Privacy Policy

Last updated: 9 April 2026

1. Controller

The person responsible for data processing within the meaning of the Swiss Federal Act on Data Protection (nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR) is:

Raul Blanco
Wasgenring 41
4055 Basel, Switzerland
Email: hello@nowone-students.com

NowOne is an independently developed app by Raul Blanco, a natural person domiciled in Switzerland. It is not operated by a company or legal entity.

2. Core Principle: Privacy by Design

NowOne was built with a "Privacy by Design" philosophy. We minimise data processing to what is strictly necessary. The App operates primarily on your device. All content you create in the App (e.g., tasks, calendar entries, flashcards) is stored locally on your device and synced across your own Apple devices via Apple CloudKit.

We do not operate our own servers for storing or processing user data. The limited data processing that does occur is described transparently in the sections below.

3. Applicable Law

As the Provider is domiciled in Switzerland, the Swiss Federal Act on Data Protection (nDSG) applies as the primary data protection law. Where NowOne is used by individuals in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) and/or UK GDPR may additionally apply.

This Privacy Policy is designed to satisfy the requirements of all applicable data protection laws.

4. What Data We Process

a. On-Device Data (no transmission to us)

All content you create within the App — including tasks, calendar entries, flashcards, timer data, and settings — is stored exclusively on your Apple device. This data is under your sole control. We have no access to it and do not process it.

b. Apple CloudKit Sync

If you use iCloud, your App data may be synced across your Apple devices via Apple CloudKit. This sync is managed entirely by Apple and is subject to Apple's Privacy Policy. We do not have access to your CloudKit data. You can disable iCloud sync for NowOne in your device's iCloud settings at any time.

  • Data processed: App content you choose to sync (tasks, calendar, flashcards, etc.)
  • Legal basis: Performance of contract (nDSG Art. 31 para. 2 lit. a; GDPR Art. 6(1)(b)) — sync is a core feature of the App
  • Retention: Determined by Apple and your iCloud settings

c. In-App Purchases & Subscriptions (RevenueCat)

NowOne uses RevenueCat, a third-party subscription management platform, to manage in-app subscriptions and analyse subscription performance.

When you make a purchase or start a free trial, the following data may be processed by RevenueCat:

  • An anonymous app user identifier (generated by the App, not linked to your identity)
  • Purchase and transaction history (provided by Apple)
  • Subscription status and entitlements
  • Anonymised, aggregated analytics data (subscription performance metrics)

NowOne does not store your payment information. All payment processing is handled by Apple. RevenueCat receives transaction data from Apple to verify and manage your subscription status.

  • Legal basis: Performance of contract (nDSG Art. 31 para. 2 lit. a; GDPR Art. 6(1)(b)) — subscription management is necessary to provide paid features
  • Retention: RevenueCat retains data in accordance with RevenueCat's Privacy Policy
  • Data transfer: RevenueCat Inc. is based in the United States. Data transfers are governed by appropriate safeguards (see Section 7)

d. App Tracking Transparency (ATT)

When you first use the App, iOS may display Apple's App Tracking Transparency prompt asking for your permission to track activity across other companies' apps and websites. If you decline, no tracking identifier is shared. If you consent, a device advertising identifier (IDFA) may be used by RevenueCat for subscription attribution analytics.

  • Legal basis: Consent (nDSG Art. 31 para. 1; GDPR Art. 6(1)(a))
  • How to withdraw: You can change your choice at any time via Settings > Privacy & Security > Tracking on your device

e. Apple Crash Reports

If you have opted in to share diagnostics with app developers through your Apple device settings, Apple may share anonymised crash reports and diagnostics data with us through App Store Connect. This data does not identify you personally.

  • Data processed: Crash logs, device model, OS version, app version (anonymised by Apple)
  • Legal basis: Legitimate interest (nDSG Art. 31 para. 1; GDPR Art. 6(1)(f)) — maintaining app stability and fixing bugs
  • How to opt out: Settings > Privacy & Security > Analytics & Improvements on your device

f. Website (www.nowone-students.com)

This website is a static informational site hosted by Hostinger International Ltd. It does not use cookies, tracking, or analytics services.

When you visit this website, Hostinger may automatically collect technical access data in server log files:

  • IP address (anonymised or truncated where possible)
  • Date and time of access
  • Browser type and version
  • Referring URL
  • Pages accessed

This data is necessary for technical operations and security (e.g., defence against attacks) and is not combined with other data sources.

  • Legal basis: Legitimate interest (nDSG Art. 31 para. 1; GDPR Art. 6(1)(f)) — ensuring website security and functionality
  • Retention: Server logs are retained by Hostinger in accordance with their Privacy Policy
  • Data transfer: Hostinger may process data in the EU/EEA and other locations (see Section 7)

g. Contact Communication

If you contact us via email at hello@nowone-students.com, we process the data you provide (e.g., email address, name, message content) exclusively to respond to your inquiry.

