Privacy Policy

Local Data (Stored on Your Device):

• Project names, client information, and gear lists
• Contact names, roles, phone numbers, email addresses, and — where you enter them — postal and billing addresses, VAT identification numbers, bank details (IBAN), and agreed day rates
• Template data and device library items
• User preferences (theme, language, settings)

Cloud Data (When Signed In):

• Email address
• Profile information (display name, photo)
• Device identifier (for multi-device sync)
• Active session information
• Synchronized project and template data
• Subscription status and plan information. We never store your payment details: subscriptions taken out on the web are processed by Stripe, and subscriptions taken out inside the iOS or macOS app are processed by Apple as part of the App Store purchase.
• Shared project data, collaborator roles, presence indicators, and chat messages exchanged within shared projects. A Data Management project linked to a shared project is shared with its members too: its shooting days, transfer sessions, offloads and verification runs, including the source, destination and drive paths they record.
• Shooting calendar entries: the title, notes, location and start/end times of your prep, shoot, return and travel periods. On a shared project these are visible to the project members.
• In-app notifications, including the message text and the name of the person who triggered them
• If you connect your own AI provider: the provider name and your API key, stored encrypted. The key itself is never included in a data export.
• Browser geolocation coordinates (only when you explicitly grant permission for weather or location features)
• Push notification subscription endpoint (if you opt in to browser notifications)
• Hashed password history (stored server-side to prevent password reuse; we never store plaintext passwords)
• Email notification preferences (whether you have opted in or out of transactional emails)
• Anonymous tool-usage counts: If you are signed in with cloud sync consent, opening a PDF tool or a calculator adds one to a daily counter for that tool (at most once per tool, account and day). The counter stores only the tool and the date — not your account, device or IP address. So that a tool is not counted twice on one day, our server keeps a one-way hash derived from your account ID, the tool and the date, and deletes it on the following day; nothing is stored on your device for this. We use the totals to decide which tools to improve.
• Usage statistics: We compute aggregate figures from the data synced to our server — for example how many accounts and projects are active, how many records of each kind exist, which camera bodies, rental houses, custom device names and auto-gear rule names are used most, and the number and total value of sub-rentals. A name or a total is shown only when it comes from at least five accounts, and no individual account's records are displayed. Only we see these figures; they are not passed on and not used for advertising or profiling. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which features are used, so that we can maintain and improve the app). You can object at any time under Art. 21 GDPR: turn on “Leave my account out of usage statistics” in Settings → Security & Privacy → Privacy & Legal, or write to the contact address in this policy. Your account is then left out of the figures and opening a tool is no longer counted.
• Help search terms: If you turn on “Help search analytics” in Settings → Security & Privacy → Privacy & Legal (off by default; you also need to be signed in with cloud sync), the words you type into the Help search are sent to our server, lower-cased and cut to 200 characters, and counted per term together with whether the search found anything. We store only the term, its counts and when it was last searched — not your account, device or IP address. Avoid typing personal details into the search. We use the counts to improve the help and keep them while they serve that purpose. Legal basis: Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time by turning the switch off.
• Accessories store order history and shipping details (if you make purchases). To limit abuse of the guest checkout we count checkouts per hour under a one-way keyed hash of your IP address; these counters are deleted after 7 days (Art. 6(1)(f) GDPR).
• Bank Transactions (if you use the Banking module): When you import bank transactions via CSV or camt.053, or enter them manually, we process: IBAN and BIC (your own bank account and counterparty), booking date, value date, signed amount and currency, purpose text (SEPA-Verwendungszweck), counterparty name, optional receipt attachment, source (manual / CSV preset / camt.053), and the link relationships you create between transactions and your invoices / Mahnungen / expenses. This data is necessary to reconcile payments against the invoices you issue and to fulfil the 10-year GoBD retention obligation under § 147 AO. You can provide it either by importing a CSV / camt.053 file your bank exports, or by using the optional direct bank connection (FinTS/HBCI), which retrieves your balance and transactions from your bank on your behalf (see Section 7).
