Privacy policy

Last updated: date to be set when this page goes live

The short version

• mdvju has no account, no ads, no analytics and no tracking.
• Your notes stay where you keep them. They never leave your phone.
• From the app, apart from what you send us yourself (an email, or your address if you sign up for news), the only thing that can ever reach us is a crash report, and only if you turn crash reports on. They’re off until you do. A report holds crash data only. It isn’t linked to you or your device, and note names, paths and links are removed before it’s sent.
• The crash server doesn’t keep your IP address. This website keeps ordinary server logs (including IP addresses) for 14 days, for security; no cookies, no analytics.
• Your settings live on your phone.
• We don’t sell, share or rent anything, because we don’t have anything to sell.

This policy covers both the mdvju app and the mdvju.app website. The rest of this page is the same thing in more detail, as the law asks.

Who we are

mdvju is made by Michał Wojtera, an independent developer in Poland. He is the data controller for the little data this policy covers.

Michał Wojtera

Poland

Contact for anything about privacy: support@mdvju.app

What mdvju collects

Crash reports, only if you turn them on

Crash reports are off by default. You can turn them on, and off again, at any time in Settings › Send Crash Reports.

When they’re on and the app crashes or hits an error, it sends a report to a crash-reporting server we run ourselves (GlitchTip, self-hosted). A report contains:

• what went wrong in the app’s code (the error and where it happened),
• the app’s version,
• your phone’s operating system and version, and the device model (for example “iPhone 15”),
• the state of the app at the time (for example which screen was open), and a short trail of what the app did just before the error, cleaned as described below.

Before a report leaves your phone, the app removes:

• any user details, and your IP address: the app doesn’t send it, and no IP address is stored with crash reports,
• your device’s name,
• web addresses, file paths and folder paths,
• links and wikilinks,
• any access tokens.

Things that are switched off entirely: screenshots, recordings of the screen, network monitoring, session tracking and performance tracing.

The cleaning doesn’t hunt for things that look like paths or links and hope it found them all. It works the other way round: the app keeps only text it knows is safe and drops everything else. So note names, paths and links are removed from crash reports before they’re sent.

A report carries crash data only. It isn’t linked to you or your device: there’s no account, no user ID, no device ID and no device fingerprint in it, so we can’t even tell whether two reports came from the same phone.

Like any internet server, ours sees the network address a report comes from while receiving it, but doesn’t keep it: no IP address is stored with crash reports, and IP scrubbing is switched on as a second safeguard. The crash server keeps no access logs with IP addresses.

Why: to find and fix crashes. Nothing else.

Legal basis: your consent (Article 6(1)(a) GDPR), which you give by turning crash reports on and withdraw by turning them off.

Where: on our own server in Łódź, Poland (EU), on the network of Lodz University of Technology. The reports and their database stay on that server.

How long: 90 days, then deleted.

If you email us

If you write to us, we get your email address and whatever you put in the message. Mail to support@mdvju.app goes to Michał’s own mailbox, on our own mail server, and Michał reads it himself. We use it to answer you and to fix what you report, and delete it 12 months after the conversation ends.

The easiest way to write is Send Feedback in the app’s Settings. It opens your iPhone’s Mail app with a new email to support@mdvju.app, with the app version and your iPhone model already filled in. The app itself sends nothing: it’s an ordinary email from you, from your own Mail app, and you see everything in it before you send it.

Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR).

If you join the mailing list

If you sign up for news, we store your email address, and use it only to send product news: Android, and major new features. Signing up is double opt-in: you get an email asking you to confirm, and you’re only on the list once you do. Every email has a link to unsubscribe. The emails have no tracking pixels, so we don’t see whether you opened them. We don’t share or sell the list.

Legal basis: your consent (Article 6(1)(a) GDPR), which you withdraw by unsubscribing.

What mdvju doesn’t collect

• Your notes, their titles, or the names of your files and folders.
• Your name, email address or Apple ID. There’s no account.
• Your location, contacts, photos or anything else on your phone.
• What you read, how long you read it, or how you use the app. There are no analytics.
• Advertising IDs. There are no ads, and no tracking across apps or websites.

Where your notes go

mdvju reads your notes from a folder on your phone, in iCloud Drive or On My iPhone. Nothing is sent to us. When you tick a checkbox, the change is written into the file in that folder; iCloud, or whichever app manages the folder, then syncs it the way it always does, under that service’s own privacy terms.

A self-hosted mdvju server is planned (see What’s next). It isn’t available yet. When it is, we’ll update this policy before it ships, to say what travels between your phone and your server.

What stays on your phone

Your settings, the last note you had open and where you were in it, your Homepage and favourites, and the list of notes in your folder are stored on your phone. Like other app data, some of this may be included in your phone’s own backups. We never receive any of it.

Other services your notes can point at

Some things in a note load from the internet, the same way a web page does:

• Images linked from the web. If a note shows an image from a web address, your phone fetches it from that website. That website sees an ordinary request from your phone, including your IP address.
• YouTube links. mdvju shows a thumbnail for a YouTube link, which is loaded from YouTube’s servers. Playing a video opens YouTube.
• Links you tap. Web links open outside the app, in your browser or the matching app.

These sites have their own privacy policies. mdvju doesn’t send them anything beyond what’s needed to fetch the image.

Purchases

The trial and the purchase go through Apple’s App Store. Apple handles the payment and your Apple ID under Apple’s privacy policy. We don’t get your name, email or payment details; Apple only tells us that a purchase is valid, and gives us sales totals.

If you have chosen in your iPhone’s settings to share analytics with app developers, Apple may also give us crash statistics and crash logs it collected, without identifying you. That is Apple’s feature, under Apple’s terms, and you can switch it off in Settings › Privacy & Security › Analytics & Improvements.

This website

This policy covers both the mdvju app and this website, mdvju.app.

mdvju.app uses no cookies and no analytics. Like most websites, its web server keeps a log of requests: your IP address, the time, the page you asked for, the page you came from (referrer) and your browser’s identification (user agent). We use these logs only to keep the site running and secure (for example, to spot and block abuse), not to profile visitors. They are kept for up to 14 days and then deleted automatically. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR). The site runs on the same server in Łódź, Poland (EU), as the crash reports.

Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw your consent at any time.

• Withdraw consent for crash reports: switch off Settings › Send Crash Reports. No more reports are sent from that moment.
• Ask for access or deletion: email us. Because crash reports aren’t linked to you, we usually can’t tell which ones came from your phone; if you can tell us roughly when a crash happened and on which device and app version, we’ll do our best to find and delete them.
• Complain: you can complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). You can also go to the authority in the EU country where you live.

Children

mdvju isn’t aimed at children, and it collects no personal data from anyone, children included, beyond the opt-in crash reports described above.

Changes to this policy

If what mdvju collects changes, for example if a future version adds a new feature that needs data, we’ll update this page before that version comes out, and change the date at the top. A change that needs your consent will ask for it in the app first.

Contact

Questions, requests or complaints about privacy: support@mdvju.app. You’ll get an answer within a month at the latest, as the GDPR requires.