  • Legal basis: Legitimate interest (nDSG Art. 31 para. 1; GDPR Art. 6(1)(f)) — responding to user inquiries; or pre-contractual measures (GDPR Art. 6(1)(b)) where the inquiry relates to our services
  • Retention: Contact emails are deleted within 30 days after the inquiry has been resolved, unless longer retention is required for ongoing business purposes, legal obligations, or the establishment, exercise, or defence of legal claims
  • Email provider: Our email is hosted by Hostinger. Your message is processed on Hostinger's infrastructure

5. Data We Do NOT Collect

For the avoidance of doubt, NowOne does not use or collect:

  • Analytics tools, tracking services, or advertising SDKs
  • Cookies, fingerprinting, or similar technologies (in the App)
  • Location data
  • Contact lists or address books
  • Health or biometric data
  • Browsing history or usage patterns
  • Any data beyond what is described in Section 4

We do not sell, rent, or trade your personal data to third parties.

6. Children's Privacy

NowOne is designed for students of all ages and carries Apple's lowest age rating. The App does not knowingly collect personal data from children.

Because the App operates primarily on-device and does not require account creation, registration, or the submission of personal information, it can be used by minors without special parental consent requirements for data processing.

For in-app purchases, Apple's parental controls and Family Sharing restrictions apply. Parents or guardians can manage and restrict purchases through Apple's Screen Time and Family Sharing settings.

If you are a parent or guardian and believe your child has provided personal data to us (e.g., via email), please contact us and we will promptly delete it.

7. Cross-Border Data Transfers

Some of the third-party services we use are based outside of Switzerland and the EEA:

  • RevenueCat Inc. — United States. The US benefits from a Swiss-US Data Privacy Framework adequacy decision and the EU-US Data Privacy Framework. RevenueCat participates in appropriate data transfer mechanisms.
  • Apple Inc. — United States. Apple processes data under its own privacy commitments and Standard Contractual Clauses where required.
  • Hostinger International Ltd. — Lithuania (EU), with infrastructure that may extend to other locations. Transfers within the EEA are covered by GDPR. Transfers to third countries use appropriate safeguards.

Where personal data is transferred to countries without an adequate level of data protection as determined by the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the European Commission, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or participation in recognised data transfer frameworks.

8. Data Retention Summary

Data Retention
On-device content Until you delete it; under your control
CloudKit sync data Per Apple's iCloud data retention; under your control
RevenueCat subscription data Per RevenueCat's retention policy
Contact emails 30 days after resolution, unless business need requires longer
Website server logs Per Hostinger's retention policy
Apple crash reports Retained in App Store Connect; anonymised

9. No Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (within the meaning of GDPR Art. 22 or nDSG Art. 21).

10. Your Rights

Under the Swiss nDSG and, where applicable, the GDPR, you have the following rights regarding your personal data:

  • Right of access: You may request information about whether and what personal data we process about you.
  • Right to rectification: You may request the correction of inaccurate personal data.
  • Right to erasure: You may request the deletion of your personal data, subject to legal retention obligations.
  • Right to restriction of processing: You may request the restriction of processing under certain conditions.
  • Right to data portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format (GDPR).
  • Right to object: You may object to processing based on legitimate interests at any time, for reasons arising from your particular situation.
  • Right to withdraw consent: Where processing is based on your consent (e.g., ATT tracking), you may withdraw your consent at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Since we process very limited personal data and most data is stored exclusively on your device, many of these rights are already fulfilled by design — you can view, modify, and delete your App data at any time directly on your device.

To exercise any of these rights, please contact us at hello@nowone-students.com. We will respond to your request within 30 days.

11. Right to Lodge a Complaint

If you believe that our processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority:

  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch
  • EU/EEA: The supervisory authority of your country of residence. A list is available at edpb.europa.eu.

We encourage you to contact us first so that we can address your concern directly.

12. Future Features

We plan to introduce optional email integration via Microsoft Graph API and Google Gmail API in a future update. This Privacy Policy will be updated before those features are released to fully describe the associated data processing, legal bases, and any additional disclosures required by Microsoft and Google (including compliance with Google's API Services User Data Policy and Limited Use requirements).

No email data is processed by the App at this time.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legal requirements, new features, or changes to our data practices. The current version is always available on this page.

For material changes that affect how your personal data is processed, we will provide notice through the App or by other reasonable means at least 30 days before the changes take effect. We recommend reviewing this page periodically.

14. Contact

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Raul Blanco
Wasgenring 41
4055 Basel, Switzerland
hello@nowone-students.com