[{"data":1,"prerenderedAt":770},["ShallowReactive",2],{"content-query-LjPlv9Sq1J":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":5,"title":7,"description":5,"body":8,"_type":765,"_id":766,"_source":767,"_file":768,"_stem":15,"_extension":769},"/privacy-policy","",false,"Privacy Policy",{"type":9,"children":10,"toc":749},"root",[11,19,26,32,56,62,67,73,292,297,303,308,353,358,364,369,514,527,533,538,544,549,562,567,573,578,584,683,689,694,700,705,711,716,722,744],{"type":12,"tag":13,"props":14,"children":16},"element","h1",{"id":15},"privacy-policy",[17],{"type":18,"value":7},"text",{"type":12,"tag":20,"props":21,"children":23},"h2",{"id":22},"_1-who-we-are",[24],{"type":18,"value":25},"1. Who we are",{"type":12,"tag":27,"props":28,"children":29},"p",{},[30],{"type":18,"value":31},"Data controller: Jan Lunge, sole proprietor (Heaper), Schloßstrasse 8a, 9273 Düssin.",{"type":12,"tag":27,"props":33,"children":34},{},[35,37,44,48,50],{"type":18,"value":36},"Contact: ",{"type":12,"tag":38,"props":39,"children":41},"a",{"href":40},"mailto:support@heaper.de",[42],{"type":18,"value":43},"support@heaper.de",{"type":12,"tag":45,"props":46,"children":47},"br",{},[],{"type":18,"value":49},"\nLegal/DSAR requests: ",{"type":12,"tag":38,"props":51,"children":53},{"href":52},"mailto:legal@heaper.de",[54],{"type":18,"value":55},"legal@heaper.de",{"type":12,"tag":20,"props":57,"children":59},{"id":58},"_2-what-this-policy-covers",[60],{"type":18,"value":61},"2. What this policy covers",{"type":12,"tag":27,"props":63,"children":64},{},[65],{"type":18,"value":66},"This notice explains how we collect, use, share and protect personal data when you use:\n• Heaper apps for iOS, iPadOS, Android, macOS, Windows & Linux (the \"Apps\");\n• heaper.app and associated sub-domains (the \"Website\"); and\n• our optional cloud-sync platform (the \"Server\").\n• the selfhosted sync backend (the \"selfhosted Server\").\n• support interactions (e-mail, chat).",{"type":12,"tag":20,"props":68,"children":70},{"id":69},"_3-data-we-collect",[71],{"type":18,"value":72},"3. Data we collect",{"type":12,"tag":74,"props":75,"children":76},"table",{},[77,106],{"type":12,"tag":78,"props":79,"children":80},"thead",{},[81],{"type":12,"tag":82,"props":83,"children":84},"tr",{},[85,91,96,101],{"type":12,"tag":86,"props":87,"children":88},"th",{},[89],{"type":18,"value":90},"Category (Apple label / Google data-type)",{"type":12,"tag":86,"props":92,"children":93},{},[94],{"type":18,"value":95},"Examples",{"type":12,"tag":86,"props":97,"children":98},{},[99],{"type":18,"value":100},"Purpose",{"type":12,"tag":86,"props":102,"children":103},{},[104],{"type":18,"value":105},"Linked to you?",{"type":12,"tag":107,"props":108,"children":109},"tbody",{},[110,134,156,179,202,225,248,270],{"type":12,"tag":82,"props":111,"children":112},{},[113,119,124,129],{"type":12,"tag":114,"props":115,"children":116},"td",{},[117],{"type":18,"value":118},"Account Data",{"type":12,"tag":114,"props":120,"children":121},{},[122],{"type":18,"value":123},"Email, display name, authentication token, subscription status",{"type":12,"tag":114,"props":125,"children":126},{},[127],{"type":18,"value":128},"Create and secure your account, billing",{"type":12,"tag":114,"props":130,"children":131},{},[132],{"type":18,"value":133},"✔",{"type":12,"tag":82,"props":135,"children":136},{},[137,142,147,152],{"type":12,"tag":114,"props":138,"children":139},{},[140],{"type":18,"value":141},"Files & notes content",{"type":12,"tag":114,"props":143,"children":144},{},[145],{"type":18,"value":146},"The documents, images, audio, tags and metadata you store",{"type":12,"tag":114,"props":148,"children":149},{},[150],{"type":18,"value":151},"Core functionality (storage, sync, search, thumbnails)",{"type":12,"tag":114,"props":153,"children":154},{},[155],{"type":18,"value":133},{"type":12,"tag":82,"props":157,"children":158},{},[159,164,169,174],{"type":12,"tag":114,"props":160,"children":161},{},[162],{"type":18,"value":163},"Device & connection data",{"type":12,"tag":114,"props":165,"children":166},{},[167],{"type":18,"value":168},"Device model, OS version, language, timezone, IP",{"type":12,"tag":114,"props":170,"children":171},{},[172],{"type":18,"value":173},"Diagnostics, fraud prevention",{"type":12,"tag":114,"props":175,"children":176},{},[177],{"type":18,"value":178},"✖ (aggregated)",{"type":12,"tag":82,"props":180,"children":181},{},[182,187,192,197],{"type":12,"tag":114,"props":183,"children":184},{},[185],{"type":18,"value":186},"Usage Data",{"type":12,"tag":114,"props":188,"children":189},{},[190],{"type":18,"value":191},"Feature interactions, timestamps, change history",{"type":12,"tag":114,"props":193,"children":194},{},[195],{"type":18,"value":196},"Sync, conflict resolution, product analytics",{"type":12,"tag":114,"props":198,"children":199},{},[200],{"type":18,"value":201},"✔ (pseudonymous UID)",{"type":12,"tag":82,"props":203,"children":204},{},[205,210,215,220],{"type":12,"tag":114,"props":206,"children":207},{},[208],{"type":18,"value":209},"Crash & error logs",{"type":12,"tag":114,"props":211,"children":212},{},[213],{"type":18,"value":214},"Stack traces, error messages, App build ID",{"type":12,"tag":114,"props":216,"children":217},{},[218],{"type":18,"value":219},"Improve stability",{"type":12,"tag":114,"props":221,"children":222},{},[223],{"type":18,"value":224},"✔ (may contain device ID)",{"type":12,"tag":82,"props":226,"children":227},{},[228,233,238,243],{"type":12,"tag":114,"props":229,"children":230},{},[231],{"type":18,"value":232},"Payment data",{"type":12,"tag":114,"props":234,"children":235},{},[236],{"type":18,"value":237},"Processed by Apple, Google or Stripe; we receive transaction confirmation only",{"type":12,"tag":114,"props":239,"children":240},{},[241],{"type":18,"value":242},"Fulfil subscription",{"type":12,"tag":114,"props":244,"children":245},{},[246],{"type":18,"value":247},"✔ (reference only)",{"type":12,"tag":82,"props":249,"children":250},{},[251,256,261,266],{"type":12,"tag":114,"props":252,"children":253},{},[254],{"type":18,"value":255},"Support communications",{"type":12,"tag":114,"props":257,"children":258},{},[259],{"type":18,"value":260},"E-mail messages, feedback, bug reports",{"type":12,"tag":114,"props":262,"children":263},{},[264],{"type":18,"value":265},"Customer support",{"type":12,"tag":114,"props":267,"children":268},{},[269],{"type":18,"value":133},{"type":12,"tag":82,"props":271,"children":272},{},[273,278,283,288],{"type":12,"tag":114,"props":274,"children":275},{},[276],{"type":18,"value":277},"Cookies & local storage",{"type":12,"tag":114,"props":279,"children":280},{},[281],{"type":18,"value":282},"No Cookies, Session tokens (access & refresh), local app preferences, sqlite based local cache for users data",{"type":12,"tag":114,"props":284,"children":285},{},[286],{"type":18,"value":287},"Website functionality, security",{"type":12,"tag":114,"props":289,"children":290},{},[291],{"type":18,"value":133},{"type":12,"tag":27,"props":293,"children":294},{},[295],{"type":18,"value":296},"We do not collect precise GPS location, contact lists, advertising IDs, health data or biometrics.",{"type":12,"tag":20,"props":298,"children":300},{"id":299},"_4-how-we-use-the-data",[301],{"type":18,"value":302},"4. How we use the data",{"type":12,"tag":27,"props":304,"children":305},{},[306],{"type":18,"value":307},"Legal bases under GDPR Art. 6 are shown in ( ).",{"type":12,"tag":309,"props":310,"children":311},"ol",{},[312,318,323,328,333,338,343,348],{"type":12,"tag":313,"props":314,"children":315},"li",{},[316],{"type":18,"value":317},"Provide and sync your content (performance of contract).",{"type":12,"tag":313,"props":319,"children":320},{},[321],{"type":18,"value":322},"Generate thumbnails, full-text and tag search indexes on the Server: we have read access to your data for