Privacy Policy

In short

1. Controller

No data protection officer has been appointed, as the legal requirements for this are not met (Section 38 of the German Federal Data Protection Act, BDSG). If you have any questions about data protection, please contact the controller named above directly.

2. Visiting the website and server log files

When you visit this website or download files, the web server automatically stores technical data: date and time, file requested, amount of data transferred, access status, referrer URL, browser type and operating system, and the IP address (anonymised).

The purpose is to provide the website and the downloads securely and without errors and to prevent misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The log files are deleted after 7 days at the latest. They are not combined with other data.

The website is run by a web hosting provider that processes the data on our behalf (Art. 28 GDPR). The connection is encrypted using HTTPS/TLS.

3. Web analytics with Google Analytics (only with consent)

With your consent, this website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This shows us how often the website is visited, which sections are read and which files are downloaded, so that we can improve the website.

Consent via Google’s dialog (Google Consent Mode): On your first visit, Google’s consent dialog (see section 4) also asks for your consent to statistics. The Google Analytics script (www.googletagmanager.com) is loaded when the page is opened, but starts with analytics storage switched off (analytics_storage = “denied”): without your consent, no analytics cookies are set and no complete measurement data is transmitted. In that case Google can only receive cookieless signals without any identifier (e.g. that a page view took place). Only when you consent does Google enable analytics storage.

Data processed: pages and sections viewed, downloads, date and time, time spent on the page, referrer URL, browser, operating system, screen size, language setting and the approximate location (country/region) that Google derives from your IP address. Google Analytics 4 does not store IP addresses for users in the EU. To recognise returning visitors, Google sets the cookies _ga and _ga_<ID> with a random identifier; they are kept for up to 2 years unless you delete them earlier or withdraw your consent. The analytics data is deleted in Google Analytics after 2 months. Google signals and personalised advertising are not enabled; we do not link the data with your Google account.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Google processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Data may be transferred to the USA; this is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), under which Google is certified.

Withdrawal: You can withdraw your consent at any time with effect for the future – via “Cookie settings” at the bottom of every page (or Google’s icon at the edge of the screen), which reopens Google’s consent dialog. You can also delete cookies that have already been set by removing this website’s site data in your browser. More information: Google’s privacy policy and Safeguarding your data in Google Analytics.

4. Advertising with Google AdSense

To finance this free website and the free app, this website shows ads via Google AdSense. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For this, your browser loads a script from Google (pagead2.googlesyndication.com) when the page is opened.

Consent: On your first visit, a consent dialog from Google asks whether Google and its advertising partners may store or read cookies and similar technologies on your device and personalise ads. This only happens with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). In the same dialog you also decide on statistics with Google Analytics (section 3); there is no other cookie notice on this website.

Without consent, Google may serve non-personalised or limited ads. For this, too, Google processes technically necessary data such as the IP address, browser and device information and the page viewed in order to deliver ads, limit how often they are shown and prevent fraud (Art. 6(1)(f) GDPR, legitimate interest in financing the free offering).

Google may transfer data to the USA; this is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), under which Google is certified.

Withdrawal and objection: You can withdraw or change your consent at any time with effect for the future – via “Cookie settings” at the bottom of every page (or Google’s icon at the edge of the screen), or by deleting this website’s site data in your browser; the consent dialog will then ask again on your next visit. You can also switch off personalised advertising at adssettings.google.com. More information: Google’s privacy policy and How Google uses information from sites or apps that use its services.

5. Storage in the browser (language, appearance and your consent)

If you explicitly choose a language or the appearance (light/dark) at the top of the page, your browser remembers this choice in local storage (localStorage, entries softstringsphone.lang and softstringsphone.theme). The entries stay on your device and are not transmitted to us. Without your choice nothing is stored; the language then follows your browser’s language setting.

Google stores your decision in the consent dialog in cookies of this website (e.g. FCCDCF, FCNEC) so that you are not asked again on every visit.

