Privacy Policy

Effective: [TO CONFIRM: effective date, normally the App Store release date]
Last Updated: 09.11.2026

1. Introduction

Recodive oHG ("we," "our," or "us") makes Hansho, an app for iPhone and Apple Watch that delivers notifications, Live Activities, widgets and alarm-style "pages" from services you choose to connect. This Privacy Policy explains what happens to your information when you use Hansho.

In short:

Hansho has no account, no registration with us, no ads, no analytics, no tracking and no third-party SDKs.
The services that send you messages ("senders") run their own server software ("hubs"). We don't run or have access to hubs. Each sender decides what it sends and keeps, so please read the sender's own privacy policy.
Messages are end-to-end encrypted to your devices and signed by the hub. Your device checks the signature and decrypts the message. We can't read them.
To push a message to your iPhone or Apple Watch, a "relay" that we operate forwards the encrypted message to Apple's push service. The relay never sees the content of a message and keeps no messages. It does see the delivery information that is not encrypted, such as the sender's name and the urgency level (see section 3).
Your messages are stored on your own devices. Your pairings and settings sync between your own devices through your private iCloud storage, which we can't access.

Data Controller (for the relay and for what you send us):
Recodive oHG
Möllendorffstraße 108
10367 Berlin, Germany
Phone: +49 156 79 75 39 03
Email: [email protected]

[TO CONFIRM: whether a data protection officer or an EU/UK representative needs to be named here]

2. How Hansho Works, and Who Handles What

A sender runs a hub. You pair Hansho with a hub by scanning a QR code or opening a link that the sender shows you.
When the sender has something for you, its hub encrypts the message to your devices and signs it.
The hub sends the encrypted message to our relay. The relay checks the hub's signature and forwards the message to Apple's Push Notification service (APNs), because only we hold the key that can push to Hansho's users.
Apple delivers the message to your device. Hansho verifies the signature and decrypts it on your device.

3. What Our Relay Processes

The relay is the only server we operate for Hansho. It processes:

The push token of your device. It is used to seal the token for the hub and, later, to forward a message to Apple. The hub holds the token only in sealed form.
The hub's identity and signature, to check that a push comes from a registered hub.
The encrypted message in transit, with the delivery information around it. The relay cannot read the title, text, images or buttons of a message, because they are end-to-end encrypted, and it does not keep the message. It can see the information needed to deliver and present it: the sender's (hub's) name, identifiers of the pairing, the message and the channel (not the channel's name), the urgency level, the name of the notification sound, and whether the message is a page. Apple's push service sees the same delivery information. Live Activity updates are end-to-end encrypted by default; a sender that runs its own hub can choose to send them unencrypted, in which case the relay could see their content in transit.
Your IP address, used briefly for rate limiting and security.

The relay stores only operational data: the registration of each hub (its domain and public key), a list of pairings that were removed (a revocation list), short-lived values that prevent a message from being replayed, and rate-limit counters. Technical logs contain only hub and pairing identifiers, never push tokens or message content.

Purpose: delivering the messages you asked for, keeping the service secure, and preventing abuse.

Legal basis: [TO CONFIRM: legal basis for relay processing; proposed: performance of the service you requested (Art. 6(1)(b) GDPR) and our legitimate interest in security and abuse prevention (Art. 6(1)(f) GDPR)]

4. What a Hub May Hold (the Sender, Not Us)

A hub is run by the sender, not by us. Depending on the sender, a hub may hold:

Your pairing.
Your devices' public keys.
Push tokens (in sealed form).
The name of your device, such as "iPhone" or "Apple Watch".
Acknowledgements and actions you tap.
The sender's own message history.

Senders are independent controllers of the data they receive and send. We don't control hubs and have no access to them. For questions about, or requests concerning, what a sender holds about you, contact the sender and read its privacy policy.

