Never Too Late · Information under Art. 13 / 14 GDPR
This page is a translation provided for your convenience. The German original is the legally binding version. German original →
Last updated: October 2026 (applies from version 1.2)
This privacy policy explains which personal data is processed when you use "Never Too Late" (apps for iPhone and Android), for what purposes this is done, and what rights you have.
The controller responsible for data processing under the General Data Protection Regulation (GDPR) and other applicable data-protection laws is:
Coverset Studios Produktgesellschaft mbH
Alt-Marienfelde 26
12277 Berlin
Germany
Email: visitors@coverset.eu
Never Too Late is a calendar app for iPhone and Android. It shows the events from the calendars on your device, creates new ones on request and reminds you in good time to set off. Processing takes place locally on your device wherever possible; no account or sign-in is required.
For the "Smart Trips" feature (departure reminders that take the current traffic situation into account and are delivered even when the app is closed) we operate our own server. It receives only the data of the events for which you switch on a Smart Trip (section 3.7). Only if you additionally connect your Google Calendar to the app (add-on to the Pro subscription) does the server gain access to your upcoming Google events in order to set up Smart Trips for you automatically (section 3.2).
Requests the app sends to external services (Google, HERE, OpenWeather, RevenueCat — section 4) travel directly between your device and the respective provider; for Smart Trips our server additionally sends routing requests to HERE. The controller has no access to the content of the communication conducted directly from your device.
With your consent given via your operating system's permission dialog, the app reads the events from the calendars on your device (for example Google, iCloud, Outlook or local calendars) and, at your request, creates new events there or changes them. The data processed includes in particular the title, start and end, location and the calendar in which the event is stored. Reading and writing take place exclusively on your device; synchronization with your calendar provider is handled by your operating system under that provider's terms – we have no access to it. Our server receives event data only if you switch on a Smart Trip for an event (section 3.7); the location is sent to HERE to calculate the travel time (section 4.3). You can revoke the permission at any time in your device's settings.
The app keeps a copy of the events read for the next few days in its local app storage so that they can be displayed immediately on start-up and reminders can be scheduled without reading the calendar again. This copy is overwritten with every refresh.
On the Pro subscription you can additionally connect your Google Calendar to our server ("Connect Google Calendar"). The server then automatically sets up Smart Trips for all your upcoming events with a destination – even if you do not open the app for an extended period. Without this connection, Smart Trips continue to work for every event you switch on in the app.
You establish the connection via Google Sign-In; in doing so you grant Google permission to make your events available to our app for reading (scope calendar.readonly). Our server then processes:
With "Disconnect Google Calendar" in the app you end the connection: the server revokes its access with Google, deletes the Google account link, event mirror, device sessions and last position, and ends the Smart Trips it had set up from your Google Calendar. Your credit, your subscription and the Smart Trips for events you switched on yourself in the app remain in place. If Google permanently denies our server access (for example because you have revoked the permission in your Google account), the server disconnects on its own initiative in the same way.
With your consent given via your operating system's permission dialog, the app determines your current location (latitude and longitude, accuracy, time of the measurement) while the app is open. Your location is:
Your position is sent to our server only together with a Smart Trip, as its starting point (section 3.7). If you have connected your Google Calendar (section 3.2), the app additionally transmits your most recent known position – sparingly, at most once per minute and only after a change of position of at least 150 meters; the server only ever stores the latest position, and each new report overwrites the previous one. No movement profile is created under any circumstances.
When you type in a location while creating or editing an event, the app suggests matching addresses. To do so, it transmits the text you have typed and – where known – your approximate position (rounded to about 100 meters, to favor nearby matches) directly to HERE (section 4.3). The address you select is stored as the location in the event in your device calendar.
App preference data (buffer time, mode of transport, reminder scheme, calendar chosen for new events, display language, theme) is stored in your device's local app storage. This data never leaves your device and can be deleted by you at any time via your device's app or system settings.
