Privacy Policy

Who is responsible?

The controller responsible for this website and support correspondence is Bastian Hagmaier (c20 consulting), Korkedamm 44, 12524 Berlin, Germany. See the Imprint for provider information. For privacy questions, contact support@c20.de.

No KorkeTrigger account or tracking

KorkeTrigger does not require a user account and includes no advertising, tracking or analytics. There is no proprietary KorkeTrigger cloud backend for profiles or action requests.

Configuration on your devices

Profiles, action URLs, authentication settings, request headers, request bodies and live image settings are stored in files on your devices. Selected configuration is also made available locally to the app’s widget extensions and synchronized to Apple Watch using Apple’s WatchConnectivity framework.

Credentials are currently stored as part of profile data, rather than in a separate Keychain store. Treat profiles, device access and backups as sensitive. Device or iCloud backups may include app data depending on your Apple system settings; KorkeTrigger does not provide its own iCloud profile synchronization.

Connections to your endpoints

When you run an action or load an image, KorkeTrigger sends the configured request directly from the executing device to the endpoint you selected. This can include a URL, credentials, headers and other configured request data. The endpoint and network providers may receive connection information such as your IP address.

Data processed or logged by an endpoint is governed by its operator and privacy practices. HTTPS encrypts the connection in transit; plain HTTP does not. KorkeTrigger does not send these requests through a KorkeTrigger cloud service.

Sharing profiles

Profiles are exported only when you choose to share them, using the iOS Share Sheet, AirDrop or another destination. You can exclude passwords, custom header values and URL query values from the exported copy. Usernames, field names and request bodies remain. Review all content before sharing; recipients and the selected sharing service handle the copy under their own arrangements.

Apple services

Apple services may process information for App Store distribution, purchases, device synchronization, backups and other system functions you use. These services are governed by Apple’s terms and privacy information. Their involvement depends on your device settings and how you use the app.

Support correspondence

If you email support, we process your email address, message and attachments to respond. For requests concerning your purchase or use of the app, the legal basis is Article 6(1)(b) GDPR where necessary to perform a contract or take requested pre-contractual steps. For other enquiries, it is Article 6(1)(f) GDPR: our legitimate interest in responding to messages and providing support. Providing this information is voluntary, but we may not be able to answer without it.

Support uses iCloud Mail with a custom domain, provided for our account by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple and its service providers process email for delivery and storage. We retain support emails under our control for less than one year. Please do not send passwords, tokens or private profiles.

Apple may process data outside the European Economic Area, including in the United States. Apple describes its use of standard contractual clauses for EEA transfers and how to request a copy in its Privacy Policy. See also the iCloud terms. Apple’s own processing and retention are governed by its applicable terms and privacy information.

This website

The public website uses no visitor-side analytics or tracking scripts, tracking pixels, cookies or browser storage. Fonts, styles and images are served with the site. Following an external link or sending email involves the destination service.

The website is hosted on Scaleway infrastructure in France and administered by Bastian Hagmaier. Scaleway SAS is our hosting provider. We use GoAccess on this server for limited server-side traffic analysis: approximate daily audience size, popular pages and downloads, bandwidth and HTTP errors. We also collect host CPU, memory, disk and network statistics with sysstat to understand operational capacity. No additional external analytics provider receives this information.

To deliver a request, the server necessarily processes your network address and the HTTP request. For the dedicated KorkeTrigger access logs introduced on 21 September 2026, IP addresses are masked before being written to disk (IPv4 /24 and IPv6 /48). Stored fields are the masked network address, request time, HTTP method, a recognised public page or download path, response status, bytes sent, server handling time and a coarse bot/non-bot classification. Unknown paths are grouped together. Query strings, authenticated usernames, referring URLs and the original user-agent string are not retained in these logs. Browser information is used transiently only to classify likely automated traffic; we do not create browser fingerprints. Error records retain only time, module, severity and a generic error code, not the original error message.

Masked addresses can still carry information about a network and are not guaranteed to be anonymous. Audience estimates group requests by masked network address and day; they are not exact counts of people. We use this limited processing for our legitimate interests in understanding use of the website and maintaining reliable, secure operation under Article 6(1)(f) GDPR.

Dedicated request and error logs are retained for up to 14 UTC calendar days, and daily aggregate traffic reports for up to 90 UTC calendar days. The retained reports do not include individual network-address or browser-detail tables. Host statistics are retained for about 30 days. Routine cleanup runs on scheduled jobs; an outage may delay deletion until the jobs resume. Reports and logs are stored on this server with restricted file access. Reports are available only through our access-controlled WireGuard VPN, not through the public website. Older shared troubleshooting records from before this change, where still present, remain subject to the previously stated retention of less than one year.

Scaleway and its authorized service providers may process data to provide the hosting service. Hosting in France does not mean all provider operations are necessarily confined to France. Scaleway describes its international-transfer safeguards in its Privacy Policy; processing of hosted customer data is governed by its data processing terms.

Optional AI profile skill

The downloadable profile skill contains instructions, an example and a local validator. Downloading it is a normal website request and may appear in server logs. It does not connect to an AI service or send profile data to us. If you use it with an AI assistant, information you provide is handled under that service’s terms and privacy practices. Keep credentials and sensitive configuration out of AI conversations; add them locally in the app.

Retention and your choices

Saved configuration remains on your devices until you remove it. Removing a profile on iPhone does not necessarily erase previously synchronized Watch data, shared copies or backups. Manage those copies and backups separately. Endpoint operators control retention of data they receive.

Where applicable under data protection law, you may request access, correction, deletion, restriction or portability of personal data held by the provider, and object to certain processing. You may also complain to a competent data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information. We do not use your data for automated decision-making or profiling. Contact support to exercise your rights; the provider does not have remote access to profiles stored only on your devices.

Changes to this policy

This policy will be updated if the app’s data practices or the website’s operation changes. The date above identifies the latest revision.