Privacy Notice - Takt App

Updated: 14 May 2026

This privacy notice explains how we process data in connection with Takt (taktapp.ch). Takt is a private note-taking app with local-first storage and device-encrypted sync for note content when that mode is enabled. This notice is provided for transparency under the Swiss Federal Act on Data Protection (FDPA) and, where applicable, the GDPR. It is not part of any contract with you.

Controller

The controller responsible for the processing described here is:

David Vasella

Talk to us at: hello@taktapp.ch

If you provide us with data about other individuals (for example by forwarding emails to add@taktapp.ch, which includes the sender's address), we assume the data is accurate and that you are entitled to share it. Please inform those individuals about our processing, for example by linking them to this notice.

The data we process

We process the following categories of personal data:

• Account data: Username, email address
• Communication: Email or other correspondence with us
• Password: Stored only as a hash (we do not know your password)
• Technical data: IP address, access times (server logs)
• Auth tokens: For authenticating your session, stored as hashes on the server
• Security data: Passkey credentials, two-factor authentication status, encrypted TOTP secrets, and hashed recovery codes if you enable these features
• Device data: Device identifiers, device type, and push notification tokens when needed for sync or iPhone notifications
• Note metadata: Timestamps, task/done status, deadlines, reminders, trashed flags, review metadata, and coarse device/mutation information. These are stored unencrypted for sync, query, conflict handling, and notification functionality. They do not include tag names or note/task content.
• API metadata: If you enable API access, the key name, last-used time, and request logs (including IP)

With device encryption enabled, your passphrase is processed with PBKDF2-HMAC-SHA256 using 600,000 iterations and a random salt to derive a wrapping key. That wrapping key encrypts your device-generated AES-256 master key; note content is encrypted locally with AES-256-GCM before sync. Your passphrase is not sent to the server and cannot be reset by Takt.

Some optional features (API-created notes, email-to-note) require server-readable content. These notes are re-encrypted by a device on sync.

If you enable the email capture feature, email contents are processed server-side as notes. Allowed sender email addresses are stored.

Why we process data

We process personal data for the following purposes:

• Providing Takt
• User authentication and account management
• Syncing device-encrypted notes across devices
• Sending transactional emails (account verification, password reset)
• Security and abuse prevention
• Compliance with legal requirements

At this stage we do not operate a newsletter and do not send advertising. If we introduce marketing communications, we will ask for consent where required.

GDPR

Takt is primarily aimed at users in Switzerland. To the extent the GDPR applies, we rely on the following legal bases:

• Art. 6(1)(b) GDPR: processing necessary for the performance of a contract (e.g., providing the service, syncing notes)
• Art. 6(1)(f) GDPR: processing necessary to protect legitimate interests, including security and compliance with Swiss law
• Art. 6(1)(c) GDPR: processing necessary for compliance with a legal obligation under EEA law
• Art. 6(1)(a) GDPR: processing based on your consent, where we ask for it

You are not obliged to provide us with data. Without account data, we cannot give you an account or sync your notes (surprise!).

Do we share personal data?

We may share personal data with the following recipients:

• Hostpoint AG (Switzerland): Hosting and databases
• Apple Inc. (United States): Push notification infrastructure for iPhone notifications and silent sync wakeups, where enabled
• Authorities and courts: If legally required. Device-encrypted note content is not readable by us. Server-readable content from optional features (API-created notes, email-to-note) may be accessible in case of a lawful request

Apple is based in the United States, which does not have data protection law considered equivalent to Switzerland's. The transfer is covered by the EU Standard Contractual Clauses, adapted for Switzerland, and where applicable by the Swiss-U.S. Data Privacy Framework. In specific cases we may rely on legal exceptions, in particular your consent, the necessity for contract performance, the establishment or defence of legal claims, or overriding public interests.

Cookies and local storage

We use no tracking cookies and employ no analytics tools (such as Google Analytics). Takt only stores the following data locally on your device:

• Auth tokens (in localStorage, for authentication)
• Username/email (in localStorage)
• Encryption keys (in memory and, if you choose to stay unlocked, as non-extractable CryptoKey records in IndexedDB until the selected timeout expires)
• UI settings such as language and theme (in localStorage)

This data stays on your device and is not transmitted to third parties. You can delete it at any time via your browser settings.

Security

We apply technical and organisational measures appropriate to the risk, in particular the cryptographic design described above, hashed credentials, transport encryption, and access controls on the server side. Absolute security cannot be guaranteed.

Retention

We store your account data as long as your account exists. Server logs are retained for up to 90 days at our hosting provider. Auth tokens expire after 90 days. Encrypted note version snapshots are retained for 30 days. After these periods we delete or anonymise the relevant data, unless a longer retention is required by law.

Your rights

Under applicable data protection law, you have the following rights. Some apply in their broader form only where the GDPR is applicable; the FDPA provides similar but in part narrower rights.

• Access: Request information about the personal data we process
• Rectification: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of personal data we are not required to retain. You can have your account deleted at any time by contacting us
• Objection: Ask us to stop specific processing where no legal or contractual basis requires us to continue. Under the GDPR, you may object on grounds relating to your particular situation, in particular to processing based on legitimate interests
• Portability: You can download your notes at any time via the export function in settings
• Withdrawal: You can withdraw any consent given at any time with effect for the future. The withdrawal does not affect processing carried out before

We may need to verify your identity before acting on these requests.

You can file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with any other competent supervisory authority. We would appreciate hearing from you first at hello@taktapp.ch.

Updates

We may update this notice from time to time. The current version is always available at taktapp.ch/privacy.