Privacy Policy

The controller under the General Data Protection Regulation (GDPR) is:

Benjamin Straatmann
MakeByte
Thamaschstraße 2
86687 Kaisheim
Germany
Email: [email protected]

Full legal details are in the Impressum.

Bestir is a productivity and planning tool. It is not a medical device and does not diagnose or treat anything. What you enter (tasks, energy level, check-ins, notes) is personal planning data. We treat it with the care it deserves.

Hosting and server logs

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit it, Cloudflare processes standard connection data to deliver the pages and protect the site against attacks: your IP address, the page requested, date and time, browser type and the HTTP response code. Legal basis: our legitimate interest in delivering the site reliably and securely (Art. 6(1)(f) GDPR). We have no access to individual log entries. Transfers to the US are based on Cloudflare’s certification under the EU-U.S. Data Privacy Framework.

Analytics without cookies

We use Umami, a self-hosted, cookieless analytics tool on our own server (analytics.makebyte.de, rented from IONOS SE in Germany). It records only anonymous, aggregate statistics such as page views, referrer, browser, operating system, device type and approximate country. It sets no cookies, stores no personal data and does not follow you across websites. Legal basis: our legitimate interest in understanding which pages are useful (Art. 6(1)(f) GDPR).

No cookies, no third-party content

This website sets no cookies and stores nothing in your browser. Fonts are served from this domain, not from Google Fonts or other third parties. There are no social media widgets and no embedded videos.

Emails to us

If you write to [email protected], we process your address and message to answer you. Messages are stored in our mailbox at mailbox.org (Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany). Legal basis: Art. 6(1)(b) GDPR where your request concerns your account, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete the messages once your request is resolved, unless legal retention duties apply.

Account

To create an account we store your email address, a display name (optional), your time zone, language and app preferences such as notification times. Purpose: providing the service and syncing it across your devices. Legal basis: Art. 6(1)(b) GDPR (contract).

Tasks and plans

Tasks you create are stored with title, steps, category, size, planned time, priority and status. Purpose: the core of the app. Legal basis: Art. 6(1)(b) GDPR.

Energy and mood check-ins

If you use the morning energy check or mood check-ins, the value you pick, the time and an optional note are stored only on your device. They are not sent to our server or to the AI. Bestir uses them to size your day. Legal basis: your consent, which you give by turning on and using the check-in (Art. 6(1)(a) GDPR). You can delete check-ins or turn the feature off at any time.

Focus sessions

When you use the focus timer, we store the session length, the task it belongs to and whether you finished it, so you can see your own progress. Timer sounds are played on your device. Legal basis: Art. 6(1)(b) GDPR.

Calendar

If you connect your device calendar or Google Calendar, Bestir reads your upcoming events to show them in your day and to give you a heads-up before appointments. We do not store calendar content on our servers, only a reference that lets the app restore the connection. Legal basis: your consent by connecting the calendar (Art. 6(1)(a) GDPR). You can disconnect it at any time in the app settings.

AI features

AI features are optional and stay off until you agree in the app. They include breaking a task into steps, suggesting a first step and writing short check-in messages. When you use them, the text of the task concerned (with its planned duration, if set) and, for check-in messages, the titles of your open tasks are sent to OpenAI (USA) through our own server, together with the app language. Your energy level, mood, name and account details are not sent. OpenAI does not use this data to train its models. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app settings at any time. Transfers to the US are based on the EU-U.S. Data Privacy Framework.

Voice input

If you use voice input, your recording is sent to OpenAI’s speech recognition for transcription and is not stored afterwards, neither by us nor in the app. The recognized text is saved as normal tasks. Voice input uses the same AI consent as above (Art. 6(1)(a) GDPR).

Notifications

If you allow notifications, we store a push token for your device. Reminders are delivered through Expo (expo.dev, USA) and Apple Push Notification service or Google Firebase Cloud Messaging; only the token and the message text are transferred. To time reminders better, we store when a notification was sent and opened. This data stays with your account and is never shared. Legal basis: your consent by enabling notifications (Art. 6(1)(a) GDPR). You can turn notifications off in your device settings at any time.

Subscriptions

Pro subscriptions are sold through the Apple App Store and Google Play. We use RevenueCat (revenuecat.com, USA) to manage subscription status. RevenueCat tells us only whether a subscription is active, the platform and an anonymous user ID. We never receive payment details. Legal basis: Art. 6(1)(b) GDPR. Transfers to the US are based on the EU-U.S. Data Privacy Framework.

App analytics

Only if you allow it in the app, Bestir sends anonymous usage events (for example “task created”) to our self-hosted Umami on our own server in Germany. No task content, no check-in values and no personal identifiers are sent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app settings.

Feedback

If you send feedback from the app, we store your message together with your account so we can reply. Legal basis: Art. 6(1)(f) GDPR (improving the app and answering you).

Your account and app data are stored in our own database on a server we rent from IONOS SE in Germany. We do not use a US cloud database. Apart from the services named above, nobody receives your data:

• IONOS SE, Germany: server hosting for the database, the AI relay and Umami
• OpenAI, USA: AI features and voice transcription, only with your consent
• Expo, USA, plus Apple and Google: delivery of push notifications
• RevenueCat, USA, plus Apple and Google: subscriptions
• Cloudflare, USA: hosting of this website
• Heinlein Hosting GmbH (mailbox.org), Germany: our email

We do not use your data for advertising and do not sell it.

• Account and app data: as long as your account exists. After you delete your account, all personal data is deleted within 30 days.
• Push tokens: removed when you turn off notifications or delete your account.
• Voice recordings: not stored.
• Emails and feedback: deleted once your request is resolved, unless legal retention duties apply.
• Anonymous statistics: kept in aggregate; they cannot be linked to you.

How to delete your account is described on Delete your account.

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable format (Art. 15 to 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), for example in the app settings.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest, you can object at any time for reasons arising from your particular situation.

To exercise your rights, write to [email protected]. We answer within 30 days. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.

Some US state laws, for example in Washington, contain special rules for consumer health data. How they apply to Bestir is explained in our separate Consumer Health Data Privacy Policy.

Bestir is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, please contact us and we will delete it.

All connections between the app, this website and our servers are encrypted (TLS). Passwords are stored only as hashes. Access to the production database is limited to what operating the service requires.

We update this policy when the app or the law changes. We tell you about significant changes in the app. The date at the top always shows the current version.