The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for the function you requested or to respect your decision). You can delete these entries at any time by removing the site data in your browser.

6. Links to other websites

This website links to the project pages of the libraries used in the app and to www.maikstrings.de. You only leave this website when you click such a link; the respective operator is responsible for any processing there.

7. Contact by email

If you send us an email, we process your details (email address, name, content) only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. The data is deleted as soon as the enquiry has been dealt with and no statutory retention obligations apply.

8. The Softstringsphone app

• No account, no telemetry, no ads: The app does not require you to register with us, contains no advertising or analytics libraries and sends no usage, crash or diagnostic data to us or to third parties. We do not operate any server for the app.
• Connections only to your own endpoints: The app connects exclusively to the FRITZ!Box and the SIP server that you enter yourself – via CAPI (home network only), TR-064 (call list and phone book, HTTPS only) and SIP with voice over RTP or SRTP. Your FRITZ!Box and your telephone or SIP provider process the data required for calls (phone numbers, time, duration, IP address) in accordance with their own privacy policies.
• Local storage: Settings, your own call history and favourites stay on the phone. Passwords for the FRITZ!Box and SIP are encrypted with AES-256-GCM; the key is kept in the Android Keystore. The app excludes itself from Android backups and from transfer when you switch devices. “Sign out and delete data” in the settings or uninstalling the app deletes this data; “Sign out” keeps it on the phone.
• VPN to the FRITZ!Box: Since version 1.1.0 the app no longer builds a VPN itself and contains no QR code scanner. Via Android, it only detects whether a VPN is currently running on the phone (without any special permission) and, at the push of a button, opens our Router VPN app (section 10) or its store page. The settings of the previously built-in VPN (including the private key) are deleted from the phone when version 1.1.0 is started for the first time.
• Call list and phone book of the FRITZ!Box are only displayed and not passed on.
• Permissions: Microphone – only during a call. Contacts (optional) – read only, to show names and dial numbers; nothing is transmitted. Notifications and full screen – for call and incoming-call displays, also on the lock screen. Foreground service, start after reboot, wake-up – to stay reachable for incoming calls (can be switched off via “Accept incoming calls”). Network and Wi-Fi – for the connection to the FRITZ!Box and SIP server and to detect whether a VPN is running. Visibility of other apps – only for Router VPN, the MyFRITZ!App and the “WireGuard” app, so that they can be opened for the VPN.
• Logs: The published app does not write phone numbers or server addresses to the Android log.
• Download: When you download the app from this website, only the server log data described in section 2 is generated. If you obtain the app via Google Play or the Galaxy Store, the store operator (Google or Samsung) processes data in accordance with its own terms.

Insofar as personal data is involved at all, the legal basis for processing on your device is Art. 6(1)(b) GDPR (providing the telephone function you requested); we ourselves receive no data from the app.

9. The Softstringsphone Pro app

Softstringsphone Pro extends Softstringsphone with on-device AI features (captions, translation, call notes, call assistant, assistant with voice input and optional local AI), fax via the FRITZ!Box, a PDF section and interfaces (webhooks, broadcast, CRM link). The same applies to the telephone function as in section 8; in addition:

