Privacy Policy (Datenschutzerklärung)

1. Data Controller (Verantwortliche Stelle)

The controller responsible for data processing on this website and in the norot app, within the meaning of the EU General Data Protection Regulation (GDPR), is:

Managing Directors (Geschäftsführer):
Moritz Koberling
Cornelius Ramesohl

Contact:
Email: norot@dynamis.health
Register Court: Amtsgericht München, HRB 295206

2. General Information (Allgemeines zur Datenverarbeitung)

This policy covers the website norot.io, the norot app for iPhone and your norot account. We process personal data in line with the GDPR and the German Federal Data Protection Act (BDSG).

We only process personal data when a legal basis allows it. For norot, these are:

• Performance of a contract or pre-contractual steps (Art. 6 para. 1 lit. b GDPR)
• Compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR)
• Legitimate interests (Art. 6 para. 1 lit. f GDPR)

Each section below says which data we process, why, and on which legal basis. Section 15 says how long we keep it.

3. This Website (Bereitstellung der Website)

3.1 Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

3.2 Server Log Files (Server-Logdateien)

When you visit norot.io, the host automatically processes the following information in server log files so it can deliver the site:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

Legal basis: our legitimate interest in delivering this website securely and reliably (Art. 6 para. 1 lit. f GDPR).

3.3 No Cookies, No Analytics (Keine Cookies, keine Analyse)

This website sets no cookies. It uses no analytics, no tracking and no third-party content. It loads no external fonts or scripts. The site is served over encrypted HTTPS connections.

4. Your norot Account (Ihr norot-Konto)

You need a norot account to use the app. It keeps your settings, your daily numbers and your Premium subscription together, so they come with you to a new iPhone.

Your norot account is separate from your Instagram account. It never holds your Instagram login, and we don’t know which Instagram account you use.

4.1 Signing Up and Signing In (Registrierung und Anmeldung)

You can create your account in two ways:

• Sign in with Apple. Apple confirms who you are. It gives us your email address and a random ID for your Apple sign-in. You can choose to hide your email address. Apple then gives us a private relay address that forwards our emails to you. Apple’s own privacy policy applies to Sign in with Apple.
• Email and password. Your password is stored only as a secure hash, a scrambled form that can’t be turned back into your password. Nobody at norot can see it.

You need to be at least 13 years old to create an account (see our Terms of Use).

4.2 What We Store (Welche Daten wir speichern)

• Your email address, or Apple’s private relay address
• How you sign in: with Apple, or with email and password
• Your account ID, a random code that identifies your account
• When you created your account and when you last signed in
• Your iPhone’s language and region setting (locale)

We don’t ask for your name or your phone number.

Why: to create and run your account, to sign you in, and to link your settings and Premium to you.

Legal basis: performance of our contract with you (Art. 6 para. 1 lit. b GDPR).

4.3 Emails (E-Mails)

We only email you about your account. For example, we send a link to confirm your email address or to reset your password, or a note about an important change to our terms. We don’t send newsletters or ads. These emails are sent through Supabase (Section 6).

Legal basis: performance of our contract with you (Art. 6 para. 1 lit. b GDPR).

4.4 Sign-In Security (Sicherheit der Anmeldung)

When you sign in, Supabase records the time, your IP address and the type of device and app you used. This helps keep accounts safe and lets us look into problems, such as sign-ins that fail. Your sign-in session itself is stored in the iOS Keychain on your iPhone.

Legal basis: our legitimate interest in keeping accounts secure (Art. 6 para. 1 lit. f GDPR).

4.5 Records of Your Agreement (Nachweis Ihrer Zustimmung)

When you create your account, you agree to our Terms of Use and confirm that you have read this Privacy Policy. We store which versions these were, when you agreed, and the app version and platform you used. When we update either document and you agree again, we store that too.

Why: so we can show which terms apply to you.

