Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for data processing in connection with the Naptide app is:

Lennart Dörfer
Provider of Naptide
c/o Online-Impressum #8297
Europaring 90
53757 Sankt Augustin
Germany
E-Mail: contact@furnista.app

2. General information on data processing

Naptide is an app designed to support the planning and documentation of a baby’s sleep and wake times. We process personal data only to the extent necessary to provide the app, manage in-app purchases and, subject to the provisions below, measure reach and advertising performance.

No user account is generally required to use the core functions. Naptide does not use AI services to process sleep or baby data entered by the user.

Providing locally stored baby and sleep data is only necessary to the extent that the relevant app features are used. RevenueCat data is only generated when paid features are used. Marketing and attribution measurement is not required to use Naptide’s core features.

3. Hosting of the app backend

Technical backend functions of the app are hosted by the following service provider:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

As part of hosting, technically necessary connection and server data may be processed, in particular the IP address, time of access, requested path, HTTP status code and other technically required connection data.

This processing is carried out to ensure the secure and stable operation of our systems, for error analysis, IT security and detection of misuse.

Legal basis: Art. 6(1)(f) GDPR.

Legitimate interest: Secure and stable operation of the app backend and protection against technical disruptions and misuse.

Server log data is regularly rotated and generally deleted after approximately 14 days unless longer retention is required in an individual case for security reasons.

4. Use of the app

4.1 Baby and sleep data processed locally

For the functions of Naptide, users may enter the following information in the app in particular:

• the baby’s date of birth or age,
• where applicable, information about premature birth or age-related calculations,
• sleep and wake times as well as times derived from them,
• entries in the sleep history,
• reminder and notification settings,
• where applicable, a locally used label or name for the baby.

This information is used to calculate and display the sleep planning and history features provided by Naptide.

Baby and sleep data is stored exclusively locally on the end device and is not transmitted to our servers, Hetzner, RevenueCat or AppsFlyer.

We therefore have no direct access to this locally stored content. It can be changed or deleted within the app. If the app is uninstalled, locally stored data may be deleted depending on the operating system and any available device backups.

Legal basis: To the extent that personal data is processed as part of the app’s functionality, this is done to provide the app functions expressly requested by the user pursuant to Art. 6(1)(b) GDPR.

4.2 Reminders and local notifications

Naptide can display reminders and notifications at the user’s request. For this purpose, the notification permission provided by the operating system is used.

Where only local notifications are used, no baby or sleep data is transmitted to a push server operated by us for this purpose. Permission can be changed or withdrawn at any time in the device’s system settings.

4.3 Aggregated usage counters via Hetzner

For basic technical and product-related analysis, certain usage actions may be counted in aggregated form, for example how often a particular feature is used in total or how often a particular step is completed overall.

For this purpose, the app only sends a predefined counter event to our backend hosted by Hetzner. In particular, no names, baby or sleep data, advertising IDs or persistent user identifiers assigned by us are stored with the counter event. Only the respective aggregate counter is incremented on the server.

No personal usage profiles are created on this basis, and the counted events are not used to recognize individual users across multiple sessions.

Technically, the IP address may be processed briefly when the server connection is established and, depending on the server configuration, may be included in the server logs described in Section 3. The IP address is not linked to the aggregated counter.

Legal basis: Art. 6(1)(f) GDPR.

Legitimate interest: Privacy-friendly, aggregated analysis of general usage in order to improve and securely operate the app without creating personal usage profiles.

5. Payment processing and premium features

5.1 App Store

Paid features or subscriptions are purchased through the Apple App Store. Payment processing and the processing of payment data, such as credit card or bank account details, are carried out by Apple in accordance with its applicable privacy terms. We do not receive complete payment data.

5.2 Subscription management and in-app purchases via RevenueCat

For the technical management, validation and restoration of in-app purchases and subscriptions, we use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA.

This may involve the processing of, in particular, a pseudonymous app user identifier, information about the product or subscription used, purchase and transaction information, the current entitlement or subscription status, as well as technically necessary platform and device data.

RevenueCat does not receive any baby or sleep data from us and does not receive complete payment or credit card details. The payment data itself remains with the respective store operator.

Legal basis: Art. 6(1)(b) GDPR, as the processing is necessary to manage and provide the purchased premium features.

RevenueCat processes customer data as a processor under its Data Processing Addendum. RevenueCat is a US company and, according to its own information, processes data in the United States, among other locations. Appropriate safeguards are used for necessary transfers to third countries, in particular the European Commission’s Standard Contractual Clauses where no adequacy decision applies.

Further information: RevenueCat Privacy Policy.

