Scope and responsible contact
This policy describes the iOS app and its optional Rapid Reminders service operated by Cyril Blum through cblum.ch. Use the contact details in the website’s legal notice to ask privacy questions or request access, correction or deletion. The website’s own hosting, cookies and traffic processing are separate from the app and described in the website privacy information.
The optional online service is experimental. The current review identified unresolved security and deletion limitations. Do not use it for confidential, health-related or business-critical information. This statement does not waive applicable data-protection rights.
Local use without an account
The app stores lists, categories, tags, reminders, notes, optional links, involved-person text and due dates in a JSON file in its local Documents directory. A saved profile may include your username, email and calendar token. The current client stores its authentication token in UserDefaults. No end-to-end or application-level encryption of this local JSON is implemented; the device’s operating-system protections apply.
No advertising or analytics SDK was found in the reviewed app source. No access to your existing Apple Reminders database, contacts, location or health records is implemented. Entering another person’s name yourself still creates personal data; only include information you are entitled to use. Siri and Shortcuts are optional Apple features and follow your Apple settings.
Optional accounts, synchronization and sharing
Registration sends a username, email address and password to the service. The server stores account identifiers, a password hash, account-activation information, a calendar access token and creation timestamps. Activation messages use the configured mail service when available. The precise mail-provider arrangement has not been verified.
Signing in can upload existing local lists and reminders and fetch server lists, reminders and sharing information. Shared users can see shared contents and usernames. The server stores reminder text and associated metadata in SQLite in readable form. HTTPS protects transmission to cblum.ch; this is not end-to-end encryption. The operator and authorized server administrators may access stored contents. The server is hosted with Hetzner in Germany, as confirmed by the operator.
Ordinary service operation also processes technical connection information such as IP addresses, request paths and timestamps. Since the backend update of October 26, 2026, activation links are no longer written to service logs or returned to the app; activation tokens are stored only as hashes and expire after 48 hours. Logs from before that update may still contain activation-related information. Web-server and service-log retention and any mail-provider retention have not been established. A fixed maximum retention period is therefore not promised.
Calendar subscriptions and third-party copies
Optional calendar links contain an access token. Anyone who obtains a link can retrieve the calendar data accessible through it without signing in to the app. Depending on the selected feed, this can include titles, subtitles, notes, links, involved-person text, categories, dates, and completed or hidden reminders. Keep links private; there is no in-app token-rotation control at present.
Opening a subscription passes the link to your chosen calendar app; copying it places it on the system clipboard. Your calendar provider or devices may download and retain independent copies under their own privacy terms. Removing sharing, signing out or deleting an item does not erase copies already held by recipients. Calendar refresh and alarm delivery are controlled by the calendar client and are not guaranteed.
Retention, deletion and backups
Local data remains until you remove it or remove the app’s local data. Signing out clears the app’s current account/token association but keeps local lists and reminders and does not delete server data. Device or system backups may retain copies according to your settings.
Stored accounts and reminder content do not expire automatically. From app build 1.1 (4), signed-in users can delete their account in the app (My Profile, Delete Account) after confirming their password. This removes the account, the lists it owns with their reminders, categories and tags, and the shares of those lists from the server; you choose whether lists stay on the device as local copies. Copies on other devices, with collaborators, in calendar apps or in server backups made before the deletion are not removed by this step. Older app versions require contacting the operator. Item and list deletions made offline are queued and sent later; synchronization no longer re-uploads content that was deleted on another device, but do not rely on it as confirmed erasure across devices. Deleting or hiding an item is not equivalent to deleting all copies.
The server, including the Rapid Reminders database, is backed up every night to storage operated by the app operator in Switzerland. Older backups are deleted automatically, so deleted accounts, lists and reminders can remain in backups for up to about 4 months. If a backup has to be restored, deletions made after its date are re-applied where feasible. Server logs are not part of these backups; how long the server keeps them is not covered by this notice. Keep separate copies of important information.
Choices and rights
You can use local lists without creating an account, decline sharing and calendar subscriptions, and stop future account synchronization by signing out. Existing server copies remain until separately removed. Contact the operator using the website’s legal contact information for access, correction, deletion or other rights that apply to your situation, and explain which account is concerned without sending a password or calendar token. You may also contact the competent data-protection authority.