1. Who is responsible

The controller for this app and website is Christian Weinmayr, Geitenedt 21, 4202 Kirchschlag bei Linz, Austria (see the imprint). You can reach us at [enable JavaScript for the address].

2. Using the app

2.1 Your lists

Your checklists — titles, sections, items, quantities, notes, assignees and reminders — are stored on your device. If iCloud is enabled, they are synced through your own iCloud (Apple CloudKit), so they are available on your other devices. We have no access to this data and cannot read it.

If you share a list, it is shared through iCloud as well. The people you invite can see and edit the list and see who else takes part (as shown by iCloud). Invitations and notifications about changes on shared lists are handled by Apple. Apple’s privacy policy applies to iCloud.

2.2 AI features

When you create a checklist with AI or use “Make it better”, the app sends the following to our server:

• New checklist: the theme you typed, your answers to the follow-up questions and the app language.
• Make it better: your request (for example “we’re bringing the dog”) and the current list — its title, sections and items with quantities, notes and whether they are checked.

Our server (a Cloudflare Worker, operated by Cloudflare, Inc., USA) forwards this text to OpenRouter (OpenRouter, Inc., USA), which passes it to the AI model provider — currently OpenAI (model GPT-6 Luna) — to generate the suggestions. The result is sent back to your device. These providers may be located outside the EU; transfers are based on the EU standard contractual clauses or an adequacy decision. OpenRouter and the model provider process the text under their own terms in order to generate the response.

We do not store your prompts or lists on our server and do not write their content to logs. Please don’t include sensitive personal information (for example about health or about other people) in your prompts if you don’t want it sent to an AI provider.

2.3 What our server keeps

To enforce the free quota and fair use and to prevent abuse, our server keeps only these technical records:

• A random installation ID, created by the app and kept in your device’s Keychain (so it survives a reinstall), together with how many free AI actions it has used.
• App Attest key IDs and public keys: Apple’s App Attest lets our server check that requests come from the genuine app on a real device (fraud prevention).
• Daily usage counts and, for subscribers, the App Store original transaction ID they are counted against. Daily counts are deleted automatically after two days.

None of this contains your name, email address, lists or prompts. Cloudflare necessarily processes your IP address to deliver requests and protect the service; Cloudflare’s short-lived technical request logs (time, endpoint, status, errors) are deleted automatically within a few days and never contain the content of your prompts or lists. We do not store IP addresses in our database.

2.4 Purchases

Premium is bought through Apple’s App Store (StoreKit). Apple processes the payment; we receive no payment details. To unlock Premium AI features, the app sends Apple’s signed transaction information to our server, which checks it and reads the product, expiry date and original transaction ID. We receive only anonymous, aggregated sales reports from Apple. Apple’s privacy policy applies.

2.5 Reminders

Reminders are local notifications scheduled on your device. They are not sent to us.

2.6 No ads, no tracking, no analytics

Hakerl contains no advertising, no tracking and no analytics or crash-reporting SDKs, and it doesn’t create a user account. If you have allowed it in your iOS settings, Apple may share anonymous crash reports and usage statistics with developers; this is controlled by Apple and you.

3. This website

This website sets no cookies and uses no analytics, trackers or external services; the fonts are hosted on our own server. If you close the language hint, your choice is remembered in your browser’s local storage and never sent to us. The web server processes the technical data needed to deliver pages (IP address, time, requested page, browser type) to operate and secure the site; it is not used to identify you. These logs are size-limited and overwritten automatically, usually within a few days. The website is hosted on a server of Hetzner Online GmbH (Gunzenhausen, Germany), our processor.

4. Legal bases

We process data to provide the features you use (Art. 6(1)(b) GDPR — e.g. creating a checklist when you ask for one) and on the basis of our legitimate interest in a fair free quota, preventing abuse and running our services securely (Art. 6(1)(f) GDPR).

5. How long we keep data

Daily usage counts are deleted after two days. The installation ID with its free-quota count and the App Attest keys are kept as long as they are needed for the free quota and fraud prevention. Your lists stay on your device and in your iCloud until you delete them.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing, and to withdraw consent at any time. Because we do not know who you are, we usually hold no data that can be linked to you — but just ask at [enable JavaScript for the address] and we will help. You also have the right to lodge a complaint with a supervisory authority; in Austria this is the Datenschutzbehörde (dsb.gv.at).

7. Changes

If the app changes in a way that affects your privacy — for example a different AI provider — we will update this policy and change the date below.

Last updated: 2 October 2026