Privacy Policy
1. Who is responsible
Dirk Hennseler Raumausstattung UG (haftungsbeschränkt), Enzianstraße 49, 68309 Mannheim, Germany, represented by its managing director Dirk Hennseler. Email: support@3xhwerk.de, phone +49 621 728486-60. Further details are in the legal notice.
We have not appointed a data protection officer because we are not legally required to do so. Please send any privacy questions to the email address above.
2. The short version
- Note & Sign has no user accounts and no server of ours that stores your notes.
- Your notes, drawings, photos, signatures, time logs and settings are stored only on your device.
- Data leaves your device only when you send it yourself, or in the specific cases described below (dictation, place name, timestamp, purchases, device backup).
- The app contains no analytics, no crash reporting and no third-party advertising SDK.
3. Data stored on your device
The app stores the content you create (text, drawings, photos, signatures, templates, time logs, reminders) and your settings (for example your name and place for the signature stamp, your letterhead and logo) in the app's private storage on your device. We have no access to this data.
When you send a PDF, the app also saves a copy in the folder Documents/Note & Sign on your device so you can find it later. Other apps that have permission to read your documents can see this folder.
With the Master plan you can encrypt notes. The key is protected by the Android Keystore and unlocked with your fingerprint or screen lock. It never leaves your device. If you remove your screen lock or reset your phone, Android deletes the key and encrypted notes can no longer be opened.
The app also counts locally how often features and its own promotional banners are used, to decide which tips to show. These counters stay on your device and are not sent to us.
4. Permissions and what they are used for
Microphone (dictation)
Used only while you hold the microphone button. The app passes your speech to the speech recognition service installed on your device (usually provided by Google or your phone's manufacturer), which returns the text. Depending on the device and its settings, this service may process audio online. That processing is governed by the provider's privacy policy. The app itself does not record or store audio.
Approximate location (place in the signature stamp)
Used only when you sign and only if you allow it. The app reads the approximate location last known to your device and asks the Android geocoding service for the name of the town. The place name is written into the note and the PDF. The coordinates are not stored. You can also enter the place by hand and deny the permission.
Biometrics and screen lock
Used to lock the time log and, with Master, to unlock encrypted notes. Android checks your fingerprint or screen lock. The app only learns whether the check succeeded and never receives biometric data.
Notifications, exact alarms, start after reboot, vibration
Used for reminders, the time tracking display, the quarter-hour chime and the end of breaks. Everything runs locally on your device.
Photos and files
When you add a photo or open a PDF, Android's own picker or camera is used and the app receives only the file you choose.
Internet
Used only for the timestamp described in section 5, for purchases through Google Play and for opening links in your browser.
5. Timestamp for sealed PDFs (Business and Master)
When you send a sealed PDF, the app requests a timestamp under the RFC 3161 standard. For this it sends only a cryptographic hash value of the document to a timestamp authority, never the document or its content. We use the free service of freetsa.org and, if it is unavailable, the timestamp service of DigiCert, Inc. (USA). As with any internet request, these services receive your IP address. The seal key is created in the Android Keystore and never leaves your device.
Legal basis: Art. 6(1)(b) GDPR (providing the feature you have chosen).
6. Purchases through Google Play
Subscriptions (Business, later Master) and voluntary support purchases are processed exclusively by Google Play. Google handles the payment under its own terms and privacy policy. We receive from Google only the information needed to provide what you bought, such as the product, the purchase status and an order or purchase identifier. We do not receive your payment details.
Legal basis: Art. 6(1)(b) GDPR (contract), and Art. 6(1)(c) GDPR for tax and accounting records we are required to keep.
7. Sending and sharing
When you send a note or document, you choose the recipient app (for example email, messenger or cloud storage) in Android's share menu. The data is then handled by that app and its provider. We are not involved.
8. Backups by Android
Android can include app data in the backup to your Google account if you have enabled device backup. This backup is controlled by you and Google. You can turn it off in your device settings. Encrypted notes stay encrypted in a backup; because the key does not leave your device, they cannot be opened on a different device.
9. Links and promotional banners
The app shows our own promotional banners, including a link to hausheimhandwerk.de. If you tap a link, it opens in your browser, and the privacy policy of the website you visit applies. The link contains the parameter ref=app so we can see that the visit came from the app; it does not identify you.
If we add third-party advertising to the free plan in a later version, we will update this policy before that version is released and describe the provider and the data involved.
10. This website
The website apps.3xhwerk.de runs on our own server in Germany. When you visit it, the web server automatically records the date and time, the page requested, the referring page, your browser's user agent and your IP address in a log file. We use these logs only to operate the website securely and to detect attacks. They are deleted after 14 days at the latest.
The website sets no cookies, uses no tracking or analytics and loads no content from third parties. Fonts are served from our own server.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating a secure website).
11. Contacting us
If you email us, we use your email address and message only to answer you. We delete the correspondence when it is no longer needed, unless we are required by law to keep it.
Legal basis: Art. 6(1)(b) or (f) GDPR.
12. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, contact us at support@3xhwerk.de. Because the app stores your content only on your device, we usually hold no data about you apart from emails and purchase information from Google Play.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
How to delete your data in the app is explained on the page Delete data.
13. Children
Note & Sign is a work tool and is not directed at children.
14. Changes
We will update this policy when the app or the law changes. The current version is always available at this address. The version number and date are shown at the top.