Privacy Notice

1. Controller

The controller responsible for data processing on this website is:

Contact by email: hello@secpal.app

2. Access data and hosting

When you visit this website, technically necessary data is processed so the site can be delivered and operated securely.

• Processed data: IP address, date and time of access, requested URL, referrer, browser type, and operating system.
• Purpose: delivery of the website, error analysis, abuse detection, and safeguarding technical operations.
• Legal basis: Art. 6(1)(f) GDPR based on the legitimate interest in operating a secure and functional website.

This website is hosted by Hetzner.

3. Android app, beta distribution, and update delivery

SecPal is also provided as a native Android app with the package name app.secpal. Distribution takes place through the Google Play Store or through SecPal download URLs. The signed app package remains the same regardless of the distribution path.

• Processed data: depending on use, this may include account data, operations and organizational data entered by users, technical device and app data, log data, version and update information, and, for managed-device or Device Owner scenarios, required provisioning or bootstrap information.
• Purpose: app delivery, authentication, provision of app features, secure technical delivery of installation and update information, error analysis, abuse detection, and system security.
• Legal bases: Art. 6(1)(b) GDPR for providing agreed app functionality and pre-contractual or contractual services; Art. 6(1)(f) GDPR for secure operation, abuse prevention, distribution integrity, and the stability of connected systems.

The same principles apply to closed and open beta phases. Beta versions may additionally process technical diagnostic data and error context where this is required to stabilize and securely provide the pre-release version.

4. Google Play Store and third-party platforms

If the SecPal Android app is distributed through the Google Play Store or other third-party platforms, those platforms may process personal data in connection with listing, download, installation, licensing, billing, update delivery, or abuse prevention.

Such processing is generally carried out under the responsibility of the respective platform operator. For Google's processing, Google's own privacy and terms documents also apply.

Where we organize beta or release programs through such platforms, we only process the information required there for release management, support, release communication, or security to the extent necessary.

5. Contact by email

If you contact us by email, we process the information you send so we can answer your request and document the related communication.

The legal basis is Art. 6(1)(b) GDPR where your request relates to pre-contractual steps or a specific inquiry, otherwise Art. 6(1)(f) GDPR.

6. No cookies and no tracking on this website

This website currently does not use analytics, tracking, or marketing cookies. There is also no consent banner for optional tracking at this time.

7. Storage duration

Server log data is stored only for as long as necessary for technical delivery, error analysis, and security monitoring.

Data from emails is deleted once the relevant request has been completed, unless statutory retention obligations require otherwise.

Data from use of the Android app or beta distribution is stored only as long as necessary for the relevant feature, security monitoring, support, error analysis, release management, or statutory retention duties.

8. Data subject rights

Under the GDPR, you may have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing.

You also have the right to lodge a complaint with a supervisory authority.

If you use a SecPal account or want personal data associated with the app to be deleted, you can contact us at hello@secpal.app.

9. Changes to this notice

We update this privacy notice whenever the website, the Android app, the actual data processing activities, the beta or release processes, or the legal requirements change.