Sheaf
Privacy
The short version
Sheaf has no accounts. There is nothing to sign up for, nothing to log in to, and no profile attached to you. There is no advertising, no third-party analytics, no attribution SDK and no crash reporter, and this website sets no cookies.
What is left is small and it is listed below in full: a random device identifier so a subscription can be unlocked on the device that paid for it, a separate rotating identifier used to measure whether songs get finished, and ordinary server records. What you write into the morning's reflection is not in that list, because it never leaves your phone.
1. Who is responsible
The controller within the meaning of Art. 4 (7) GDPR is:
- …
- …
- …
We have not appointed a data protection officer; on the size and the kind of processing described here, Art. 37 GDPR and § 38 BDSG do not require one. Write to the address above with anything about this page.
2. What stays on your device, and is therefore not collected at all
The following live in the app's own database, on that phone, and are never transmitted to us. They are not "data we protect carefully" — they are data we do not have.
- What you write. The answers to the morning's reflection. It can be a child's handwriting, so it is not collected at all: nothing to consent to, nothing to disclose, nothing to retain, and nothing for us to hand over if we were asked to.
- Your streak, your level, your progress and your achievements.
- Your playlists and your downloads.
- Faults. When something goes wrong, Sheaf writes the error to a screen inside the app instead of sending it anywhere. That is why there is no crash reporter — and it is also why we only learn about a fault if you write to us.
- Your time zone, which the app needs in order to know which day it is for you.
Deleting an entry deletes it. Deleting the app deletes all of it. We cannot restore any of it, because we never had it.
3. What is sent to us, why, and on what legal basis
3.1 Delivering the catalogue
The app asks our server for the catalogue and downloads the songs, lessons and morning pages it shows you. Those requests carry no identifier of you.
Legal basis: Art. 6 (1)(b) GDPR — performing the contract you entered into by using the app.
3.2 Unlocking what a household has paid for
The app registers a device identifier with us: a random UUID made for this
purpose, sent together with the platform (ios or android) and the
app's build number. We store it with the time it was created and the time it was last seen, and
beside it the record of what has been unlocked and until when.
It is not your name, your email address, your advertising identifier, or anything Apple or Google tell us about you. It identifies a device, not a person, and it is worth no more than knowing what has been paid for. Because the identifier is itself the credential, anyone holding it can ask what that device has unlocked — it is deliberately worth nothing else.
When you play a premium track, the app asks us for a short-lived token tied to that identifier, and the token is what the media request carries.
Legal basis: Art. 6 (1)(b) GDPR.
3.3 Whether songs get finished
The catalogue is small, and every song in it is a decision. So when a song is played, the app records how many seconds were audible, the furthest point reached, where somebody skipped, and how the playback ended, and sends that to us in a batch.
The record also says roughly how old the install identifier below was when the song was played — one of six ranges: the same day, the next day, two to three days, four to seven, eight to thirty, or thirty-one to ninety. It lets us see whether people come back at all, which nothing else we hold can answer. It is the age of the identifier, not of your installation: because that identifier is replaced every ninety days, a replaced one starts again at nought, and we cannot see past ninety days for anybody. The date the identifier was made stays on your device and is never sent.
Three things make this what it is, and all three are enforced in the code rather than promised here:
- A separate identifier, which rotates. The record carries an anonymous install identifier — a random UUID made on the device — that is replaced with a new one every ninety days.
- It is never the identifier from section 3.2, and the two are never sent in the same request. The part of the app that measures listening cannot read the part that holds the device identifier. Two identifiers that never travel together are two identifiers nothing can join.
- Nothing reads it back. No content is unlocked, withheld, ordered or recommended on the basis of what anybody listened to. The route is write-only.
No name, no account, no advertising identifier and no stored IP address sits beside the row.
Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is knowing which of a very small number of songs people finish and which they abandon, so that we make more of the first kind. We consider it to override your interests because the record is pseudonymous under an identifier that expires, cannot be joined to the identifier that knows what you paid for, is deleted after ninety days, and never changes what you are shown. The age range is a property of the identifier rather than of you, is deliberately coarse, and is left off entirely whenever it could not be given without linking a replaced identifier to the one before it. Those records are also the one thing an erasure request cannot reach, precisely because they carry no identifier that could be matched to you — they expire instead.
You may object at any time and without giving a reason (Art. 21 GDPR). In the app: Settings → What Sheaf measures, and turn off "Which songs get finished". That stops the recording, throws away anything measured and not yet sent, and replaces the install identifier, so what has already been sent cannot be joined to anything the device does afterwards. You can also write to the address in section 1 and we will confirm.
3.4 Buying a subscription
Payment happens in the App Store or in Google Play. We never see a card number. From the store we receive only the fact that a subscription started, renewed, lapsed or was refunded, so that content can be unlocked or locked again.
That flows through RevenueCat, which keeps subscription state for us. The app tells RevenueCat the same device identifier as in section 3.2, and RevenueCat tells our server when something about a subscription changes. We store the notification it sends, which contains that identifier and the store's own description of the event.
Legal basis: Art. 6 (1)(b) GDPR.
3.5 Keeping the service up
Our server writes one line per request with the method, the path, the status code and how long it took. It does not log IP addresses, user agents or request bodies. A few lines — about a refused premium request or a failed device registration — contain the device identifier from section 3.2.
