Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. The GoatNotes app

2.1 No data collection by us

GoatNotes has no server of its own, no user account, and contains no analytics, advertising or tracking components. We receive no information about you, your documents or how you use the app.

2.2 Your documents and settings

Your documents are stored wherever you put them: on your iPad, in iCloud Drive or with another provider you have added to the Files app. If you use iCloud, Apple processes this data under your own agreement with Apple; we have no access to it. Settings, downloaded shape libraries, your own components and text styles are stored only locally on your device and are removed when you delete the app.

2.3 Photos and files

You insert pictures through the iPadOS pickers. The app receives only the pictures or files you explicitly select and copies them into your document. It has no access to your photo library as a whole.

2.4 Network connections only when you ask

Opening or editing a document never connects to the internet. The app only connects when you explicitly use one of these features:

• Downloading shape libraries: libraries are loaded from draw.io’s public repository via raw.githubusercontent.com, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.
• Installing fonts: fonts are loaded from the official Google Fonts repository, also via raw.githubusercontent.com (GitHub, Inc.).
• Loading linked images: if a document refers to pictures only by web address, the app loads them only when you request it. The request goes to the server named in the document.

For these requests your iPad necessarily transmits your IP address and ordinary connection data (such as the time and the requested file) to the respective server. The app uses connections without cookies or a shared cache and sends no other data about you. The legal basis is Art. 6(1)(b) GDPR, as the connection is necessary to perform the feature you asked for. GitHub, Inc. also processes data in the United States; it is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). GitHub’s own privacy statement applies to its processing.

2.5 App Store

The app is downloaded and updated through Apple’s App Store; Apple is responsible for the data processed there. If you have agreed in iPadOS settings to share analytics with app developers, Apple provides us with aggregated crash reports and usage statistics that do not identify you. You can withdraw this consent at any time under Settings ▸ Privacy & Security ▸ Analytics & Improvements.

3. This website

3.1 Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Each time you visit, the server automatically processes data your browser transmits: IP address, date and time, the requested page or file, the previously visited page (referrer), browser and operating system, status code and amount of data transferred.

This processing serves to deliver the website and to keep it stable and secure, for example to detect abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. Vercel processes the data as a processor under a contract pursuant to Art. 28 GDPR and keeps logs only as long as necessary for these purposes. Data may be transferred to the United States; Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and the European Commission’s standard contractual clauses apply in addition.

3.2 No cookies, no analytics

This website sets no cookies, stores nothing in your browser and uses no analytics or tracking services, no social media plugins and no embedded third-party content. Fonts and icons are served from this server, so visiting the site causes no connections to other providers. Whether the site appears in English or German is decided by a small script in your browser from your language setting; nothing is stored.

3.3 Contact by email

If you email us, we process your email address, your name if given, and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of the app, and otherwise Art. 6(1)(f) GDPR, our legitimate interest being to answer you. We use an email provider as a processor for our mailbox. We delete the data once it is no longer needed, unless statutory retention obligations apply.

3.4 Links to the App Store

The App Store button is a plain link. Only when you click it do you leave this website; Apple Inc. is then responsible for the processing on apps.apple.com.

4. Your rights

With regard to personal data concerning you, you have the right to

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) and
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to the email address above is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

5. Other information

There is no automated decision-making, including profiling. You are not obliged to provide us with personal data; without the server logs, however, the website cannot be delivered. We update this policy when the app, the website or the law changes.

Last updated: September 28, 2026