For the Codext CRM mobile app on iOS and Android.
The short version. Codext CRM is a client for a CRM you run yourself. Your contacts, deals, mail and everything else travel between your phone and the instance you chose — they are not routed through, copied to, or stored by Codext GmbH. The app contains no analytics, no advertising, no third-party tracking SDKs and no crash reporter. It does not ask for your data because it never receives it.
This app is published by Codext GmbH ("we", "us"), the developer of record on the App Store. You can reach us at crm@codext.de.
Codext CRM is open-source software (MIT licence). The source of both the app and the server it talks to is public at github.com/codextde/codext-crm, so every claim on this page can be checked rather than taken on trust.
The app has no account system and no backend of its own. On first launch it asks which CRM instance to connect to — by scanning a pairing QR code shown in that instance's own browser settings, or by typing its address. From that point on, every request the app makes goes to that address and nowhere else.
Who controls your data therefore depends on who runs that instance:
crm.codext.de). Then the separate agreement covering that hosted instance
governs the data on it, and we act as processor under it. Installing the app on its own
never creates such a relationship.Only to your instance, only over HTTPS, and only what the screen you are on needs: the CRM records you open, the changes you make, searches you type, mail you read or send, and messages you write to an AI colleague. The credential established at pairing accompanies each request so your instance knows which user is asking.
The app opens no other network connections. There is no telemetry endpoint, no "check for updates" ping, no error-reporting service and no ad network. If you inspect its traffic, the only host you will see is the one you typed.
| What | Where | Why |
|---|---|---|
| Device token for your instance | iOS Keychain / Android Keystore | Keeps you signed in. Bound to one user in one workspace, expires, and is revocable from the phone or the browser at any time. |
| Instance address | App storage | So the app knows where to reconnect. |
| Your tab-bar layout and app settings | App storage | Per-device preferences. Never leaves the device. |
| Cached CRM content | App storage | So lists and records survive a scroll or a brief loss of signal. |
Deleting the app removes all of it. Signing out discards the token and the cache immediately.
Used for one thing: scanning the pairing QR code your CRM shows in Settings → Mobile app. Frames are decoded on the device and discarded. No photo is taken, saved, uploaded or kept. If you connect by typing the address instead, the app never asks for the camera at all.
Optional, off by default, and used only to unlock the app on this device. Authentication is performed by iOS; the app receives a yes or no. Your biometric data is never available to the app, never stored by it and never transmitted.
Optional and never requested at launch — you turn them on from Settings, after reading what they are for. If you do, Apple issues a push token which is stored on your instance so it can notify you about your own deals and tasks. Delivery is relayed by Apple Push Notification service and by Expo's push service, which see the token and the notification payload in transit; see expo.dev/privacy. Declining notifications changes nothing else about the app.
Through this app we collect nothing. Not usage data, not identifiers, not diagnostics, not contact information, not location. This is what is declared on the App Store product page under "Data Not Collected", and it is true because the app has no channel through which to send us anything.
Apple provides us with aggregate, anonymised App Store statistics (downloads, crash counts, and so on) for any app on the store. That data comes from Apple, cannot identify you, and is not something the app produces.
The AI in Codext CRM — the assistant, the AI colleagues, lead scoring, drafted mail — runs on your instance, using the model provider and API key configured there by whoever administers it. The app only displays the result. It holds no model credentials and calls no model provider directly. Which provider sees your prompts is a decision made on the server, by your administrator, and is governed by that instance's own policy.
Codext CRM is business software, not directed at children, and not intended for anyone under 16. We do not knowingly collect anything from children — a claim made easy by collecting nothing from anyone.
Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection over your personal data. Because your CRM data sits on the instance you connect to, those requests are addressed to whoever operates it — in most cases your own organisation. If Codext GmbH operates your instance under a hosting agreement, write to crm@codext.de and we will handle it as processor for the controller.
For the app itself there is nothing to request, delete or export from us: we hold no record that you installed it.
If this policy changes we will update the version and date at the top of this page, and the history is visible in the repository. Material changes to what the app does will also appear in the release notes for the version that makes them.
Codext GmbH
Email: crm@codext.de
Source and issue tracker:
github.com/codextde/codext-crm
Before publishing: add Codext GmbH's registered postal address and, for the German Impressum, the managing director and commercial register number. Left blank deliberately rather than guessed.