processing, serving, indexing, and search functionality (legitimate interest).",{"type":12,"tag":313,"props":324,"children":325},{},[326],{"type":18,"value":327},"Maintain offline functionality – all content is stored locally; sync is opt-in.",{"type":12,"tag":313,"props":329,"children":330},{},[331],{"type":18,"value":332},"Diagnostics & crash reports to keep the Apps reliable (legitimate interest).",{"type":12,"tag":313,"props":334,"children":335},{},[336],{"type":18,"value":337},"Security: audit logs detect abuse and recover from accidental deletions (legitimate interest / vital interest).",{"type":12,"tag":313,"props":339,"children":340},{},[341],{"type":18,"value":342},"Billing & compliance (legal obligation).",{"type":12,"tag":313,"props":344,"children":345},{},[346],{"type":18,"value":347},"Marketing communications where you have consented (consent - GDPR Art. 6(1)(a)).",{"type":12,"tag":313,"props":349,"children":350},{},[351],{"type":18,"value":352},"Cookies: strictly necessary cookies (legitimate interest); optional analytics cookies (consent).",{"type":12,"tag":27,"props":354,"children":355},{},[356],{"type":18,"value":357},"We never sell personal data or use it for third-party advertising.",{"type":12,"tag":20,"props":359,"children":361},{"id":360},"_5-sharing-processors",[362],{"type":18,"value":363},"5. Sharing & processors",{"type":12,"tag":27,"props":365,"children":366},{},[367],{"type":18,"value":368},"We share data only with service providers bound by data-processing agreements:",{"type":12,"tag":74,"props":370,"children":371},{},[372,398],{"type":12,"tag":78,"props":373,"children":374},{},[375],{"type":12,"tag":82,"props":376,"children":377},{},[378,383,388,393],{"type":12,"tag":86,"props":379,"children":380},{},[381],{"type":18,"value":382},"Processor",{"type":12,"tag":86,"props":384,"children":385},{},[386],{"type":18,"value":387},"Role",{"type":12,"tag":86,"props":389,"children":390},{},[391],{"type":18,"value":392},"Region",{"type":12,"tag":86,"props":394,"children":395},{},[396],{"type":18,"value":397},"Safeguards",{"type":12,"tag":107,"props":399,"children":400},{},[401,424,447,470,493],{"type":12,"tag":82,"props":402,"children":403},{},[404,409,414,419],{"type":12,"tag":114,"props":405,"children":406},{},[407],{"type":18,"value":408},"Cloud hosting providers (Infomaniak)",{"type":12,"tag":114,"props":410,"children":411},{},[412],{"type":18,"value":413},"Servers, encrypted object storage",{"type":12,"tag":114,"props":415,"children":416},{},[417],{"type":18,"value":418},"EU",{"type":12,"tag":114,"props":420,"children":421},{},[422],{"type":18,"value":423},"SCCs / ISO 27001:2022",{"type":12,"tag":82,"props":425,"children":426},{},[427,432,437,442],{"type":12,"tag":114,"props":428,"children":429},{},[430],{"type":18,"value":431},"Analytics services (Insighthub, Umami)",{"type":12,"tag":114,"props":433,"children":434},{},[435],{"type":18,"value":436},"Crash & error logging",{"type":12,"tag":114,"props":438,"children":439},{},[440],{"type":18,"value":441},"US & EU",{"type":12,"tag":114,"props":443,"children":444},{},[445],{"type":18,"value":446},"SCCs + IP anonymisation",{"type":12,"tag":82,"props":448,"children":449},{},[450,455,460,465],{"type":12,"tag":114,"props":451,"children":452},{},[453],{"type":18,"value":454},"Apple / Google / Stripe",{"type":12,"tag":114,"props":456,"children":457},{},[458],{"type":18,"value":459},"Payments",{"type":12,"tag":114,"props":461,"children":462},{},[463],{"type":18,"value":464},"Various",{"type":12,"tag":114,"props":466,"children":467},{},[468],{"type":18,"value":469},"Their own compliance",{"type":12,"tag":82,"props":471,"children":472},{},[473,478,483,488],{"type":12,"tag":114,"props":474,"children":475},{},[476],{"type":18,"value":477},"Push notification providers (FCM, APNs)",{"type":12,"tag":114,"props":479,"children":480},{},[481],{"type":18,"value":482},"Message