's terms; some apps exclude particularly sensitive data from it.
  • Deletion. The settings of every app contain “Delete all data”. This removes database, files and keys on the device; with sync or a server enabled, also the cloud files or the workspace on the server if you confirm it.
  • Demo data for trying things out stays on the device and can be removed with one tap.
  • Diagnostics. A diagnostic report in the settings contains only technical details (version, device, error codes), no content – and is only sent if you email it to support yourself.

Appliance Records

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Energy & Meters

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Face ID / Touch ID / fingerprint: for the optional app lock.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Garden Care

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Digital Floor Plan

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Rooms & Inventory

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Rooms and items with photos, category, value, purchase date, serial number and receipts, plus exports for your insurer. Photos and receipts are stored encrypted inside the app. Text recognition for rating plates and serial numbers runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph items, rating plates or receipts, or scan a serial number.
  • Photos: only when you pick existing pictures of your items or receipts.
  • Notifications: to remind you to update the inventory or make a backup.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Household Checklists

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Your household devices (manufacturer, model, serial number, year), maintenance intervals and history, warranty and purchase data, receipts, manuals and documents as photos or PDFs, spare-part numbers, service contacts and the emergency sheet. Text recognition for rating plates and receipts runs directly on the device; photos are never uploaded.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph rating plates, receipts or documents.
  • Photos: only when you pick existing photos of rating plates, receipts or manuals.
  • Notifications: to remind you on the due date of a maintenance job or before a warranty ends.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a backup file that you store and re-import yourself; it leaves the device only via the share sheet to a destination of your choice.

Maintenance Calendar

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Objects (devices, vehicles, equipment), maintenance plans, meter readings such as operating hours or mileage, checklists, consumables, completed jobs and proof photos. Photos are stored encrypted inside the app.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph a finished maintenance job or a rating plate as proof.
  • Photos: only when you pick an existing photo as proof.
  • Calendar: to add upcoming maintenance dates to a calendar you choose – only after you connect it; the app only changes events it created itself. It does not use your reminders.
  • Notifications: to remind you of due maintenance.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password.

Appliance Manuals

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Appliances with rating-plate photo, manufacturer, model and serial number, manuals as photos or PDFs, spare and wear parts, maintenance plans and history, and the shopping list. Photos are stored encrypted inside the app; rating-plate text recognition runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph a rating plate, manual pages or a finished maintenance job, or scan a barcode or QR label.
  • Photos: only when you pick an existing photo of a rating plate, manual pages or a repair.
  • Notifications: to remind you before due maintenance such as descaling or filter changes.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Move Checklist

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Move-In/Move-Out Photos

Local, with optional end-to-end encrypted sync via your own iCloud Drive or Google Drive

What the app stores locally

Handover reports with property, parties (names), rooms, photos with defect markers, meter readings, keys, signatures and history. Photos are stored without location data and AES-256-GCM encrypted inside the app container.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph rooms, defects, meter readings or keys for a report.
  • Photos: only when you pick existing photos as evidence; only those are copied into the app.
  • Notifications: to remind you of open reports or follow-up dates.

Does data leave the device?

Not by default. All content stays on your device; the app has no user account and no server of its own. Data leaves the device only when you share, export or back it up yourself – or when you turn on the optional sync (see below).

Backup: a backup file that you store and re-import yourself; it leaves the device only via the share sheet to a destination of your choice.

Optional sync via your own cloud

In the settings you can turn on sync between your own devices. On iOS it uses a hidden app folder in your iCloud Drive, on Android the app data folder of your Google Drive (Google sign-in only for that folder, scope drive.appdata). All data is encrypted on the device beforehand with AES-256-GCM; the key is derived from your sync password (PBKDF2-SHA256) and stays in the keychain. Apple, Google and I only see encrypted files. Without your password the data cannot be restored. Sync is off by default and can be switched off at any time; the cloud files can be deleted in the settings.

Renovation & Quotes

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

The app stores the entries, lists, notes and attachments you create in it in a local SQLite database on your device. Files and attachments are stored encrypted inside the app; the key stays in the keychain (iOS) or Keystore (Android). Text recognition, if used, runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph or scan something.
  • Photos: only when you pick an existing photo yourself.
  • Face ID / Touch ID / fingerprint: for the optional app lock.
  • Notifications: for local reminders.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a file or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

Warranty & Guarantee

Local only – data leaves the device only when you share or back it up yourself

What the app stores locally

Products with retailer, purchase date, price, serial number and warranty deadline, receipts and rating plates as photos or PDFs, defects and claims with history. Receipts are stored encrypted inside the app; text recognition runs on the device.

Permissions

Each permission is requested only when you first use the feature and can be revoked at any time in the system settings.

  • Camera: only when you photograph a receipt, a rating plate or a defect, or scan a serial number.
  • Photos: only when you pick an existing photo of a receipt or defect.
  • Notifications: to remind you before a warranty expires.

Does data leave the device?

No. All content stays exclusively on your device. The app has no user account, no server of its own and no cloud sync. Data leaves the device only when you export it yourself via the share sheet, pass on a PDF or create a backup – and only to the recipient you choose.

Backup: a password-protected, encrypted backup file (AES-256) that you store yourself, for example in your own cloud or on your computer. It cannot be read without your password. Share extension: content handed over via “Share” from other apps is copied only locally into this app.

App stores

When downloading and using an app through the Apple App Store, Google Play or the Aptoide app marketplace, Apple, Google or Aptoide process data independently, for example to operate their stores, install apps, provide updates and handle purchases. On Aptoide we publish primarily our iOS apps. Read more in the Apple Privacy Policy and the Google Privacy Policy.

Legal basis

Where I process personal data at all – for example when you email me or when I operate a preset server myself – this is done to fulfil the usage relationship (Art. 6(1)(b) GDPR) or on the basis of my legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Processing on your device, in your own cloud or on a server you operate takes place without my involvement.

Your rights

Subject to applicable law, you have rights of access, rectification, erasure, restriction, portability and objection. You may also lodge a complaint with a data-protection supervisory authority. Because the apps work without an account, I can neither view nor delete data on your device – you do that yourself via “Delete all data” or by uninstalling the app. Questions can be sent to christian@tonke.de.

Last updated: September 2026

The German version is authoritative.