Privacy Policy
(For the German version, click here)
Effective date: Oct. 4th, 2026
Controller: Michael Ritter, Innsbruck, Austria. Full contact details are in the Impressum address.
Contact: kantenkugel@kantenkugel.com
Controller: Michael Ritter, Innsbruck, Austria. Full contact details are in the Impressum address.
Contact: kantenkugel@kantenkugel.com
Summary
The app does not collect, transmit or share your data. It has no internet access, no accounts, no ads and no analytics. The website only processes an uploaded backup file to answer your request and stores nothing. Its hosting provider, Vercel, processes technical data such as your IP address when you visit it.
1. The app: data stored on your device
- Your code and setup: the generated code, your lock's design (wheels, symbols, direction calibration), the start position, the reveal delay, the state of the setup, and the release time once the timer has started. This is kept in a file in the app's private storage, encrypted with a key stored next to it. That keeps the code out of plain sight, but it does not protect against someone who can read the app's files.
- Your lock profiles: the names and designs of the padlocks you add.
- Remembered choices: your last lock, effort and delay.
The app requests no Android permissions, has no internet access, and has no access to your padlock, location, contacts, files or any identifier of you or your device. It uses no analytics, crash reporting, advertising or third-party services that receive your data. You can delete the stored code with "I'm finished, delete the code", and clearing the app's data or uninstalling the app removes everything the app stores.
2. Android backup
If Auto Backup or device transfer is switched on in your device settings, Android can copy the stored code record (not your lock profiles or remembered choices) to your Google account or a new device. The app does not control this, and Google's terms and privacy policy apply to such backups. You can switch it off in your Android settings.
3. Optional backup file
The "Download backup file" button is optional and does nothing until you tap it. The app creates a file at a location you choose through Android's file picker and does not send it anywhere. The file contains the code, the chosen delay and, once the timer has started, the release time, encrypted so that only the website's private key can open it. If you never use the website, the developer receives no data from you.
4. The website (padlock-randomizer.kantenkugel.com)
You can upload a backup file to the website to get your code once it is due.
- What happens: the website decrypts the file on its server, checks whether the code is due (using the release time in the file, or a waiting time set by the website if the file has none), and responds to you. The uploaded file and the decrypted contents exist only in memory while your request is handled.
- What is not stored: the website does not store the file or its contents. Its error logs never contain any part of the uploaded file or the decrypted code. The website sets no cookies and uses no analytics or tracking tools, including Vercel Web Analytics and Speed Insights.
- Purpose and legal basis: providing the retrieval you requested, Art. 6(1)(b) GDPR. The technical processing needed to run the site securely, described in section 5, is based on the legitimate interest in operating a stable and secure service, Art. 6(1)(f) GDPR.
- Uploading is your decision.
5. Hosting by Vercel
The website is hosted by Vercel Inc., USA. The website's code runs on servers in Frankfurt, Germany. When you visit the website or upload a file, Vercel handles the request and processes technical data about it: your IP address, the city and country derived from it, and system configuration information. Vercel uses this to deliver the site and for security and abuse prevention.
- Vercel's role: the developer uses Vercel's free plan, which has no separate data processing agreement. Vercel therefore handles this technical data under its own terms and Privacy Notice (vercel.com/legal/privacy-policy). The developer has no access to this data beyond what Vercel's dashboard offers.
- Transfers outside the EU/EEA: Vercel is a US company and its primary processing facilities are in the US. Transfers rely on Vercel's certification under the EU-US Data Privacy Framework and on Standard Contractual Clauses, as stated in its documents.
6. Sharing
The developer does not sell your data and does not pass it on, apart from the hosting by Vercel described in section 5.
7. Retention
The app keeps data on your device until you delete it. The website stores nothing. Vercel keeps the website's function logs for 1 hour. For its own technical data Vercel states no fixed period; see its Privacy Notice.
8. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. The developer holds no data about you apart from what appears in the short-lived error logs, so requests will usually concern data Vercel processes under its own responsibility; you can contact Vercel at privacy@vercel.com. For the developer, contact kantenkugel@kantenkugel.com.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at .
You are not required to provide any data, and there is no automated decision-making.
9. Children
The app is not directed at children and does not knowingly collect data from anyone.
10. Changes
Changes will be published at the website's privacy policy site with a new effective date.