As of: October 13, 2026

1. Controller

PC-Future GmbH
Senkenweg 11
86972 Schwabniederhofen, Germany
Email: apps@pc-future.de

2. Principle: Local data storage

All notebook content is stored exclusively on your device (Apple® SwiftData). No content is transmitted to the publisher's servers or to third parties — except for the cloud connections you actively use (section 4), the iCloud synchronisation for shared notebooks (section 5), the "Student notebook viewing" feature (section 6), and the insertion and playback of embedded external videos (section 9). Even in those cases, no data is transmitted to PC-Future GmbH servers unless you actively select the NiblyNotes server for "Student notebook viewing" — in which case only end-to-end encrypted data is stored. In all other respects, the app works fully offline.

The following data is stored locally on your device:

• Notebooks (title, cover colour, folder assignment, creation date)
• Notebook pages including handwriting, text boxes, images, shapes and PDF backgrounds
• Page backgrounds (lined, grid etc.) and margin settings
• Tool settings (last used stroke widths per tool)
• Folder structure for notebooks

3. Camera and photo library access

The app optionally requires access to the camera (to capture photos directly into notebook pages) and the photo library (to insert existing images). Captured or selected photos are only embedded in the current notebook and do not leave your device without your action.

4. Cloud connections (optional)

NiblyNotes offers the option to connect to educational cloud providers to import, export files or to create backups. A connection is only established when you actively log in to a provider. Supported are:

• BayernCloud Schule (ByCS) — a service of the Free State of Bavaria. Login is handled via the official ByCS sign-in procedure.
• Nextcloud — open-source cloud. Login via the official login flow v2 with app password.
• NetMan for Schools (H+H Software) — version 6 or later, REST interface with username/password authentication.

Credentials are stored exclusively in the iOS® Keychain of your device and do not leave your device. When sending, opening or backing up to a cloud, only the file you selected is transmitted to the server you configured. The app does not communicate with any third-party services.

5. Shared notebooks (iCloud® synchronisation)

The "shared notebooks" feature lets you share a notebook with other people who can view or edit it simultaneously. This uses Apple®'s iCloud® system exclusively (CloudKit):

• Synchronised notebook data is stored in your personal iCloud® and shared via Apple's infrastructure with the devices you invite.
• The publisher of the app has no access to shared notebook content.
• All participants need an Apple® account to share and join.
• When you end a share, a local copy of the notebook remains with every participant.
• Every participant decides via a "Publish" button when local changes are transmitted.
• A share can be granted as "Read only" or "Edit"; you can change the permission at any time.

6. Student notebook viewing (encrypted server)

The "Student notebook viewing" feature lets teachers view and comment on their students' notebook pages. Transmission goes through a server, but all data is end-to-end encrypted on the device beforehand — the server cannot read the content.

Who is responsible for the server?

NiblyNotes supports two operating models:

• School-owned server: The school runs a server on its own website (standard PHP web hosting is sufficient). In this case the school authority is the controller responsible for the server. The server code is provided by PC-Future free of charge.
• NiblyNotes server in Germany: Anyone who does not want to run their own server can use the server we (PC-Future GmbH) operate. It is hosted in a data centre in Germany (GDPR-compliant hosting).

In both cases only encrypted data is transmitted to the server — see the next section.

Which data is transmitted?

• Notebook pages (encrypted) — the last X pages of notebooks shared by the student (X is set by the teacher, typically 1–20)
• Teacher annotations (encrypted) — the layer drawn with the Apple Pencil®
• Class and teacher names, student name, notebook title (encrypted) — as accompanying data for display in the other app

The server only stores encrypted data blocks and non-meaningful identifiers (random UUID strings). No clear-text names, class names or notebook titles are stored on the server.

Encryption

• Algorithm: AES-256-GCM (Authenticated Encryption with Associated Data) — industry standard, approved for the transmission of sensitive data by both the US NIST and the German BSI
• Key management: A 256-bit key is generated per class on the teacher's iPad. The key travels via the QR code directly to the iPads of the students who scan it. It does not leave the iPad through any server connection — the server never knows the key.
• Authentication: Authorisation is proven via an HMAC-SHA-256 value derived from the key (TOFU procedure). The authentication token also does not allow the server to decrypt the content.