• No account, no telemetry, no ads: The app does not require you to register with us, contains no advertising or analytics libraries, no Google Play services, no ML Kit and no Firebase, and sends no usage, crash or diagnostic data to us or to third parties. We do not operate any server for the app.
• Connections only to your own endpoints: The app connects to the FRITZ!Box and the SIP server that you enter yourself – via CAPI (home network only), TR-064 (HTTPS only: reading the call list and phone book and, at your request, writing contacts and call barring entries and setting up an IP phone) and SIP with voice over RTP or SRTP. To find the FRITZ!Box, it searches for devices in the home network (SSDP). Your FRITZ!Box and your telephone or SIP provider process the data required for calls (phone numbers, time, duration, IP address) in accordance with their own privacy policies.
• On-device AI features (optional): For live captions, translation, call notes and the call assistant, the app passes the call audio in memory to the speech recognition and the recognised text to the translator of the Android system; greetings of the call assistant that include your name are spoken by the system’s text-to-speech – in each case exclusively their offline versions on the device; for calls the app never uses an online version. Optionally (setting “Recognition for captions”), the app recognises the call audio with its own AI speech pack instead (see “Voice input in the assistant with the AI speech pack”) – likewise exclusively on the device, without audio or text leaving the phone. Depending on the phone, these system services come from Google or from the manufacturer. Audio is never recorded or stored. Only if you switch it on does the app store the transcript as text and the notes generated from it – encrypted with AES-256-GCM on the phone; you can delete them at any time. Notes and spam assessment are produced by rules within the app, not by an online service.
• Local AI in the assistant (optional): Only if you tap “Download” in the assistant does the app download the language model Qwen2.5-1.5B-Instruct once (about 1.1 GB, Apache-2.0 licence) via HTTPS from huggingface.co, the service of Hugging Face, Inc. (USA). As with any website request, Hugging Face receives your IP address, the date and time and the identifier of the Android download service; the app sends no other data. If you wish, the phone downloads only over Wi-Fi. The app checks the file against its checksum (SHA-256) and does not use any connection afterwards: whatever you type or say to the assistant is processed by the model only on the phone (llama.cpp); it is neither stored nor transmitted. The model does not see your contacts – the app matches names itself. You can delete the model at any time – in the assistant or under Settings → Security and privacy → “Downloaded data”. Answers from the AI are labelled as such; “Report answer” opens your email app with a message to us containing your question and the answer – it is only sent if you tap Send in the email app yourself (section 7 then applies). The legal basis is Art. 6(1)(b) GDPR (the function you requested); information on data protection at Hugging Face: huggingface.co/privacy.
• Voice input in the assistant with the AI speech pack (optional): Voice input is voluntary and has to be set up in the app. Only if you tap “Download” under “Set up voice input” does the app download a speech recognition model (German about 140 MB, other languages about 670 MB; models by NVIDIA, CC BY 4.0 licence) via HTTPS from our server softstringsphone.maikstrings.de; by default only over Wi-Fi. For technical reasons the server processes your IP address, the date and time and the app’s identifier (as described in section 2); the app sends no other data. At most once a day the app checks there whether a newer version is available. The app verifies the files using a digital signature and their checksums. The speech recognition itself takes place exclusively on your device (sherpa-onnx): the microphone only runs while you have tapped the microphone in the assistant; recordings are neither stored nor transmitted, and the recognised text only ends up in the input field. The recognition uses contact names as a hint to spell names correctly – on the device. Alternatively, you can switch on the phone’s simple offline speech recognition (also on the device) or the online speech recognition (next item). You can delete the speech pack at any time – under “Set up voice input” or under Settings → Security and privacy → “Downloaded data”, where all call notes can also be deleted at once. The legal basis is Art. 6(1)(b) GDPR (the function you requested).
• Online speech recognition in the assistant (optional, only with consent): Only if you explicitly agree under “Set up voice input” is your voice recording sent to your device’s speech recognition service (on most devices Google, i.e. Google Ireland Limited or Google LLC) when you speak via the assistant’s microphone, where it is converted into text. So that names are recognised correctly, from Android 13 onwards hint words are also sent: the assistant’s command words and up to 30 names from your contacts or favourites (no phone numbers). While this recognition is in use, the app shows “online” at the microphone. The legal basis is your consent (Art. 6(1)(a) GDPR); the app stores the time and version of your consent on the device. You can withdraw it at any time in the app under “Set up voice input”; the lawfulness of the processing carried out until then remains unaffected. Data may be transferred to third countries (e.g. the USA); the provider’s privacy policy applies (policies.google.com/privacy). We ourselves neither receive nor store any recordings. Online recognition is never used for phone calls, transcripts or captions.
• The people you talk to: With captions and notes, the app also processes what the other party says; with the call assistant, what the caller says (processed only on the phone as text, no audio is recorded; your microphone is off while the call assistant is talking). So that the other party is informed:
