Legal information

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (DSGVO/GDPR) is:

toz.red
Ben Fayershtain
Courbierestr. 9
10787 Berlin, Germany
Email: info@toz.red

"Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Data protection officer

No Data Protection Officer (Datenschutzbeauftragter) has been appointed. Pursuant to Art. 37 DSGVO, appointment is not required for this operation, as fewer than 20 employees are regularly engaged in the automated processing of personal data.

For any data protection enquiries, please contact: info@toz.red

3. Data we collect

3.1 Server access logs

When you visit this website, our web server automatically records the following data in server log files:

• IP address of the requesting device
• Date and time of the request
• URL of the requested page
• HTTP status code
• Browser type and version (User-Agent string)
• Referring URL (Referrer), if transmitted by your browser
• Amount of data transferred

Legal basis: Art. 6(1)(f) DSGVO (legitimate interest). Our legitimate interest lies in the secure and stable operation of the website, detection and defence against attacks, and statistical analysis of usage for technical improvements. This data is not used to identify individual users.

3.2 Cookies

This website sets no cookies unless you ask for them. There are no advertising cookies and no cross-site tracking cookies at all.

If, and only if, you accept analytics in the consent banner, Google Analytics sets its own _ga cookies to tell repeat visits apart. Reject, and nothing is set and nothing is loaded. See our Cookie Policy for the full detail, including how to change your mind later.

3.3 localStorage: language preference

This website stores your language preference (English or German) in your browser's localStorage. This is a purely technical, client-side mechanism: the data never leaves your device and is not transmitted to our server. It is not a cookie and does not require consent under TDDDG § 25.

3.4 Contact by email

If you contact us by email, we process your email address and the content of your message solely for the purpose of handling your enquiry.

Legal basis: Art. 6(1)(b) DSGVO (pre-contractual measures) or Art. 6(1)(f) DSGVO (legitimate interest in responding to enquiries), as applicable.

4. Third-party services

When you visit this website, your browser may make requests to the following third-party services. Each contact transmits your IP address to the respective provider.

4.1 Web fonts (self-hosted)

This website uses the fonts Inter and JetBrains Mono, which are self-hosted on our own server. No request is made to Google Fonts or any other external font CDN. This avoids the data transfer issues identified by LG München I (Az. 3 O 17493/20, ruling of January 20, 2022).

4.2 GitHub API

The GitHub repositories page (/en/github) loads repository data directly from the GitHub API via a client-side JavaScript request.

• Provider: GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA
• Purpose: Display of public GitHub repository data
• Data transmitted: Your IP address and browser User-Agent string
• Legal basis: Art. 6(1)(f) DSGVO, legitimate interest in providing dynamic content
• Transfer to third country: USA. Transfer basis: adequacy decision for the EU–US Data Privacy Framework (DPF), Commission Implementing Decision of July 10, 2023
• GitHub Privacy Policy: docs.github.com: Privacy Statement

4.3 No other third-party requests

All other assets, that is fonts, stylesheets, scripts (including the GSAP animation library) and images, are self-hosted on our own server. Your browser contacts a third-party server in only two cases: the GitHub API described in 4.2, which runs when you open a page that lists repositories, and Google Analytics, which loads from googletagmanager.com only after you have accepted it. No content delivery network is used.

5. Your rights (Betroffenenrechte)

Under the DSGVO, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at info@toz.red.

• Right of access (Art. 15 DSGVO): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and if so, to receive a copy of that data.
• Right to rectification (Art. 16 DSGVO): You have the right to request the correction of inaccurate personal data concerning you without undue delay.
• Right to erasure, "right to be forgotten" (Art. 17 DSGVO): You have the right to request the deletion of personal data concerning you, subject to the conditions set out in Art. 17.
• Right to restriction of processing (Art. 18 DSGVO): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20 DSGVO): You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to object (Art. 21 DSGVO): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f). We will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Art. 7(3) DSGVO): Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the DSGVO (Art. 77 DSGVO).

The competent supervisory authority for toz.red is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstraße 219
10969 Berlin
Germany
Website: www.datenschutz-berlin.de

7. Data retention

Server access logs are automatically deleted after 30 days. No log data is archived beyond this period.

Email correspondence is retained for as long as necessary to handle your enquiry and any follow-up, and deleted thereafter unless a longer statutory retention obligation applies.

localStorage data (language preference) is stored only in your own browser and can be cleared at any time via your browser settings. We have no access to or copies of this data.

