Limen records apartment handovers on Android and iPhone. It is published by Alexis Peringer. This notice covers both platforms and identifies the version-specific differences.
Android 1.2 and iPhone 1.2.2 can also store supporting documents, individual participant positions and follow-up notes. They retain exact exported PDFs and their HTML copies in private storage. Recovery copies can retain removed evidence until the complete record is deleted. Exports and copies shared with other apps must be deleted separately, in Downloads on Android and in the Limen folder of the Files app on iPhone. A backup can cover one record or the library and contains the referenced evidence and retained exports. Creating an unencrypted archive requires an explicit choice.
Peringer does not collect, receive, sell or share the personal data entered into Limen. There is no Limen account, developer-operated server, advertising, analytics, telemetry or crash-reporting service. Protocols, photos and drawn signatures stay in the app’s private storage unless the user exports, shares or backs them up.
The person or organisation using a Limen installation decides why and how protocol data is recorded and is the data controller for that data. A professional operator remains responsible for giving participants its identity, contact details and any additional notice its processing requires.
A handover record can contain names, roles, addresses and contact details; property, lease, deposit, meter and key information; room observations, defects, comments and reservations; photos; and drawn signatures. These details are provided by the user for the protocol and are not sent to Peringer.
Drafts, photos and signatures are stored in Limen’s private app storage. On Android that is the app’s private directory, which the system removes when the user clears Limen’s app data or uninstalls it. On iPhone it is the app’s container, which iOS removes when the user deletes the app. Records otherwise remain until the user deletes them.
When requested, Limen writes a protocol PDF to the device and can pass it to the system share sheet. On Android the file goes to Downloads, in a Limen folder. On iPhone it goes to a Limen folder in the app’s Documents, which the Files app shows under On My iPhone. Files in either place, and copies sent to other apps, are outside Limen’s private storage and remain under the user’s control.
Limen can create a backup containing records, original photos and signature ink, and saves it in the same location as exported PDFs, Downloads on Android or the Limen folder in Documents on iPhone. A password on that backup is optional. With one, the archive is encrypted and Limen cannot recover the password. Without one, anyone who has the file can read everything in it, which the app says on screen when it saves. A backup in either place is outside Limen’s private storage and under the user’s control. Restoring a backup reads only the file the user selects.
While it builds a password-protected archive, the iPhone version writes the unencrypted intermediate copy into its own cache rather than beside the finished file, removes it when the export ends, and sweeps it again on the next export in case the app was killed part way.
Limen keeps its private app data out of the platform’s own backups. On Android it disables cloud backup and device-to-device transfer. On iPhone it marks the private records, photos, signatures, recovery copies and retained exports as excluded, so neither an iCloud backup nor a backup to a computer copies them.
Two kinds of iPhone data still go into those backups, because iOS backs them up for every app. The first is the Limen folder in Files, with the exported PDFs, their HTML copies and any backup archive saved there, so an archive saved without a password can also be read from a backup. The second is the app’s settings. They hold the name, role and agency name entered at the start of a session, the contact details offered again on the next new-session form, the controller details entered under Data, backup and privacy, the last valid value of each date and time field, the language, the theme and the identifier of the record left open. Deleting the app removes both from the phone. An existing iCloud or computer backup keeps them until that backup is replaced or deleted.
Typing at least three characters in a Swiss address field sends the search text and ordinary network metadata to the federal swisstopo SearchServer at https://api3.geo.admin.ch/rest/services/ech/SearchServer. Manual entry works offline, and the field stays free to type when nothing matches. Swisstopo operates under its own terms and privacy information. No records, photographs or signatures are sent to Peringer. On iPhone, an ephemeral network session avoids a shared disk cache for the query and reply.
The app also contains links to independent rental-deposit providers. Opening one hands the URL to the user’s browser; the browser and destination site then operate under their own terms. Limen does not receive information about the visit.
On Android, Limen declares no camera or storage permission. Photos are captured by the system camera through a temporary grant for one destination file, or selected through the system picker.
On iPhone, the camera is the one permission a handover needs, because iOS has no way to hand the capture to a separate camera app the way Android does. The photo library is reached through the system picker, which needs no permission. A supporting document is chosen in the system’s Files picker, and Limen copies only that file into its private storage. In both versions, only the system components involved and the item the user chooses take part.
Both versions can lock the saved records and the settings behind the phone’s own lock, an option the user turns on in Limen’s settings. The record already open stays reachable, so a handover in progress can continue. On Android the check is the phone’s screen lock. On iPhone the check is Face ID, Touch ID or the passcode, run by iOS. Limen learns only whether the check succeeded and never receives face, fingerprint or passcode data. The lock does not encrypt records or exported files.
The signed Android release declares the INTERNET permission. It also contains dev.peringer.limen.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, a private permission generated by an Android support library so the app’s own components can communicate; it grants no access to device data and cannot be used by other apps.
iOS has no equivalent of an internet permission. The iPhone release declares two usage descriptions, the texts the system shows when it asks for consent. The camera one appears the first time the camera opens. The Face ID one appears only when the user turns on the library lock.
Open-source libraries used by the Android build run inside the app. The iPhone build carries no third-party code. It includes a reduced copy of libphonenumber’s published metadata and cantonal flags as data files. Neither build adds advertising, analytics or developer-operated collection services.
Limen is a professional documentation tool and is not directed at children. Peringer collects no personal data from users, including children.
If this policy changes, the last-updated date above changes with it. Material changes to data use must also be reflected in the app and its store disclosures.
For questions about this policy, contact aperinger@proton.me