DialshadeThis policy separately describes visits to dialshade.com, support communication and processing in the Dialshade app. The app is awaiting public release; the app disclosures refer to the functionality currently prepared for release.
1. Controller
Dialshade – an offering by Valentin Spöth
Valentin Spöth, sole proprietor
Turnhallestrasse 31
77654 Offenburg, Germany
Phone: +49 152 29262825
Email: privacy@lumefide.com
No data protection officer has been appointed because no statutory appointment obligation currently applies.
2. Visiting this website
Hosting, technical requests and security
This static website is delivered through Cloudflare Workers Static Assets by Cloudflare, Inc. Requests for pages, local images and styles involve technically necessary request data. This includes IP address, time, requested resource, referrer if transmitted, browser or user-agent information, and status and error data. The purposes are reliable delivery, security, abuse prevention and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are a secure and technically stable information service.
Cloudflare processes hosting and request data on our behalf where it acts as a processor; it processes certain service data under its own privacy policy. Processing in the United States or other countries outside the European Economic Area (EEA) is possible. Cloudflare describes the envisaged transfer safeguards, including Standard Contractual Clauses and adequacy decisions where their conditions are met, in its Data Processing Addendum and Privacy Policy. This does not promise exclusively European processing.
We keep no separate visitor log and create no visitor profiles. Cloudflare determines technical retention periods within its service. Operator-side diagnostic information is retained only as long as needed for security, troubleshooting or legal claims; no fixed deletion period for all Cloudflare logs is promised here.
Cookies, browser storage and external links
The website contains no scripts, analytics or advertising services, tracking pixels, external fonts or embedded third-party content. It sets no first-party cookies and uses neither local storage nor other first-party browser storage. There is no account, contact form or payment system on the website. Images and styles load from the same host. This implementation does not require an analytics consent banner.
Cloudflare may set technically necessary security cookies when security checks require them. Section 25(2) of the German TDDDG applies to strictly necessary device storage or access where its conditions are met. Cloudflare may also send Network Error Logging headers (NEL/Report-To). Supporting browsers may then send technical network failure reports to Cloudflare; this is not visitor analytics added by us.
A connection to an externally linked provider is made only when you open that link. Its processing is governed by its own notices. The Apple link prepared for release contains no campaign parameters. Email links open your mail application; a message is transmitted only when you send it yourself.
3. Support and privacy requests
If you contact us by email or telephone, we process contact details, message content, technical information you choose to provide, any attachments and our correspondence to handle your request. Emails also involve metadata such as sender, recipient, time, subject and technical delivery information.
Depending on the request, the legal basis is Article 6(1)(b) GDPR (contract or pre-contractual communication), (c) (legal obligation) or (f) (legitimate interests in efficient support, security and defense of legal claims). Support and privacy email at the listed addresses is handled through Apple’s iCloud Mail. Apple processes content and metadata under its applicable service and privacy terms; international processing is possible. Details: Apple Privacy Policy.
Support requests are generally deleted no later than twelve months after final resolution, unless statutory retention duties or legal claims require longer storage. Please do not send passwords, payment-card details or unnecessary personal information. App version, iOS version, device model and an error description are usually sufficient. Remove personal information from screenshots and purchase receipts.
4. Processing in the Dialshade app
Local looks and widget data
Dialshade requires no proprietary user account and operates no proprietary server for your looks. Favorites, saved looks with an optional name and local UUID, design selection, widget size, time format, date and seconds options, accent and brightness settings, and onboarding status are stored locally. The app and widget share local iOS App Group storage for this purpose. The widget reads the selected look identifier and configuration to display the clock. Settings and technical state also use local iOS storage such as UserDefaults and SDK storage.
App code does not send these look names, favorites or design configurations to us or RevenueCat. We cannot view looks stored only locally. Dialshade implements no proprietary CloudKit or iCloud synchronization; Apple device backups you enable are separate and subject to Apple’s settings and terms.
Local processing provides the app and widget functions you select (Article 6(1)(b) GDPR where personal data is processed). Section 25(2) TDDDG applies to the strictly necessary device access for these functions where its conditions are met.
Permissions and other services
The functionality prepared for release requests no access to the photo library, location, contacts, camera or microphone. The app includes no advertising, advertising or attribution SDKs and does not access IDFA. It includes neither PostHog nor TikTok nor another additional product analytics service. RevenueCat’s pseudonymous purchase and SDK reporting described below is separate.
Apple purchases and restoration
Optional Pro purchases use Apple’s In-App Purchase system. Apple displays and processes purchases and manages billing, the Apple Account and subscriptions under its own terms and Privacy Policy. We receive no payment-card details. The app and widget extension verify signed StoreKit transactions for Pro access. This involves product and transaction identifiers, purchase, expiration and any revocation dates, and entitlement status. Restoration is requested through Apple. Article 6(1)(b) GDPR is the legal basis for providing and restoring purchased access.
