ER Companion Privacy Policy

Last updated: 6 November 2026

This policy explains which personal data is processed when you use the ER Companion app for iOS and Android ("the app"), an unofficial companion app for ELDEN RING. Visits to our website, including this page and the unlock code page, are also covered by the privacy policy of our website: https://software-notion.de/legal/privacypolicy

Controller

Sebastian Kruse, Software Notion, Kornblumenring 40, 31600 Uchte, Germany. Email: info@software-notion.de. Further contact details are in our imprint: https://software-notion.de/legal/imprint

We are not required to appoint a data protection officer.

The short version

• You can use the app without an account. Your progress, checklists, map markers, settings and notes are stored on your device.
• The free version shows ads from Google AdMob. Personalised ads, and the device access they need, require your consent, which you can change at any time in the app's settings. You can remove the ads with a purchase.
• Optional online features, such as iCloud sync, cross-platform sync, sign-in, the AI assistant and support requests, only transmit data when you use them.
• Payments are handled by Apple or Google. We use RevenueCat to manage purchases and never receive your payment details.
• The app contains no analytics or crash-reporting tools. We do not sell your data.

Data stored on your device

The app stores your progress (for example collected items and completed checklist entries), the map markers you set, your filters and settings, and downloaded maps and content in its private storage on your device. It also creates a random installation ID, which is used for referral rewards and to match a support request to your device (see below). We have no access to this data while it stays on your device.

The app keeps technical log files on your device for up to seven days to help find errors. They can contain the actions you took in the app and, if you use the AI assistant, the questions you asked. The log files only leave your device if you send them to us with a support request.

Storing this data is strictly necessary to provide the functions you use (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (b) GDPR). The data stays on your device until you delete it in the app or uninstall the app.

Notes

Notes, folders, tags and sketches you create in the app are stored in a separate local database on your device. They are not transmitted to our servers and are not part of the iCloud sync or the cross-platform sync. They are only included in an export file you create yourself (see below), so they also leave your device when you share an exported note or file.

Export and import

You can export your data to a file and import it on this or another device. The export file contains your progress, map markers and settings as well as your notes. It goes to the destination you choose, such as Files, another app or a cloud storage service, whose own privacy terms apply there. We do not receive the file.

System search and app shortcuts

On iOS, the app can make game content available in the system search (Spotlight). On iOS and Android it can offer app shortcuts, for example on the home screen icon. The search index and the shortcuts are created and stored by the operating system on your device; we do not receive them. On iOS you can turn off the search integration in the system settings for the app.

Connections to our servers

Whenever the app connects to our servers (api.software-notion.de, static.software-notion.de or software-notion.de), our server technically processes your IP address, the date and time, the requested address, the amount of data transferred and the app and system version sent by your device. Without this data the content cannot be delivered. We use it to deliver content and to keep our servers secure (Art. 6 (1) (f) GDPR; our legitimate interest is the stable and secure operation of the app). Server log files are deleted after 14 days at the latest unless they are needed to investigate a specific security incident.

When it starts, the app loads some information from our servers, for example which sign-in options are available, the list of sponsors and information banners. Apart from the technical data above, these requests contain no personal data, with the exception of the referral check described below.

Map and content downloads

Maps and other content that are not included in the installation are downloaded from static.software-notion.de when you request them or when an update is available. Only the technical data described above is processed. Depending on the platform, some content may also be delivered by the App Store or Google Play as part of the installation.

Advertising (Google AdMob)

The free version of the app shows ads provided by Google AdMob. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

When the app is started for the first time in the EU, the EEA, the United Kingdom or Switzerland, Google's consent dialog (User Messaging Platform) asks whether you agree to personalised ads and the related storage of and access to information on your device. On iOS, Apple's App Tracking Transparency prompt also asks whether the app may access your device's advertising identifier (IDFA). To deliver ads, Google processes your IP address, device and app information, the advertising identifier (IDFA or Android advertising ID, if access is allowed), ad interactions and an approximate location derived from your IP address.