Storage duration

Data on the server is automatically deleted after 21 days of inactivity. As soon as a class or notebook share is ended in the app, the teacher can additionally remove the corresponding data from the server manually.

Responsibilities of the deploying school

For pedagogical use with minor students, the data-protection responsibility for obtaining the necessary consents — and for choosing a suitable server — lies with the deploying teacher or the school authority. In this constellation, PC-Future GmbH is either a processor (when our NiblyNotes server is used) or not involved at all (when a school-owned server is used).

On request, PC-Future GmbH provides a data processing agreement (DPA) for the operation of the NiblyNotes server.

7. Classroom via server (web relay)

Classroom via server (inbox, submission, screen view, compatibility mode). These features primarily run over the local Wi-Fi network. If devices are not on the same network, they can be handled via a server – either a school-owned server configured by the school via MDM, or the NiblyNotes server hosted in Germany (GDPR-compliant hosting). Inbox, submission and screen-view data are transmitted end-to-end encrypted (AES-256-GCM); the server only stores encrypted data blocks and random identifiers – no clear-text names, class names or file names. Data is automatically deleted after 6 hours of inactivity, so it remains on the server for only a few hours. Exception – compatibility mode: the content provided by the teacher (PDF/images) is made available for browser access without the app and is protected by an access code and password, but for technical reasons is not end-to-end encrypted. The teacher deliberately chooses which content to provide in this mode.

8. Screen view (ScreenView)

Screen view (ScreenView). For an active class, the teacher can enable screen view. While active, connected student devices periodically (when idle or during editing) transmit a small, encrypted image of the notebook page currently being edited to the teacher's device. The student's name is embedded in the image for identification. Scrolling alone does not trigger a transmission. Transmission is encrypted (AES-256-GCM), over the local network or – if enabled – via the classroom server (see section 7). The teacher's device keeps only the last 3 captures per student; they are deleted as soon as screen view is switched off or the class is ended/deleted. The purpose is pedagogical supervision during lessons. The school/teacher using the feature is responsible for lawful use (legal basis, prior transparent information to students/guardians, no covert use).

9. Embedding External Videos (YouTube, mebis media library, ByCS learning platform)

NiblyNotes lets users embed references to external videos in a notebook. Supported are the YouTube platform as well as the mebis media library and the ByCS learning platform of the Free State of Bavaria. The videos themselves are neither stored on PC-Future GmbH's servers nor transmitted to PC-Future GmbH.

When inserting a YouTube or learning-platform link, only a neutral placeholder is created on the notebook page. At this point, no connection is made to the respective provider. Inserting the link is privacy-neutral. Links from the mebis media library work slightly differently, as described in the section “mebis media library”.

When playing a video, your iPad establishes a direct connection to the video provider. In doing so, personal data — in particular your IP address — is transmitted to the provider. Data processing by the provider is governed by its own privacy policy. PC-Future GmbH has no influence over what data the provider collects or how it is processed.

For YouTube, NiblyNotes uses the most privacy-friendly embed mode the provider offers — the so-called "Privacy-Enhanced Mode" via the domain youtube-nocookie.com. In this mode, no tracking cookies are set before active playback. The connection is only established when the user taps "Play".

Before the first external video is inserted, the app displays a privacy notice that must be actively confirmed by the user.

mebis media library

For a link from the mebis media library, NiblyNotes already checks when inserting whether the video is freely available. To do so, the app queries the details of this medium via the public interface of the media library (repository.bycs.de): title, author, licence, access status and the address of the video file. Title, author and licence are suggested as the name of the video placeholder. In doing so, your IP address and the identifier of the medium are transmitted to the media library. No login data, no notebook content and no cookies are transmitted; the request is made without a cookie store and without caching.

When playing a freely available mebis video, the app queries these details again and then loads the video file directly from the address provided by the media library. This address may point to a server the media library uses to deliver its media (e.g. download.sodix.de). Playback uses the video player built into iPadOS. Your IP address and the usual technical connection data are transmitted to this server; NiblyNotes does not set any cookies.

If a mebis video is not freely available, it opens in the in-app browser when played (see next section).

