Privacy
Privacy policy for the FokusFamilie app
Effective 22 October 2026. This policy applies to the FokusFamilie app on iOS, iPadOS, watchOS, Android, macOS, Windows and Linux. The general privacy policy applies to this website.
1. Controller
Software Notion, owner Sebastian Kruse, Kornblumenring 40, 31600 Uchte, Germany, e-mail: focusfamily@software-notion.de.
2. Principle: your case data stays on the device
All case, person, appointment and documentation data you record in the app is stored exclusively on your device, encrypted with AES-256-GCM and protected by the app lock. Software Notion operates no service that receives this data and has no access to it. The app contains no analytics, advertising or tracking libraries.
3. Processing where data leaves the device
3.1 Licence server (fflicense.software-notion.com)
To verify the edition (Free, Professional, Organisation), the app sends to our licence server: a randomly generated, pseudonymous user identifier, a randomly generated device identifier together with the device's public key, platform, app version, the licence status and, for organisation licences, the organisation identifier. When connecting, the server technically processes your IP address; it is kept only briefly in technical logs for troubleshooting. Name, e-mail address or case data are not transmitted. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Without a connection the app keeps working with the last verified licence state.
The app shows the pseudonymous user identifier as the Focus Family ID. A recovery code is used to use it on another device. The licence server stores only a salted hash of it (PBKDF2), not the code itself. Checking and renewing the code is only possible with requests that a registered device signs with its device key; to prevent abuse, the number of these requests per IP address and per identifier is limited, and the IP address is processed only transiently for this. The legal basis is Art. 6(1)(b) GDPR.
3.2 In-app purchases (Apple App Store, Google Play, RevenueCat)
Subscriptions are handled by Apple or Google; we do not receive payment details. To link a purchase to the licence we use the service provider RevenueCat, Inc. (San Francisco, USA). RevenueCat receives the pseudonymous user identifier, the store receipt, app version, platform and an installation identifier assigned by the SDK. Transfers to the USA are based on the Standard Contractual Clauses and the EU-US Data Privacy Framework, under which RevenueCat is certified. The legal basis is Art. 6(1)(b) GDPR.
3.3 Your organisation's server (optional)
If your organisation connects the app to its self-hosted FokusFamilie server, the cases, documentation and files you release, your work e-mail address and your name are transmitted to that server. Your organisation is the controller for this processing; Software Notion has no access to that server. Please direct questions about this processing to your organisation's data protection officer.
3.4 Crash reports
After a crash the app can send a technical report (time, platform, app version, device model, exception type and a sanitised error text without names, notes or case content) exclusively to the connected organisation server. The feature is on by default and can be switched off at any time under Settings → Privacy. Without an organisation server nothing is sent; Software Notion receives no crash reports. The legal basis is the organisation's legitimate interest in stable operation (Art. 6(1)(f) GDPR).
3.5 Speech recognition and dictation
Dictation uses the operating system's speech recognition. On devices that support on-device recognition, the app enforces it and audio does not leave the device. If the device does not support on-device recognition, Apple or Google processes the recording on their own servers under their privacy terms. In that case, check whether dictating sensitive content is compatible with your organisation's rules.
3.6 Local AI assistant
The AI assistant runs entirely on the device (Apple Foundation Models or a locally stored ONNX model). When a model is downloaded once on Android, the model file is fetched from huggingface.co, which technically reveals your IP address to that provider. No input or case data is sent to any AI service.
3.7 Device calendar
On request the app writes appointments to the device calendar. By default only neutral entries without case details are written; detailed entries must be enabled explicitly. What the calendar provider (e.g. iCloud, Google, Exchange) synchronises from them is governed by its terms.
3.8 Apple Watch, widgets and Live Activities
Apple Watch and widgets show only the daily overview (times, appointment kinds, optionally the case alias) and open tasks. Transfer happens exclusively over the encrypted connection between iPhone and Watch; no server is involved.
3.9 Purchases through Paddle (organisation licences and subscriptions in the desktop applications)
Organisation licences and the Professional subscription taken out in the desktop applications for Windows, macOS and Linux are sold through our online reseller Paddle.com Market Limited (30 Old Bailey, London EC4M 7AU, United Kingdom), which is the contracting party of the purchase as Merchant of Record. Paddle collects the data required for ordering, payment, invoicing, VAT and fraud prevention (e.g. name, email address, billing address or country and postcode, VAT ID, payment details, IP address) under its own responsibility; Paddle's privacy policy applies. We do not receive payment details. The legal basis is Art. 6(1)(b) GDPR. The European Commission has issued an adequacy decision for the United Kingdom; whether Paddle transfers data to further third countries is governed by Paddle under its own responsibility in its privacy policy.
Organisation licences: We receive from Paddle the organisation identifier, subscription and customer identifiers, number of seats, billing period and status in order to activate the seats.