8. Automated decision-making

This website does not use automated decision-making or profiling within the meaning of Art. 22 DSGVO. No decisions with legal or similarly significant effects are made on the basis of automated processing.

9. Data of minors

This website is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at info@toz.red and we will delete it promptly (Art. 8 DSGVO).

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our services. The "Last updated" date at the top of this page indicates when the most recent revision was made. Continued use of the website after a revision constitutes acceptance of the updated policy.

For significant changes, we will make reasonable efforts to provide notice (e.g. via a notice on the homepage).

11. Our apps (Koda and other toz.red apps)

This section applies to the apps published by toz.red, for example Koda and Sticklock for Mac, iPhone and iPad. Sections 1 to 10 describe this website. The controller named in section 1 is also responsible for the apps.

11.1 We collect no data

Our apps collect no data about you. They contain no analytics, no tracking and no advertising, and you need no account with us. The apps send no data to us. We cannot see your documents or notes, and we cannot see how you use an app.

11.2 Your documents and iCloud

What you store in an app stays on your device. If you use iCloud, Koda also keeps your documents as files in your own iCloud Drive and syncs your library through your own iCloud account. This storage belongs to your Apple Account. Apple stores and processes this data for you as the provider of your Apple Account, under Apple's terms and privacy policy. We have no access to it. For Sticklock, see section 11.8.

11.3 Purchases

Downloads and in-app purchases, for example Koda Pro or the Sticklock Full Version, are handled by Apple through the App Store. Apple processes your payment under its own privacy policy. We receive neither your name, nor your Apple Account, nor your payment details. Apple provides us with aggregated sales and download figures that do not identify you.

11.4 Reporting an issue

If you use "Report an Issue" in an app, the app prepares an email in your own mail app, addressed to info@toz.red. Nothing is sent until you send that email yourself. It contains what you chose to include: your description and, if you leave that option switched on, technical details such as the system version and the device model. We use your email address and the content of the message only to handle your report, as described in section 3.4.

11.5 Optional AI integrations in Koda

Koda for Mac offers optional AI integrations. They are switched off by default, and each one starts only after you have switched it on and confirmed it. The integrations run through a local server on your Mac. Koda itself does not send your documents to the internet. If you connect an AI app that uses a cloud service, the provider of that app processes the documents you ask it to work with, under that provider's own terms and privacy policy. We take no part in that processing and receive none of that data. Suggestions from a local model (Ollama) are computed on your Mac.

11.6 Camera and photos

On iPhone and iPad, Koda uses the camera only to scan documents, and it receives from your photo library only the pictures you pick for import. Scans and imported pictures are stored like your other documents (section 11.2). They are not sent to us.

Sticklock uses the camera only if you turn on the photo after a wrong password, on the Mac, iPhone or iPad. It adds pictures to your photo library only if you choose “Save to Photos”, and it cannot read your photo library (section 11.8).

11.7 Your rights

Because we hold no data from the apps, there is nothing from them that we could disclose, correct or delete. The only exception is email you have sent us; your rights under section 5 apply to it.

11.8 Sticklock

Sticklock (formerly Secure Sticky Notes) is our note app for Mac, iPhone and iPad. Sections 11.1, 11.3, 11.4 and 11.7 apply to it. In addition:

• Notes: stored encrypted on your device, one file per note. Your password is never stored.
• iCloud sync (optional, Full Version): when sync is on, your notes are encrypted on your device first and then stored in your own iCloud Drive. iCloud then holds only the encrypted notes and the data needed to check your password (a random salt and a check value), never the password itself. On a new installation sync is off until you turn it on; if your iCloud Drive already holds Sticklock notes when the app first starts, for example from an earlier version, sync is on from the start. iCloud is a service Apple provides under your Apple Account (section 11.2); we have no access to it.
• Camera (optional): only if you turn on “Take a Photo After a Wrong Password” does the app take one photo after each wrong password typed on the lock screen. It is off by default and needs your permission to use the camera. Photos kept in the app stay on that device and in its backups (for example iCloud Backup or Time Machine). They are not synced and are not part of your encrypted notes. If you choose, the app also adds them to your Photos library or copies them to a folder you pick. They are never sent to us.
• Touch ID and Face ID: handled by your device. The app receives no fingerprint or face data. The key for unlocking with Touch ID or Face ID stays in the device’s keychain and does not sync.

1. Scope and acceptance

These Terms of Use ("Terms") govern your use of the software applications, websites, and related services ("Software") provided by toz.red, Berlin, Germany ("toz.red", "we", "us").

