Privacy

Last updated: August 2026

The short version

This website sets no cookies, runs no scripts and has no forms. The Spinther app has no account, collects nothing about you, and contains no analytics, telemetry or third-party SDKs. Your tasks live on your iPhone and sync through your own iCloud, end-to-end encrypted. We cannot see any of it.

The rest of this page explains that in the detail the GDPR asks for.

Who is responsible

The data controller is Spinther, at:

For any privacy question or request, email hello@spinther.app.

We have not appointed a Data Protection Officer under Art. 37 GDPR: we are not a public authority, and our core activities involve neither large-scale systematic monitoring nor large-scale processing of special categories of data. We are established in Sweden, and therefore in the European Union, so no Art. 27 representative is required.

This website

spinther.app is a set of static pages served by a Cloudflare Worker. It sets no cookies and stores nothing in your browser. It loads no JavaScript, no fonts, no images and no resources from any other domain. There is no analytics, no session recording, no tag manager and no advertising technology of any kind, so there is no consent banner and nothing for you to opt out of.

There is no sign-up form, no newsletter and no unsubscribe route, because we do not collect email addresses through this site. The only way to reach us is to write to us, and that is covered under correspondence below.

Serving the site necessarily involves your IP address and request metadata reaching Cloudflare, who host it. That is ordinary web delivery, described under processors and retention below.

The app: what it stores, and where

Spinther’s App Store privacy label is Data Not Collected in every category. Concretely:

Two sort timestamps are stored unencrypted, because iCloud cannot order encrypted columns and the default lists sort on them. They are timestamps, not content. Everything you actually type is encrypted.

Because this data sits in your iCloud account rather than on our servers, we have no access to it, no ability to recover it for you, and no way to produce it in response to a request — from you or from anyone else. Deleting the app and its iCloud data removes it.

When the app connects to the internet

Every occasion Spinther itself reaches the network is started by you, and none of them sends your content to us:

• iCloud sync — between your iPhone and your own Apple Account. Apple is your provider here, not ours.
• Importing from Todoist — only when you start an import. Spinther signs in to your Todoist account using PKCE with no client secret, reads your tasks, and never stores the access token. Your tasks travel from Todoist to your device; we receive none of them. One caveat worth stating plainly: Todoist’s consent screen loads our name and logo from spinther.app, so at that moment your browser contacts this site, exactly as described under “This website” above.
• Sharing a web link into the app — Spinther fetches that page’s title, from that page’s own site, so it can name the task sensibly. Title only, and it falls back silently if the site does not answer.

Separately, the first time you dictate, iOS may download its own speech model. That is Apple’s asset pipeline, requested by the operating system rather than by Spinther, and nothing about it reaches us.

Permissions the app may ask for

Each is optional and revocable at any time in iOS Settings: microphone (dictation), notifications (reminders), calendar (read-only, to show your events), reminders (to import them) and alarms (for escalated reminders).

Spinther asks when you first use the feature that needs it. The one exception is reinstalling the app onto a device that already holds your iCloud data, where notifications and calendar are requested up front so your existing reminders keep working.

The About screen reads device motion for a small parallax effect. iOS does not prompt for that and there is no switch for it in Settings, so it belongs here rather than in the list above: the readings are used as they arrive, never stored, and never sent anywhere.

Spinther never requests location. There is no location code anywhere in the app.

Legal bases

We process personal data only where Art. 6(1) GDPR gives us a lawful basis. There is very little to process:

Legitimate interests assessment. For site delivery and security our interest is in keeping the site available and protected from abuse. No less intrusive means achieves this, the data involved is limited to connection metadata, it is never used for advertising or profiling, it is kept briefly, and it does not override your rights. You may object at any time under Art. 21 by writing to us.

Nothing here relies on consent, because nothing here is optional tracking.

Processors

We use one processor, acting under a data processing agreement and only on our documented instructions.

Apple is involved, but not as our processor

Two things happen through Apple, and neither is a processor relationship, so neither belongs in the table above:

• Distributing the app, through the App Store and TestFlight. Apple acts as an independent controller for that under its own terms, not on our instructions.
• Syncing your tasks through iCloud. That happens inside your own Apple Account, under your agreement with Apple. We never see it, and we could not instruct anyone about it.

Email forwarded from hello@spinther.app arrives in a personal mailbox, which its own provider operates as a controller in the ordinary way.

We will update this section before engaging any new processor.

International transfers

Cloudflare is established in the United States and serves this site from a global edge network, so your connection metadata may be handled outside the European Economic Area, the United Kingdom and Switzerland. For those transfers we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2), with the UK International Data Transfer Addendum for UK transfers and the Swiss addendum under the revised FADP. You can request a copy of the relevant safeguards by emailing us.

How long we keep things

Your rights

Under the GDPR and UK GDPR you may request access to your personal data (Art. 15), correction of it (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and portability (Art. 20), and you may object to processing based on legitimate interests (Art. 21).

In practice the only personal data we hold is the correspondence you have sent us, so that is what any request will reach. Email hello@spinther.app and we will respond within one month, as Art. 12(3) requires.

Children

Spinther is intended for adults. We do not knowingly process personal data from children under 16. If you believe a child has sent us personal data, write to us and we will delete it.

Automated decision-making

There is none. We carry out no profiling and no automated decision-making producing legal or similarly significant effects (Art. 22). The app contains no AI or machine-learning model that evaluates you in any way.

Security

Everything is served over HTTPS. Your content is end-to-end encrypted in iCloud. The app has no server of ours to breach, no account database and no third-party SDK, which removes most of the surface a notice like this usually has to account for. Access to the little we do hold is limited and multi-factor protected.

No system is perfectly secure. If you believe you have found a security issue, please email hello@spinther.app.

In the unlikely event of a personal data breach likely to risk your rights and freedoms, we will notify the supervisory authority without undue delay and within 72 hours where feasible (Art. 33), and notify you directly where the risk to you is high (Art. 34).

Changes

We may update this notice as the product changes. The date at the top always shows when the current version took effect. If a change materially affects how we handle your data, we will say so prominently here before it takes effect.

Complaints

If you think our processing infringes the GDPR you may lodge a complaint with a supervisory authority (Art. 77) — in the EU or EEA state where you live, where you work, or where the issue arose. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY); in the UK it is the Information Commissioner’s Office. We would genuinely rather hear from you first, if you are willing.