Privacy Policy

The German version is legally binding; this translation is provided for convenience.

1. The short version

Kadence is built so that your training and health data stays on your device. It is stored on our servers only if you turn on cloud backup yourself or send it to us yourself, for example in a feedback report. The app contains no third-party analytics or advertising software, no crash reporting and no advertising or tracking identifiers. This website sets no cookies and embeds nothing from third parties; it counts visits with a tool we run ourselves, using a pseudonymous value (see 2.2). Where we have to limit abuse — when sharing, when reporting and in feedback without an account — we process pseudonymised or only briefly stored technical values (see 2.3, 3.6, 3.7).

What the app sends on its own. Even if you do not use any online feature, the app connects to our servers for:

checking the trial and subscription: at launch the app identifies itself with a random identifier (Kadence ID) to our server and to our purchase processor RevenueCat (3.12),
the version check at launch and fetching the exercise catalogue, each without an identifier (3.8),
once a day, usage counts without a persistent identifier, which you can turn off in the app (3.9).

What happens only when you use it: the optional account (3.3), the optional cloud backup (3.4), food search (3.5), the feedback form (3.6) and sharing by link (3.7). Everything else happens exclusively on your device.

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator named above. No data protection officer needs to be appointed. For privacy questions, contact us at the e-mail address given.

2. This website

2.1 Hosting and server logs

The website runs on our own infrastructure (data centre: Hetzner Online GmbH, Germany). When you open a page, the web server necessarily processes your device’s IP address, date and time, the requested address, the browser type and the referring page if your browser sends it. This data goes into server logs and serves only secure operation and troubleshooting. It is deleted after 7 days and not combined with other data.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

The website sets no cookies and embeds no fonts, scripts or content from third parties. Your browser loads the counting script for visitor statistics from our own statistics server; see 2.2.

2.2 Visitor statistics

To know how many people visit this website, we use the open-source software Umami. It runs on our own statistics server in the same data centre as the website (2.1); no data is sent to third parties.

How counting works. When you open a page, your browser loads a small counting script from our statistics server and runs it. The script sends the server the requested address (without query parameters), the page title, the referring page and your browser’s screen size and language setting; in doing so the server technically also sees your IP address and browser signature. From this, Umami derives browser, operating system and device type as well as country and, where determinable, region and city, and stores these details with the page view. Umami does not store the IP address itself.

A pseudonymous value instead of a cookie. To group page views from the same browser, Umami derives a hash (session identifier) from IP address, browser signature, a secret key and a value that changes every calendar month. Within one calendar month, several visits from the same browser can thus be linked to each other, but not across the change of month; IP address and browser signature cannot be recovered from the hash. Umami sets no cookies and stores nothing in your browser; the script only checks whether an opt-out flag for Umami is set in your browser’s local storage. Data is only evaluated in aggregate.

No counting: If your browser sends the “Do Not Track” setting, the script does not count your visit. Shared pages (2.3) do not contain the counting script. The website also works fully if you suppress the script, for example with a content blocker.

The legal basis is our legitimate interest in learning whether and how this website is used (Art. 6(1)(f) GDPR). You can object to being counted at any time, most easily via your browser’s Do Not Track setting.

Sharing a link from the app creates a page under kadence-app.com/s/…. Opening such a page is subject to the server logs described in 2.1. The page shows a preview of the shared content and a sender card if the sender created one. What appears there was chosen by the sender (see 3.7).

On every shared page you can report the content. We store the time, the reason you chose, your optional note and a pseudonymised hash of your IP address (derived with a secret key) to limit abuse of the reporting function. The IP address itself is not stored. The report is deleted together with the shared content, at the latest six months after receipt. The legal basis is our legitimate interest in a working reporting mechanism (Art. 6(1)(f) GDPR).

3. The app

3.1 Data on your device

Everything you record in the app is stored in a local database on your device: workouts and training history, strength values and sets, your own exercises, workouts and units, goals, food diary, your own foods and meals, supplements, body data such as weight, age, height and heart-rate limits, your age group (3.13), your confirmation of the safety notice (3.14), and your settings. The device’s protected storage — the keychain on iPhone, on Android an app storage area encrypted with a key from the Android Keystore — also holds the Kadence ID (3.12) and, if you stay signed in, a sign-in token (3.3).