By downloading, installing, or using any toz.red Software, you agree to be bound by these Terms. If you do not agree, do not use the Software.

2. License grant

Subject to these Terms, toz.red grants you a personal, non-exclusive, non-transferable, non-sublicensable license to install and use the Software on Apple-branded devices that you own or control, solely for your personal or internal business purposes.

You may not:

• Copy, modify, or create derivative works of the Software
• Reverse engineer, decompile, or disassemble the Software except as expressly permitted by law
• Rent, lease, sell, sublicense, or otherwise transfer rights in the Software to a third party
• Remove or alter any proprietary notices or labels on the Software
• Use the Software for any unlawful purpose or in violation of any applicable laws

3. Free software provisions (BGB § 521, § 524)

Where toz.red Software is made available free of charge, the following provisions apply in accordance with the German Civil Code (Bürgerliches Gesetzbuch, BGB):

Pursuant to BGB § 521, a donor (Schenker) is only liable for wilful misconduct (Vorsatz). For free software, our warranty obligations are correspondingly reduced compared to paid software.

Pursuant to BGB § 524, the warranty for defects in gratuitous transfers is limited. toz.red warrants only that the Software, at the time of download, does not have defects that were fraudulently concealed.

These reduced obligations for free software do not limit the unlimited liability set out in Section 4 below.

4. Unlimited liability

Notwithstanding any other provision in these Terms, toz.red's liability is unlimited in the following cases, which cannot be excluded or limited under German law (BGB §§ 276, 309 Nr. 7):

• Intentional misconduct (Vorsatz): Damage caused intentionally by toz.red or its agents.
• Gross negligence (grobe Fahrlässigkeit): Damage resulting from grossly negligent conduct by toz.red or its agents.
• Injury to life, body, or health: Damage arising from negligent or intentional breach of duty that results in death, personal injury, or damage to health.
• Product liability (Produkthaftungsgesetz): Liability under the German Product Liability Act remains fully intact and is not affected by these Terms.
• Fraudulent concealment of defects: Where toz.red has fraudulently concealed a defect in the Software.

5. Limited liability for essential contractual obligations (Kardinalpflichten)

For breaches of essential contractual obligations, those whose fulfilment is necessary to achieve the purpose of the contract and on whose compliance you may regularly rely ("Kardinalpflichten"), caused by simple negligence (einfache Fahrlässigkeit), toz.red's liability is limited to the typically foreseeable damage at the time the contract was concluded.

This limitation does not apply where the circumstances of Section 4 (Unlimited Liability) apply.

6. Excluded liability

To the fullest extent permitted under German law, toz.red excludes all liability for the following, where caused by simple negligence in relation to non-essential contractual obligations:

• Indirect or consequential damages (mittelbare Schäden, Folgeschäden)
• Loss of profits (entgangener Gewinn)
• Loss of data, except where caused by conduct covered under Section 4
• Loss of business or business interruption
• Loss of anticipated savings

This exclusion applies only to non-essential obligations and is without prejudice to the unlimited liability provisions of Section 4 and the limited liability provisions of Section 5. Each of the exclusions in this Section is to be treated as a separate and severable provision.

7. User responsibility for backups

You are solely responsible for maintaining adequate backups of all data you store in or import into toz.red Software. toz.red strongly recommends using macOS Time Machine or another backup solution to protect your data.

toz.red shall not be liable for any loss of data arising from your failure to maintain backups, except to the extent that such loss results from conduct covered under Section 4.

8. Intellectual property

The Software, including all source code, design, graphics, user interfaces, trademarks, logos, and documentation, is and remains the exclusive intellectual property of toz.red and is protected by applicable German and international copyright and intellectual property laws.

These Terms do not transfer any ownership interest in the Software to you. The license granted in Section 2 is the entirety of the rights granted. All rights not expressly granted are reserved by toz.red.

9. Termination and access

toz.red reserves the right to terminate or suspend your access to online features of the Software at any time, with or without cause, subject to applicable law.

Standalone app functionality that does not require a network connection is not affected by any such termination. You may continue to use your locally installed copy subject to these Terms.

You may terminate your use of the Software at any time by uninstalling it from your devices.

10. Modifications to these Terms

toz.red reserves the right to modify these Terms at any time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will provide at least 30 days' notice before the changes take effect, by posting a notice on the toz.red website or within the Software.

Your continued use of the Software after the effective date of any modification constitutes your acceptance of the modified Terms. If you do not agree to the modified Terms, you must stop using the Software before the effective date.

11. Governing law and jurisdiction

These Terms are governed exclusively by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and conflict of law provisions.

