MaschinenNotesCosts, Maintenance & Fuel Deutsch

Privacy policy

Draft – the highlighted details are still missing.

This is a translation for your convenience. Only the German version is legally binding.

This privacy policy covers the website www.maschinennotes.de, ordering licenses, downloads, the programs and apps “MaschinenNotes – Costs, service & fuel” (Windows, macOS, Android, iOS) synchronisation via the RuppiLab Cloud and the withdrawal function “Withdraw from contract”.

1. Controller

RuppiLab, owner Peer Drescher
[STRASSE UND HAUSNUMMER]
[PLZ] Oberkrämer
Germany
E-mail: apps@ruppilab.de

We have not appointed a data protection officer as we are not required to. Please send any privacy questions to the address above.

2. In brief

  • No tracking, no analytics or advertising services, no social media plugins – neither on the website nor in the apps.
  • The website loads everything from our own server: fonts, images, scripts. No third-party content is embedded.
  • Your vehicle and cost data stays on your devices (encrypted database). For synchronisation it is end-to-end encrypted on the device first – we cannot read it.
  • Cookies: only a technically necessary session cookie when you submit an order or the withdrawal form.

3. Hosting and server logs

The website, the download server and the RuppiLab Cloud run on a server at [HOSTER: Name und Anschrift des Rechenzentrums]. When you visit the website, the web server processes technically necessary data: IP address, date and time, requested address, amount of data, status code, referrer and browser identifier (user agent). This data is stored in log files to keep the service running and to fend off attacks, and is deleted after [ANZAHL] days. Legal basis: our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR). We have a data processing agreement with the host (Art. 28 GDPR).

All connections are encrypted with TLS (https).

4. Cookies and browser storage

The website does not set any cookies for analytics or advertising. Only when you submit the order form or the form of the withdrawal function is a session cookie “mnorder” set. It contains a random identifier, is used solely to protect the forms against abuse (limiting the number of submissions) and is deleted when you close the browser. Legal basis: § 25 (2) no. 2 TDDDG (strictly necessary) and Art. 6 (1) (f) GDPR.

If you confirm the cookie notice with “OK”, your browser remembers this in its local storage (localStorage, entry “mn-hinweis”). This entry is not sent to us; you can delete it in your browser settings at any time.

5. Downloads and download counter

When you download a program or a manual, we count the download. We only store the time, product, file name, version, edition (e.g. Windows 64-bit) and whether the download came from the website or from the program – no IP address, no browser identifier, no cookie. The browser identifier is only evaluated briefly so that search engines and bots are not counted. The website shows at most the total number of downloads. Legal basis: Art. 6 (1) (f) GDPR (interest in anonymous statistics).

6. Ordering a license

For an order via the form we process the details you enter: license type and quantity, name, company and VAT ID if applicable, address, e-mail address, payment method, licensee (name in the license key), your previous license key for renewals, and your notes. We need them to conclude and perform the contract, issue an invoice and send you the license key (Art. 6 (1) (b) GDPR). The order is sent to us by e-mail; you receive a confirmation at the address you entered.

To protect against automated abuse we use a form token without cookies, a field invisible to humans and a limit of orders per session and hour; no IP address is stored. We keep order and invoice data as long as commercial and tax law require (up to 10 years, Art. 6 (1) (c) GDPR) and delete it afterwards.

Payment by bank transfer: We receive the usual details from your bank (name, account details, amount, reference).

7. Withdrawal via the withdrawal function

If you use “Withdraw from contract”, we process the details you enter there: your name, the details identifying the contract (e.g. order number, order date, e-mail address used for the order, the part withdrawn if applicable) and the e-mail address for the confirmation of receipt, as well as the date and time of receipt. We need them to confirm receipt without delay (Section 356a (4) BGB) and to process the withdrawal (Art. 6 (1) (c) and (b) GDPR). We do not ask for reasons. We keep the details together with the order documents (section 6, up to 10 years, Art. 6 (1) (c) GDPR). Abuse protection as for the order form: form token without cookie, invisible field, limit on submissions per session and hour, no IP address stored.

