Banora Pin

Banora Pin Privacy Policy

Version 1 · Effective 13 September 2026

This Privacy Policy explains what personal data we process when you use Banora Pin, why we process it, and what rights you have under the GDPR.

1. Who is responsible for your data?

Ala Eddine Bannour
Schulstraße 20
13347 Berlin
Germany

Email: hi@banora.dev

2. What data do we process?

Good news: your notes remain private.

Your notes are stored on your device and, if you use iCloud Backup, in your own iCloud account. We do not access or process the content of your notes.

You can use the app without creating an account. If you choose to create an account or purchase a subscription, we process the information needed to provide and manage those features. Without this information, we cannot create your account or manage your subscription.

We may process your account identifier, email address (if you create an account), subscription and purchase information, records of your acceptance of our Terms of Use, and technical data such as your IP address, device information, a device identifier, authentication information, service logs, and timestamps of requests, logins and connections.

Why we process this data: We use this information to provide the app and its features, manage subscriptions and purchases, comply with legal obligations, notify you about updated terms, and keep the service secure and reliable.

Legitimate interests: We process technical data, including IP addresses, device information, authentication information, service logs, and timestamps of requests, logins and connections, where necessary to protect the service, prevent misuse, troubleshoot problems, and resolve disputes or protect our legal rights.

Legal bases: Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligations), and Article 6(1)(f) GDPR (legitimate interests, including maintaining records necessary to protect our legal rights).

3. Who receives your data?

We use service providers for hosting, authentication and subscription management. In particular, we currently use:

  • Supabase for database hosting, authentication and backend infrastructure; our database is hosted in Frankfurt, Germany.
  • RevenueCat for subscription management.

These providers receive only the data needed to provide their services.

In addition, Apple independently provides the App Store, subscription purchases, Sign in with Apple and iCloud Backup. Apple processes personal data according to its own privacy policy and terms. For more information, see Apple's Privacy Policy at https://www.apple.com/legal/privacy/.

4. Do we transfer data outside the EU?

Some of our service providers may process data outside the European Union or European Economic Area.

In particular, Supabase and RevenueCat may process account information, email addresses, subscription information, purchase information, IP addresses, authentication information, service logs and other technical data outside the EU/EEA.

Where personal data is transferred outside the EU/EEA, we use appropriate safeguards required by the GDPR, including the European Commission's Standard Contractual Clauses.

You can request further information about these safeguards by contacting us at hi@banora.dev.

5. How long do we keep your data?

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy or to comply with legal obligations.

  • Account data is deleted when you delete your account.
  • Purchase records are retained for 8 years following the end of the relevant fiscal year, unless a longer retention period is required by law in a particular case. They remain stored even if you delete your account, because this legal retention duty takes precedence over the right to erasure for these records (Article 17(3)(b) GDPR).
  • Records of your acceptance of the Terms may be retained for the applicable legal limitation period.
  • Technical logs are automatically deleted after the retention period set by our hosting environment.

6. Your rights

Under the GDPR, you have the right to:

  • access your personal data;
  • correct inaccurate data;
  • request deletion of your data;
  • restrict processing;
  • receive a portable copy of your data; and
  • object to processing based on legitimate interests.

To exercise your rights, contact us at hi@banora.dev.

7. Complaints

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a data protection authority, particularly in the EU country where you live, work, or where the issue occurred.

For Berlin, the competent supervisory authority is:

Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI)
Alt-Moabit 59-61
10555 Berlin
Germany