We have no access to this data. It leaves your device only when you deliberately use one of the features described below. You can export or completely delete it at any time (see 3.11).

3.2 Apple Health and Health Connect

On iPhone the app can connect to Apple Health, on Android to Health Connect. Both connections are optional; the app works fully without them.

3.2.1 Apple Health (iPhone)

If you allow it, the app reads your current heart rate, body weight, date of birth, height and biological sex from Apple Health to calculate heart-rate zones and calorie values. It can also read workouts from other apps and devices (type, time period, duration, distance, calories and source) to show them in your history; you choose in the app which workout types appear. The app does not store these workouts in its database, does not back them up to the cloud and does not export them. The app writes completed workouts back to Apple Health with duration, calories and heart-rate history so they appear alongside your other activities.

These accesses happen exclusively on your device. Apple Health data is not transferred to our servers unless it is part of a workout you transfer via cloud backup (3.4). We never use health data for advertising and do not pass it on to third parties. You manage what the app may read or write in the Health app under “Data Access & Devices”.

3.2.2 Health Connect (Android)

On Android the app can use Health Connect, the health data store on your device provided by Google. You grant or refuse access for each data type individually in Health Connect’s permission dialog and can change your choice at any time in Health Connect under app permissions.

What the app reads, and what for:

Workouts from other apps and devices (type, start and end time, and the app that recorded them), to show them in your history and to count them towards your distance goals; you choose in the app which workout types appear.
Distance within the time period of such a workout, to show it with the workout and to count it towards your distance goals.
Active calories burned, to show them with a workout, to add them to your daily nutrition balance and to show them in the statistics of a completed Kadence workout.
Heart rate as average and maximum within the time period of a workout, to show them in that workout’s details, and to show you whether heart-rate data from Health Connect is arriving at all.
Weight and height (the most recent value in each case), to pre-fill your profile, for example for the calorie target.

What the app writes: each completed workout as an exercise session with type, start and end time and the workout’s name; and your body weight when you choose to send the weight entered in the app to Health Connect. The app writes no calories and no heart-rate data to Health Connect.

Only while you use the app. The app reads Health Connect data only while it is open, not in the background. It does not request access to your older history; Health Connect therefore only provides data from 30 days before you first granted access onwards.

Storage. Workouts, distances and heart-rate values read from Health Connect are only displayed: the app does not store them in its database, does not back them up to the cloud and does not export them. Values the app takes over into your own entries — body weight and height in your profile, or the active calories of a completed Kadence workout — are stored in the local database like everything else you record (3.1); they are part of the export (3.11) and, only if you have turned on cloud backup, of the backup (3.4).

Use and sharing. These accesses happen on your device. Health Connect data is not transferred to our servers unless it is part of your own entries that you transfer via cloud backup (3.4). We use Health Connect data only to provide the features described above. We do not pass it on to third parties, do not use it for advertising, do not sell it and do not use it to assess creditworthiness or for lending purposes. We do not evaluate it; in the cloud backup it is stored encrypted as described in 3.4. Kadence’s use of information received from Health Connect adheres to the Health Connect Permissions Policy, including the Limited Use requirements. Health Connect itself is a feature of your device; the app reads and writes there locally without us transmitting data to Google.

3.3 Account (optional)

The app is fully usable without an account. You only need one to turn on cloud backup or to send feedback with a reply.

Depending on your device, there are these ways to sign in:

Magic link by e-mail. You enter your e-mail address and receive a one-time code. We process your e-mail address, the time of sign-in and the first and last name you provide.
Sign in with Apple (iPhone). Apple sends us an identifier, your e-mail address or a relay address generated by Apple, and your name the first time. We never see a password.
Sign in with Google (Android). Google gives the app a token signed by Google, which the app passes to our sign-in service. It contains your Google account identifier, your e-mail address, whether Google has verified that address, and, if available, your name. Our sign-in service checks the token’s signature and that it was issued for Kadence. We store the Google account identifier, your name and your e-mail address; we use the address only if Google marks it as verified, and only a verified address links the sign-in to an existing account with the same address. We never see a password, and the app requests no access to other Google services or data. Google is independently responsible for the sign-in process on its side; Google’s privacy policy applies. Beyond the sign-in itself, we pass no data to Google.