8. Contact by e-mail

If you e-mail us, we process your address and the content to answer your request (Art. 6 (1) (b) GDPR where a contract is involved, otherwise (f)). We delete the e-mails once the request is settled and no retention obligation applies.

9. The programs and apps

Local data: vehicles, entries, photos, receipts and settings are stored on your device in an encrypted database. MaschinenNotes has no user account and sends no usage, crash or telemetry data to us. The license check happens offline in the program.

Permissions (only when needed, can be revoked in the system settings at any time): camera – for photos of vehicles and receipts and to scan the sync code (QR code); photos – via the system photo picker, only the selected image is used; location – for the “fuel prices nearby” station search; notifications – for deadline reminders triggered by the device itself.

Fuel prices: When you use fuel prices, the app sends the chosen location (or the place you set) and the radius to our interface api.tankstellen-ampel.de. The position is only used to answer the request and is not stored. Price data comes from the Market Transparency Unit for Fuels (MTS-K) of the German Federal Cartel Office. If you report a wrong price or wrong station details via “Report error”, we forward the station, type of report, the correct value and the time – without name or account – to the MTS-K. Legal basis: Art. 6 (1) (b) GDPR (requested feature).

Map: the app loads map tiles from our own map server maps.gps-srv.de; as with any internet request, your IP address is transmitted. Loaded tiles stay on the device for up to 30 days. Map data © OpenStreetMap contributors, OpenMapTiles.

GPS-Srv.de (optional): if you connect MaschinenNotes to your GPS-Srv.de account, the app uses your API key to read trips and odometer readings (read-only). GPS-Srv.de’s terms and privacy policy apply.

Navigation and links: tapping “Route” or an address opens your device’s maps app (e.g. Apple Maps, Google Maps or OpenStreetMap) with that address; the provider’s terms apply.

10. Synchronisation via the RuppiLab Cloud

With a license you can sync your data between computers and phones. If you choose the RuppiLab Cloud as storage, we store the sync data uploaded by your devices on our server. This data is end-to-end encrypted on your devices; the key is derived from your sync code and never leaves your devices. We can neither read nor analyse the content (vehicles, entries, receipts, attachments).

To provide the service we additionally store (Art. 6 (1) (b) GDPR):

  • a random space identifier and a hash of your access key,
  • a fingerprint (SHA-256 hash) of your license key, the license type, the number of seats and the date until which your update entitlement – and thus the RuppiLab Cloud – runs; not the license key itself and not the name it contains,
  • per connected device a random device identifier, the platform, an optional device name you set in the app, and the time of the first and last connection,
  • name, size, checksum and modification time of the encrypted files and the storage used.

IP addresses are not stored. To prevent abuse, a shortened value re-encrypted daily is derived from the IP address and kept for at most two hours. Error logs contain no content, identifiers or addresses and are deleted after 90 days. No cookies are set and no data is passed on to third parties.

Deletion: you can delete the sync space in the desktop app at any time (“Stop sync”) – the data is deleted immediately. When your update entitlement ends, your devices can still read the data for 90 days; access is then blocked and the space is deleted automatically after about six more months. Spaces that no device has accessed for 24 months are deleted automatically. Server backups are overwritten after [ANZAHL] days.

11. Synchronisation via Google Drive, Dropbox or OneDrive (optional)

If you choose your own storage at Google Drive, Dropbox or Microsoft OneDrive instead, you sign in directly with that provider and allow MaschinenNotes to access its own app folder. The access authorisation stays on your device; we receive no data. Here too, sync data is end-to-end encrypted before uploading. The terms and privacy policies of the chosen provider apply (Google Ireland Ltd., Dropbox International Unlimited Company or Microsoft Ireland Operations Ltd.); the provider may transfer data to the USA.

12. Disclosure of data

We do not sell data and only pass it on where necessary to perform the contract (e.g. to PayPal for PayPal payments, to the MTS-K for an error report), to our host as processor, or where required by law.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Please contact apps@ruppilab.de.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

14. Changes

We update this policy when the website, the programs or the law change. The version published here applies.

Last updated: 13.10.2026