• Accounting & Tax Data (if you use the business features): When you create quotes, invoices, order confirmations, delivery notes, expenses and receipts (including scanned receipt images and text extracted from them by on-device OCR), cash-book (Kassenbuch) entries, vendor bills, fixed-asset records, or recurring documents, we store these records. They embed personal data of your clients and suppliers (such as name, postal and billing address, email, VAT identification number, and — where you enter it — bank details / IBAN) as well as your own business and tax identifiers (Steuernummer, USt-IdNr, responsible tax office, and small-business / Kleinunternehmer status). This data is processed to produce your invoices and bookkeeping, to generate statutory tax reports and exports (EÜR, advance VAT return, DATEV, ELSTER), and to meet the 10-year GoBD retention obligation under § 147 AO.
• Electronic signatures: When you or a counterparty sign a contract, quote, or delivery / return note electronically, we store the drawn signature image together with the signer's name, the time of signing, and the IP address from which it was signed, as evidence of the agreement. Signing is performed entirely on our own infrastructure; no third-party e-signature provider is involved.
• Crew network & availability (if you use the crew-networking features): the connections you establish with other users, the professional contact details those users choose to share with you (name, email, photo), and any availability information and private scheduling notes you record about your contacts.
• Crew search (Contacts → Connected Crew → Connect): signed-in users can look for other accounts to send them a connection request. By name: your account is found by part of your display name only if you turn on “Findable by name in crew search” in Settings → Security & Privacy → Privacy & Legal (off by default); the person searching then sees your display name and profile photo, never your email address. By email address: someone who types your exact email address finds your account (display name, photo and the address they typed) unless you turn off “Findable by exact email address” in the same place (on by default); people you are already connected with can always find you this way. The search runs on our server, and we do not store what is typed into it. Legal basis: for the name search Art. 6(1)(a) GDPR (consent, which you withdraw at any time by turning the switch off); for the email-address search Art. 6(1)(f) GDPR (the legitimate interest in being reachable for connection requests from people who already know your address), to which you can object at any time by turning the switch off (Art. 21 GDPR).
• Public rental catalogue & gear requests (if you publish a rental catalogue): when someone — with or without an account — submits a rental request through your public catalogue link or the in-app rental network, we store the requester's name, email address, whether they are requesting as a private person or a business and, where provided, phone number, company, address and VAT ID, together with the requested items and rental period. We use these details to deliver the request to the catalogue owner and to send the requester the owner's quote and status updates by email (legal basis: Art. 6(1)(b) GDPR — steps taken at the requester's own request prior to entering into a contract). When a private person accepts a quote online, we also store their acknowledgement of the withdrawal instructions and, if they withdraw from the contract through the quote link, the withdrawal they send (name, email address, date and time of receipt); we send them a confirmation of receipt and inform the catalogue owner (legal basis: Art. 6(1)(c) GDPR — § 356a BGB). Requests that do not result in a rental (declined, expired or cancelled) are automatically deleted 90 days after they close. Requests withdrawn by the requester are kept as evidence until the end of the third year after the year of the withdrawal and then deleted.
• Focus Pulling Simulator public leaderboard (only if you join it): the pseudonymous display name you choose, and for every take you post the level, your score and a summary of your camera setup (lens, stop, sensor size, frame rate). Posted takes are replayed and scored on our server; the take's recording is used for that check only and is not stored. The board shows your display name, score and setup to other signed-in users — never your e-mail address or real name — and people who share a project or crew connection with you can see you on the Team board (legal basis: Art. 6(1)(a) GDPR — your consent by joining). Leaving the leaderboard, withdrawing your cloud consent or deleting your account deletes every posted take.
• AI Agent Access (if you enable the Agent access feature): The access keys you issue to connect an AI agent are stored only as a salted hash, never in plaintext. We also keep a metadata-only activity log of the actions an agent performs on your behalf — the tool name, status, and timestamp only, never the content of your data. See Section 7 for how this feature exposes your data to the AI provider you choose.