  • If notes are saved, the other party always hears an announcement at the start (“Please note: this call is being transcribed as text, but not recorded. If you do not agree, please say so …”). If they object, “Stop transcript” ends the transcription immediately and discards everything recognised so far; nothing is saved. The announcement can only be switched off for captions alone without saving (e.g. as a reading aid). The announcement is built into the app and is played even if your microphone is muted.
  • Alternatively (setting “Consent by pressing 1” or the “Ask for consent” button during a call), the other party is instead asked to agree to the transcription by pressing 1. Without 1, nothing is transcribed; pressing 9 lets them stop the transcription at any time, and everything recognised so far is discarded. As proof, the app stores the time, the key and the version of the announcement in the note; the proof is deleted together with the note. The app recognises the key on the phone – from the key tone in the call or from the key event sent by the other end.
  • The call assistant introduces itself as an automated assistant and tells the caller that their answer is shown as text but not recorded. With the key spam filter (optional), it asks the caller to press 1 to be connected; without a key press, it says goodbye and shows you the number and what was said in a silent notification – the number is not blocked.
  • Before captions or notes run automatically or the call assistant is switched on, the app shows a notice that you confirm once; the app remembers its version and the time.
  Whether you may use these features is your responsibility as the user: especially for business use, the GDPR may require the consent of the person you are talking to. We receive none of this data.
• Fax (via your FRITZ!Box): Sent and received faxes go through the fax function of your FRITZ!Box and your telephone provider. Received faxes, transmission reports, fax drafts, cover page details, templates and the fax address book are kept on the phone. The app analyses scanned pages on the device (its own scanner, without Google). Email forwarding (optional, off by default): If you switch it on, the app sends new faxes as PDF via the mail server you enter to the address you enter; faxes often contain data of the senders, which the app points out before you switch it on. The mail provider’s terms apply to the processing there; the password is stored encrypted.
• PDF section: Scanning, merging, editing pages, signing, compressing and the “My PDFs” storage work only on the phone. PDFs only leave the device at the push of a button: when sharing (to the app you choose), when faxing, when saving to “Downloads” and when printing (to the printer or print service you choose in Android’s print dialog).
• Call assistant and block list: To recognise known numbers, the app compares incoming numbers on the device with your contacts, favourites, the box’s phone book and your call history. The block list is kept on the phone; if you wish, the app also adds blocked numbers to the call barring of your FRITZ!Box.
• Webhooks, broadcast and CRM link (optional, off by default): If you switch on webhooks, the app sends events (type, time, direction, phone number, name, duration; content from the call only if you switch this on as well) to the address you enter – only via HTTPS or via HTTP within your own home network, optionally signed with a secret that you define. Before call content is included, the app points out that it will then go to a third party. The operator of the receiving end is responsible for the processing there. The Android broadcast can be read by other apps on your phone; it never contains call content, and the app points this out before you switch it on. “Open in CRM” opens the address you have stored in the browser; the phone number and name are passed to this address (your CRM provider).
• Local storage: Settings, your own call history, favourites, notes and the block list stay on the phone. Passwords for the FRITZ!Box and SIP, notes and transcripts are encrypted with AES-256-GCM; the key is kept in the Android Keystore. The app deletes notes after the period you set (default 90 days; options 30 days, 90 days, 1 year or never) and keeps at most 300 calls. The app excludes itself from Android backups and from transfer when you switch devices. “Sign out and delete data” in the settings or uninstalling the app deletes this data; “Sign out” keeps it on the phone.
• VPN to the FRITZ!Box (optional): The app does not build a VPN itself and contains no VPN service. On the go, the phone connects to your FRITZ!Box via our separate “Router VPN” app (section 10) (or another VPN app such as the MyFRITZ!App); the privacy policy of the respective app applies to its processing. Softstringsphone Pro only detects on the device whether a VPN is currently running and, at the push of a button, opens the VPN app or its page in the app store. No data is transmitted to us. If an earlier version had stored the box’s VPN settings, the app deletes them on first start.
• Call list and phone book of the FRITZ!Box are only displayed and not passed on.
• Permissions: Microphone – only during a call that you are conducting (not while the call assistant is talking), and for voice input in the assistant while you have tapped the microphone. Camera – the app has no camera permission; to scan documents for a fax, the phone’s camera app takes the photo (it is analysed on the device and only stored or shared at the push of a button). Contacts (optional) – read only, to show names and dial numbers; nothing is transmitted. Notifications and full screen – for call and incoming-call displays, also on the lock screen. Foreground service, start after reboot, wake-up – to stay reachable for incoming calls (can be switched off via “Accept incoming calls”). Network and Wi-Fi – for the connection to the FRITZ!Box and SIP server.
• Logs: The published app does not write phone numbers or server addresses to the Android log.
• Download: When you download the app from this website, only the server log data described in section 2 is generated. If you obtain the app via Google Play or the Galaxy Store, the store operator (Google or Samsung) processes data in accordance with its own terms.

