1Data controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Thomas Möbius
Geschwister-Scholl-Str. 4
04808 Wurzen
Germany
Email: info@theofac.com
No data protection officer has been appointed because the statutory requirements for such an appointment are not met.
2Key points at a glance
OFAC stores calendars, shifts, working hours, pay details and settings locally on your device. The provider does not operate an OFAC user account for this purpose and does not receive this content.
If you connect Google Drive and initiate a backup, OFAC transfers a backup file that has already been encrypted on your device to your Google account. If you also enable a schedule, this backup runs automatically. Google also receives connection and file metadata in the process. Android system backup remains disabled independently of this.
There is no advertising or usage analytics SDK and no active external crash reporting service. You choose where to send exports and print output. The website generates technical access data; details are provided in Section 3.
ICS calendar import: An ICS file you select in the Android file picker is read and checked exclusively on your device. OFAC does not upload the file to an OFAC server and does not access the Android system calendar for this purpose.
3Using this website
Access data
When you visit theofac.com, the web server automatically processes the data transmitted by your browser: IP address, date and time of access, the page requested, the previously visited page, browser type and version, and operating system.
This processing is technically necessary to deliver the page and safeguard its operation, for example against attacks and overload. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the stable and secure provision of the website. The data is not combined with other data sources or analysed to identify individuals. Server logs are deleted after no more than 14 days.
Hosting
The website runs on a dedicated virtual server that the controller operates and configures. Server logs are stored exclusively on this server.
The underlying infrastructure is provided by
netcup GmbH
Emmy-Noether-Straße 10
76131 Karlsruhe
as a processor under a contract pursuant to Article 28 GDPR. The server is located within the European Union. No transfers to third countries take place.
Cookies and audience measurement
This website does not use analytics, marketing or tracking cookies and does not embed external fonts, maps, videos or other third-party content. A consent prompt is therefore not required.
The strictly necessary cookie ofac_language is stored for the website language you explicitly select. Once you acknowledge the cookie notice, ofac_cookie_notice is also stored. Both contain only the respective setting, apply to the entire website, have a maximum lifetime of twelve months and are not used for analytics, marketing or tracking.
Contacting us
If you contact us by email, we process your information solely to handle your enquiry. The legal basis is Article 6(1)(b) GDPR if the enquiry concerns a contract, or otherwise Article 6(1)(f) GDPR. Your message is deleted once it is no longer needed, provided no statutory retention periods prevent deletion.
Support form and support tickets
If you use the support form on theofac.com, the server processes the information you enter to handle your request: name, email address, category, subject, message and selected form language. You may optionally attach up to two screenshots in JPEG or PNG format, each no larger than 5 MB.
Your name and email address are encrypted using a public-key sealed box before being written to the support database. The public website holds only the encryption key and cannot subsequently decrypt these values itself. A non-reversible HMAC blind index is also stored to recognise the email address. The message text, subject, category, ticket status and technical attachment metadata are stored to handle the request. Attachments are stored under random file names with restricted file permissions outside the publicly accessible web directory.
To prevent abuse, the support system uses HMAC-based, non-reversible hashes of the client IP address and truncated user agent, as well as short-lived form nonces and rate limits. Independently of this, the unprocessed IP address may appear in the web server logs described in this section. Error logs for the support endpoint are designed not to record message content, email addresses or plain-text IP addresses.
A random access token is generated for the status page. Only its SHA-256 hash is stored on the server; access expires after 365 days, or 30 days after closing in the case of a closed case. The link containing the reference number and token is sent to the email address provided and should be kept private. Expiry of the link does not delete the ticket content; however, a support case is automatically deleted six months after it is closed, together with all messages, internal notes and attachments. Cases that are not closed remain stored until they are closed.
The legal basis is Article 6(1)(b) GDPR where the request concerns the use or provision of OFAC, or otherwise Article 6(1)(f) GDPR. The legitimate interest is responding to support requests and operating the support system securely and with protection against abuse.
Support requests by email
If you write directly to support@theofac.com, we also create a case from your message and process the details in it as described above; name and email address are stored encrypted in the same way, and JPEG or PNG images are accepted as attachments. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the request relates to a contract. A reply to a support email is assigned to the existing case using the reference number. Messages that our mail server classifies as spam do not become cases; they are stored temporarily in encrypted form, deleted automatically after 30 days at the latest, and processed further only if the classification turns out to be a mistake. Cases created from an email are also deleted six months after they are closed.
4Data the app processes on your device
You decide what information to enter in OFAC. Depending on the features you use, this may include:
Duty and shift planning Shifts, shift patterns and rotations, duty times and assignments to calendar days.
Appointments and calendar entries Title, description, notes, location, date and time, categories and colours, and reminder times.
Working hours and time tracking Recorded working and break times, comparisons of planned and actual hours, overtime and corrections for individual days.
