Privacy Policy

This Privacy Policy explains how Dotted Mind processes personal data in the Dotted Mind app and on dottedmind.app.

Dotted Mind is a local-first notebook app. Your notes, drawings, book titles, page titles, and notebook files are stored locally on your device.

1. What Dotted Mind does not do

Dotted Mind does not:

sell your data
show ads
use the IDFA
track you across apps or websites
send your note content, drawings, book titles, page titles, or notebook files to analytics or diagnostics services
use your content to train AI models

2. Local notebook content

Your notebook content is stored locally on your device using Apple system storage technologies.

Your content may be included in your own iCloud or Finder device backups, depending on your Apple settings.

When you export a PDF, share a page as an image, copy a link, or use the iOS share sheet, Dotted Mind passes the selected content to Apple’s system sharing interface at your direction.

Purpose: providing the notebook features of the app.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
Storage: locally on your device until you delete the content or remove the app.

3. Optional analytics and diagnostics

Product analytics and diagnostics are off by default. They only start if you give consent. You can change your choices at any time in the app settings.

Dotted Mind has two separate consent choices:

product analytics
diagnostics, crashes, errors, hangs, performance, and profiling

Product analytics are provided by PostHog Inc. using the EU cloud endpoint eu.i.posthog.com.

Analytics may include events such as app opened, book/page/chapter created or deleted, page exported, page shared, bookmark changed, and feedback submitted. These events do not include your note content, drawings, titles, or feedback message text.

PostHog also derives an approximate, coarse location (such as country or region) from your IP address when an event is received; this coarse GeoIP lookup cannot be turned off. PostHog is configured to discard the raw IP address after this lookup, so the IP itself is not stored.

Diagnostics are provided by Sentry using the EU region endpoint de.sentry.io.

Diagnostics may include crash, error, and hang reports (with stack traces, app version, operating system version, and device model), limited performance and energy metrics collected as counts only, such as thermal-state changes and aggregated CPU/runtime data from Apple’s MetricKit, and, occasionally, a single performance profile when your device runs hot. Sentry is configured not to attach your IP address (sendDefaultPii is off), and diagnostics never include your note content.

Both PostHog and Sentry may use pseudonymous technical identifiers, such as a per-install identifier and session identifier, to connect events from the same app installation. These identifiers are not your name or email address, but they are treated as personal data because they can link events to the same installation.

Purpose: app improvement, stability, and performance.
Legal basis: consent, Art. 6(1)(a) GDPR. For storing or accessing identifiers on your device, consent is also the basis under § 25(1) TDDDG.
Retention: product analytics (PostHog) up to 12 months; diagnostics (Sentry) up to 30 days, the free-plan retention limits of each provider.
Withdrawal: you can withdraw consent at any time in the app settings. Withdrawal does not affect processing that happened before withdrawal.

4. Feedback form

If you submit feedback, Dotted Mind processes your feedback message and, if provided, your optional email address.

If “Include device info” is enabled, the feedback may also include app version, build, app variant, iOS version, device model, and screen label.

Feedback is sent through a Cloudflare Worker and then creates a support issue in Linear.

Providers:

Cloudflare, Inc.
Linear Orbit, Inc.

Your email address may be stored locally on your device to pre-fill the feedback form next time. You can remove it at any time using the clear (✕) button in the feedback form’s email field, which also forgets the saved address.

Purpose: receiving, managing, and responding to support requests and feedback.
Legal basis: consent, Art. 6(1)(a) GDPR, when you submit feedback; where needed, legitimate interest, Art. 6(1)(f) GDPR, in handling support requests and improving the app.
Retention: support tickets in Linear are automatically closed after 6 months without activity and archived 6 months after they close; archived tickets are retained until manually deleted. You can request deletion at any time.

5. Website

When you visit dottedmind.app, technical connection data such as IP address, browser information, request time, and accessed pages may be processed to provide the website securely and reliably. The website is hosted by Cloudflare, Inc.

Purpose: providing the website, security, and technical reliability.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Retention: request logs are processed by Cloudflare (Workers observability) and retained for up to 3 days on the current plan.

When you sign up for the Dotted Mind beta on dottedmind.app, your email address is processed in order to send you the beta link and occasional product updates. Signup uses the double opt-in procedure: you receive a confirmation email and are added to the list only after you confirm. You can withdraw your consent at any time via the unsubscribe link in every email.

Email delivery and list management are handled by MailerLite (MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland) as a processor. Subscriber data is stored on servers within the European Union (Germany and the Netherlands).

Purpose: sending the beta link and occasional product updates you signed up for.
Legal basis: consent, Art. 6(1)(a) GDPR.
Retention: until you unsubscribe or withdraw your consent.