Legal basis: our legitimate interest in being able to prove what was agreed (Art. 6 para. 1 lit. f GDPR).

5. Sync (Synchronisierung)

Your account syncs your norot settings and your daily numbers. When something changes, norot saves it to your account. When you sign in on another iPhone, it comes with you.

5.1 Your Settings (Ihre Einstellungen)

• Your Reels mode and your daily number
• Your feed switches, for example hiding Explore or showing the feed in grayscale
• Your quiet hours and your daily time limit
• Changes that are still waiting to start, with the time they start. Raising a limit starts after 24 hours, and saving the start time keeps it the same on every iPhone.

Why: so your settings are the same on each iPhone you use, and after you reinstall norot.

Legal basis: performance of our contract with you (Art. 6 para. 1 lit. b GDPR).

5.2 Daily Numbers (Tägliche Zahlen)

For each day you use norot, your account stores a few totals:

• How many reels you opened
• How many seconds you spent in norot’s Instagram browser
• How often norot stepped in, for example when your daily number was reached
• Your Reels mode and daily number that day, and whether you stayed within it
• The version of the norot app

What we never store: which reels you opened, which accounts you looked at, or anything you saw, wrote or sent on Instagram. The reel counter runs on your iPhone. Only the daily totals reach us.

Why: to show your history and streaks, also on a new iPhone. We also use these numbers to improve norot, for example to see how many people stay within their own limit. For this we mostly look at totals across all users.

Legal basis: showing your history is part of our contract with you (Art. 6 para. 1 lit. b GDPR). Improving norot is our legitimate interest (Art. 6 para. 1 lit. f GDPR). You can object to this (Section 18).

6. Where Account Data Is Stored: Supabase (Speicherort der Kontodaten: Supabase)

Your account and the data linked to it, as described in Sections 4, 5, 12 and 13, are stored by our service provider Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992.

Supabase runs our database and our sign-in service on Amazon Web Services (AWS) servers in the eu-central-1 region in Frankfurt am Main, Germany. So this data is stored inside the European Union and inside Germany. Supabase encrypts it when it is stored and when it is sent (AES-256 and TLS).

There are two exceptions. First, small server functions that norot uses, for example to receive subscription updates from RevenueCat, may run outside Germany. The data they read and write stays stored in Frankfurt. Second, Supabase staff and Supabase’s own service providers may access data from outside the EU for support, maintenance and security (Section 17).

Legal basis: performance of our contract with you (Art. 6 para. 1 lit. b GDPR). We have a data processing agreement with Supabase under Art. 28 GDPR.

7. The App: Instagram (Die App: Instagram)

norot shows Instagram’s website (instagram.com) inside Apple WebKit, the browser engine that also powers Safari.

You log in on instagram.com itself. Your username, password and any login codes go directly from your device to Instagram, which is operated in the EU by Meta Platforms Ireland Ltd. We never read, store or send your Instagram login details.

Instagram’s cookies, which keep you logged in, are stored only on your device, inside norot’s app container. “Log out of Instagram” in norot’s Settings deletes them.

Your use of Instagram is governed by Meta’s own terms of use and privacy policy. Meta decides how it processes data about your Instagram use. We have no influence on that.

norot does not read, collect or transmit your messages, posts, feed or profile. To apply your settings, it only hides parts of the page and counts the reels you open. The counting happens on your iPhone. Which reels you opened never leaves your iPhone. Only the daily totals reach your account (Section 5.2).

8. The App: Data on Your Device (Die App: Daten auf Ihrem Gerät)

norot also keeps data on your iPhone:

• The reels counted today, so the same reel isn’t counted twice. This list never leaves your iPhone.
• Today’s numbers, your streaks and up to 90 days of daily stats
• A copy of your settings and any pending setting change
• Your sign-in session for your norot account

This data is kept in norot’s app storage, in an App Group that norot shares only with its own widgets, and in the iOS Keychain. Your settings and daily totals are also saved to your account (Section 5).

