Hinatadocs
EN
Hinata/Legal
Edit this page

Privacy Policy

Last updated: 15 July 2026

In accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), this policy informs you about the data processing connected with the use of the Hinata application ("App"). The German version of this policy is authoritative.

Important note on scope: This Privacy Policy applies solely to the App itself and to the way the App communicates with a server you choose. Hinata is a client application for self-hosted server instances. The publisher of the App does not operate any server instance and has no access to the servers you connect the App to. The respective operator of each server instance is solely responsible for all server-side data processing (see Section 2).

1. Controller for the App

The controller within the meaning of Art. 4(7) GDPR for the provision of the App (distribution via the app stores or as a web application) and for the processing described in this policy is:

Rebar Ahmad Weberstr. 58 47798 Krefeld Germany E-mail: mail@ahmadre.com

No data protection officer is legally required or appointed.

2. Roles: App publisher and instance operators

Hinata is a project and issue management application that organizations self-host on their own infrastructure. The App connects exclusively to the server instance whose address you or your organization enter.

  • The App publisher (Section 1) only provides the application software. He does not operate any server instance, does not store any account or content data, and has no access to the data you transmit to a server instance through the App.
  • The operator of the respective server instance (e.g. your organization) is the sole controller within the meaning of the GDPR for all server-side data processing. This covers in particular accounts, content (projects, issues, comments, attachments, time tracking, knowledge base), server logs, e-mail delivery (the operator configures its own e-mail or SMTP provider) and the storage and hosting infrastructure used.

For access, erasure and all other data subject rights concerning data stored on an instance, please contact the operator of your instance. Its privacy notice applies.

3. Processing by the App on your device

The App itself processes data exclusively locally on your device, to the extent technically necessary for its operation:

  • the server addresses you enter,
  • sign-in tokens (access and refresh tokens) for the selected instances,
  • application settings (e.g. language, theme, notification preferences).

This data stays on your device and is not transmitted to the App publisher. The App uses no cookies or comparable technologies for analytics or advertising. It embeds no tracking services and sends no telemetry to the App publisher. The legal basis for this local storage is Art. 6(1)(b) GDPR and, where applicable, Section 25(2) of the German TDDDG (technical necessity).

4. Communication with the server instance you choose

All data you enter in the App (e.g. credentials, content, comments, files, voice messages) is transmitted by the App directly and transport-encrypted (TLS/HTTPS) to the server instance you selected. The App publisher is not involved in this transmission and cannot access it. The controller for the processing of this data is exclusively the operator of the instance (Section 2).

5. Push notifications (Hinata Connect and Firebase Cloud Messaging)

If you enable push notifications, they are delivered via a central relay component ("Hinata Connect") operated by the App publisher, and via Firebase Cloud Messaging (FCM), a service of Google Ireland Limited / Google LLC. In doing so, the App publisher processes:

  • a push identifier for your device or installation (FCM token),
  • the content of the respective notification. This happens only transiently for the purpose of delivery. The App publisher does not store notification content permanently.

The legal basis is Art. 6(1)(a) GDPR (your consent, given by enabling push notifications). Push notifications are optional. You can disable them at any time in your device's system settings or in the App's notification settings. Without push notifications, the App publisher processes no data at all.

6. International data transfers

When Firebase Cloud Messaging is used (Section 5), data may be processed by Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. In addition, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) serve as appropriate safeguards. Beyond this, the App publisher performs no third-country transfers. Whether and where the operator of your server instance transfers data is stated in its privacy notice.

7. Retention

The App publisher stores personal data only to the extent and for as long as required for push delivery (Section 5). Push identifiers are deleted when they become invalid or when you disable push notifications.

You can delete the local data on your device (Section 3) yourself at any time by clearing the App's data or uninstalling the App. The respective instance operator is responsible for the retention of server-side data.

8. Your rights as a data subject

Under the GDPR you have, in particular, these rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on Art. 6(1)(f) GDPR (Art. 21), and withdrawal of consent with effect for the future (Art. 7(3)).

  • For the processing described in this policy (App, push delivery), please send your requests to the contact address in Section 1.
  • For account and content data on a server instance, the respective operator is the correct addressee. Depending on the instance, the App offers self-service features for this directly in the App (e.g. data access and export under Art. 15 GDPR and account deletion under Art. 17 GDPR). The respective instance processes these requests.

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

9. No automated decision-making

The App publisher does not carry out solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Minors

The App is not directed at children under the age of 16. Persons under 16 should only use the App with the consent of their legal guardians.

11. Data security

The App transmits data exclusively transport-encrypted (TLS/HTTPS) and stores sign-in tokens in the protected storage areas of the respective operating system. The respective instance operator is responsible for the security of server-side processing.

12. Changes to this Privacy Policy

We update this Privacy Policy where changes to the App or the legal framework require it. The version available at the time of your use applies. The date at the top of this policy shows the current version.

The operator of your server instance may supplement or replace this policy with its own privacy notice for its instance. For server-side processing, the operator's notice always prevails.

13. Contact

For questions about data protection relating to the App, contact us at mail@ahmadre.com.