6. Mobile attribution and marketing measurement with AppsFlyer

We use AppsFlyer to attribute app installations to advertising campaigns and marketing channels. Under AppsFlyer’s contractual terms, the contracting entity for customers based in Germany is generally AppsFlyer Ltd., 14 Maskit St., Herzliya 4673314, Israel.

We currently use AppsFlyer exclusively for installation and attribution measurement. We do not send our own events relating to trials, purchases, paywalls or the use of individual Naptide features to AppsFlyer.

As part of technical attribution, AppsFlyer may process the following data depending on the operating system, device settings and permissions granted:

• IP address and technical device information,
• device type, operating system and operating system version, language and time zone,
• technical identifiers such as the AppsFlyer ID and IDFV and, only after the relevant Apple permission has been granted, the advertising identifier IDFA,
• information about ad clicks, campaigns, installations, first opens and subsequent app sessions.

Baby and sleep data, names, dates of birth, information about premature birth, sleep or wake times and reminder data are not transmitted to AppsFlyer.

The processing is used to measure which advertising campaigns led to installations of Naptide and to statistically evaluate our advertising. Where consent is required under data protection or device-access law, the relevant processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

6.1 Apple App Tracking Transparency (ATT) and IDFA

On iOS, we use Apple’s App Tracking Transparency (ATT) system where access to the advertising identifier IDFA is requested. The ATT prompt is shown only if the user has not yet made a decision.

If the user grants ATT permission, AppsFlyer may use the IDFA for attribution where it is made available by the operating system. If ATT permission is denied or restricted, the IDFA is not used. The ATT setting can be changed at any time in iOS under “Privacy & Security” > “Tracking”.

6.2 SKAdNetwork (SKAN)

For iOS advertising campaigns, Apple’s SKAdNetwork (SKAN) may also be used. SKAN provides a privacy-oriented attribution mechanism supplied by Apple and works without access to the IDFA. It can therefore also be used where ATT permission has not been granted.

Naptide is configured so that SKAN postbacks can be transmitted or otherwise made available to AppsFlyer for analysis using Apple’s designated mechanism.

6.3 Data transfers by AppsFlyer

AppsFlyer may process data within its global infrastructure and with the involvement of affiliated companies or service providers outside the European Economic Area. According to AppsFlyer, appropriate safeguards are used for such transfers depending on the recipient, in particular adequacy decisions, the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Further information: AppsFlyer Services Privacy Policy.

7. Contact by email

If users contact us by email, we process the data provided solely for the purpose of handling the inquiry.

Email communication is provided via:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany

Depending on the content of the message, the email address, name, content of the inquiry and voluntarily submitted attachments may be processed in particular.

Legal basis: Art. 6(1)(b) GDPR where the inquiry relates to a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in handling user inquiries.

Support inquiries are deleted after final processing unless statutory retention obligations or other legitimate reasons require longer storage.

8. Recipients and disclosure of data

Personal data is only disclosed where this is necessary for the purposes described in this Privacy Policy or where there is a legal obligation to do so. Recipients or service providers used may include in particular:

• Hetzner Online GmbH (hosting and backend),
• Apple (App Store and payment processing),
• RevenueCat, Inc. (management of in-app purchases and subscriptions),
• AppsFlyer Ltd. and affiliated companies or subprocessors (attribution and marketing measurement, where permitted),
• IONOS SE (email communication).

Baby and sleep data that is stored exclusively locally on the end device is not transmitted to these recipients.

9. Storage periods

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations.

• Local baby and sleep data: on the end device until it is deleted there by the user or until the app data is deleted.
• Aggregated Hetzner counters: as aggregate totals; any server log data containing technical connection data is kept separately and is generally stored for approximately 14 days.
• RevenueCat data: for as long as necessary for technical contract and subscription management or in accordance with RevenueCat’s contractual deletion and retention rules.
• AppsFlyer data: in accordance with the configuration selected by us and AppsFlyer’s contractual or statutory retention rules; data is not processed for longer than necessary for attribution and marketing measurement.
• Support emails: until final processing, unless statutory retention obligations apply.

10. Rights of data subjects

Subject to the statutory requirements, data subjects have in particular the right to:

• access the personal data being processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Data subjects also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Where data is stored exclusively locally on the end device and is not accessible to us, we cannot technically access, modify or delete that data centrally. Such data can be managed directly in the app or on the end device.

11. Data security

We use appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access.

These measures include in particular:

• encrypted data transmission via TLS,
• server-side access restrictions,
• limiting data transmitted to external services to what is necessary,
• local storage of baby and sleep data,
• aggregated usage counters without a persistent user identifier assigned by us,
• regular rotation of server logs.

12. Changes to this Privacy Policy

We may amend this Privacy Policy if Naptide’s functions, service providers used, legal requirements or the nature of data processing change.

The version published at the relevant time applies.