The app schedules reminders for events and for departure as notifications and alarms of your operating system; content and timing are calculated locally on your device. For Smart Trips, our server additionally sends the departure reminder and – where necessary – brief notices (for example that your credit is running low or that your position is out of date) to your device via the push services of Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging). For this purpose the app transmits your device's push token (an identifier assigned by the push service) and the display language to our server.
Background sync: So that Smart Trips are also set up for events you enter without opening the app afterwards, our server sends an invisible push message up to six times a day to every device that has checked in within the last 30 days. The app then briefly reads your device calendar and sets up Smart Trips where appropriate (section 3.7). Whether and when the operating system wakes the app for this is decided by the operating system itself; you can prevent this in your device's settings (section 11). After each run the app sends our server a brief report without any event content – only numbers and reasons (for example the number of events read, the number of Smart Trips set up, the duration, whether the location was known) so that we can check the reliability of this feature. This report is processed only in the server's operations log, which our hosting provider deletes after seven days (section 3.7).
For Smart Trips, a server operated by us accompanies the event until departure: it calculates the travel time with the current traffic situation, re-checks it at regular intervals until departure and sends the departure reminder as a push notification – even when the app is closed. Unlike the purely local feature set (sections 3.1, 3.3, 3.5 and 3.6), the server processes data for this purpose even while the app is not open.
Scope by plan: On the Starter plan and with Flex credit, the server processes only the events for which you switch on a Smart Trip. On the Pro subscription the app automatically sets up Smart Trips for all your events with a destination (also during background sync, section 3.6); you can exclude individual events at any time. With a connected Google Calendar, the server additionally takes over the set-up itself (section 3.2).
Our server processes the following data:
Operations log: For troubleshooting, the server keeps a log of its operations. It contains no email addresses, event titles, addresses or coordinates, only internal numbers (for example "Wallet 12", "Trip 97") and technical details. The hosting provider retains it for seven days and then deletes it.
The sole purpose of the processing is to calculate and deliver departure reminders taking the current traffic situation into account, and to manage your credit and subscription. There is no use for advertising purposes, no profiling and no disclosure to third parties beyond the service providers named here.
Legal bases: Server-side processing is the core of the Smart Trips service; its legal basis is performance of the usage contract (Art. 6(1)(b) GDPR — activation of individual Smart Trips or the Pro subscription). Access to your device calendar, your location and – on the Pro subscription – your Google Calendar is based on your consent (Art. 6(1)(a) GDPR), which you give via your device's permission dialogs or Google Sign-In and can withdraw at any time with effect for the future (section 11). The pseudonymized device and account identifiers are based, insofar as they serve to restore credit and subscription, on the usage contract (Art. 6(1)(b) GDPR) and otherwise on our legitimate interest in protection against unauthorized multiple use (Art. 6(1)(f) GDPR). You can delete your data on our server at any time in the app ("Delete account", section 7).
Hosting: the server is operated on the platform of Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA — a US provider whose infrastructure for our application runs in the EU region of Amsterdam (Netherlands). The data is therefore stored within the EU; however, as the provider is a US company, access from a third country cannot be entirely ruled out. We have concluded a data processing agreement with Railway pursuant to Art. 28 GDPR, including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: railway.com/legal/privacy.
In the past you could sign up voluntarily on our website for a waiting list ("Early Bird"); the form is no longer available. For people already on the list we continue to process the details given at the time:
Purposes: notifying you when the app launches, sending the announced benefit code, possibly inviting you as a tester, and occasional information about the app around the launch. Your data is not shared with third parties for advertising purposes.
The form was provided via Google Forms; the responses are stored in Google Sheets (processing by Google, see section 4.7 on third-country transfers). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future and request deletion of your data – informally by email to visitors@coverset.eu.
On our website we invite you to take part, voluntarily, in a short survey about punctuality (coverset.eu/umfrage). The survey is designed to be anonymous: we do not ask for your name or contact details, and we store neither an IP address nor a time of day with your answers. What we store is:
The sole purpose is to develop Never Too Late in line with real needs; answers are evaluated in aggregated form. They are transmitted to our server at Railway Corporation (EU hosting region Amsterdam, see sections 3.7 and 5). Submitting the form produces technical server logs there (see section 5); we do not combine those with the answers. Please do not enter names, contact details or health information in the free-text field.
