Privacy Policy

Auf Deutsch lesen.

This Privacy Policy explains how Dotted Mind processes personal data in the Dotted Mind app and on dottedmind.app.

1. Your notebook content stays on your device

Your notebook content is stored locally on your device using Apple system storage technologies.

Your content may be included in your own iCloud or Finder device backups, depending on your Apple settings.

When you export a PDF, share a page as an image, copy a link, or use the iOS share sheet, Dotted Mind passes the selected content to Apple’s system sharing interface at your direction.

The only exception: a screenshot you choose to attach to a feedback message may show your note content and is sent to our support tool, see section 3.

Purpose: providing the notebook features of the app.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
Storage: locally on your device until you delete the content or remove the app.

2. Optional analytics and diagnostics

Anything Dotted Mind collects beyond your device is optional and exists only to make the app better. Product analytics and diagnostics are off by default, start only if you consent, and can be changed at any time in the app settings.

Dotted Mind has two separate consent choices:

• product analytics
• diagnostics, crashes, errors, hangs, performance, and profiling

Product analytics are provided by PostHog Inc. using the EU cloud endpoint eu.i.posthog.com.

Analytics may include events such as app opened, book/page/chapter created or deleted, page exported, page shared, bookmark changed, and feedback submitted. These events do not include your note content, drawings, titles, or feedback message text.

PostHog also derives an approximate, coarse location (such as country or region) from your IP address when an event is received; this coarse GeoIP lookup cannot be turned off. PostHog is configured to discard the raw IP address after this lookup, so the IP itself is not stored.

Diagnostics are provided by Sentry using the EU region endpoint de.sentry.io.

Diagnostics may include crash, error, and hang reports (with stack traces, app version, operating system version, and device model), limited performance and energy metrics collected as counts only, such as thermal-state changes and aggregated CPU/runtime data from Apple’s MetricKit, and, occasionally, a single performance profile when your device runs hot. Sentry is configured not to attach your IP address (sendDefaultPii is off), and diagnostics never include your note content.

Both PostHog and Sentry may use pseudonymous technical identifiers, such as a per-install identifier and session identifier, to connect events from the same app installation. These identifiers are not your name or email address, but they are treated as personal data because they can link events to the same installation.

Purpose: app improvement, stability, and performance.
Legal basis: consent, Art. 6(1)(a) GDPR. For storing or accessing identifiers on your device, consent is also the basis under § 25(1) TDDDG.
Retention: product analytics (PostHog) up to 12 months; diagnostics (Sentry) up to 30 days, the free-plan retention limits of each provider.
Withdrawal: you can withdraw consent at any time in the app settings. Withdrawal does not affect processing that happened before withdrawal.

3. Feedback form

If you submit feedback, Dotted Mind processes your feedback message and, if provided, your optional email address.

If “Include device info” is enabled, the feedback may also include app version, build, app variant, iOS version, device model, and screen label.

Feedback is sent through a Cloudflare Worker and then creates a support issue in Linear.

You can also attach up to three screenshots to your message. Screenshots are optional and are chosen by you from your photo library; they may contain note content, for example a page you are asking about. They are uploaded directly to Linear over an encrypted connection; the Cloudflare Worker only issues the upload links and does not receive the image files.

Your email address may be stored locally on your device to pre-fill the feedback form next time. You can remove it at any time using the clear (✕) button in the feedback form’s email field, which also forgets the saved address.

Purpose: receiving, managing, and responding to support requests and feedback.
Legal basis: consent, Art. 6(1)(a) GDPR, when you submit feedback; where needed, legitimate interest, Art. 6(1)(f) GDPR, in handling support requests and improving the app.
Retention: support tickets in Linear are automatically closed after 6 months without activity and archived 6 months after they close; archived tickets are retained until manually deleted. You can request deletion at any time.

4. Website

When you visit dottedmind.app, technical connection data such as IP address, browser information, request time, and accessed pages may be processed to provide the website securely and reliably. The website is hosted by Cloudflare, Inc.

Purpose: providing the website, security, and technical reliability.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Retention: request logs are processed by Cloudflare (Workers observability) and retained for up to 3 days on the current plan.

Website analytics. To understand how the website is used, Dotted Mind uses PostHog (PostHog Inc., EU cloud endpoint eu.i.posthog.com) in a cookieless mode:

• No cookies are set, and nothing is stored on or read from your device.
• PostHog does not receive your IP address. Cloudflare, which already processes your IP to deliver the site, passes only an approximate country to the analytics.
• Only aggregate, anonymous usage data is collected (such as pages viewed, approximate country, and whether the signup form was submitted); it is not linked to your identity.