Subscriptions in the desktop applications: The purchase is started by a request to our licence server signed by the registered device. The licence server creates the order at Paddle and passes on the pseudonymous user identifier (Focus Family ID) as an assignment reference and, if available, the customer identifier of an earlier purchase at Paddle. Order and payment details are entered in the browser directly into Paddle's order form. From Paddle we receive for the subscription: customer and subscription identifiers, status, price identifier and billing interval, the end of the current billing period, whether a cancellation is scheduled, transaction identifiers, and the identifier and type of refunds and chargebacks. We do not store name, email address, address or payment details; after verification, notifications from Paddle are stored only with these details, the event identifier and a checksum. The purpose is to assign the purchase to the Focus Family ID, to activate the Professional edition and to end it again after cancellation, refund or chargeback, and to allow Paddle's customer portal to be opened to manage the subscription. Invoices and records that must be retained for tax purposes are kept by Paddle as the seller under the retention obligations that apply to Paddle.
3.10 Location, trip recording and maps
The app uses your location only after you grant "While using the app" and only for three functions: (a) trip recording from "Start trip now" to "Arrived", also while the screen is off (on iOS with the blue location indicator, on Android with a persistent notification); route, kilometres and duration are stored encrypted on the device and synchronised as evidence only when connected to your organisation's server. (b) Optional "Open case at location automatically": the current location is only compared with the addresses on the device and is neither stored nor transmitted. (c) "Calculate travel time & km" on your explicit tap, using the device's map service. When you review a trip, the app shows the route on a map from Apple Maps (iOS) or Google Maps (Android); for this the device loads map tiles for the visible area from the respective provider, which technically learns your IP address and the map area. The route itself is drawn on the device. Apple's or Google's privacy policies apply. The legal basis is Art. 6(1)(b) GDPR; when working for an organisation, the organisation's legal basis applies.
3.11 Requests from the app (Help & contact)
The “Help & contact” area in the app, the desktop application and the admin panel sends security reports, bug reports, feature requests and general enquiries to Software Notion. Only after explicit confirmation, the following is transmitted: reference and kind of request, the reply e-mail address, product (app, desktop application or admin panel), version and build, platform or operating system with version, device model (mobile apps only), interface language, licence type, Focus Family ID, the version and instance ID of a connected organisation server (only if connected), and the subject and text written by the user; depending on the kind, also category, severity and affected component (security report), description, steps and expected behaviour (bug report), request or use case and benefit (feature request) or the message (general contact). App data such as cases, appointments, tasks, documents, notes and contacts is never transmitted; before sending, the text is checked on the device against the names stored there and shown in full. The request is transmitted over TLS to the Software Notion website, which forwards it by e-mail: security reports to security@software-notion.de, all others to focusfamily@software-notion.de. The purpose is to process and answer the request. To prevent abuse, the number of requests per IP address is limited; for this the IP address is processed only transiently and is not stored with the request. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract for Focus Family or its use, otherwise Art. 6(1)(f) GDPR (answering enquiries, fixing bugs and security vulnerabilities). All transmitted data is deleted no later than 30 days after receipt, usually as soon as 10 days after the request has been dealt with. Details are on the Help & contact page.
3.12 Update check in the desktop applications
Shortly after start and then about every 12 hours, the desktop applications for Windows, macOS and Linux check whether a new version is available. If the application is connected to an organisation's server, it asks that server and sends the platform and installation target including the processor architecture; the organisation is the controller for this. Otherwise, or if the organisation's server does not support this request, it asks the Software Notion version service at api.software-notion.de and, where applicable, sends the version and build of the connected server. The installed version is only compared with the response on the device. Installation packages are downloaded from static.software-notion.de and their signature is verified on the device before installation. Your IP address is technically processed in the process; no identifiers, licence or case data are transmitted, and the version service stores no details of the request. The IP address is kept only briefly in technical logs. The legal basis is our legitimate interest in providing bug fixes and security updates (Art. 6(1)(f) GDPR).
3.13 Cancellation via the cancellation page of the website
The page “Cancel contracts here” on the Focus Family website (cancellation page) can be used to cancel a Professional subscription from the desktop applications (Section 312k BGB). We process the type of cancellation and, where given, the reason, your name, to identify the contract at least one of the Focus Family ID, the Paddle order or subscription number or the email address used for the purchase, the requested termination date, the email address for the confirmation as well as the date and time of receipt and a reference number. When you submit the form, the website stores these details in its database so that the receipt and content of the cancellation can be proven and the confirmation can be delivered reliably. It forwards them by email to focusfamily@software-notion.de and immediately sends you a confirmation of receipt to the address you entered; if sending fails temporarily, it is retried automatically for up to seven days without you having to submit the cancellation again. If an email cannot be delivered, for example because the address entered does not exist, or if delivery does not succeed within seven days, the website stops trying and deletes the content of the email; we then handle the matter manually and, where necessary, confirm receipt to you by other means. The website deletes the content of the emails from the database once they have been delivered or once delivery attempts have stopped; only delivery data (recipient, subject, timestamps, number of delivery attempts and, where applicable, the type of delivery error) is kept. We use the details to identify the contract and carry out the cancellation in our seller account at Paddle; Paddle does not receive any further details from the form. To prevent abuse, the number of cancellations per IP address is limited; the IP address is only processed transiently for this purpose and is not stored with the cancellation. The legal bases are Art. 6(1)(b) GDPR (carrying out the cancellation) and Art. 6(1)(c) GDPR in conjunction with Section 312k(4) BGB (confirming the cancellation); retention as proof is based on Art. 6(1)(f) GDPR (legitimate interest in being able to prove the receipt and content of the cancellation and to defend against claims). We keep the cancellation, the confirmation and the database record with the delivery data until the regular limitation period expires, i.e. three years from the end of the year in which the cancellation was received (Sections 195 and 199 BGB), and delete them automatically afterwards in every case, even if an email could not be delivered; where statutory retention obligations are longer, those apply.