Personalised ads and the storage of and access to information on your device for this purpose are based on your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). If you do not consent, Google only shows non-personalised or limited ads, which are selected based on the context; we rely on our legitimate interest in financing the free app through advertising for this (Art. 6 (1) (f) GDPR). You can change or withdraw your consent at any time in the app's settings (privacy options for ads). On iOS you can also change the tracking permission in the iOS settings under Privacy & Security › Tracking.

Google may process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, on the basis of which the European Commission has found an adequate level of data protection (Art. 45 GDPR). More information: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites

If no ad from Google is available, the app may show one of our own banners instead, for example for our merchandise shop or for partner offers such as Amazon. The banner image is loaded from our servers. The partner's website only opens in your browser if you tap the banner; its own privacy terms apply there, and partner programmes may record that you came from our app.

If you buy the ad removal, the app no longer loads ads.

Purchases and subscriptions

Purchases and subscriptions are sold through the App Store (Apple) or Google Play (Google), which process the payment as independent controllers under their own privacy policies. We never receive your payment details.

To manage purchases across devices and platforms we use RevenueCat, a service of RevenueCat, Inc., USA, which processes this data on our behalf (Art. 28 GDPR). RevenueCat receives the purchase receipts and transaction data from the store, the products purchased, the store country and currency, the platform and app version, your IP address and an app user ID. The app user ID is a random ID or, if you sign in, the pseudonymous ID described under "Sign in with Apple or Google". The legal basis is the performance of the purchase contract (Art. 6 (1) (b) GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46 (2) (c) GDPR).

Promotional codes are redeemed directly with the App Store or Google Play; the app only opens the store's redemption page. If you request a code on our website, the website stores a cookie with a random ID for 30 days so that it can show you the codes assigned to you, and saves your IP address and the operating system and device type derived from your browser's user agent together with the assigned code to prevent misuse. The form is protected by Google reCAPTCHA. Details are in the privacy policy of our website (Art. 6 (1) (b) and (f) GDPR; § 25 (2) no. 2 TDDDG for the cookie).

Referral links

The app lets you share a personal referral link (/apps/er-companion/<ID>). When someone opens such a link, our website stores the referral ID, the IP address, the browser's user agent, the operating system and device type derived from it and the time. When the app is started with an internet connection, it sends its installation ID to our server. If a referral link was opened from the same IP address, we link the two entries and also store the app's user agent. The app also asks how many confirmed referrals belong to its own referral ID in order to unlock referral rewards. We use this data only to credit referrals and to prevent misuse (Art. 6 (1) (f) GDPR; our legitimate interest is a working referral programme). The person who shared the link only sees the number of referrals, never who was referred. We keep the entries as long as they are needed for the referral programme and delete them on request.

Sign in with Apple or Google

Signing in is optional. It lets you use your purchases and subscriptions on your other devices and on other platforms. On iPhone and iPad, Sign in with Apple runs directly through iOS. Otherwise the app opens our sign-in page at software-notion.de/auth, which forwards you to Apple or Google. The provider returns your name and email address (or Apple's relay address if you hide your email); our server passes them straight to the app and does not store them.

The app calculates a pseudonymous user ID from your email address (or, if none is available, from your name) using a one-way hash function (SHA-256). This ID is used as the app user ID at RevenueCat. Your name, email address and the sign-in tokens are stored on your device in the protected system storage (Keychain or Android Keystore) and, on iOS, also in the private iCloud database of your iCloud account so that you stay signed in in our other apps. For Sign in with Apple, the app sends a one-time authorisation code to our server, which exchanges it with Apple for a token so that the sign-in can be revoked later; the token is returned to the app and is not stored on our server.

You can delete your account in the app's settings at any time. The app then asks our server to revoke the sign-in with Apple or Google and removes the sign-in data from your device. Your purchases remain linked to your App Store or Google Play account. The legal basis is Art. 6 (1) (b) GDPR. Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and Google (Google Ireland Limited) process the sign-in as independent controllers under their own privacy policies.

iCloud sync (iOS)

On iOS, the app synchronises your progress and map markers through Apple's CloudKit service in the private database of your own iCloud account. iCloud sync is switched on if you are signed in to iCloud; you can turn it off in the app's settings. We cannot access this data. Apple processes it as an independent controller under its own terms (https://www.apple.com/legal/privacy/) and may process data in the USA; Apple uses appropriate safeguards for such transfers, such as the EU-U.S. Data Privacy Framework and EU standard contractual clauses. Notes are not part of the iCloud sync.

