Privacy policy

In short

Terminoo photographs an official letter, reads its text on your phone, and sends the text — never the photograph to an AI service in the European Union so it can be explained in your language.

• The photograph never leaves your phone.
• Before the text is sent, details that identify you are removed where we can detect them.
• The service that explains your letter keeps nothing.
• Everything else stays on your phone, and you can export or delete all of it at any time.
• There is no account. We do not know who you are.

The rest of this document is the same thing said precisely, because Art. 13 GDPR requires precision.

1. Who is responsible

No data protection officer is appointed (decision of 14 September 2026). Art. 13(1)(b) requires the officer's details only where one exists, so this policy names none — deliberately, and not by omission. Use the contact address above for any data protection question.

2. What happens on your phone, and stays there

The photographs are encrypted with a key held in the phone's own secure hardware — the Android Keystore or the iOS Keychain — and are stored where only Terminoo can reach them. They are never added to your photo library and never uploaded.

The recognised text and the extracted values are stored in the app's database, which is not separately encrypted by Terminoo. It is protected by the operating system's own storage encryption and the app sandbox. If you turn on the app lock, it also asks for a fingerprint, face or PIN before showing anything — but that protects the screen, not the file.

None of this is transmitted to us. We have no copy of your letters.

3. What is sent, and to whom

To explain a letter, the app sends:

• the letter's text, after redaction (see §4),
• the language you chose,
• today's date on your device, so that "within two weeks" can be resolved against something,
• a schema version number.

Alongside it, the app sends one identifier for your installation.

It remains true that the app does not send the photograph, your name, your phone number, your IP address as an identifier, or anything about the content of your other letters.

Recipient and location. The text goes to our own service running on Amazon Web Services in the Frankfurt region (eu-central-1), and from there to Amazon Bedrock in the European Union, which runs the language model that produces the explanation. AWS acts as a processor under Art. 28 on the basis of a data processing agreement, which forms part of the AWS Service Terms and binds them from the moment we accepted those terms.

If you buy a subscription or a letter pack, the purchase itself is handled by Apple or Google, not by us: you pay the app store, the store tells us only whether a purchase is active, and we never see your name, your address or your card. To ask that question we use RevenueCat, a service that works with both stores. The only thing we send it is the scrambled installation identifier described above, and RevenueCat acts as our processor under Art. 28.

Apple and Google are named here because you will see them on your statement, not because we send them anything. We do not: your purchase is a contract between you and the store, and the store knows about it from its own relationship with you, not from us.

We do not receive, and cannot ask for, your payment details.

Your letters do not leave the EU. The text is explained in Frankfurt and nowhere else. That is not only a promise: the permission our service holds to call the language model is restricted to European regions, so a request routed anywhere else fails outright rather than travelling quietly, and an automated check refuses to build the service if that restriction is ever loosened. The model is also one that keeps nothing — no storage of what is sent or returned, no training on it, no human review — and our service refuses to run at all against a model that does not carry that guarantee.

One thing does leave the EU, and only one. To find out whether a purchase is active, we ask RevenueCat, Inc., a company in the United States, about the scrambled installation identifier — and nothing else. No letter, no text, no name, no payment detail. If you never buy anything, this question is never asked about you.

How that transfer is protected, and how to check. The safeguard is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which RevenueCat's data processing terms incorporate. You may ask us for a copy at the address in §11, and we will send you the clauses as they applied on the day you asked. We have also written down why we consider the transfer safe — in short, because the only thing that crosses the border is a value scrambled twice, the second time with a secret RevenueCat has never had and cannot obtain — and you may ask for that assessment too.

Nothing is stored on the server. The service holds your letter's text only in memory for the seconds it takes to produce an explanation. There is no database of letters, no object storage, and the request and response bodies are not written to logs.

What the logs do contain: a request identifier, timing, the model used, a status code, and an error code where something failed. They are an allow-list — a field is logged only if it is named — and no field carries letter content.

4. Redaction, and its honest limits

Before the text is sent, the app removes, where it can detect them:

• your name where it follows a salutation or an honorific ("Sehr geehrte Frau …"),
• the recipient address block,
• tax identification numbers and tax numbers,
• social security, insurance and case reference numbers,
• dates of birth,
• email addresses and telephone numbers.

This is best-effort and cannot catch everything. It works on the shapes German official letters usually take. An unusual layout, an unlabelled number, or a name in a position the patterns do not cover will pass through. We say this plainly rather than promise anonymisation, because the redacted text is not anonymous data — it remains personal data, and it is treated as such throughout.

You can see exactly what will be sent before each send: Settings → Show what will be sent, every time.

5. Legal basis

Art. 6(1)(a) and Art. 9(2)(a) GDPR — your explicit consent.

Official correspondence routinely contains special categories of personal data under Art. 9: health information in letters from a health insurer, benefit and social-assistance status from a Jobcenter, residence and immigration status from an Ausländerbehörde. We cannot tell in advance which letters do. So consent is asked for separately and explicitly, in its own unticked box, and the app does not work without it.