3.14 Withdrawal via the withdrawal function of the website
The withdrawal function “Withdraw from contract here” (in German “Vertrag widerrufen”) on the Focus Family website (withdrawal page) can be used by consumers to withdraw from the purchase of a Professional subscription from the desktop applications (Section 356a BGB). We process your name, to identify the contract at least one of the Focus Family ID, the Paddle order or subscription number or the email address used for the purchase, the email address for the confirmation of receipt, the content of the withdrawal declaration as well as the date and time of receipt and a reference number. Section 3.13 applies accordingly to storage, forwarding by email to focusfamily@software-notion.de, the confirmation of receipt, the limit per IP address and retention: the website likewise stores the details in its database and deletes the content of the emails once they have been delivered or once delivery attempts have stopped, we carry out the withdrawal in our seller account at Paddle and arrange the refund, and Paddle does not receive any further details from the form. The legal bases are Art. 6(1)(b) GDPR (carrying out the withdrawal and the refund) and Art. 6(1)(c) GDPR in conjunction with Section 356a(4) BGB (confirmation of receipt); retention as proof is based on Art. 6(1)(f) GDPR. We keep the withdrawal, the confirmation of receipt and the database record with the delivery data for three years from the end of the year in which the withdrawal was received (Sections 195 and 199 BGB) and delete them automatically afterwards in every case, even if an email could not be delivered; where statutory retention obligations are longer, those apply.
4. Permissions
Camera, microphone, photo library, calendar, location, speech recognition, Face ID/Touch ID or biometrics and notifications are used only after your approval and only for the described function. All permissions can be revoked in the system settings at any time.
5. Retention and deletion
Local data remains stored until you delete it in the app or uninstall the app. "Delete case" removes all records and files of the case; "Delete all data" removes all local data. Licence data on the licence server, including the hash of the recovery code and the details received from Paddle about a subscription from the desktop applications, is stored for as long as the pseudonymous user identifier exists and is deleted together with it; you can delete the identifier in the app or ask us to delete it. Deletion in the app is always possible after an explicit confirmation, even while a subscription through Paddle is running or a payment process is open; the subscription is cancelled immediately and any open payment process is aborted, and a payment completed only after the deletion request is refunded automatically. The deletion is normally carried out immediately and, if the payment service is unreachable, usually within 24 hours. If the automatic cancellation does not succeed within 14 days, we cancel the subscription manually and complete the deletion afterwards; until then, the identifier remains blocked and we keep only the data needed for the cancellation. The app shows the processing status via a reference that is valid only for this deletion request; no email address is needed for this. To process the deletion, the licence server keeps a minimal deletion record (hash of the reference, processing status and timestamps) and a minimal marker containing only the deleted licence identifier, so that late payment notifications from Paddle can be recognised and such payments refunded. Both are kept until the deletion has been completed and for 90 days afterwards, and then deleted. The legal bases are Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR (carrying out and documenting the deletion) and Art. 6(1)(b) and (f) GDPR (cancellation and refund of late payments). Data stored at Paddle is deleted by Paddle according to its own retention periods. Technical logs are kept only briefly. Requests sent via “Help & contact” (section 3.11) are deleted no later than 30 days after receipt, usually as soon as 10 days after they have been dealt with. Cancellations made on the cancellation page (section 3.13) and withdrawals made via the withdrawal function (section 3.14) as well as the related confirmations are kept for three years from the end of the year of receipt and deleted afterwards in every case, even if a confirmation could not be delivered. Data on an organisation server is subject to your organisation's retention periods.
6. Recipients and international transfers
Recipients are exclusively the parties named in section 3. Transfers to third countries take place only through RevenueCat (USA), through Paddle for purchases (organisation licences and subscriptions in the desktop applications; United Kingdom, adequacy decision; for further transfers by Paddle see its privacy policy) and, where applicable, through Apple or Google for speech recognition, purchase processing and map display.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority; for us this is the Data Protection Commissioner of Lower Saxony. You can view the pseudonymous licence identifier (Focus Family ID) in the app under Licence; quote it in requests to focusfamily@software-notion.de so that we can locate your data. You can export and delete your local data yourself at any time.
8. Changes
We update this policy when the app or the legal situation changes. The current version is linked in the app under Settings → Legal.