5. What Stays on Your Devices and in iCloud

Messages are stored locally on each device.
Pairings, per-channel settings (mute, urgency limit, sound) and read or acknowledged state sync between your own devices through your private iCloud (CloudKit) storage.
Pairing keys sync through iCloud Keychain. They can also be handed from your iPhone to a paired Apple Watch directly.
Images. A message can contain a link to an image (https). Hansho fetches that image itself, so the server that hosts the image can see your device's IP address. We do not control that server.

Apple stores iCloud data under your Apple Account. We can't see it. Apple's handling of iCloud data is described in Apple's Privacy Policy.

6. Permissions

Hansho may ask for the following. Each is optional and can be withdrawn at any time in your device's settings, although Hansho's features that depend on it then stop working.

Notifications (including Time Sensitive notifications), to show messages.
Camera, only to scan a pairing QR code.
Alarms, so that pages can ring like an alarm.
iCloud, to sync your pairings, settings and state between your devices.

7. Recipients and Processors

Apple delivers push notifications (APNs) and provides iCloud and the App Store. Apple acts under its own privacy policy.
Hosting provider for the relay: [TO CONFIRM: hosting provider and whether it acts as a processor under a data processing agreement].
Senders receive what you send to them or what their hub collects when you pair with it, as described above.
Hansho has no advertising or analytics providers.

8. Retention

The relay keeps no message content. For the operational data it does keep:

Registration of each hub (domain and public key): [TO CONFIRM: retention period]
Revocation list of removed pairings: [TO CONFIRM: retention period]
Anti-replay values and rate-limit counters: kept only briefly. [TO CONFIRM: exact duration]
Technical logs (hub and pairing identifiers only): [TO CONFIRM: retention period]
IP addresses: used transiently for rate limiting and security. [TO CONFIRM: whether they are written to any log, and for how long]

On your devices, messages stay until you delete them or delete the app. Deleting the app removes the data stored locally. A sender's hub may keep its own records; contact that sender for those.

If you write to us for support, we receive what you choose to send (such as your email address and message) and use it only to answer you. We delete support emails once the matter is resolved, unless the law requires us to keep them.

9. International Transfers

[TO CONFIRM: where the relay is hosted and whether personal data is transferred outside the EU/EEA, with the safeguards used]. Apple may process data in other countries under its own terms.

10. Your Rights Under GDPR

You have the right to access, rectification, erasure, restriction of processing, data portability and objection regarding personal data we process about you. You can object to processing based on legitimate interests. You can withdraw any consent at any time.

Because Hansho has no accounts, we can only identify data about you on the relay if you give us enough information, such as the hub concerned. You control the data on your devices and in your iCloud account: you can unpair a sender at any time in Hansho or on the sender's side, and you can delete everything stored on your device by deleting the app.

To exercise a right against us, write to [email protected]. For data held by a sender, contact the sender.

11. Children's Privacy

Hansho is not directed at children, and it has no social features or user-generated content. It is rated 4+ in the App Store because it contains no objectionable content, but children are not its intended audience. We do not knowingly collect personal data from children. If you believe a child has used Hansho and wish to have related data removed, write to [email protected].

12. Security

Messages are end-to-end encrypted to your devices and signed by the hub. Your device verifies the signature and decrypts the message on the device.
Your device's signing key is generated in the Secure Enclave. Pairing keys are kept in the Keychain and sync through iCloud Keychain.
The relay keeps no message content, and its logs contain no push tokens or message content. Delivery information that is not encrypted is described in section 3.
Push tokens are sealed, so a hub holds them only in sealed form.

No system is perfectly secure, and we can't guarantee absolute security.

13. Updates to This Policy

If this policy changes, we'll update this page and the date above.

14. Contact Information

Recodive oHG
Möllendorffstraße 108, 10367 Berlin, Germany
Privacy and app support: [email protected]
Feedback: [email protected]

15. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin, Germany
Phone: +49 30 13889-0
Email: [email protected]
Website: https://www.datenschutz-berlin.de