Last updated: 12 September 2026 · Legal notice · Deutsch
This is a translation for convenience. The German version is the legally binding one.
Nora is a local-first app for recording your working days. Your entries are stored on your device; there is no user account and no Nora database holding your working days. For the map and address search we operate a small proxy (see “Recipients”). Without Nora Pro an ad banner is shown to fund the app; the one-time purchase Nora Pro removes it.
Hendrik Heidsiek
Schützenstr. 32
24568 Kaltenkirchen
Deutschland
E-Mail: hendrik@heidsiek.eu
No data protection officer has been appointed (not required by law).
Work-day entries (status, notes), settings and places (label, centre, radius) are stored locally only; we have no access to them. If you switch on place detection, geofences are registered with the operating system; the evaluation happens on the device, and no location data is transmitted for this function. The “background location” permission is used solely to set or suggest the day’s status when you arrive at one of your places – including while the app is closed.
Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the function you requested) and Art. 6(1)(b) GDPR. Place detection is optional and can be switched off at any time.
If you use the map or the address search when adding a place, the requests needed for that are transmitted: map tiles, your search term and the coordinates of the map section. If you open the map picker without a saved place, that is initially your current position, so the map starts in the right spot. Your work-day data is not transmitted.
These requests run through a proxy we operate (Cloudflare Worker) to Mapbox. The proxy holds the map service key server-side and does not store the requests; to prevent abuse, the IP address is evaluated briefly for rate limiting.
Legal basis: Art. 6(1)(b) GDPR (providing the function you called up) and Art. 6(1)(f) GDPR (protecting the service).
Nora greys out the public holidays of your chosen region. For Germany they are computed on the device; for Austria, Switzerland, the US, the UK, Ireland, the Netherlands, France, Spain, Canada and Australia they are bundled with the app. Only if you pick another country, or the bundled data does not cover a year, does Nora load the holidays once (and afterwards at most every 90 days) from Nager.Date (date.nager.at). Only the country code and the year are transmitted – no user data, no entries, no location. As with any network request, the provider sees your IP address. Legal basis: Art. 6(1)(b) GDPR.
Without Nora Pro, an ad banner is shown via Google AdMob (Google Ireland Ltd.) to fund the app. Device-related data may be processed in the process – e.g. an advertising ID (on iOS Nora never asks for tracking permission, so no advertising ID is available there), IP address, coarse region and device/usage information – in order to deliver ads and, with your consent, personalise them, as well as to prevent fraud. None of your work-day, note or location/place data recorded in Nora is transmitted to AdMob. With Nora Pro (one-time purchase) and during the first 14 days after installation, Nora shows no ads and requests none.
Consent: Before ads are requested for the first time, Nora shows a consent dialog (Google User Messaging Platform). There you decide whether your data may be used to personalise advertising. If you decline, ads are still delivered – but non-personalised. If no consent decision comes about at all (for example because the consent form could not be loaded), the app requests no ads. You can change or withdraw your choice at any time in the app settings under “Ad/consent settings”; withdrawal takes effect for the future. More: Google privacy · AdMob partners.
Legal basis: Consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
The one-time purchase is handled by Google Play or the Apple App Store; we receive no payment data. Nora only stores a local unlock flag. The earlier “Remove ads” purchase continues to count as Nora Pro. Legal basis: Art. 6(1)(b) GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Operating the map proxy | USA (EU data centres) |
| Mapbox, Inc. | Map tiles, address search, reverse geocoding | USA |
| Nager.Date (date.nager.at) | Public holidays for countries without bundled data (country code + year only) | Austria |
| Google Ireland Ltd. / Google LLC | Advertising (AdMob), consent management (UMP) – only without Nora Pro | Ireland / USA |
| Google Ireland Ltd. / Apple Distribution International Ltd. | Handling the in-app purchase (Google Play / App Store) | Ireland |
Cloudflare · Mapbox · Google
The providers named above may process data in the USA. Such transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) where the respective provider is certified, and otherwise on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
Local data: until you delete it in the app, clear the app data in the system, or uninstall the app. If you have the system backup switched on, the backup stored there is not affected – it sits in your Google or Apple account and is retained under that provider’s rules (see “Backup” and “Deletion”). Map/search requests: not stored by the proxy; connection data arises briefly at Cloudflare to prevent abuse. Advertising data: according to Google’s rules.
Your data can be backed up using your operating system’s backup function (Android Auto Backup / iCloud). What is backed up is the app database, including your notes and the places you created. The backup is encrypted via your Google or Apple account and is subject to their privacy terms; you can switch it off in your system settings. In addition, you can save a backup as a file from within Nora.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR) – for advertising, via the app settings. An informal message to hendrik@heidsiek.eu is sufficient.
Your work-day data sits on your device – and, if you use the system backup, additionally in your own Google or Apple backup. We have access to neither: we can neither view nor hand over nor delete this data. You have direct access to it yourself through the app (backup export, “Delete all data”).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority of your habitual residence or the authority responsible for us.
You can delete the data on your device at any time: in the app under Settings → “Delete all data”, by clearing the app data in the system, or by uninstalling.
An existing backup made by your operating system is not deleted by this – it survives uninstallation and is restored on a new device. You remove that backup in your account settings (Android: Google One → Backups; iOS: Settings → Apple Account → iCloud → Backups). You also need to delete any backup file you exported yourself, wherever you stored it.