RevenueCat: pseudonymous identifier, purchases and SDK activity
The app integrates RevenueCat, Inc. as a technical service for purchase and entitlement data and an overview of SDK users, subscriptions and revenue. RevenueCat processes end-user data for us as a processor. Because Dialshade supplies no proprietary account, the SDK generates a persistent random app user identifier (called an “Anonymous App User ID” by RevenueCat). This identifier is pseudonymous, not anonymous: SDK activity and purchases can be associated with a record.
Processing can include this identifier, the Apple-provided vendor-specific device identifier IDFV (Identifier for Vendor), technically necessary IP and network data, device, operating-system, app and SDK metadata, product information, communication and activity timestamps (such as first or last SDK contact), transaction or receipt information, purchase history, subscription status and Pro entitlement status. In normal operation, RevenueCat is initialized directly at app launch, independently of onboarding, the purchase screen or making a purchase. Users without a Pro purchase may therefore also be recorded as new or active SDK users in the RevenueCat dashboard. Further SDK communication may occur when reopening the app. Verified purchases are reported; existing purchases and restorations are synchronized. StoreKit remains authoritative for access; a RevenueCat reporting failure alone does not block access.
The purposes are reliable purchase and entitlement management, restoration, abuse prevention and our overview of new and active SDK users, trials, subscriptions, renewals, cancellations, one-time purchases, refunds and revenue. Activity means SDK communication and is not a complete count of installations or offline and widget-only use. The legal bases are Article 6(1)(b) GDPR for performing purchased services and Article 6(1)(f) GDPR for reliable purchase operation, abuse prevention and operational reporting. Our legitimate interest is reliable app operation with understandable business performance. The right to object is explained below.
Dialshade sends no names, email addresses, proprietary account identifiers, look content or IDFA advertising identifier to RevenueCat. Automatic addition of device identifiers to attribution attributes and optional SDK diagnostics are disabled in the integration. Independently, SDK 5.96.0 sends the IDFV, when available, to RevenueCat in the technical HTTP header “X-Apple-Device-Identifier”. IDFV is a vendor-specific device identifier, not IDFA. The disabled attribution setting therefore does not prevent every transmission of a device identifier; the necessary network data and pseudonymous SDK activity described above also remain.
RevenueCat is based in the United States and uses infrastructure including Amazon Web Services in the United States. Data may therefore be processed outside the EEA. RevenueCat provides data-processing terms including Standard Contractual Clauses; information on recipients and international processing is available in the RevenueCat Privacy Policy. Integration alone does not establish exclusively European storage or promise a particular certification or individually signed agreement. You may ask us for information about the transfer safeguards applicable in the particular case and, where applicable, a copy.
Purchase and entitlement data is retained where needed to provide and document access rights, comply with legal obligations or address legal claims. Technical SDK data is additionally subject to applicable service terms and configuration. No fixed automatic deletion period at RevenueCat is promised. Requests concerning our RevenueCat records can be sent to privacy@lumefide.com. Matching a record may require purchase context or an available pseudonymous app user identifier; do not send credentials. If the SDK is already active, you can retrieve the existing ID in the app settings through “Datenschutz-Kennung kopieren” (Copy privacy ID). This action does not initiate an additional SDK connection. At your request, the ID is copied to the local iOS clipboard for up to five minutes; Universal Clipboard sharing is disabled for this copy. No message is sent automatically.
5. Deletion and retention
You can delete saved looks and remove favorites in the app. Local configurations generally remain until you remove them or local app data is deleted. Subscription expiry does not delete looks and favorites. Deleting the app can remove local app and widget data; it does not automatically delete device backups or transaction and entitlement data held by Apple or RevenueCat. Reinstallation may restore purchase rights but is not a backup of your looks.
Manage Apple-controlled backups and account or purchase data through Apple’s services. You can request deletion of support or RevenueCat data we control at the privacy address. Statutory retention obligations and necessary defense of legal claims may prevent immediate complete erasure. The applicable criteria are described in the sections above.
6. Your rights and complaints
Subject to statutory conditions, your rights include access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). Where processing relies on consent, you may withdraw it at any time for the future without affecting the lawfulness of earlier processing.
Objection: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation under Article 21 GDPR. We will then stop processing the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves legal claims.
Contact privacy@lumefide.com for data we control, including RevenueCat records processed on our behalf. We cannot remotely read or delete purely local looks; manage them through the app and device. Apple’s and Cloudflare’s privacy contacts are also responsible for processing under their own control. We make no solely automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR.
You may lodge a complaint with a data protection supervisory authority, particularly where you live, work or suspect an infringement. The authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany: baden-wuerttemberg.datenschutz.de. The official GDPR text explains the conditions.
7. Required information and minors
Visiting the website requires no registration; technical request data is necessary for delivery. Without contact details needed to reply, we may be unable to handle a support request. Without necessary purchase data, Pro purchases cannot be provided or restored.
Neither the website nor the app asks for a date of birth. Minors should involve parents or guardians where required by law or Apple Account settings, particularly for purchases. Apple’s account, family, Screen Time and purchase-approval rules may apply depending on country and account. The respective App Store listing determines the regional age rating once publicly available.
8. Changes
We update this policy when the app, website, service providers or legal requirements change. The date at the top identifies the version. Material changes are communicated appropriately.