To stop one caller flooding a route, the server counts recent requests per IP address in memory only. Nothing is written to disk, nothing survives a restart, and an entry is worthless within a minute.
Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in operating the service and defending it against abuse.
4. This website
It sets no cookies, and it loads its fonts, styles and images from this server alone. There is no analytics of any kind.
The postal address and the email address on the imprint appear only after your browser has quietly solved a small computational puzzle. It asks nothing of you, and it is there to stop address harvesters collecting them in bulk. Doing it loads a script from captcha.sheesh.solutions, which is our own server and not a third party. That server necessarily sees your IP address and the ordinary headers your browser sends, and uses them to tell a browser from an automated client. It is Cap, self-hosted for exactly this reason: the alternative would hand a visit to our imprint page to a third-party captcha company, and there is no version of that we would be comfortable with on this page.
Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in not having our contact details harvested, weighed against a transient technical record.
5. Storing things on your device (§ 25 TDDDG)
The app stores on your device what is needed to give you what you asked for: the catalogue, your downloads, your progress, and the device identifier that unlocks what you paid for. That is strictly necessary within the meaning of § 25 (2) no. 2 TDDDG and needs no consent.
The install identifier described in section 3.3 is also stored on your device, for the measurement described there. This website stores nothing on your device beyond what your browser needs to display the page.
6. Who else sees anything
We use the following processors and recipients, and no others:
- netcup GmbH, Daimlerstraße 25, 90441 Nürnberg, Germany
- Hosting of our server and of this website, in Germany. A processor under Art. 28 GDPR.
- RevenueCat, Inc., San Francisco, USA
- Subscription state. Receives the device identifier from section 3.2 and the purchase information the store provides. A transfer to the United States, made on the basis of the European Commission's standard contractual clauses under Art. 46 (2)(c) GDPR and, where applicable, a certification under the EU–US Data Privacy Framework.
- Apple Distribution International Ltd., Ireland / Apple Inc., USA
- Distribution and payment on the App Store. Apple is a controller in its own right for what it does with your Apple Account; what reaches us is only what section 3.4 describes.
- Google Ireland Ltd., Ireland / Google LLC, USA
- Distribution and payment on Google Play, on the same footing as Apple.
There is nobody else. No advertising network, no analytics company, no attribution service, no crash reporting service, no third-party content delivery network. Nothing is sold, and nothing is shared with anybody for their own purposes.
We pass data to public authorities only where we are legally obliged to, and only what we are obliged to pass.
7. How long anything is kept
- Listening records (section 3.3)
- Ninety days, then deleted by a job that runs every night. The identifier on them expires on the same ninety-day clock, so no chain of listening longer than that window can exist.
- Device identifier and what it has unlocked (section 3.2)
- For as long as the device may need it to restore a subscription. A subscription that has ended is kept rather than deleted, because a refund or a billing dispute can arrive months later and answering one needs the history. Ask us and we will delete it — see section 8.
- The store's subscription notifications (section 3.4)
- 400 days, then deleted by a job that runs every night. The longest thing we sell is a yearly subscription, so a year is the shortest window in which the whole life of a purchase — the first payment and the renewal or the expiry that answers it — can be read side by side, and the rest is room for a late renewal and for the time it takes somebody to write to us and be answered.
- Server log lines (section 3.5)
- For as long as the server keeps its output. They are not archived.
- Rate-limit counters
- In memory only. Gone on restart, and worthless within a minute.
- What is on your device (section 2)
- Until you delete it, or delete the app. We have no say in it and no copy of it.
8. Your rights
You have the right to:
- access the data we hold about you (Art. 15);
- rectification of anything inaccurate (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- portability — to receive what you gave us in a machine-readable form (Art. 20);
- object to processing based on our legitimate interest, at any time and without giving a reason (Art. 21) — that covers section 3.3 and section 4.
How to exercise them, given that we do not know who you are. There is no account, so we cannot look you up by name, and we will not ask you for identity documents in order to create a link that does not otherwise exist. What we can act on is an identifier: tell us the device identifier from section 3.2 and we will show you, correct or delete everything filed under it. Deleting it is one command on our side and it reaches all three places that identifier appears, including the store's notifications, which do not go with the rest on their own. If you cannot produce one, say so, and we will tell you honestly what can and cannot be found — in most cases the honest answer is that we hold nothing that can be tied to you, which is the point of the design rather than an evasion.
You have the right to complain to a supervisory authority (Art. 77). You may complain to any of them; the one competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg — datenschutz-hamburg.de.
9. Automated decisions
There is no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Art. 22 GDPR. Nothing in Sheaf changes what you are shown on the basis of what you have done.
10. Children
Sheaf is made for families to use together and is not directed at children as its primary audience. It collects no personal data from anybody, of any age, beyond what is described above, and the learning path — the part meant to be worked through together with your children — collects nothing at all. What a child writes stays on the device.
11. Do you have to give us anything
Only what section 3.2 describes, and only if you want a subscription unlocked: without a device identifier we cannot tell which device paid. Everything else is either not personal data or not required, and nothing bad happens if you object to section 3.3.
12. Changes to this page
If this page changes in a way that matters, the version date at the top changes with it. We will not quietly widen what we collect: shipping no third-party analytics and no crash reporter is a design decision recorded in this project, not a setting somebody can flip.