How Regulation (EU) 2016/679 applies to Flutabby, what we do and do not process, and what you can ask of us.
Flutabby processes no personal data on our behalf. The app has no analytics, no advertising, no crash reporting, and no account system. It sends nothing to us, because we run no service for it to send anything to.
Everything the app stores stays on your device, under your control, encrypted where it is sensitive.
Version Two s.r.o., Slovak Republic, is the entity responsible for the Flutabby app.
Contact: the contact form at www.versiontwo.sk. Requests about your rights under this notice reach us there, and we treat them as such whether or not you label them that way.
We are not required to appoint a Data Protection Officer under Article 37, because we carry out no large scale or systematic monitoring and process no special categories of data. Enquiries sent through the form above reach the people who can answer them.
We process no personal data through the app itself. There is therefore no lawful basis to declare under Article 6 for app usage, because no processing takes place.
The only circumstance in which we hold personal data about you is when you contact us through the form. In that case:
Connection profiles, credentials, keys, login scripts, and preferences are stored locally on your device. Credentials sit in a vault encrypted with AES-256, using a key derived from your vault password and, at your option, protected by Face ID or Touch ID through the operating system keychain.
Under the GDPR this local data is not processed by us. We have no access to it, no copy of it, and no ability to decrypt it. You are the only party who can read it.
Flutabby can synchronise settings with a Tabby Web server whose address you enter. That server is chosen by you and, in the normal case, operated by you. Where you run it yourself, you are the controller of the data on it and we have no role at all. Where someone else runs it, your relationship is with them, and their notice governs what happens to the data.
The app transmits to the address you configure and to no other address.
Support purchases are processed by Apple and by Google under their own terms. Those companies are independent controllers for the payment data they handle. We receive only the confirmation that a purchase or restore succeeded, which carries no identifying information about you, and we never see your name, payment card, or billing address.
The distribution platforms also collect their own download and device statistics, over which we have no control. Apple's and Google's privacy notices govern that.
We transfer no personal data outside the European Economic Area, because we hold none from the app. The contact form and the correspondence it generates are handled within the EEA.
Under Articles 15 to 22 you have the right to request access to your personal data, its rectification, its erasure, the restriction of its processing, its portability, and to object to processing based on legitimate interest.
In practice, for Flutabby these rights have an unusual answer: we hold nothing to give you, correct, or delete, except any support correspondence you have sent us. For that correspondence, use the contact form and we will act within one month, as Article 12(3) requires. We will not charge you for it.
To erase the data held on your device, delete the app. If you configured sync, clear the data on the server you configured as well.
There is none. Flutabby performs no profiling and makes no automated decisions that produce legal or similarly significant effects.
Because we hold no user database, there is no central store of your data for an attacker to reach. Should a breach nonetheless occur that affects personal data we hold, we will notify the supervisory authority within seventy two hours as Article 33 requires, and notify affected people where Article 34 requires it.
If you believe we have handled your personal data unlawfully, you may lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work, or the place of the alleged infringement.
Our lead authority is the Office for Personal Data Protection of the Slovak Republic, dataprotection.gov.sk. We would rather you told us first, so we get a chance to put it right.
A revised notice will be published on this page with a new effective date.