delivery",{"type":12,"tag":114,"props":484,"children":485},{},[486],{"type":18,"value":487},"US",{"type":12,"tag":114,"props":489,"children":490},{},[491],{"type":18,"value":492},"SCCs",{"type":12,"tag":82,"props":494,"children":495},{},[496,501,506,510],{"type":12,"tag":114,"props":497,"children":498},{},[499],{"type":18,"value":500},"Email service (SendGrid)",{"type":12,"tag":114,"props":502,"children":503},{},[504],{"type":18,"value":505},"Transactional emails",{"type":12,"tag":114,"props":507,"children":508},{},[509],{"type":18,"value":487},{"type":12,"tag":114,"props":511,"children":512},{},[513],{"type":18,"value":492},{"type":12,"tag":27,"props":515,"children":516},{},[517,519,525],{"type":18,"value":518},"Sub-processor list last updated: ",{"type":12,"tag":520,"props":521,"children":522},"span",{},[523],{"type":18,"value":524},"2025-07-13",{"type":18,"value":526},". We will notify users 14 days before onboarding new processors.",{"type":12,"tag":20,"props":528,"children":530},{"id":529},"_6-international-transfers",[531],{"type":18,"value":532},"6. International transfers",{"type":12,"tag":27,"props":534,"children":535},{},[536],{"type":18,"value":537},"Where data leaves the EEA, we rely on Standard Contractual Clauses and EU-US Data Privacy Framework (where applicable) with additional security measures.",{"type":12,"tag":20,"props":539,"children":541},{"id":540},"_7-your-rights",[542],{"type":18,"value":543},"7. Your rights",{"type":12,"tag":27,"props":545,"children":546},{},[547],{"type":18,"value":548},"Under GDPR (& UK GDPR/DSA/CCPA where applicable) you may:\n• Access or export your data (\"Data Portability\" – ZIP/JSON).\n• Correct or delete notes & files. Deletion cascades to server backups within 30 days.\n• Object to processing or request restriction.\n• Withdraw consent for marketing/analytics (does not affect contract-based processing).\n• Lodge a complaint with your supervisory authority.",{"type":12,"tag":27,"props":550,"children":551},{},[552,554,560],{"type":18,"value":553},"To exercise these rights, e-mail ",{"type":12,"tag":38,"props":555,"children":557},{"href":556},"mailto:privacy@heaper.de",[558],{"type":18,"value":559},"privacy@heaper.de",{"type":18,"value":561},"; we'll respond within 30 days.",{"type":12,"tag":27,"props":563,"children":564},{},[565],{"type":18,"value":566},"Competent supervisory authority: Der Landesdatenschutzbeauftragte Mecklenburg-Vorpommern.",{"type":12,"tag":20,"props":568,"children":570},{"id":569},"_8-security-measures",[571],{"type":18,"value":572},"8. Security measures",{"type":12,"tag":27,"props":574,"children":575},{},[576],{"type":18,"value":577},"• TLS 1.3 in transit; AES-256 at rest.\n• Email authentication codes with short livetime.\n• Sessions with short lived access tokens and longer-lived revokable refresh tokens.\n• Decentral authentication with EDDSA public and private key challenges.\n• Application has access to user data for operational purposes (serving, indexing, search, thumbnails).\n• the users files and data are replicated to their device allowing offline use even when the server is not reachable.",{"type":12,"tag":20,"props":579,"children":581},{"id":580},"_9-data-retention",[582],{"type":18,"value":583},"9. Data retention",{"type":12,"tag":74,"props":585,"children":586},{},[587,603],{"type":12,"tag":78,"props":588,"children":589},{},[590],{"type":12,"tag":82,"props":591,"children":592},{},[593,598],{"type":12,"tag":86,"props":594,"children":595},{},[596],{"type":18,"value":597},"Data set",{"type":12,"tag":86,"props":599,"children":600},{},[601],{"type":18,"value":602},"Retention rule",{"type":12,"tag":107,"props":604,"children":605},{},[606,619,632,645,658,670],{"type":12,"tag":82,"props":607,"children":608},{},[609,614],{"type":12,"tag":114,"props":610,"children":611},{},[612],{"type":18,"value":613},"Account Data & subscription data",{"type":12,"tag":114,"props":615,"children":616},{},[617],{"type":18,"value":618},"While account is active + 6 years for