Privacy Policy
PeppermintBytes · Website & Apps
Updated: April 2026
1. Scope
This privacy policy applies to:
- the website peppermintbytes.com
- all iOS apps developed and published by PeppermintBytes (currently: CoreFiles, Work2Rule, My§34aApp, plus all future apps under the PeppermintBytes label)
Each app is described in a dedicated section (Part B) where app-specific processing applies. The general section (Part A) applies to the website and to all apps where relevant.
Part A - General (Website & Cross-App)
2. Controller
Controller within the meaning of the GDPR:
Daniel Rosier
PeppermintBytes
c/o IP-Management #9686
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany
Phone: +49 511 8076 2010
Email: privacy@peppermintbytes.com
Website: peppermintbytes.com
3. Legal Bases
Depending on the processing activity, we rely on the following legal bases under the GDPR:
- Art. 6(1)(a) GDPR - consent
- Art. 6(1)(b) GDPR - contract or pre-contractual measures
- Art. 6(1)(c) GDPR - legal obligation
- Art. 6(1)(f) GDPR - legitimate interests
The applicable legal basis is indicated for each processing activity.
4. Hosting & Server Logs
Our website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. On each page request, the web server automatically stores server logs including:
- anonymized IP address
- date and time of access
- requested URL
- referrer URL
- browser type and operating system
Legal basis: Art. 6(1)(f) GDPR. Logs are automatically deleted after 7-30 days. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.
5. Cookies
Our website uses cookies. Technically necessary cookies are set based on Art. 6(1)(f) GDPR. Analytics cookies (e.g. Matomo) are used only with your consent (Art. 6(1)(a) GDPR). You can adjust cookie settings at any time in your browser or via our cookie controls.
6. Web Analytics with Matomo
We use Matomo (Open Source) for website usage statistics. Matomo is self-hosted on our servers at netcup in Germany. No data is shared with third parties.
Matomo processes, among other things: anonymized IP addresses, visited pages, dwell time, referrer, browser/OS and country. Legal basis: Art. 6(1)(f) GDPR (or Art. 6(1)(a) GDPR where cookie consent applies).
Opt-out: enable Do-Not-Track in your browser or use the Matomo opt-out option on our website.
7. Social Network Links
Our website contains simple links (no embedded plugins) to:
- Instagram - Meta Platforms Ireland Limited, Dublin 2, Ireland
- LinkedIn - LinkedIn Ireland Unlimited Company, Dublin 2, Ireland
- Reddit - Reddit Inc., San Francisco, CA, USA
- Bluesky - Bluesky PBLLC, USA
- Mastodon - decentralized network (the respective instance operator is responsible)
When you click one of these links, you leave our website and the privacy policy of the respective provider applies. No automatic transfer takes place merely by visiting our site.
8. Link to Apple App Store
Our website contains links to the Apple App Store. When opening these links, Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) may process personal data. We have no influence on this. Apple privacy information:
9. In-App Purchases & Apple StoreKit
Some apps offer paid features or subscriptions via the Apple App Store (in-app purchases). Payment processing is handled exclusively by Apple via StoreKit. We do not receive payment data such as credit card numbers.
Apple may process personal data in the purchase flow (e.g. Apple ID, purchase history). Please refer to Apple's privacy policy and App Store terms. We only store anonymized purchase status locally on the device to unlock features.
Legal basis: Art. 6(1)(b) GDPR.
10. Your Rights
You have the right to:
- access (Art. 15 GDPR)
- rectification (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection (Art. 21 GDPR)
- withdraw consent (Art. 7(3) GDPR)
To exercise your rights, contact: privacy@peppermintbytes.com
11. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. Our competent authority is:
Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Phone: +49 40 42854-4040
www.datenschutz-hamburg.de
12. Data Deletion and Retention
Personal data is deleted or blocked as soon as the purpose for storage no longer applies, unless statutory retention obligations require longer storage.
Part B - App-Specific Privacy Notices
This section describes data-protection specifics for each PeppermintBytes app. New apps will be added here. Part A applies in addition to all apps.
CoreFiles
Overview
CoreFiles is a local file manager for iOS. By default, the app processes files exclusively on your device.
Optional connections to external storage and cloud services enable access to third-party systems you select. All connections are voluntary and are activated only through your active setup in the app settings.
Locally processed data (without external connection)
- Managed files and folder structures on the device
- App settings and configurations
- Favorites, connection profiles, and scan shortcuts
- Connection credentials (e.g. tokens, app passwords) stored exclusively in iOS Keychain
- Local encrypted data backups (including .cfbak, AES-256-GCM), stored only locally or in locations selected by you
No data from this local processing is transferred to our servers. We have no access to your files.
Optional feature: AI-supported filename suggestions during scanning
CoreFiles can generate filename suggestions while scanning based on recognized content, dates, or document types.
Processing primarily uses system capabilities available on the device. The exact processing available depends on iOS version, device support, and, where applicable, enabled Apple Intelligence features.
We do not receive file contents from your scans. You can edit every suggested filename at any time or enter a fully manual name.