Pay-related information If you use these features: hourly rates, allowances and bonus rules, and the reports calculated from them.
Absences Details of leave, time off in lieu or sick days, if you enter them.
Settings and feature activation Selected country and region for optional public holiday calculation, display and design settings, language, reminder settings, completion status of setup steps and the locally stored activation status of app features.
Note on particularly sensitive information
Entries for sick days and free text such as “doctor’s appointment” may constitute health data within the meaning of Article 9 GDPR. This information is processed locally. If you create a backup, it may be included in the encrypted backup content; when exporting or printing, it may be output as plain text. Please keep this in mind when creating and sharing backups or export files (see Section 8).
ICS import and technical source data
After you confirm an ICS import, OFAC stores technical source information alongside the selected calendar entries in the encrypted local database. This includes an import operation identifier with a timestamp and result counters, as well as technical source identifiers and verification fingerprints for imported entries. This information is used solely to recognise unchanged repeat imports, local changes and imported entries previously deleted locally. Source information for an imported entry may remain after the entry is deleted locally and is removed only when the local app data is deleted. It is included in an OFAC database backup.
5Purposes and legal bases for using the app
Processing on your device serves solely to provide the app features you request: planning shifts and appointments, recording and analysing working hours, and reminding you of upcoming events.
Where processing falls within the scope of the GDPR at all, it is based on Article 6(1)(b) GDPR (performance of the agreement to provide the app). If you voluntarily enter information covered by Article 9 GDPR, such as sick days, this is based on Article 9(2)(a) GDPR through your own entry of that information.
If you use OFAC exclusively for personal purposes, the household exemption under Article 2(2)(c) GDPR will generally apply to you as a user. However, if you use the app professionally to plan data relating to other people, for example as a manager, you are responsible for that processing under data protection law.
6Storage, security and retention in the app
Your data is stored in a local database within your device’s protected, app-specific storage area. OFAC uses the following measures to protect this data:
- Encrypted database: The database is encrypted with AES-256 using SQLCipher.
- Key management: A key in the Android Keystore protects the database passphrase, which is stored separately in private app storage. Hardware-backed protection depends on the device. The provider receives neither the key nor the passphrase.
- App sandbox: Other apps cannot access this storage area.
- No unencrypted network traffic: The app is configured so that the system blocks unencrypted connections.
Your data remains stored until you delete it yourself. You can do this in three ways:
- delete individual entries in the app,
- fully reset the local dataset using “Delete local data” in the settings,
- uninstall the app or clear its data in Android settings under “Apps → OFAC → Storage”.
Recovery by the provider is neither possible nor provided for.
7Permissions and device access
OFAC requests only the permissions strictly necessary for each feature:
Notifications (POST_NOTIFICATIONS)
Required to remind you of shifts and appointments. Notifications are generated entirely locally on your device. They are not sent through push services. You can revoke this permission at any time in Android settings; reminders will then stop.
Exact alarms (USE_EXACT_ALARM, on Android 12 and 12L SCHEDULE_EXACT_ALARM)
Required so that reminders are triggered at the intended time without delay. This is particularly relevant to reminders for the start of a shift. No data is transmitted in the process.
Receiving the system boot event (RECEIVE_BOOT_COMPLETED)
When the device restarts, the system discards scheduled alarms. OFAC uses this permission solely to reschedule reminders you have already enabled. No data is collected, read or transmitted in the process.
File selection for import, backup, export and printing OFAC uses Android’s Storage Access Framework. For ICS import, only the file you select in the system picker is read. For backup, export and printing, access is limited to the file or folder you choose and to the operation concerned. General storage permission is not requested.
OFAC requests no access to your location, contacts, camera, microphone, phone status or system calendar.
Internet (INTERNET)
This technical permission is included in the manifest and is granted without a runtime dialogue. In particular, it enables Google Drive backup when you activate it. The prepared OFAC config adapter has no production caller; no holiday version adapter is included. Public holidays are calculated locally.
8ICS import, local backup, export and printing
ICS calendar import
OFAC reads an ICS file only after you explicitly select it using the Android system picker. The file is read locally within the implemented size and security limits, checked structurally and processed as a preview. External URLs, attachments or other content referenced in the ICS file are neither loaded nor executed. Unsupported information such as attendees, the organiser, attachments and certain free-text fields is not imported into OFAC.
Only after your final confirmation are selected calendar entries and the technical source data described in Section 4 written to the encrypted local database. If you leave an import before confirming it, the preview is discarded; the selected source file is not stored as a permanent copy in OFAC. Nothing is uploaded to OFAC.
Local backup, export and printing
A local OFAC backup is first created in private app storage. You can download an additional copy to a location of your choice. Both files are encrypted with your backup password. The password for a manual local backup is not stored permanently. Recovery is impossible without this password.
ICS, CSV and JSON exports and print output are not protected by OFAC backup encryption. They may contain personal information in plain text. If you choose another service as a storage or sharing destination, that service processes the files you provide under its own terms.