The app cannot function without this consent, and we say so at the point of asking. Nothing else is bundled into the consent, and there is no other service you lose by refusing. The processing is not a condition attached to the service — reading a letter to you is the service, and Art. 9 offers no other basis on which we could do it.

Withdrawing consent stops all transmission immediately. Your letters and their text stay on your phone; nothing further is sent for explanation until you consent again. Withdrawal does not affect the lawfulness of what happened before it.

6. Automated decision-making

There is none within the meaning of Art. 22. The app produces an explanation, and it computes deadlines from dates printed in your letter. Nothing it produces has a legal effect on you or similarly significantly affects you: no application is decided, nothing is submitted on your behalf, and no money is moved.

Every explanation carries a visible statement that it was produced by a machine and may be wrong, and the paper letter remains the authoritative version throughout.

7. How long we keep things

On the server: nothing, beyond the seconds of the request itself. There is one exception, and it holds no letter data.

To keep the free allowance meaningful and to stop the service being used automatically at scale, we keep one row per installation, found by the scrambled identifier described in §3. It holds: how many letters are left, which month that count belongs to, the dates on which you used one of the two "urgent letter" allowances, a count of letters explained this month, and a version number. There is no field it could hold letter content in, and nothing in it records which letters you scanned or when — only how many.

How long. The row expires by itself 400 days after it was last written. That number is not arbitrary: the two urgent-letter allowances refresh on a rolling twelve months, so a row that forgot sooner would hand them back early. When it expires, the installation simply looks new again.

This is personal data in the sense of Art. 4(1) GDPR — a pseudonymous identifier is still personal data, and calling it otherwise would be wrong. What is true is narrower and worth stating plainly: it cannot be reversed into a device or a person by us or by anyone who obtained the database, it is not joined to any letter, and it exists to count.

The legal basis for this one row is split, and the split is by purpose rather than by what you pay. Counting letters is how we deliver what was promised — the free allowance included, because an allowance nobody counts is not an allowance — so that purpose rests on Art. 6(1)(b), performance of our agreement with you. Only the second purpose is different: stopping the service being used automatically at scale rests on Art. 6(1)(f), our legitimate interest in being able to offer a free tier at all. We weighed that interest against yours and concluded it holds, on the narrow ground that the row carries a count and a date, is joined to no letter, and cannot be turned back into you. Against that second purpose, and only that one, you may object at any time under Art. 21.

On your phone: until you delete a letter, or use Settings → Delete everything, which removes every letter, every stored photograph and every setting, and cannot be undone.

Consent records are kept as the Art. 7(1) evidence they are: a withdrawal is recorded as a new entry rather than by erasing the original grant, so the record shows both that consent was given and that it was withdrawn. They are deleted by Delete everything along with the rest.

8. Your rights

Because there is no account and nothing of yours is stored on our servers, most of these you exercise directly in the app rather than by writing to us — which is faster and does not require identifying yourself to us:

You also have the right to complain to a supervisory authority (Art. 77). The competent one for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden — competent because the provider is established in Hessen. You may equally complain to the authority where you live or work.

We cannot identify you from anything we hold, so a request to us about "my data" will usually be answered by explaining that we hold none — that is not an evasion, it is the design.

8a. If you write to us

This section is about the support form on this website and the email address below. It has nothing to do with the app: writing to us is not part of using Terminoo, and the app never sends us a message on your behalf.

If you use the form, we receive what you type into it — your message, the email address you give us so we can reply, and a name if you choose to enter one. We use it to answer you and for nothing else. We do not profile you with it, we do not use it for marketing, and it is never linked to anything from the app, because there is nothing in the app to link it to.

The legal basis is Art. 6(1)(b) GDPR where your message concerns a purchase or the service itself, and otherwise our legitimate interest in answering people who contact us, Art. 6(1)(f). Giving a name is optional; an email address is not, because we cannot reply without one.

The message is delivered to the mailbox at contact@fadi-zg.de and is kept only as long as needed to deal with it and to show what was said if that is later disputed, then deleted. The website is hosted by Netlify and the mailbox is provided by Hostinger; both process the message only to deliver it. No other recipient receives it.

Please do not send us a photograph of a letter, or its full text. We do not need it, we do not want it, and the app is built so that it never reaches us. If you send one anyway we will delete it rather than keep it on file.

9. Children

Terminoo is not directed at children and is not intended for anyone under 16, the age at which Art. 8(1) GDPR permits consent in Germany without parental authorisation.

10. Changes

If this policy changes in a way that affects what is sent or why, the app asks for consent again rather than relying on the old one. The version you agreed to is recorded with your consent.

Data protection contact

Questions about your data: contact@fadi-zg.de

No data protection officer has been appointed. The controller is a sole trader with no employees, so the twenty-person threshold in §38(1) sentence 1 BDSG is not met. Whoever is named above can answer a request under Art. 15–22, and for most of them the honest answer is that we hold nothing about the person asking, because there is no account and the server stores nothing.