Optional cloud/external connections – overview
CoreFiles supports, among others, the following optional connections:
- Microsoft SharePoint / OneDrive (via Microsoft Graph API) – OAuth 2.0
- Google Drive (Google Drive API) – OAuth 2.0
- Dropbox (Dropbox API v2) – OAuth 2.0
- Nextcloud – Login Flow v2, then WebDAV (app password/basic auth)
- pCloud (pCloud API) – OAuth 2.0
- Additional WebDAV services (e.g. MagentaCLOUD) via WebDAV credentials
For all external connections, the following applies: we do not receive, store, or process cloud file contents. Connections are established directly between your device and the respective provider. Credentials (tokens/passwords) are stored exclusively in iOS Keychain. Each connection can be removed at any time in app settings, and credentials can be deleted.
OAuth 2.0 services
With OAuth 2.0 services, you do not provide your password directly to CoreFiles.
You authorize CoreFiles through the provider's login dialog. The app receives access tokens, which are stored locally in iOS Keychain.
Microsoft SharePoint / OneDrive (Microsoft Graph)
Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA
When connected, the following is transmitted directly to Microsoft:
- Authentication data (OAuth token via Microsoft Identity Platform)
- File operations (read/write/delete) within SharePoint/OneDrive resources connected by you
- Technical connection data (e.g. IP address, timestamps)
Legal basis: Art. 6(1)(b) and Art. 6(1)(a) GDPR
Microsoft privacy information: privacy.microsoft.com/en-us/privacystatement
Google Drive
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EU)
When connected, the following is transmitted directly to Google:
- Authentication data (OAuth token via Google Identity Services)
- File operations within Google Drive areas shared/linked by you
- Technical connection data (e.g. IP address, timestamps)
CoreFiles uses Google Drive permissions within the scope of drive.file (picker-based access), i.e. no blanket full access to the entire Drive account.
Legal basis: Art. 6(1)(b) and Art. 6(1)(a) GDPR
Google privacy information: policies.google.com/privacy?hl=en
Dropbox
Provider: Dropbox International Unlimited Company, One Park Place, Dublin 2, Ireland (for users in the EU)
When connected, the following is transmitted directly to Dropbox:
- Authentication data (OAuth token)
- File operations (read/write/delete) within your Dropbox storage
- Technical connection data (e.g. IP address, timestamps)
Legal basis: Art. 6(1)(b) and Art. 6(1)(a) GDPR
Dropbox privacy information: dropbox.com/privacy
Nextcloud
Nextcloud is typically self-hosted. The responsible party is the respective operator of the Nextcloud server connected by you.
When connected, the following is transmitted to your Nextcloud server:
- App password/credentials for basic auth (stored locally in iOS Keychain)
- File operations via WebDAV (read/write/delete)
- Technical connection data (e.g. IP address, timestamps)
We recommend using app passwords instead of the main account password.
Legal basis: Art. 6(1)(b) and Art. 6(1)(a) GDPR
pCloud
Provider: pCloud AG, Poststrasse 24, 6300 Zug, Switzerland
When connected via OAuth 2.0 and pCloud API, the following is transmitted directly to pCloud:
- Authentication data (OAuth token; stored locally in iOS Keychain)
- File operations (read/write/delete) within your pCloud storage
- Technical connection data (e.g. IP address, timestamps)
Note: pCloud is based in Switzerland and subject to Swiss data protection law and applicable GDPR requirements for EU users.
Legal basis: Art. 6(1)(b) and Art. 6(1)(a) GDPR
pCloud privacy information: pcloud.com/privacy_policy.html
WebDAV services (e.g. MagentaCLOUD)
For WebDAV connections, the app authenticates directly against the respective server using username/password or an app-specific password. These credentials are stored encrypted in iOS Keychain and are not transmitted to us.
Matomo analytics in CoreFiles (optional)
CoreFiles can collect usage statistics via a self-hosted Matomo instance (hosting in Germany), provided you have consented.
No file contents are transferred; only usage events for product improvement (e.g. features accessed). You can withdraw consent at any time in app settings.
Legal basis: Art. 6(1)(a) GDPR
Permissions
- File access: required for core app functionality
- Camera/Photos (optional): for scan and import features
- Face ID / Touch ID (optional): to protect local sensitive areas (e.g. "Private Data")
- Network access (optional): only when using external connections (e.g. cloud, SMB, WebDAV, SFTP)
Telemetry / crash reporting
No usage statistics are transferred without your consent.
Additional third-party crash/advertising SDKs (e.g. Firebase Crashlytics) are not part of standard processing.
Work2Rule
Overview
Work2Rule is a purely local iOS app. No personal data is transferred to external servers.
Locally Processed Data
All data entered in the app is stored exclusively on your device. We have no access to it.
Network Access
Work2Rule has no network access and does not send data to external servers.
Telemetry
The app does not collect telemetry or analytics data.
My§34aApp
Overview
My§34aApp is a purely local iOS app. No personal data is transferred to external servers.
Locally Processed Data
All data entered in the app is stored exclusively on your device. We have no access to it.
Network Access
My§34aApp has no network access and does not send data to external servers.
Telemetry
The app does not collect telemetry or analytics data.
Future Apps
When a new app is launched, a dedicated section will be added here. If the app works locally only and uses no third-party services, the Work2Rule/My§34aApp model applies. Additional processing (network access, third-party services, location etc.) will be documented in detail.
13. Updates and Changes
This privacy policy is updated as of April 2026 and available at peppermintbytes.com/privacy. If significant changes occur (especially when adding new apps with network access or new third-party services), this policy will be updated and the date revised.