7. Contact by email

If you contact Dotted Mind by email, for example at hello@dottedmind.app, your message and the details you provide are processed in order to handle your request. The mailbox is operated by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as a processor (servers located in Germany).

Purpose: receiving and responding to your message.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where your request relates to a contract.

8. Apple services

Apple may process data when you download the app, buy subscriptions or paid features, use iCloud Backup, use device backups, use TestFlight, or use Apple system services.

If Dotted Mind offers paid features, purchases and subscriptions are processed by Apple through the App Store. Dotted Mind does not receive your full payment details.

Apple is responsible for its own data processing under Apple’s privacy terms.

9. TestFlight beta testing

When you use TestFlight, Apple may process beta testing data such as installed beta apps, device and system information, crash logs, usage information, and feedback you submit. Apple may send some of this to us to help test and improve the app. If you submit feedback, Apple also receives it; depending on how you were invited and how you submit, your email address or other information may be visible to us. Apple is responsible for its own processing of TestFlight data under Apple’s privacy terms.

Purpose: testing the app and fixing issues during the open beta.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR, in testing and improving the app; consent, Art. 6(1)(a) GDPR, where you choose to submit feedback. Apple processes TestFlight data as its own controller under Apple’s privacy terms.
Retention: Apple retains beta app feedback for up to one year and may keep crash and usage data until the related bugs are resolved. We keep the feedback and diagnostic data Apple shares with us only for the duration of the open beta and only as long as we need it to fix the issue and improve the app; TestFlight builds and their data expire automatically 90 days after upload, and we delete your beta data when the open beta ends or you stop testing.

10. Recipients and international transfers

Depending on your choices, personal data may be processed by:

PostHog Inc. for optional product analytics
Sentry for optional diagnostics
Cloudflare, Inc. for feedback and website infrastructure
MailerLite Limited (Ireland) for beta and product-update email delivery
ALL-INKL.COM – Neue Medien Münnich (Germany) for the email mailbox
Linear Orbit, Inc. for support ticket management
Apple for App Store, purchases, subscriptions, backups, TestFlight beta testing, and Apple system services

Some providers are based in the United States or belong to corporate groups based in the United States, even if EU endpoints or EU regions are used.

Where personal data is transferred outside the European Economic Area, Dotted Mind relies on appropriate safeguards such as the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or other lawful transfer mechanisms under GDPR.

Dotted Mind does not claim that all data always stays exclusively in the European Union.

11. Retention

Personal data is kept only as long as needed for the purposes described in this Privacy Policy or as required by law.

Current retention periods:

local notebook content: until you delete it or remove the app
local consent settings: until you change them, reset app data, or remove the app
local analytics identifier: until reset or removed with app data
locally saved feedback email: until changed, cleared, or app data is removed
beta signup (MailerLite): until you unsubscribe or withdraw consent
product analytics (PostHog): up to 12 months (free-plan retention)
diagnostics (Sentry): up to 30 days (free-plan retention)
feedback tickets (Linear): auto-closed after 6 months without activity, archived 6 months later; retained until deleted on request
website & feedback request logs (Cloudflare): up to 3 days
TestFlight beta data (Apple → us): kept for the duration of the open beta; Apple retains feedback up to 1 year and crash/usage data until bugs are resolved; TestFlight builds and their data expire 90 days after upload

12. Your rights

Under the GDPR, you may have the right to:

access your personal data
correct inaccurate data
request deletion
restrict processing
receive your data in a portable format
object to processing based on legitimate interests
withdraw consent at any time
lodge a complaint with a data protection supervisory authority

To exercise your rights, contact hello@dottedmind.app.

Because Dotted Mind does not create user accounts, some data may only be identifiable through information you provide, such as your email address, feedback content, or technical identifiers from your device.

13. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

The competent authority in North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Website: https://www.ldi.nrw.de

You may also contact another competent data protection authority.

14. Children

Dotted Mind is not specifically directed at children. If you are below the age required to consent to data processing in your country, consent must be given or authorized by a parent or legal guardian where required by law.

15. Automated decision-making

Dotted Mind does not use personal data for automated decision-making that produces legal effects or similarly significant effects.

16. Changes

This Privacy Policy may be updated when the app, website, providers, or legal requirements change. The current version is available on this page.

17. Controller

Dotted Mind is provided by:

Manuel Welsch
Kamper Weg 100
40627 Düsseldorf
Germany
Email: hello@dottedmind.app

Further provider information is available in the Legal Notice.

18. Contact

Questions about privacy can be sent to hello@dottedmind.app.

Last updated: June 2026