Privacy policy

Short version: without an account, your lists never leave your device. With an account, we store your email address and an encrypted copy of your data that we cannot read. There are no ads, no analytics and no tracking, in the app or on this website.

Who is responsible

Vincent Winkler, Nikolsdorf 95, 9782 Nikolsdorf, Austria.
Email: contact@sospiro.app

This website

sospiro.app sets no cookies and uses no analytics, tracking pixels or third-party embeds. Fonts are served from our own server. To deliver pages, our server necessarily processes your IP address and the request (page, time, browser). Technical logs, if kept, are deleted after 14 days at the latest. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Using the app without an account

Everything you write is stored only on your device. Nothing is sent to us. Notifications are scheduled locally on your device.

Your account and sync

If you create an account to sync between devices, we process:

• your email address and, if you set one, a display name;
• a value derived from your password on your device. Your password itself never leaves your device; we store only a salted hash of the derived value;
• your tasks, projects and lists, encrypted on your device before upload (end-to-end encryption). We cannot read them;
• device names and platforms, and the time of each device's last sync;
• your subscription status.

Legal basis: performing our contract with you (Art. 6(1)(b) GDPR). We keep this data until you delete your account. Deletion is immediate and removes everything listed above from our server. You can delete your account in the app or on the delete account page.

If you request a password reset, we send you an email through our email provider. Our servers are operated by Hetzner Online GmbH in Germany under a data processing agreement.

Payments

Subscriptions bought in the Android or iOS app are processed by Google Play or the Apple App Store under their own privacy policies. We use RevenueCat, Inc. (USA) to check the status of those purchases; it receives a random account ID and the purchase receipts, not your tasks. Subscriptions paid by card are processed by Stripe Payments Europe Ltd. (Ireland). Stripe receives your email address and payment details; we never see your full card number. Legal basis: Art. 6(1)(b) GDPR. Where data reaches the USA, the transfer relies on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

Calendar connections

If you connect a Google or Microsoft Outlook calendar, your device talks to that provider directly. Calendar events are never sent to our servers. The sign-in step runs on connect.sospiro.app, a static page that hands the access token back to your device without storing it. Google's and Microsoft's own privacy policies apply to your calendar account.

Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interests. Write to contact@sospiro.app. You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna,dsb.gv.at).

Children

Sospiro is not directed at children under 14, and we do not knowingly collect their data.

Changes

If this policy changes, we update this page and the date below.

Last updated 25 October 2026.