Deleting the app removes this data from your iPhone, with one exception. iOS may keep norot’s Keychain entries after you delete the app. They hold today’s reel count and any pending setting change, so reinstalling does not reset today’s limit. They can also hold your sign-in session. They never contain anything from Instagram.

9. The App: Screen Time (Die App: Bildschirmzeit)

If you choose to lock the Instagram app, norot uses Apple’s Family Controls framework, which is part of Screen Time. You pick the app yourself in Apple’s list.

Apple gives norot only opaque tokens for your selection, not the names of the apps. These tokens are stored on your device. Apple does not tell us which apps you picked, and nothing is sent to us.

If you turn on “Block adult websites”, Apple’s own Screen Time filter does the filtering on your iPhone, and norot never sees which websites you visit.

You can turn off norot’s Screen Time access at any time in iPhone Settings.

10. The App: Rules File (Die App: Regeldatei)

Instagram changes its website often. To keep up, the app downloads a small rules file from norot.io when it starts and about every 6 hours. The file contains only data, such as which parts of the page to hide.

The request contains no personal data, no identifier, nothing from your account and nothing about how you use Instagram. Like any web request, it includes your IP address and basic technical details, such as the app and iOS version. Our host Vercel processes these in server logs to deliver the file (see Section 3.2).

Legal basis: our legitimate interest in keeping the app working when Instagram’s website changes (Art. 6 para. 1 lit. f GDPR).

11. Notifications (Mitteilungen)

norot does not send you notifications. There is no push server, and nothing about notifications is sent to us.

12. In-App Purchases and Subscriptions (In-App-Käufe und Abonnements)

12.1 Buying Through Apple (Kauf über Apple)

You buy norot Premium through Apple’s App Store. Apple handles the payment under its own privacy policy. We never receive your payment method, card number or billing address.

12.2 Subscription Management: RevenueCat (Abo-Verwaltung: RevenueCat)

We manage subscriptions with our service provider RevenueCat, Inc. (revenuecat.com/privacy). To show offers and to check whether you have Premium, the app contacts RevenueCat, also if you never buy anything.

RevenueCat links your purchases to your norot account ID. This is how Premium stays with your account on any iPhone. We don’t give RevenueCat your email address or your name.

RevenueCat processes:

• Your norot account ID, and before you sign in, a random ID for your installation
• Apple’s transaction IDs (assigned by Apple, not your payment details)
• The product you bought, its price and currency, and your App Store country
• Purchase, renewal, cancellation and expiry times
• Your subscription status, for example active, cancelled or expired
• Technical details needed for the request, such as your IP address, app version and iOS version

12.3 Subscription Updates on Our Server (Abo-Ereignisse auf unserem Server)

When you buy, renew or cancel Premium, or when it ends, RevenueCat sends a message about it to our server at Supabase. We store:

• Your current subscription status and when it ends
• The product, the store and the subscription period, whether it is a free trial, and how often it has renewed
• The price, currency, taxes and Apple’s commission
• Your App Store country
• Purchase, renewal, cancellation and expiry times, and the reason a subscription ended, if Apple gives one
• Apple’s transaction IDs, the offer you bought from, any offer code, and whether the purchase is shared through Family Sharing
• The original message from RevenueCat, which holds these same details

Why: to give you Premium on each iPhone where you use your account. We also use these records to understand how Premium is doing, for example how many people renew.

Legal basis: giving you Premium is part of our contract with you (Art. 6 para. 1 lit. b GDPR). Understanding how Premium is doing is our legitimate interest (Art. 6 para. 1 lit. f GDPR).

Recipients: Apple, RevenueCat, Inc. and Supabase, Inc. We don’t share purchase data for advertising.

Retention: until you delete your account (Section 15).