The account is managed by our own sign-in service, which runs on our servers (section 4); apart from Sign in with Apple and Sign in with Google, no external sign-in provider is involved. A sign-in token remains in your device’s protected storage (3.1) only if you choose “Stay signed in”.

The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).

You can delete your account at any time in the app under Profile → Account. This deletes the account with the sign-in service and all backed-up data (3.4). Data on your device is unaffected.

3.4 Cloud backup (optional, explicit consent only)

Training and nutrition data are health data within the meaning of Art. 9 GDPR. They are transferred to our servers only if you explicitly turn on backup in the app. An account alone transfers nothing. The switch is off when the app ships.

If you consent, the app transfers your own exercises, workouts and units, your training history with sets and results, your goals, your food diary, your own foods and meals, supplements and intakes, and selected settings such as body weight and nutrition goal. Catalogue content and cached third-party products from food search are not transferred.

The content is stored on our servers (location: data centre of Hetzner Online GmbH, Germany) encrypted with a separate key per account (AES-256-GCM). The server holds the content only as ciphertext and does not analyse it. This is not end-to-end encryption: the key is held on our side so you can restore your data after losing a device.

The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). We log the time and the version of the consent text you agreed to.

When you stop, we distinguish three steps:

Pausing. If you turn off backup in the app, the app stops transferring anything from that moment on. The app then asks whether the data already backed up should remain on the server. If you choose “Keep”, the encrypted backup remains stored so that you can resume backing up later or restore your data on a new device. Your consent continues to apply for this.
Withdrawing. You can withdraw your consent completely at any time: choose “Delete server data” when turning backup off, delete your account, or write to us at the e-mail address given above. We then delete your backed-up data as described below and no longer process it. The lawfulness of processing up to that point is unaffected. If you want to back up again later, the app asks for your consent again.
Deleting. When the server data or the account is deleted, we destroy your account’s key and delete the stored entries. This makes previously taken backup copies permanently unreadable as well.

In all three cases the data on your device remains unaffected.

3.5 Food search and barcode scanning

When you search for a food or scan a barcode, the app sends the search term or article number to our food service. This service queries the databases of Open Food Facts, the German Federal Food Code (BLS) of the Max Rubner-Institut and, only if nothing is found there, the FatSecret Platform. No account data, device identifier or diary entries are transmitted; technically the service sees your IP address (server logs as in 2.1).

The camera is evaluated exclusively on the device when scanning barcodes. No photos are stored or transmitted.

The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR). FatSecret is based in Australia and the USA; see section 5.

3.6 Feedback and bug reports

Under Profile → Feedback you can report bugs and wishes. You can also report a content error on exercises and workouts from our catalogue via “Report a problem”: you choose a category and can add a short text; the type and content version of the item and the app version are attached automatically, and screenshots are not possible there. The same applies to both routes as described below — with an account the report runs via your account, without an account there is no reply channel. We do not need any health information to handle a report. Above the text field, the feedback form therefore asks you, and “Report a problem” likewise asks you, to leave out health information you do not want to share and points out that screenshots can show things like weight, meals or heart rate. There are two ways:

Feedback without an account: we receive your text, the chosen category and a technical context (app version, operating system and version, device model, affected screen, language). We link the report to no account and no identifier such as the Kadence ID, and therefore cannot reply to you. This does not necessarily make the report anonymous: what you write in the text may point to you. We process your IP address for at most one hour to limit the number of reports per sender; we do not store it with the report. Screenshots are not possible this way.
Feedback with an account: we additionally link the report to your account so we can reply, and you can attach screenshots. Before you send a report with screenshots, you explicitly confirm in a checkbox that is not pre-ticked that we may process health information in your screenshots or your text to handle this report; without this confirmation you can only send without screenshots. We strip metadata (EXIF) on receipt. Screenshots are stored unencrypted on our server; only you, with your account, and we can retrieve them. They are deleted together with the report.

Reports you write offline are sent later. We keep reports and attachments for six months after closure.