Files stored externally are not deleted when OFAC is reset or uninstalled. Delete copies you no longer need from their respective storage locations.
9Google Drive backup and Android system backup
Optional Google Drive backup. You connect your Google account yourself and grant permission through Google for the private app data area (drive.appdata). This does not give OFAC general access to your other Drive files. A manual backup is transferred at your request; automatic backups run only after you separately enable them and according to your schedule.
Before transfer, the backup is encrypted using AES-256-GCM and your password. Neither the provider nor the Drive transport receives the decryption key. Google processes the encrypted container and, in particular, account, connection and file metadata, including the file size and backup time. Content encryption does not conceal this metadata.
For Drive, OFAC can store the backup password on this device, encrypted under an Android Keystore key. It is not transmitted to Google or the provider. You can remove the stored password in OFAC, which disables automatic backups. Simply turning off the schedule is different from removing the password.
OFAC keeps one current Drive backup. Older backup objects are removed only after a new backup has been uploaded successfully. If you interrupt an operation, several objects may temporarily exist. Disconnecting the account, turning off automatic backups, removing the password or uninstalling the app does not automatically delete the existing Drive file. You can delete OFAC app data through the connected apps settings in Google Drive; you manage access permissions in your Google account.
Drive is provided by Google; for users in the European Economic Area, the controller named in Google’s privacy policy is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The backup feature you request serves to perform a contract under Article 6(1)(b) GDPR insofar as the provider processes personal data in doing so. Google’s processing is governed by its own privacy policy. Granting account access in Android is not equivalent to blanket consent for other processing purposes.
Android system backup. Automatic Android backup and system-level device transfer are disabled for persistent OFAC data. This does not prevent an OFAC Drive backup you have enabled. When changing devices, you restore an OFAC backup yourself using the corresponding password.
10Getting the app through Google Play
OFAC is distributed through the Google Play Store. When you download or update the app, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes personal data as an independent controller, in particular your Google account identifier, device and installation information, and download history.
The app provider has no control over this processing and does not receive personal data from it. The Google Play Console displays only aggregated, anonymised statistics on installations and crashes from which individuals cannot be identified.
No purchase or payment features are active in the app. No payment data is therefore collected or processed.
For details, please refer to Google’s privacy policy: policies.google.com/privacy
11Recipients and international processing
Your calendar, shift, time and pay content is not sent to OFAC servers. Optional Drive backup transfers the encrypted backup and technical metadata to Google. You choose any further recipients when exporting, printing or saving.
Google also processes data on servers distributed worldwide. Processing exclusively within the EU or EEA is therefore not guaranteed here. Google describes the transfer mechanisms it uses, including adequacy decisions and standard contractual clauses, in its data transfer frameworks. The scope and legal bases of Google’s processing are explained in Google’s privacy policy.
OFAC does not use data for advertising or profiling. Public holidays are calculated locally; no school holiday feature is included.
12Access to information on your device
Both on this website and in the app, storing information on your device and accessing it are limited to what is strictly necessary to provide the features you explicitly request. Consent is not required for this under Section 25(2), point 2 of the German Telecommunications and Digital Services Data Protection Act (TDDDG). At no time is information stored or read for analytics, audience measurement or advertising purposes.
13Your rights
Under the GDPR, you have the following rights: access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21).
For the app, this means in practice that the provider does not hold a copy of your local calendar and working time content. You control its editing and deletion in the app; you delete externally stored copies through the service you chose. Your statutory rights against the respective controller remain unaffected. You exercise these rights directly yourself:
- Access and inspection: entirely through the app on your device
- Rectification: by editing the relevant entries in the app
- Erasure: using the methods described in Section 6
- Data portability: through the app’s backup and export features
For website access data, email correspondence and any questions about data protection, you can contact the provider at info@theofac.com.
For data submitted through the web support system, however, the provider may process personal data. You can exercise your rights relating to a support request by quoting the reference number and contacting info@theofac.com . The local app database is separate from this and remains inaccessible to the provider.
14Right to lodge a complaint with a supervisory authority
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State where you live or work, or where the alleged infringement occurred.
The supervisory authority responsible for the provider is:
Saxon Commissioner for Data Protection and Transparency
Maternistraße 17
01067 Dresden
Postal address: PO Box 11 01 32, 01330 Dresden
Email: post@sdtb.sachsen.de
Website: www.datenschutz.sachsen.de
15Children and young people
OFAC is aimed at working adults and is not intended for use by children. No data is deliberately collected from children.
16Changes to this privacy policy
This privacy policy will be updated whenever changes to the website or app features are relevant to data protection, for example through the introduction of accounts, synchronisation, calendar sharing, purchase features or crash reports. The current version is available at https://theofac.com/en/privacy/, through the Google Play Store listing and in the app under “Privacy policy”. The date of the latest change appears at the beginning of this document.