Contact form

If you write to us through the contact form at /contact, we process the name, email address, optional topic and message you enter, and the language of the page. The form sends them to our support mailbox as an email, with your address as the reply address; the form itself stores nothing, and you do not receive a copy. To limit abuse, the form is protected by Cloudflare Turnstile and we count messages per hour under one-way keyed hashes of your IP address and your email address; these counters hold the hash, the hour and a number, and no message content, and they are deleted after 7 days. We use your details only to answer you. The legal basis is Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before one, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries and in protecting the form against abuse). We delete your message once your enquiry is settled, unless statutory retention duties for business correspondence apply (§ 257 HGB, § 147 AO).

Reports of illegal content (DSA)

If you report content through the “Report content” form, we process the name, email address and explanation you enter, the link to the reported content, and a one-way keyed hash of your IP address (the address itself is not stored). Purpose: to handle the notice and tell you our decision. Legal basis: Art. 6(1)(c) GDPR with Art. 16 DSA. Recipients: our support inbox; the person whose content you reported, only where strictly necessary (Art. 17(3)(b) DSA); authorities where the law requires it. Retention: a notice is deleted 6 months after our decision. While a complaint or legal dispute about the decision is still open, it is kept until that is closed, and a notice awaiting a decision is kept until it is decided. For child sexual abuse material you may report without a name or email address.

Cancellation and withdrawal declarations (§§ 312k, 356a BGB)

If you cancel a subscription on the “Cancel contracts here” page, we process the name, email address, contract details, type of termination, any reason and the requested end date you enter, the date and time we received the declaration, whether it matches an active subscription of an account, and a one-way keyed hash of your IP address (the address itself is not stored). Purpose: to carry out and confirm the cancellation and to be able to prove it. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with § 312k BGB. Recipients: our support inbox; Stripe, to end a matched subscription. Retention: 3 years from the end of the year in which we received the declaration (the regular limitation period, §§ 195, 199 BGB).

If you withdraw from a subscription on the “Withdraw from contract” page, we process the name, email address and contract details you enter and the date and time we received the declaration; if it matches an active subscription of an account, also the start of the contract, the end of the withdrawal period, the latest invoice and the refund amount we calculate, and when the subscription was stopped; and a one-way keyed hash of your IP address (the address itself is not stored). Purpose: to receive and confirm the withdrawal (§ 356a BGB), to end the subscription and to refund you, and to be able to prove it. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with §§ 355, 356a, 357 and 357a BGB. Recipients: our support inbox; Stripe, to end the subscription and to pay the refund. Retention: 3 years from the end of the year in which we received the declaration (§§ 195, 199 BGB); records of the refund payment itself are kept for the periods of commercial and tax law (§ 257 HGB, § 147 AO).

Online quote acceptance and withdrawal (§§ 312f, 356a BGB)

If you send a quote with “Let the customer accept online”, your customer can open it at a /q/ link. There we process the postal code they enter (compared with the one on the quote, not stored), their IP address and browser identification (stored in full for 7 days to detect misuse, after that only as one-way hashes), the time of each step, the options they choose, their acknowledgement of your terms and, for a consumer, of the withdrawal instructions, the totals shown to them and the acceptance or decline (with any reason). To accept, your customer enters the name of the person signing and draws a signature or uploads an image of it; we store both with the quote and show them to you. If a consumer withdraws from the contract there, we also store the name and email address they enter, the date and time we received the declaration, a reference number and whether it arrived after the deadline. We send your customer the contract confirmation and the confirmation of receipt by email, and inform you. For this data you are the controller and we process it on your behalf (Art. 28 GDPR); the legal basis is Art. 6(1)(b) GDPR and, for the confirmations, Art. 6(1)(c) GDPR with §§ 312f and 356a BGB. It is stored with the quote and deleted with it.

Call-sheet links: dietary and allergy information, read receipts

If a production that uses the app shares a call sheet by link, the people it names can open it without an account. The link shows what the production put on the call sheet: names, roles and call times, and, unless the production hid them, phone numbers and email addresses. If the production switches on the dietary block, the link also shows diet counts and named allergy and intolerance rows. This can be health data or reveal religious beliefs (special categories of personal data, Art. 9 GDPR).

The production is the controller for this content. It decides what goes on a call sheet and needs a legal basis for it; for health data that is the explicit consent of the person concerned (Art. 9(2)(a) GDPR). We store and deliver the published copy on the production’s behalf as its processor (Art. 28 GDPR). To exercise your rights regarding a call sheet, contact the production named on it; requests that reach us are passed on to it.

When a link is opened we record the time of the first and of the latest opening and the number of openings, and, if the recipient presses “Confirm”, the time of the confirmation, so that the production can see who has received the call sheet (Art. 6(1)(f) GDPR: legitimate interest in knowing that call times and safety information arrived). No IP address is stored with this. A link stops working 48 hours after the last shoot day or when the production revokes it. The published copy is erased 30 days after that; the recipient’s name and the receipt times remain until the production deletes the project or its account.