Legal basis. For the report itself, the legal basis is our legitimate interest in fixing bugs and improving the app (Art. 6(1)(f) GDPR) or, for reports with an account, performance of the user relationship (Art. 6(1)(b) GDPR). If a report with screenshots contains health information, we process it solely to handle that report, based on your explicit consent via the checkbox (Art. 9(2)(a) GDPR). If you include health information in a report without screenshots despite the notice, we likewise process it only to handle that report; we base this on your deliberate sending after the notice (Art. 9(2)(a) GDPR).

Withdrawal. You can withdraw your consent at any time with effect for the future by writing to us at the e-mail address given above. We then delete the screenshots concerned or the entire report. We can only find a report sent without an account if you describe it precisely enough (for example time and wording).

When you share an exercise, workout, plan or unit, the app stores a copy of the content on our server and generates a link. You do not need an account to share.

What is shared. Only templates are shared: the structure of the exercise, workout, plan or unit with the texts you wrote for it (such as names, descriptions and notes). Training results, your history, body, health and nutrition data are not shared. Whatever you write into shared texts yourself is, however, visible to anyone who opens the link — do not put anything there that should not become public.

Who can see the content. Anyone who knows the link or QR code can open the content without signing in, import it and pass the link on; there is no password or access control. We do not list shared content anywhere, and the pages ask search engines not to include them (“noindex”). This is a request to search engines, not protection: if a link is published, the content may also show up there. So only share what anyone with the link may see. The content expires after the period shown when sharing; before that, we remove it on your request to the e-mail address given above.

For this we store pseudonymised hashes of your device identifier and of your IP address, each derived with a secret key, to limit the number of shared items per device and to trace abuse. Neither the device identifier nor the IP address is stored in plain text; the hashes are deleted together with the shared content.

Optionally you can create a sender card with a display name, description and picture. It is voluntary, not linked to your account name and shown only on your shared pages. The app inserts it into the copy of the content when you share: if you change or remove it in the app, this applies to future links; links already shared keep showing the card until they expire, unless you ask us to remove it.

The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR); for the sender card, your consent by creating it (Art. 6(1)(a) GDPR).

3.8 Exercise catalogue, images and version check

The app fetches new and updated exercises, workouts and illustrations from our content service. No account data or device identifier is transmitted; the server logs from 2.1 apply. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).

On a cold start the app also asks our configuration service whether a newer app version is available or maintenance is scheduled. Only the app identifier, operating system, app version and language are transmitted — no device identifier, no account, no sign-in token; the request is not stored. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).

3.9 Usage counts without a persistent identifier

To improve the workout catalogue, the app counts a few things per calendar day on your device and sends these counters to our own server once a day, at the earliest on the following day. We want to know which catalogue workouts are started, completed or aborted, how many own workouts and exercises are created and which timer formats are used — not who is training.

What is sent: per catalogue workout, the day’s number of starts, completions and aborts; the number of your own workouts and exercises (numbers only, no names and no contents) and the starts, completions and aborts of your own or shared workouts as a total; timer starts per format (interval, Tabata, AMRAP, EMOM, for time); app version, platform (iOS or Android) and language; a rough install age in four buckets (up to 7 days, up to 30 days, up to 90 days, older); the calendar day; and a daily token: a random value that the app generates afresh for each calendar day. It is stored with the daily snapshot and serves only to prevent a day that is sent again from being counted twice. Because every day gets a new value, submissions from different days cannot be linked through it; there is no persistent identifier that spans days.

What is never sent: no user, device, account or Kadence ID, no sign-in data and no sign-in token, no times of day (only the calendar day), no training contents (no exercises, sets, reps, weights or results), no health or body data, no nutrition data, no location. The server processes your IP address only transiently as a hash with a short expiry to limit the number of submissions per sender; it is neither stored with the counters nor retained in any other way.

Legal basis: Apart from the daily token, which is valid for one day only, the counters contain nothing that identifies you or your device; submissions from different days cannot be combined with each other or with other data to point to a person. In our assessment they are therefore not personal data within the meaning of Art. 4(1) GDPR (Recital 26). Should individual items nevertheless be regarded as personal data, we base the processing on our legitimate interest in improving the workout catalogue (Art. 6(1)(f) GDPR); the switch in the app then acts as your objection. In any case we describe the counters in full because you should know what your device sends.

