Privacy Policy

Modul is a personal organiser for iPhone, with iPad layouts. It combines To-Do, Habits, Calendar, Projects, Notes and Finance in one app, and adds widgets, Live Activities, Control Center controls, Siri and Shortcuts actions and Home Screen quick actions. It is made by an independent developer in Ukraine.

None. Specifically:

• Modul has no account. It never asks for an email, password, phone number or an Apple or Google login.
• I run no servers for Modul: there is no backend, no database of users and no API of mine.
• There is no analytics, advertising, tracking, crash-reporting SDK or other third-party SDK in the app. The app’s privacy manifest declares that it does not track you, lists no tracking domains and lists no collected data types.

Because I never receive the content you keep in Modul, I do not access it and I do not act as a controller of it. If you have questions about this, write to me.

On your device. Modul keeps your content in a database on your iPhone or iPad.

In your own iCloud. If you use iCloud, Modul stores your data in your private iCloud database (CloudKit container iCloud.com.mykhalik.Modul) so your devices stay in sync. That database belongs to your Apple Account. As the developer, I cannot read it. Apple operates iCloud under Apple’s own terms and privacy policy. Modul has no on/off switch for sync. You control iCloud for apps in iOS Settings, and when iCloud is unavailable Modul keeps working on the device alone. [TODO: confirm the iOS Settings path and the behaviour with iCloud off, on a real iPhone]

Settings. A few small settings (not your content) also travel through iCloud’s key-value store, so a second device looks the same.

Widgets and Live Activities. They read a small snapshot of tasks, calendar items and finance totals that the app writes to an App Group container. That container is shared only between Modul and its own widget extension, on the same device.

Notifications. Reminders and budget alerts are local notifications scheduled on your device. I have no push server. The app declares the remote-notification background mode only so iCloud can wake it to sync.

These requests go directly from your phone to the service. I do not proxy, log or see them.

Optional keychain sync. In Profile → Security you can switch on “Sync bank keys via iCloud”. Then only the monobank token and exchange keys are stored as iCloud Keychain items, which Apple encrypts end to end, so that your iPad does not need them typed again. It is off by default. The app-lock code never syncs.

Modul is not affiliated with or endorsed by monobank, Binance, WhiteBIT, Kraken, OKX, Apple or Google. Their names are trademarks of their owners.

You can share a budget with a partner by invitation, using CloudKit sharing. The other person receives only sums: the plan (limit, currency, start day and category limits) and, for each person and each budget month, the total spent and the totals per category. They never receive individual transactions, merchants, accounts or balances.

The other person takes part through their own Apple Account, by invitation. The owner can stop sharing.

• Backup. Profile → Backup exports a JSON file through the iOS share sheet, and you choose where to save it. Modul does not upload it anywhere. You are responsible for where you keep that file. Import reads a JSON file that you select.
• Deleting items. Deleting an item deletes it on every synced device. An in-app undo exists for deletions; it is not a way of keeping data.
• Disconnecting. Disconnecting a bank or exchange removes its token or keys from the Keychain.
• Deleting the app. Removes the on-device database and the Keychain items stored on that device.
• Deleting the iCloud copy. Go to iOS Settings → your name → iCloud → Manage Account Storage → Modul → Delete Data. [TODO: confirm on a real iPhone that Modul appears under Manage Account Storage]

Modul 1.0 has no “erase everything” button. Modul has no accounts, so there is no account to delete.

• Bank tokens and exchange keys are kept in the iOS Keychain, not in app preferences.
• Optional app lock and Face ID.
• Receipts are read on your device.
• All network requests use HTTPS (TLS).

No system is perfectly secure. I can tell you what is done; I cannot promise that nothing will ever go wrong. If you use iCloud, how your iCloud data is protected also depends on your iCloud settings, as described by Apple.

Modul is not directed at children under 13 (16 in some countries). I do not knowingly collect data from children; in fact, I collect none from anyone.

Modul sends me nothing automatically. If you write to me, I receive the email address and the message you chose to send. Profile → Write to Us opens an email with the subject prefilled with your app and iOS version, for example “Modul 1.0 · iOS 26.6”. If no mail app accepts it, the address is copied instead.

I use your message only to answer you and keep it only as long as needed to help you. I do not sell it or share it.

Apple gives me aggregated analytics in App Store Connect (installs, sessions, retention and crash counts), only for users who agreed in iOS Settings to share them with developers. I cannot identify anyone from them. If I use TestFlight, its feedback also comes through Apple.

EU, EEA and UK (GDPR). The only personal data I process for Modul is what you send me when you write to me (legitimate interest in answering you, or your consent). You have the right to access, correct, erase, restrict and port that data, to object to its use, and to complain to your supervisory authority. I make no automated decisions about you. Data stays on your device and in your own iCloud, so I do not receive or access it. Data that Apple processes for iCloud is processed under Apple’s infrastructure and terms.

My support email is hosted by Apple (iCloud+), the website by Cloudflare, and the project brief form is handled by Formspree. These providers operate internationally, so what you send me may be processed outside your country, including outside the EEA and the UK, under their own terms and safeguards. If you want to know more, write to me.

Ukraine. The Law of Ukraine “On Personal Data Protection” applies. If you think your rights were violated, you can contact the Ukrainian Parliament Commissioner for Human Rights.

California and other US states (CCPA/CPRA). I do not sell or share personal information, and I do not use it for targeted advertising.

To use any of these rights, write to [email protected].

This part covers mkhlkbhdn.com only. The statements in Part 1 about Modul collecting nothing do not apply here, because a website works differently from the app.

• The website itself sets no cookies and has no analytics. The typeface is bundled with the site, so opening a page does not make a request to Google.
• Cloudflare hosts the site and processes standard request data (such as your IP address, the time and the page requested) under Cloudflare’s own privacy policy.
• The ExpressionsLib product page (/shop/expressionslib) embeds two YouTube videos, using YouTube’s privacy-enhanced domain (youtube-nocookie.com). They load when that page opens, so your browser contacts YouTube, which receives your IP address and browser details and handles them under Google’s privacy policy. No other page on this website loads anything from YouTube.
• Links to Instagram, Telegram, Gumroad and other sites lead to those sites, and their policies apply once you open them.

If you send the project brief form on the home page, I receive what you type: name, email, company or brand, website, what you need, project details, budget, deadline and whether you have a script or storyboard. The form is sent through Formspree to my email. Formspree and my email provider process it under their own policies.

I use it only to reply to your enquiry. I keep it until one month after the project is closed, or, if no project follows, one month after the enquiry is closed. Then I delete it. You can ask me to delete it earlier. To ask for deletion, email [email protected].

The legal basis is my legitimate interest in answering you, or your consent to be contacted. Your rights are those listed in Part 1.