Bug reports and crash reports

If you send a bug report from the app, we process what you type (subject, description, steps to reproduce), any screenshots you attach, your name and email address if you are signed in, technical details of your device and browser (browser identification, app version, screen and window size, language, platform, page address without its query), and the last log lines of the app. If the app crashes and you send the crash report offered on the error screen, we process the error message and its technical trace, the address of the page (long tokens and IDs in it are removed first), the browser identification, the app version, the last log lines and your optional note. We use this only to find and fix faults (Art. 6(1)(f) GDPR: legitimate interest in a working and secure service). The reports are stored on our server in Germany, can be read only by the operator and are deleted after 180 days.

If you rate the result after the AI has read a call sheet, we process your rating, the sections you marked as wrong, your optional comment (up to 500 characters), and technical details of the read: AI provider and model, the version of our reading instructions, the kind and number of files, how many days and entries were found, the number of requests and tokens, the duration, the app version and the platform. The content of the call sheet is not sent to us. We use the ratings only to improve the reading (Art. 6(1)(f) GDPR: legitimate interest in a reliable feature). They are stored on our server in Germany under your account, shown to the operator without your account ID, deleted after 365 days or with your account, and included in your data export.

Calendar links (shared production calendar, calendar subscription)

If you create a share link for a production calendar, anyone who has the link can see, without an account: the project name, the prep, shoot and return periods, the shoot locations (name, address, time zone), the names and roles of the first five crew members and the size of the crew, and the scene numbers and headings planned per day. Rates, phone numbers, email addresses and notes are not shown. The link has an expiry date and you can revoke it at any time; a project in the Trash is not shown. If you create a calendar subscription (ICS feed), anyone who has its address can read: project names, project and period notes, the shoot location, the dates and times of prep, shoot, return and travel periods and, for a gear feed, the names and quantities of the gear and the provider. A subscription address does not expire; it stops working when you delete the feed. Create these links only for people who should see this data. Legal basis: Art. 6(1)(b) GDPR. For personal data of your crew in these links you are the controller and we process it on your behalf (Art. 28 GDPR).

Receipts and e-invoices by email

If you use your personal receipt inbox address, invoices that you or your suppliers send to it are received by our own mail server. Incoming mail is checked for spam and malware. We keep only the PDF and XML attachments: they are stored in your receipt storage and listed for import in the app, where the invoice fields (supplier, address, bank details, amounts, line items) are read out. The message text and the sender address are not passed on to the app. A message without a usable attachment or without a valid address is set aside on the mail server, not processed, and deleted there after 30 days. This works only while cloud synchronisation is switched on; otherwise the mail is discarded. Legal basis: Art. 6(1)(b) GDPR; for the data of your suppliers Art. 6(1)(f) GDPR (the interest in receiving invoices electronically). The files are kept until you delete them or your account.

Call sheets forwarded by email

If you forward a mail with a call sheet to your personal call sheet address, it is received by our own mail server and checked for spam and malware. We keep only the PDF and picture attachments: they are stored in your private Shared documents inbox, together with the file name, type, size and time of arrival, so that you can import the sheet in the app on any of your devices. A call sheet usually contains personal data of other people (names, roles, phone numbers, email addresses, call times, locations). We do not read the file on the server: its content is processed only when you import it in the app, with the reading method you chose there. The message text and the sender address are not passed on to the app. A message without a usable attachment or without a valid address is set aside on the mail server, not processed, and deleted there after 30 days. This works only while cloud synchronisation is switched on; otherwise the mail is discarded. Legal basis: Art. 6(1)(b) GDPR; for the data of the people named on the sheet Art. 6(1)(f) GDPR (your interest in receiving the working document that was sent to you). A forwarded file is deleted when you file or delete it in the app, and otherwise 90 days after it arrived; with your account at the latest. You can retire the address at any time by rotating it in the settings.

Notification content, OffShoot and Live Activities

Push notifications about a finished or failed data transfer carry the project name in their title and file or issue counts in their text; they contain no names of persons. If you connect the third-party app OffShoot with an access key, it sends us the session label, project name, status and counts of each transfer so that we can notify you; we do not store these events, only a fingerprint that prevents duplicates and is deleted after 7 days. In the iOS app, Live Activities show copy progress on the lock screen: for this the labels of the cards, cameras or sources being copied, the progress and counts are sent to your device through the Apple Push Notification service, and the Live Activity token of the device is stored with your account. Legal basis: Art. 6(1)(a) GDPR (you switch notifications on) and Art. 6(1)(b) GDPR.