The exclusive place of jurisdiction for all disputes arising from or in connection with these Terms, to the extent permitted by applicable law, is Berlin, Germany.

If you are a consumer resident in an EU member state, you may also bring proceedings in the courts of your place of domicile, and mandatory consumer protection provisions of your country of residence may apply in your favour.

12. Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable under applicable law, that provision shall be modified to the minimum extent necessary to make it enforceable, or if modification is not possible, severed from these Terms. The remaining provisions shall continue in full force and effect.

In the event of invalidity, the parties agree that a valid provision that most closely reflects the economic intent of the invalid provision shall replace it.

13. Language

These Terms are provided in English as a convenience. The authoritative version is the German language version (Nutzungsbedingungen), which prevails in the event of any conflict or ambiguity between the English and German texts.

14. Contact

For questions about these Terms, please contact:

toz.red
Email: info@toz.red
See also: Impressum

1. Cookies on this website

By default this website sets no cookies at all. When you arrive, nothing is written to your device beyond the strictly necessary items in Section 2, and no analytics script is loaded.

A consent banner asks once whether we may count your visit with Google Analytics.

• If you reject (and you can, just as easily as accepting), no analytics script is loaded and no analytics cookie is set. Ever.
• If you accept, Google Analytics sets _ga and _ga_<id> cookies, which last up to two years and tell a returning visitor from a new one. IP addresses are truncated before storage, and advertising and ad-personalisation signals are switched off.

The website is fully functional either way. There is no cookie wall and no feature you lose by refusing.

2. localStorage: language preference

This website stores one item in your browser's localStorage: your selected language (English or German). This allows the site to remember your preference when you return.

This is not a cookie. localStorage is a browser-side storage mechanism that:

• Never transmits data to any server: it stays entirely within your browser
• Is not accessible to toz.red or any third party
• Has no expiry date but can be cleared at any time via your browser settings
• Does not track you across websites

Per TDDDG § 25 Abs. 2 Nr. 2, storing or reading information from a terminal device is exempt from the consent requirement where it is "strictly necessary" to provide a service explicitly requested by the user. Saving your language choice falls within this exemption. No consent is required.

To clear this preference, open your browser's developer tools (F12), navigate to Application → Local Storage → toz.red, and delete the entry, or clear all site data via your browser's privacy settings.

3. No advertising, fingerprinting or cross-site tracking

Whether or not you accept analytics, toz.red does not use any of the following:

• Advertising or retargeting cookies
• Social media tracking pixels (e.g. Facebook Pixel, Twitter Pixel)
• Browser fingerprinting techniques
• Cross-site tracking mechanisms of any kind
• Session recording or heatmap tools

4. Third-party cookies

This website loads no fonts or styles from external content delivery networks. Every such asset is served from our own server.

Google Analytics is the only third party that can set a cookie through this website, and only once you have accepted it. It is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States on the basis of the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. The legal basis for the cookies themselves is your consent under TDDDG § 25 Abs. 1, and for the processing that follows, DSGVO Art. 6(1)(a).

5. Changing or withdrawing your choice

Your answer is remembered in localStorage under toz.red.consent, not in a cookie. You can change it at any time, and a withdrawal is as easy as the original consent:

Change your choice

Rejecting after having accepted stops collection immediately and deletes the _ga cookies this website set. Data already collected by Google can be removed on request: write to info@toz.red.

These principles apply to any non-essential cookie on this website, now or later:

• The banner is shown before anything non-essential is set
• Rejecting is equally easy as accepting: no dark patterns
• The website stays fully functional without consent: no cookie walls
• Consent is granular (analytics is separate from advertising, which we do not use at all)
• You can withdraw at any time

6. Legal basis (TDDDG)

Cookie and storage regulation in Germany is governed by the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, until May 2024 the TTDSG), specifically § 25, which implements Art. 5(3) of the ePrivacy Directive into German law.

Under TDDDG § 25 Abs. 1, storing information on or reading information from a user's terminal device requires consent, unless one of the exemptions in § 25 Abs. 2 applies. The localStorage usage described in Section 2 falls under the § 25 Abs. 2 Nr. 2 exemption (strictly necessary for a service explicitly requested by the user).

For any data processing that follows from cookies (e.g. processing of IP addresses in server logs), the legal basis under DSGVO Art. 6(1)(f) (legitimate interest) applies. See the Privacy Policy for full details.

7. Contact

If you have questions about this Cookie Policy, please contact:

toz.red
Email: info@toz.red