This is separate from the optional in-app analytics in section 2.

Purpose: understanding and improving the website, including which countries visitors come from.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Because nothing is stored on or read from your device, the consent requirement of § 25(1) TDDDG does not apply, so no cookie banner is shown.
Retention: website analytics (PostHog) up to 12 months (free-plan retention).

5. Beta signup and updates

When you sign up for the Dotted Mind beta on dottedmind.app, your email address is processed in order to send you the beta link and occasional product updates. Signup uses the double opt-in procedure: you receive a confirmation email and are added to the list only after you confirm. You can withdraw your consent at any time via the unsubscribe link in every email.

Email delivery and list management are handled by MailerLite (MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland) as a processor. Subscriber data is stored on servers within the European Union (Germany and the Netherlands).

Purpose: sending the beta link and occasional product updates you signed up for.
Legal basis: consent, Art. 6(1)(a) GDPR.
Retention: until you unsubscribe or withdraw your consent.

6. Contact by email

If you contact Dotted Mind by email, for example at hello@dottedmind.app, your message and the details you provide are processed in order to handle your request. The mailbox is operated by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as a processor (servers located in Germany).

Purpose: receiving and responding to your message.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where your request relates to a contract.

7. Apple services and TestFlight

Apple may process data when you download the app, buy subscriptions or paid features, use iCloud Backup, use device backups, use TestFlight, or use Apple system services. If Dotted Mind offers paid features, purchases and subscriptions are processed by Apple through the App Store. Dotted Mind does not receive your full payment details.

When you use TestFlight, Apple may process beta testing data such as installed beta apps, device and system information, crash logs, usage information, and feedback you submit. Apple may share some of this with us to help test and improve the app; depending on how you were invited and how you submit feedback, your email address or other information may be visible to us.

Apple is responsible for its own data processing under Apple’s privacy terms.

Purpose: testing the app and fixing issues during the open beta.
Legal basis: legitimate interest, Art. 6(1)(f) GDPR, in testing and improving the app; consent, Art. 6(1)(a) GDPR, where you choose to submit feedback.
Retention: Apple retains beta feedback for up to one year and crash and usage data until the related bugs are resolved; TestFlight builds and their data expire 90 days after upload. We keep what Apple shares with us only as long as needed during the open beta.

8. Recipients and international transfers

Depending on your choices, personal data may be processed by:

• PostHog Inc. for product analytics (optional in the app; cookieless on the website)
• Sentry for optional diagnostics
• Cloudflare, Inc. for feedback and website infrastructure
• MailerLite Limited (Ireland) for beta and product-update email delivery
• ALL-INKL.COM – Neue Medien Münnich (Germany) for the email mailbox
• Linear Orbit, Inc. for support ticket management
• Apple for App Store, purchases, subscriptions, backups, TestFlight beta testing, and Apple system services

Some providers are based in the United States or belong to corporate groups based in the United States, even if EU endpoints or EU regions are used.

Where personal data is transferred outside the European Economic Area, Dotted Mind relies on appropriate safeguards such as the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or other lawful transfer mechanisms under GDPR.

Dotted Mind does not claim that all data always stays exclusively in the European Union.

9. Your rights

Under the GDPR, you may have the right to:

• access your personal data
• correct inaccurate data
• request deletion
• restrict processing
• receive your data in a portable format
• object to processing based on legitimate interests
• withdraw consent at any time
• lodge a complaint with a data protection supervisory authority

To exercise your rights, contact hello@dottedmind.app.

Because Dotted Mind does not create user accounts, some data may only be identifiable through information you provide, such as your email address, feedback content, or technical identifiers from your device.

The competent supervisory authority for Dotted Mind is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (www.ldi.nrw.de). You may also contact any other competent data protection authority.

10. Children

Dotted Mind is not specifically directed at children. If you are below the age required to consent to data processing in your country, consent must be given or authorized by a parent or legal guardian where required by law.

11. Automated decision-making

Dotted Mind does not use personal data for automated decision-making that produces legal effects or similarly significant effects.

12. Changes

This Privacy Policy may be updated when the app, website, providers, or legal requirements change. The current version is available on this page.

13. Controller and contact

Dotted Mind is provided by:

Manuel Welsch
Kamper Weg 100
40627 Düsseldorf
Germany
Email: hello@dottedmind.app

Further provider information is available in the Legal Notice. Questions about privacy can be sent to the email address above.

Last updated: July 2026