Emerolo privacy policy

Last updated: 23 October 2026

1. Who we are

The Emerolo app (the "App") and the website emerolo.com are provided by Stella Irodotou, P.O. Box [pending], Cyprus ("we").

For any question about this policy or your data: privacy@emerolo.com.

2. The basic principle

The App works without a user account and without a server of ours. Everything you enter is stored only on your device and, only if you turn it on, in an encrypted backup in your own Google Drive.

We do not receive, see or store the data you enter in the App. We do not sell it and do not share it with anyone.

3. Data that stays on your device

Stored on your device: events, tasks, notes, lists, settings and appearance choices; in the business mode also appointments, client details, services, cash book and purchases.

This data is stored in an encrypted database. Its key is kept in the device's secure keystore (Android Keystore or iOS Keychain). The App PIN is not stored; only a non-reversible form of it (a hash) is kept to check it.

The App excludes its data from the operating system's automatic backups, so that backups exist only as described in section 4.

Because we have no access to this data, we do not process it. You manage it: you can change or delete it at any time, and delete all of it from the device with "Delete everything". If you uninstall the App, it is deleted from the device.

4. Backups in your Google Drive (optional)

If you turn this on, the App connects to your Google account through Google's sign-in and asks only for the "drive.appdata" permission. With it, the App can access only a hidden folder that belongs to it inside your Google Drive; it cannot see, read or change any other file of yours.

Before it leaves the device, the backup is encrypted on the device with a key derived from the backup password you choose (or from your recovery code). Neither we nor Google can read its content. Google, as the provider of Google Drive, only sees that an encrypted file exists, its size and when it changes.

The email address of your Google account is stored only on your device, to show you where the backup is. Signing in with Google and Google Drive are governed by Google's terms and privacy policy (policies.google.com/privacy).

The App's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to create and restore your backup, is not transferred to us or to third parties, is not used for advertising and is not read by any human.

You can stop backups and delete the backup from your Drive inside the App (Settings › Device › Backups and computer). You can also remove the App's access from your Google account (myaccount.google.com/permissions).

5. Notifications

Reminders are created and scheduled by your device itself. The App does not use an internet (push) notification service and sends nothing to a server for them.

6. Messages, calls and links

When you tap to send a message (Viber, WhatsApp, SMS), to call or to open a link, the App opens the matching app on your device with a ready text. You send the message yourself, from your own app, and that app's terms and privacy policy apply. We do not receive the message or the recipient.

7. Subscriptions and payments

Subscriptions are bought and paid for only through Google Play or the App Store. Your payment details are processed by Google or Apple under their own policies; we do not receive them. The App checks on your device, through the store, whether your subscription is active.

As the seller, we may receive sales reports from Google or Apple (for example order number, product, price, country). We use them only for our accounting and tax obligations (Article 6(1)(c) GDPR) and keep them for as long as tax law requires.

8. What we do not do

The App contains no advertising, no analytics, no tracking and no automatic crash reports, and does not use an advertising ID. It does not use artificial intelligence that sends data off the device. It does not ask for, and has no fields for, health data.

9. When you contact us

If you email us at privacy@emerolo.com, we receive only what you send: your email address and the content of the message. For this data we are the controller.

The only purpose is to answer your request. The legal basis is our legitimate interest in answering those who write to us (Article 6(1)(f) GDPR) and, for requests to exercise your rights, our legal obligation (Article 6(1)(c)). We delete the message 30 days after our reply.

Please do not send us client details, events, backups or App files; we do not need them. If they are sent, we delete them immediately.

Email is forwarded through Namecheap's forwarding service and stored in Google's Gmail, which act as service providers (processors). These providers may process data outside the European Economic Area (e.g. in the USA), with the safeguards of Chapter V GDPR (an adequacy decision or standard contractual clauses).

10. The website emerolo.com

The website uses no cookies, analytics or tracking. It is hosted on GitHub Pages (GitHub, Inc.), which, like any server, receives visitors' IP addresses to show the page and for security, under its own privacy statement. We do not receive this data.

11. For professionals: your clients' details

If you use the business mode, you are the controller of the client details you enter. You are responsible for informing your clients, having a legal basis, entering only what is necessary and deleting what you no longer need or are asked to delete.

We are not a processor on your behalf, because we never have access to this data: it stays on your device and in your own Google Drive. The App helps you with deleting a client, exporting one client's details and a reminder for clients with no visit for more than 2 years. Do not enter health data.

12. Your rights

Under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) you have the right of access, rectification, erasure, restriction, objection and portability. For the data on your device and in your Drive you exercise them directly in the App. For the data we hold (sections 7 and 9) write to privacy@emerolo.com; we answer within one month.

You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live: in Cyprus, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy); in Greece, the Hellenic Data Protection Authority (www.dpa.gr).

13. Age

The App is meant for adults (18 and over) and is not intended for children.

14. Changes

If this policy changes, it will be published here with a new "Last updated" date. If the App starts to use data in a new way, we will inform you before that.