13. Premium Offers in the App (Paywall-Ereignisse)

When norot shows you a Premium offer, the app notes what happened and saves it to your account:

• Which offer screen you saw, and which version of it
• Where it came from, for example the end of sign-up or a Premium feature you tapped
• What happened next. For example, you closed it, bought Premium, cancelled a purchase or restored an earlier one. We also note if a purchase or restore failed, with a short error code.
• The product you chose, the app version and the time

Why: to learn which Premium features matter to people, and to find and fix problems with buying. We don’t use this for advertising.

Legal basis: our legitimate interest in improving norot and its Premium offer (Art. 6 para. 1 lit. f GDPR). You can object to this (Section 18).

14. No Ads, No Tracking (Keine Werbung, kein Tracking)

norot shows no ads. It does not track you across other apps or websites, and it contains no analytics tools from other companies. We don’t build advertising profiles, and we don’t sell or rent data.

The app contains code libraries (SDKs) from two other companies: RevenueCat for subscriptions (Section 12) and Supabase for your account (Section 6). Neither is used for advertising or tracking.

We share data only with the companies named in this policy, or when the law requires us to. Our service providers process data only on our behalf, under data processing agreements (Art. 28 GDPR).

15. How Long We Keep Data (Speicherdauer)

• Your account and the data linked to it (settings, pending changes, subscription records and records of your agreement): until you delete your account.
• Premium offer events: up to 2 years. Older ones are deleted automatically. All of them are deleted with your account.
• Daily numbers: up to about 400 days. Older days are deleted automatically. All of them are deleted with your account.
• Sign-in records and server logs at Supabase, RevenueCat and Vercel: for a short time, as set by these providers.
• Backups: deleted data can stay in Supabase’s automatic backups for a short time, until they are overwritten.

16. Deleting Your Account (Löschung Ihres Kontos)

You can delete your account in the app at any time: Settings, Account, Delete account. This deletes your account and all data linked to it on our servers. It can’t be undone.

Your subscription is separate. Apple manages subscriptions, so deleting your account does not cancel one. To stop it, cancel it in iPhone Settings: tap your name, then Subscriptions, then norot.

What stays. Apple keeps its own record of your purchases. We keep a short note that an account was deleted: when it was created and deleted, how it signed in, whether it had Premium, and on how many days it was used, including the last one. This note has no email address and no account ID, so it can’t be linked back to you.

If you can’t open the app, write to us at norot@dynamis.health and we will delete your account for you.

17. International Data Transfers (Internationale Datenübermittlung)

Your account data is stored in Frankfurt, Germany (Section 6). Some of our service providers are based outside the European Economic Area, or may process or access data there:

• Supabase, Inc. (account and database): based in Singapore, part of a group with companies in the USA. Data is stored in Frankfurt but may be accessed from outside the EU for support, maintenance and security.
• RevenueCat, Inc. (subscriptions): USA
• Apple Inc. (purchases and Sign in with Apple): USA
• Vercel Inc. (this website and the rules file): USA

Where this happens, we rely on appropriate safeguards: the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) and, where the recipient is certified, the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR).

18. Your Rights (Ihre Rechte)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 para. 3 GDPR)

You can do some of this yourself in the app: see and change your settings, see your stats, and delete your account (Section 16). For everything else, such as a copy of your data, write to norot@dynamis.health. Please tell us the email address of your account, so we can find it.

Right to Object (Widerspruchsrecht)

Where we process your data based on our legitimate interest (Art. 6 para. 1 lit. f GDPR), you can object at any time, for reasons that come from your personal situation (Art. 21 GDPR). This covers, for example, using daily numbers to improve norot (Section 5.2) and Premium offer events (Section 13). To object, write to norot@dynamis.health.

19. Right to Lodge a Complaint (Beschwerderecht)

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

20. Changes to This Policy (Änderungen dieser Datenschutzerklärung)

We update this policy when norot or the law changes. The current version is always on this page, with its date at the top. If a change matters for you, we will tell you in the app.