Cross-platform progress sync

If you want to move your progress between devices, for example from iOS to Android, you can upload it manually. The app then sends your progress data to api.software-notion.de, where it is stored together with the app and a randomly generated sync ID. You enter the sync ID on your other device to download the data. Anyone who knows the sync ID can download this progress, so please keep it to yourself. Notes are not included. As stated in the app, uploaded progress is kept for 30 days and then has to be uploaded again. The legal basis is Art. 6 (1) (b) GDPR.

AI assistant

The AI assistant answers questions about the game and is available after an unlock. When you send a question, the app transmits your question, up to the last eight messages of the current conversation and the app's identifier to api.software-notion.de. Our server adds instructions about the game and forwards the text to the chat API of OpenAI (OpenAI, USA), which generates the answer. We do not store your questions or the answers on our server. According to OpenAI, data sent through its API is not used to train its models and is kept for up to 30 days to detect misuse (https://openai.com/policies/privacy-policy/). Transfers to the USA are based on the EU-U.S. Data Privacy Framework where OpenAI is certified, and otherwise on EU standard contractual clauses.

Please do not enter any personal information in your questions. Answers are generated automatically and can be wrong. The legal basis is Art. 6 (1) (b) GDPR, because you use the feature at your own request.

Speedrun leaderboards

The speedrun leaderboards are loaded directly from the public API of speedrun.com. Your device connects to speedrun.com, which receives your IP address and the technical data of the request. If you tap a run, it opens in your browser on speedrun.com or on the video platform where it was published, for example YouTube or Twitch, whose own privacy terms apply. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is showing current leaderboards.

Support requests

If you contact us or report a bug from the help page of the app, the app creates a support ID. If the option to send an extended report is ticked (it is ticked by default and you can untick it), the app first sends the following to api.software-notion.de: the support ID, the installation ID, the app and the type of request, device information (device type, manufacturer, model, device name, system version), your app settings, your map markers and your progress data, and a ZIP file with the app's version history, its purchase status at RevenueCat (unlocks and the app user ID), the sign-in status (provider and pseudonymous user ID, without name or email address) and the log files of the last days. The app then opens the contact or bug report form on software-notion.de with the support ID filled in; what you enter there is covered by the privacy policy of our website.

On some Android devices the device name can contain your name if you have chosen it that way. We use the data only to process your request (Art. 6 (1) (b) GDPR for questions about a purchase, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering your request and fixing errors). We delete it once your request has been dealt with, at the latest after two years, unless statutory retention periods apply.

Sponsoring

If you support us with a sponsoring purchase, you can enter a name and an email address. The app then sends them to our server together with the purchase ID, the price, the currency, the platform and the app. We send you an email with an activation link; once you have confirmed it, the name you entered appears in the sponsor list shown in our apps. Entering a name and address is voluntary. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by email; we then remove your name from the list.

Ratings

The app may occasionally ask whether you would like to rate it, using the standard rating dialog of iOS or Android. Your rating goes directly to Apple or Google; the app does not learn whether or how you rated it.

Recipients and transfers outside the EU

Apart from the services named above (Google, Apple, RevenueCat, OpenAI, speedrun.com), we do not pass on your data unless we are legally obliged to do so. Where these services process data in the USA, the safeguards described in the respective section apply.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), and the right to object to processing (Art. 21 GDPR). Where processing is based on Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation. You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (https://www.lfd.niedersachsen.de), or the authority where you live.

To exercise your rights, send us an email. Because most of your data only exists on your device, the quickest way is often in the app itself: you can reset your progress, delete notes, delete your account and uninstall the app.

Children

The app is not specifically aimed at children. If you are under 16, please ask a parent or guardian before you use online features, make purchases or agree to personalised ads.

Changes to this policy

We update this policy when the app or the legal situation changes. The current version is always available on this page.