The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the box before you submit. Because we store the answers without a name, contact details or IP address, we usually cannot link them to you afterwards. If you would like your answer deleted, write to visitors@coverset.eu and tell us the date and, if applicable, the wording of your free text.
The app uses services from HERE (addresses, routes and traffic), OpenWeather (weather), RevenueCat (purchases and subscriptions) and – only with a connected Google Calendar – from Google (sign-in, calendar). When these are used, data is transferred to the respective provider.
The provider in the European Economic Area is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
calendar.readonly scopeThe provider is HERE Global B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands.
The provider is OpenWeather Ltd, 30 St Mary's Axe, London EC3A 8BF, United Kingdom.
Purchases in the app (Flex credit and the Pro subscription) are handled by Apple (App Store) or Google (Google Play); only they receive payment data, on their own responsibility and under their privacy notices. To manage purchases and subscriptions we use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, as a processor.
Push messages from our server (section 3.6) are delivered via the Apple Push Notification service (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA) or Firebase Cloud Messaging (Google Ireland Ltd. / Google LLC, section 4.1). In the process these services receive your device's push token and the content of the message; invisible messages for background sync contain no event content.
Data is transferred to Google and Apple in the USA on the basis of the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) and, where required, on the basis of Standard Contractual Clauses under Art. 46 GDPR.
As a Dutch provider, HERE processes data primarily within the EU; for any transfers to third countries, HERE states that processing is safeguarded by EU standard contractual clauses. For the United Kingdom (OpenWeather) an adequacy decision of the EU Commission under Art. 45 GDPR is in place; where OpenWeather transfers data to further third countries (according to its own information within its group of companies, including Latvia and the USA), this is done on the basis of appropriate safeguards.
RevenueCat processes the data in the USA (among others via Amazon Web Services). The transfer is based on the EU Standard Contractual Clauses (module two, controller to processor) pursuant to Art. 46 GDPR, which form part of the data processing addendum with RevenueCat.
More information on data processing by Google can be found here: policies.google.com/privacy, and by Apple here: apple.com/legal/privacy.
Our website (coverset.eu) is delivered via the platform Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the page is called up, technical data is inevitably processed in the host's server logs, in particular:
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the technical provision and security of the website. More information: vercel.com/legal/privacy-policy.
For the Smart Trips feature we additionally operate an application server with Railway Corporation (USA, EU hosting region Amsterdam); details including the third-country notice can be found in section 3.7. Technical server logs (IP address, timestamp, user agent, requested resource) are also generated here; the legal basis in this respect is Art. 6(1)(f) GDPR (technical provision and security).
Audience measurement (Vercel Web Analytics): On our website (landing page and information pages) we use Vercel Web Analytics, a privacy-friendly visitor statistics service provided by the hosting provider named above. No cookies are set and no cross-site user profiles are created; visits are evaluated in aggregated form only (e.g. page views, referrer, country, browser type). We do not use any audience measurement in the app itself. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the statistical evaluation and improvement of our website).
You may withdraw any consent you have given at any time, with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.
The app does not set its own cookies and performs no tracking, no analytics and no profiling. During Google Sign-In (Pro subscription), Google may set its own cookies as part of authentication – the controller has no direct influence over this.
Transmission between your device, our server and the external services named above is encrypted throughout via HTTPS (TLS). Credentials and identifiers are stored server-side only in protected form: session secrets as well as device and account identifiers exclusively as cryptographic hashes with a secret salt; the Google refresh token never leaves the server. The server's operations log contains no email addresses, event titles, addresses or coordinates.
To the extent personal data is processed, you have the following rights:
To exercise your rights, please contact us using the details given in Section 1. An overview of the competent data-protection supervisory authorities in Germany is available at bfdi.bund.de.
This privacy policy may be updated whenever legal requirements, the app's functionality, or the services used change. The current version is always available on this page.