Privacy policy

This is a translation for your convenience. The German version is legally binding.

In short

This website sets no cookies, does not follow you across sites and loads no content from third-party servers: fonts and images come from the same server as the page. We only count how many people visit the site, using the cookie-free service Cloudflare Web Analytics (see section 2). In the app, your financial data stays on your computer. We have no access to it and no user account for you.

This policy applies to the website and to the AndNext app.

1. Controller

AndNext, Martin Röhr
Möllhausenufer 31, 12557 Berlin, Germany
Email: support (at) andnext.app

We have not appointed a data protection officer because we are not required to.

2. Visiting the website

The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, and your browser and operating system. This is necessary to deliver the site and protect it against attacks and misuse.

The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU standard contractual clauses also apply. We have a data processing agreement with Cloudflare. We have not set up any access logs ourselves. How long Cloudflare stores data is set out in Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

Audience measurement. We use Cloudflare Web Analytics to see how many visitors open the website, which pages are read, which site brought them to us and which country they come from. According to Cloudflare the service works without cookies and without storing information on your device, and does not recognise individual visitors across visits or websites. We only receive aggregated numbers, nothing about individual people. The legal basis is our legitimate interest in improving the website and understanding whether it is found (Art. 6(1)(f) GDPR). We also see how often our download file is requested in Cloudflare’s statistics, without identifying individuals.

3. Contact by email

If you write to us, we process your email address and the content of your message in order to reply. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete messages once the enquiry is settled, unless statutory retention obligations apply.

4. Buying a licence through Lemon Squeezy

Licences are sold by Lemon Squeezy as the merchant (Lemon Squeezy, LLC, USA). When you buy, you enter your payment and billing details directly with Lemon Squeezy. Lemon Squeezy is responsible for this itself; its privacy policy applies: lemonsqueezy.com/privacy.

We receive the order details from Lemon Squeezy (name, email address, country, product purchased, licence key) to manage your licence and help you with questions (Art. 6(1)(b) GDPR). We keep them for as long as statutory obligations require.

5. The app

Your financial data

AndNext stores accounts, transactions, items, savings goals, notes and settings exclusively on your computer. They are not transmitted to us. AndNext also creates backups locally. If you turn on backup to iCloud Drive, a copy is stored in your own iCloud storage at Apple; only you control this.

Licence check

When you enter a licence key, AndNext activates it for your computer with Lemon Squeezy. The licence key and a name for the computer (the computer name) are transmitted, and for technical reasons also your IP address. After that, AndNext checks at most once a week whether the licence is still valid. The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR). No financial data is transmitted.

Updates

At startup and every four hours after that, AndNext asks our download server whether a new version is available and downloads it if so. The server is hosted by Cloudflare (see section 2). For technical reasons, your IP address, the installed version and information about your operating system are transmitted, but never financial data. We do not analyse these requests. The legal basis is the performance of the licence agreement, which includes updates (Art. 6(1)(b) GDPR), and our legitimate interest in a secure, up-to-date app (Art. 6(1)(f) GDPR).

Bank connection (optional)

The direct bank connection runs through Enable Banking (Enable Banking Oy, Finland), an account information service licensed in the EU. To use it, you set up your own access with Enable Banking and sign in to your bank. Balances and transactions then go from your bank via Enable Banking directly to your computer, not to us. Access is read-only; payments cannot be initiated. Enable Banking’s privacy policy applies to its processing. You can end the authorisation at any time in the app or with your bank; it also ends after the period set by the bank.

After you sign in to your bank, a small redirect page on GitHub Pages (GitHub, Inc., USA) takes you back to the app. A one-time code is transmitted in the address; GitHub technically processes your IP address in the process. We store none of this.

Feedback (optional)

If you send us feedback from the app, we transmit the chosen category, your text, your email address if you wish, and the app version and language to our feedback service at Cloudflare. Accounts and amounts are not transmitted. We use the feedback to improve AndNext and to reply to you (Art. 6(1)(f) GDPR, and also (b) if you provide an email address), and delete it once it has been dealt with.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just send us an email.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

7. Other

No automated decision-making or profiling takes place. We do not pass your data on for advertising purposes and do not sell it.

Last updated: November 2026