Turning it off: Under Profile → Data → Usage counts you can turn off sending at any time. After that the app counts nothing, deletes the counters not yet sent from the device and sends nothing. The app points out the counting when you first launch it. Daily counters already sent cannot be recalled — they carry only the daily token of the day in question and therefore cannot be attributed to a device, not even by us.

Recipients and retention: The only recipient is us; the counters are stored on our own servers (hosting, section 4) and go to no third party. We delete the received daily snapshots after 90 days; after that only aggregated daily totals without personal reference remain, indefinitely. Data is only evaluated in aggregate.

3.10 Notifications

Supplement reminders and the rest-timer display are local notifications generated by the app on your device. There is no push service and no transfer to our servers.

3.11 Export and deletion

Under Profile → Data → Export data the app creates a file with all your data in JSON and CSV format (right to data portability, Art. 20 GDPR). The file is unencrypted and contains health data; store it accordingly. It is passed on via your device’s share menu, not via our servers.

The export file is a copy outside the app. Neither removing the app nor deleting your account affects it; delete it yourself wherever you saved or sent it.

Your data is kept in different places, each of which you delete separately:

The app’s local database (workouts, nutrition, settings, age group, safety notice record): it is deleted when you remove the app from your device; there is no separate function in the app to delete all local data. If you state in the age question that you are under 16, the lock screen offers “Delete data”: the app then deletes the local database completely. Only your age answer, so that the lock stays in place, and the entries in the device’s protected storage (see below) remain. If you are signed in, the app signs you out in the process; your backup on the server remains until the account is deleted, which the lock screen also offers.
The device’s protected storage (3.1): on iPhone, the Kadence ID (3.12) remains in the keychain even after you remove the app, so that reinstalling does not start a new trial and your subscription is found again. A stored sign-in token (3.3) may also remain there; sign out before removing the app if you do not want it to remain. Both entries are bound to this device: an encrypted backup of the device may contain them, but they can only be restored to the same device, not to a new one. If you fully reset the device without restoring such a backup, they are gone. On Android, both entries are deleted when you remove the app, and they are excluded from Android’s backup; after reinstalling, the app generates a new Kadence ID.
Our servers: you delete your account and backed-up data under Profile → Account (3.3, 3.4). Feedback and shared content are deleted after the periods in section 6, earlier on request. We delete the trial and subscription records per Kadence ID on request unless a retention obligation prevents this.
Device backups: if you create an iCloud or computer backup of your device via iOS, it may contain a copy of the local database. You manage these backups with Apple or on your computer; we have no access to them, and removing the app does not delete them. On Android, the app excludes its local database and the protected storage from Android’s backup (backup to your Google account and transfer to a new device); such a backup may only contain technical settings that components of the app keep in Android’s settings storage — once purchasing is available on Android, this may include a cache of our purchase processor with the Kadence ID (3.12).
Apple Health and Health Connect: workouts the app wrote to Apple Health or Health Connect (3.2), and on Android a body weight you sent there, may remain there even if you remove the app. You delete them in the Health app or in Health Connect.

3.12 App store and subscription

The download and the subscription are handled by the app store of your device: on iPhone by Apple via the App Store, on Android by Google via Google Play. The respective store operator is independently responsible for this; its privacy policy applies. We do not receive your payment data, your Apple ID or Google account, your name or your payment method. Via our purchase processor, however, we do receive transaction data about your subscription (see below). This is personal data too, because it can be associated with an installation via the Kadence ID and, with an account, with your account.

Kadence ID. When you first launch the app, it generates a random, pseudonymous identifier (Kadence ID). It is kept in your device’s protected storage (3.1); on iPhone it therefore survives reinstalling the app, on Android it is deleted together with the app (3.11). It is not exported, not shared with others and contains nothing that points to you. Because we do associate it with the trial, the subscription status and, with an account, your account, we treat it as personal data. Its sole purpose is to associate the trial and the subscription status with an installation; it is not used for advertising or tracking.