tax",{"type":12,"tag":82,"props":620,"children":621},{},[622,627],{"type":12,"tag":114,"props":623,"children":624},{},[625],{"type":18,"value":626},"Notes & files",{"type":12,"tag":114,"props":628,"children":629},{},[630],{"type":18,"value":631},"Until you delete them or 12 months after account closure",{"type":12,"tag":82,"props":633,"children":634},{},[635,640],{"type":12,"tag":114,"props":636,"children":637},{},[638],{"type":18,"value":639},"Crash logs",{"type":12,"tag":114,"props":641,"children":642},{},[643],{"type":18,"value":644},"90 days rolling window",{"type":12,"tag":82,"props":646,"children":647},{},[648,653],{"type":12,"tag":114,"props":649,"children":650},{},[651],{"type":18,"value":652},"Server change logs",{"type":12,"tag":114,"props":654,"children":655},{},[656],{"type":18,"value":657},"30 days to resolve sync conflicts",{"type":12,"tag":82,"props":659,"children":660},{},[661,665],{"type":12,"tag":114,"props":662,"children":663},{},[664],{"type":18,"value":255},{"type":12,"tag":114,"props":666,"children":667},{},[668],{"type":18,"value":669},"3 years after resolution",{"type":12,"tag":82,"props":671,"children":672},{},[673,678],{"type":12,"tag":114,"props":674,"children":675},{},[676],{"type":18,"value":677},"Marketing consent records",{"type":12,"tag":114,"props":679,"children":680},{},[681],{"type":18,"value":682},"3 years after withdrawal",{"type":12,"tag":20,"props":684,"children":686},{"id":685},"_10-automated-decision-making",[687],{"type":18,"value":688},"10. Automated decision-making",{"type":12,"tag":27,"props":690,"children":691},{},[692],{"type":18,"value":693},"We do not use automated decision-making or profiling that produces legal effects concerning you.",{"type":12,"tag":20,"props":695,"children":697},{"id":696},"_11-children",[698],{"type":18,"value":699},"11. Children",{"type":12,"tag":27,"props":701,"children":702},{},[703],{"type":18,"value":704},"Heaper is not intended for children under 16 in the EEA (13 elsewhere). We do not knowingly collect their data.",{"type":12,"tag":20,"props":706,"children":708},{"id":707},"_12-changes",[709],{"type":18,"value":710},"12. Changes",{"type":12,"tag":27,"props":712,"children":713},{},[714],{"type":18,"value":715},"We will post any changes here and in the Apps' \"About → Privacy\" screen 14 days before they take effect. For material changes we will request consent via in-app prompt.",{"type":12,"tag":20,"props":717,"children":719},{"id":718},"_13-contact",[720],{"type":18,"value":721},"13. Contact",{"type":12,"tag":27,"props":723,"children":724},{},[725,727,731,734,735,739,742],{"type":18,"value":726},"Privacy queries: ",{"type":12,"tag":38,"props":728,"children":729},{"href":556},[730],{"type":18,"value":559},{"type":12,"tag":45,"props":732,"children":733},{},[],{"type":18,"value":49},{"type":12,"tag":38,"props":736,"children":737},{"href":52},[738],{"type":18,"value":55},{"type":12,"tag":45,"props":740,"children":741},{},[],{"type":18,"value":743},"\nData-protection officer (EU): Jan Lunge, Schloßstrasse 8a, 9273 Düssin",{"type":12,"tag":27,"props":745,"children":746},{},[747],{"type":18,"value":748},"There is a right to complain to a supervisory authority. All consents that have been given on the basis of GDPR Art. 6 No. 1 letter a or GDPR Article 9 No. 2 letter a can be revoked.",{"title":5,"searchDepth":750,"depth":750,"links":751},2,[752,753,754,755,756,757,758,759,760,761,762,763,764],{"id":22,"depth":750,"text":25},{"id":58,"depth":750,"text":61},{"id":69,"depth":750,"text":72},{"id":299,"depth":750,"text":302},{"id":360,"depth":750,"text":363},{"id":529,"depth":750,"text":532},{"id":540,"depth":750,"text":543},{"id":569,"depth":750,"text":572},{"id":580,"depth":750,"text":583},{"id":685,"depth":750,"text":688},{"id":696,"depth":750,"text":699},{"id":707,"depth":750,"text":710},{"id":718,"depth":750,"text":721},"markdown","content:privacy-policy.md","content","privacy-policy.md","md",1774954235569]