Insofar as personal data is involved at all, the legal basis for processing on your device is Art. 6(1)(b) GDPR (providing the telephone function you requested); we ourselves receive no data from the app.

10. The Router VPN app

Router VPN connects your Android phone to your own router at home (e.g. a FRITZ!Box) via an encrypted WireGuard tunnel, so that you can reach your home network on the go – for example with Softstringsphone.

• Only to your own router: The app uses Android’s VPN function (VpnService) with the official WireGuard library. The tunnel leads exclusively to the router whose WireGuard settings you import yourself. We do not operate any VPN servers; your traffic never passes through us and is neither analysed, modified, logged nor passed on to third parties by the app. Which apps use the tunnel and whether only connections to your home network or also their internet traffic go through it, you choose in the app (default: only our apps, only the home network); with “Everything”, the internet traffic of these apps goes out via your connection at home.
• No account, no telemetry, no ads: The app collects no personal data, requires no registration, contains no advertising or analytics libraries and sends nothing to us or to third parties.
• Local storage: The imported VPN settings contain a private key. They are encrypted with AES-256-GCM (key in the Android Keystore), stored only on the phone, not included in Android backups and never logged. “Delete” on a connection or uninstalling the app removes them.
• Recognising home and choosing apps: To recognise when you are at home (automatic by network), Router VPN asks your own router for its device ID – only in your own Wi-Fi or through the tunnel – and stores it only on your phone. To let you choose apps, the app reads the list of installed apps with an icon in the app drawer; it stays on the phone. No location access, none of this is sent anywhere.
• Camera (optional): Only if you tap “Scan QR code” to read your router’s QR code. Recognition runs on the phone (ZXing, without Google Play services); camera images are neither stored nor sent. Alternatively, the settings can be imported as a file or text.
• Permissions: VPN – Android asks once for your approval before it is switched on for the first time. Internet – for the tunnel to your router. Network state – to tell mobile data from Wi-Fi. Visibility of installed apps (apps with an icon in the app drawer, no access to all packages) – for choosing apps, see above. Camera (optional) – see above. Start after reboot – to switch a VPN that was on back on after a restart. The VPN can be switched off at any time in the app, via the quick setting or in the Android settings.
• Download: When you download the app from this website, only the server log data described in section 2 is generated. If you obtain the app via Google Play or the Galaxy Store, the store operator (Google or Samsung) processes data in accordance with its own terms.

Insofar as personal data is involved at all, the legal basis for processing on your device is Art. 6(1)(b) GDPR (providing the VPN connection you requested); we ourselves receive no data from the app.

How the tunnel works, which traffic uses it and how to set it up is explained on the page Router VPN explained.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). There is no automated decision-making, including profiling (Art. 22).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:

12. Changes

This privacy policy is updated whenever the website or one of the apps changes. The version published here applies. Last updated: October 2026.