Purchase processor. Taking out, verifying and restoring the subscription is handled for us by the service provider RevenueCat, Inc. (San Francisco, USA) as a processor. For this, the app identifies itself to RevenueCat with the Kadence ID at every launch, including during the trial; if you are signed in, it uses your account’s identifier there instead, so the subscription applies on all your devices. RevenueCat receives the Kadence ID or account identifier, the purchase receipts issued by the store and the subscription’s transaction data (among other things product, the store’s transaction identifier, times of purchase, renewal, cancellation and expiry, price and currency, store country, subscription state, platform and app version). When connecting, RevenueCat technically sees your device’s IP address. No advertising or device identifiers and no health data are transmitted. If you restore your purchase on another device, that device’s Kadence ID is also sent to RevenueCat so the subscription can be assigned there.

Our servers. On first contact, our servers record when the trial started for each Kadence ID. RevenueCat notifies us whether and until when a subscription exists for a Kadence ID (with an account: also for your account). We store this together with the Kadence ID, the store’s transaction identifier, the relevant times and the subscription state. We also keep RevenueCat’s notifications as an event log to detect duplicates and trace errors; they contain the transaction data named above. The purpose is to check access after the trial, to prevent a second trial on the same device and to carry the subscription over to further devices. We receive no payment data, no Apple ID or Google account and no invoices.

Account. If you sign in to the app with an account, we link your device’s Kadence ID to that account. The subscription then also applies on other devices where you are signed in. If you delete your account, we remove this link; the subscription records remain, without reference to the account, for the periods set out in section 6.

The legal basis for the trial, checking the subscription and carrying it over to further devices is performance of the user relationship (Art. 6(1)(b) GDPR); for preventing a second trial on the same device, our legitimate interest (Art. 6(1)(f) GDPR); for retaining accounting records, our legal obligation (Art. 6(1)(c) GDPR). RevenueCat is based in the USA; see section 5.

3.13 Age rule and young people

Kadence may be used from the age of 16, with or without an account; use under 16 is not permitted (Terms of Use, section 4). Cloud backup (3.4) is available to you from the age of 16; you give the consent for it yourself in the app.

Age group. The app asks for your age in three groups: under 16, 16–17, 18 or older. We do not ask for a date of birth for this. The app stores the group together with the time of your answer only on your device; it is not transferred to our servers. Its sole purpose is to apply the age rule: under 16 the app does not unlock training or registration — privacy information, legal texts, support and exporting and deleting your data remain accessible —, under 18 the calorie target calculator does not offer the goal “Lose weight”, and the safety notice (3.14) appears in a version for young people. Because your age group changes over time, the app asks again after a while for the group 16–17. You can also change your age group yourself at any time in the app under Profile → Basics.

Self-declaration. The answer is a self-declaration. No age verification takes place, and we collect no further data for it.

Parents and guardians can contact us at the e-mail address given above if they believe that a child under 16 has created an account. We will then delete the account together with its backed-up data.

The legal basis for processing the age group is performance of the user relationship, of which the age rule is part (Art. 6(1)(b) GDPR).

3.14 Safety notice before your first workout

Before you start a workout for the first time, the app shows you safety information that you actively confirm. This confirmation is neither medical clearance nor consent to data processing; it only documents that the information was shown to you and that you took note of it. If the information changes in substance, the app asks again.

What is stored: a random identifier of the confirmation event, the version and revision of the notice, the language shown, the text variant (for adults or for 16- to 17-year-olds), a check value (hash) of the text shown, the time of confirmation according to your device, the app version, the method of confirmation and the entry point from which you wanted to start the workout. Training contents, health data, location and device identifiers are not included.

Only on your device: The record is kept exclusively in the local database on your device. It is not transferred to our servers, not even via cloud backup, and we have no access to it. If you remove the app, it is deleted with it; after reinstalling, the app shows the notice again.

The legal basis is our legitimate interest in showing you the safety information in a traceable way before your first workout and in recording which version you confirmed (Art. 6(1)(f) GDPR).

4. Recipients and processors

We process personal data ourselves on our own servers (website, statistics, sign-in service, mail server, cloud backup, feedback, sharing, usage counts, subscription status). Other parties receive it only as far as necessary for the purposes described, or if we are legally obliged to disclose it, for example by order of an authority or court.

