Privacy policy of the “RudelOrga” app

Last updated: 8 November 2026 · applies to the Android app RudelOrga (de.christiankempf.rudelorga). The website is covered by the general privacy policy. In case of doubt the German version prevails.

In short: RudelOrga stores your lists, polls, kitties and everything else on your phone. If you connect a group, the state goes end-to-end encrypted into your own OneDrive or Nextcloud folder. I receive no data. There is no account with me, no server and no advertising.

Draft note: RudelOrga is in development. Check this policy against the finished app before publishing (background sync, notifications, photos, any purchase) and declare the same in the Play Console data safety form. Remove this box afterwards.

1. Controller

2. What the app stores on your device

• Members: name and colour as you enter them, and which member is “me” on this phone.
• Lists, polls and helper lists: entries, people responsible, due dates, votes and sign-ups.
• Group kitty: expenses with amount, who paid and for whom.
• Inventory, skills and register: items with location and loans, members’ skills, locations and journal of plants.

Whatever you enter in a connected group is visible to all members of that group. So only enter what the others may see.

3. Sync via your cloud folder (optional)

Whoever founds a group creates a folder for it in their own storage and shares it with the others. Each device puts its state there as a file – compressed and end-to-end encrypted beforehand (XChaCha20-Poly1305). The group’s name is stored encrypted inside the folder; the folder name itself contains it in plain text so that you can find it again. Syncing happens while the app is open.

• OneDrive: you sign in with your Microsoft account (login.microsoftonline.com); the files run via the Microsoft Graph interface (graph.microsoft.com). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Microsoft’s privacy statement applies.
• Nextcloud or WebDAV: RudelOrga connects directly to the server whose address you enter. The server’s operator is responsible for it.

The storage provider sees no content, only encrypted files, the folder name and the technical details that come with any storage (account, file size, time, IP address). Sign-in data and the group’s key are stored encrypted in the Android Keystore. The legal basis is Art. 6(1)(b) GDPR.

4. Invitation

The invitation (RUDELORGA1-…) contains the location of the folder and the group’s key. You send it yourself, for example by messenger. Whoever has it can read everything in the group – so only send it to those who belong.

5. Maps in the register

For the register RudelOrga loads map tiles from the Federal Agency for Cartography and Geodesy (TopPlusOpen, sgx.geodatenzentrum.de, Frankfurt am Main) and aerial photos from the State Office for Geoinformation and Rural Development Baden-Württemberg (DOP20, owsproxy.lgl-bw.de, Stuttgart). Only the requested map area and, for technical reasons, your IP address are transmitted – no identifier and no entries. You place locations with the crosshair; the app does not request your position. The legal basis is Art. 6(1)(b) GDPR.

6. Sharing

You can pass on lists, poll results, settlements and helper plans as text via Android’s share function. Where it goes is up to you.

7. Permissions

RudelOrga does not request location, camera, contacts or storage.

8. No advertising, no analytics

RudelOrga contains no advertising, no analytics tools, no trackers and no crash reporting.

9. Retention and deletion

The data stays on your device until you delete it in the app or uninstall the app. Whoever created the group’s folder in OneDrive or Nextcloud deletes it there. Android may include app data in your personal device backup if you have enabled this in the system settings.

10. Your rights

As I receive no data from the app and cannot decrypt the group’s content, I cannot provide information about it or delete it; you are in control – on your devices and in your folder. For questions, contact me at the address above. You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for me: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.