ByCS learning platform and content that requires a login

Videos from the ByCS learning platform and mebis content that requires a login are opened by NiblyNotes in a browser window inside the app when played. This window is provided by iPadOS (Apple's Safari view). You log in directly with the respective service of the Free State of Bavaria. NiblyNotes has no access to your credentials, to the content shown in the browser or to the cookies stored there. The login session is managed by iPadOS on the device, separately from the Safari app.

Data processing by the mebis media library, the ByCS learning platform and the servers they use is governed by the privacy information of BayernCloud Schule: bycs.de

Transmission to external displays

If you have a projector or Apple TV® connected and stream the video to the external display via the full-screen button in the player, the data connection still runs only through your iPad. For mebis videos playing in the built-in iPadOS player: when transmitting via AirPlay®, iPadOS may have the Apple TV® fetch the video directly. In that case, the server delivering the video receives the IP address of the Apple TV®. Content in the in-app browser is shown on the external display as screen mirroring of the iPad.

Synchronisation in shared notebooks and sharing via the mailbox

When a notebook containing embedded videos is shared between multiple devices via the sync feature, or a video is passed on via the classroom mailbox, only the video metadata is transmitted (provider, video ID, original URL, placeholder name, placeholder position and size). The video itself is not transmitted — it resides with the provider.

Trademark notice

YouTube and Google are trademarks of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. PC-Future GmbH and NiblyNotes have no business relationship with Google LLC or any of its subsidiaries.

Google/YouTube privacy policy: policies.google.com/privacy

mebis and BayernCloud Schule (ByCS) are services of the Free State of Bavaria. PC-Future GmbH and NiblyNotes have no business relationship with these services; NiblyNotes only uses publicly accessible addresses and interfaces.

10. Own file formats

NiblyNotes uses two custom file formats for export and exchange:

• .nibly — complete notebook with all pages
• .niblypg — single page for targeted exchange

When sending these files via AirDrop®, email or cloud upload, only the content of the selected notebooks or pages is transmitted.

11. Backup

The app offers an optional backup function to automatically back up your notebooks to one of the cloud solutions mentioned in section 4. The backup function only runs against the cloud provider you set up — never against the publisher's servers.

12. Tracking, analytics, advertising

No analytics services, no advertising and no tracking SDKs are used. The app does not connect to any external push notification service and does not transmit usage data to the publisher.

13. Data transmission to publisher servers

There is no transmission of personal content, notebook data, usage data or telemetry to PC-Future GmbH servers. Exception: If you select the NiblyNotes server we operate in Germany for the "Student notebook viewing" feature (see section 6), the relevant data is stored there — but only end-to-end encrypted. We cannot view the content because the key never leaves the teacher's iPad over a server connection.

14. Your rights (Art. 15 ff. GDPR)

Since no personal data is transmitted to us, we cannot provide information about notebook content itself. For your cloud providers and Apple® services, the respective privacy policies of the providers apply.

For your rights vis-à-vis:

• Apple® (iCloud®, CloudKit, App Store®): apple.com/legal/privacy
• BayernCloud Schule: information at bycs.de
• Nextcloud: information from your respective Nextcloud operator
• NetMan for Schools: information from your school authority or H+H Software GmbH
• NiblyNotes server (PC-Future GmbH, optional for "Student notebook viewing"): requests at apps@pc-future.de. Since only encrypted data without any clear-text reference to a person is stored on our server, access and deletion can only be carried out via the app itself (end the class / share → data is deleted from the server).

15. Trademark notices

NiblyNotes® is a registered trademark of PC-Future GmbH.

All product names, logos and trademarks mentioned are the property of their respective owners. They are mentioned solely for the purpose of describing compatibility and do not represent support or official partnership with the respective providers. In particular:

• Apple, Apple Pencil, iPad, iPadOS, iCloud, AirDrop, AirPrint and App Store are trademarks of Apple Inc.
• Microsoft, Word, PowerPoint and Excel are trademarks of Microsoft Corporation.
• Nextcloud is a trademark of Nextcloud GmbH.
• NetMan for Schools is a trademark of H+H Software GmbH.
• BayernCloud Schule and mebis are services of the Free State of Bavaria.
• YouTube and Google are trademarks of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

NiblyNotes is not affiliated with, endorsed by or officially certified by these providers. Integration is carried out exclusively via the publicly documented interfaces.

16. Contact

For questions about data processing in NiblyNotes please contact us at apps@pc-future.de.