Processors (Art. 28 GDPR) process data only on our instructions:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, operates the data centre running our servers.
RevenueCat, Inc., San Francisco, USA, handles in-app subscriptions (purchase, verification, restore); receives the Kadence ID (with an account: also the account ID), the store’s purchase receipts (Apple or Google) and the subscription’s transaction data, no advertising or device identifiers (see 3.12).

There is no external e-mail delivery provider; we send magic links via our own mail server.

Independent controllers decide on their own processing; their own privacy policies apply:

Apple Inc. or Apple Distribution International Ltd. for the App Store and the purchase of the subscription (3.12) and for Sign in with Apple (3.3). Apple Health (3.2) is a feature of your device; the app reads and writes there locally without us transmitting data to Apple.
Google LLC or Google Ireland Limited for Google Play and the purchase of the subscription on Android (3.12) and for Sign in with Google (3.3). Health Connect (3.2) is a feature of your device; the app reads and writes there locally without us transmitting data to Google.

Food search databases receive from our server only the search term or article number, no identifier and not your IP address (3.5); in our assessment this is not personal data: Open Food Facts, Max Rubner-Institut and FatSecret (Secure Digital Solutions Pty Ltd, Australia / FatSecret Platform, USA).

5. Transfers to third countries

Our servers are located in Germany; for the account, cloud backup, feedback, sharing and usage counts no data is transferred to third countries. During food search, a request may go to FatSecret in Australia or the USA. It is sent from our server and contains only the search term or article number — neither your IP address nor any identifier; in our assessment no personal data is transferred. To handle the subscription we transfer the data named in 3.12 to RevenueCat, Inc. in the USA; the basis is the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) as part of our data processing agreement with RevenueCat. To our knowledge (September 2026) RevenueCat is not certified under the EU-US Data Privacy Framework. Apple and Google process data under their own rules, which you can review with them.

6. Retention

Server logs: 7 days.
Visitor statistics (2.2): Umami currently stores individual page views with a pseudonymous session identifier without automatic deletion; we will set a maximum period and state it here. Aggregated figures without personal reference: indefinitely.
Usage counts of the app (3.9): received daily snapshots 90 days; aggregated daily totals without personal reference indefinitely.
Version check (3.8): nothing is stored.
Account: until you delete it.
Backed-up data (cloud): until you delete the server data, withdraw your consent or delete your account; then immediate destruction of the key. If you only pause backup (3.4), the backup remains stored.
Age group (3.13) and confirmation of the safety notice (3.14): only on your device; we store none of this on our servers.
Trial start per Kadence ID without a subscription: two years after the installation’s last contact with our server, so that no second trial starts on the same device.
Subscription status and association of Kadence IDs with the subscription (access data): for the duration of the subscription and three years thereafter, so that you can restore your subscription and questions or claims arising from the subscription can be resolved. The link to your account ends when the account is deleted.
Event log of RevenueCat’s notifications (3.12): twelve months.
Accounting records: the app store of your device (Apple App Store or Google Play) bills you for the subscription and settles with us. We keep these settlements for seven years (§ 132 of the Austrian Federal Fiscal Code, BAO). They contain no names, e-mail addresses or payment details; depending on the store, they may list individual transactions, for example with transaction number, date, product, price and country.
Abuse prevention: IP address for feedback without an account at most one hour (3.6); as a hash for usage counts at most one hour (3.9); hashes for sharing together with the shared content (3.7).
Shared content including the hashes from 3.7 and the sender card inserted into it: until the expiry shown when sharing, or until removal; final deletion follows at the latest 30 days after expiry.
Sender card in the app: on your device until you remove it.
Feedback and attachments: six months after closure.
Reports on shared content: together with the shared content, at the latest six months after receipt.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw any consent at any time with effect for the future.

Much of this you can do directly in the app: export, account deletion and withdrawing sync consent; you delete local data by removing the app (3.11). For anything else, write to the e-mail address given.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. In addition to the GDPR, the Austrian Data Protection Act (DSG) applies.

No automated decision-making or profiling takes place.

8. Changes

We update this policy when the app or the law changes. The current version is always available at this address; the date is shown above. For changes requiring new consent, the app will ask you again.

This policy is available in German and English. In case of discrepancies, the German version prevails.

Operator and controller