Privacy Policy

Thomas Schwabauer, Kirschenwäldchen 8D, 35578 Wetzlar, Germany, email: kontakt@physiqueforge.de

We operate the website, backend, database, AI service and file storage (for progress photos, recipe and product images) ourselves on a rented server of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, located in Germany. When you access our services, technically necessary data is processed automatically (IP address, date/time, page accessed, browser and operating system information).

Purpose

Provision, security and stability of the website and app

Data

Server logs, all content stored in the app

Legal basis

Art. 6 (1) (b) GDPR (performance of a contract) and (f) GDPR (legitimate interest in secure operation)

Recipient

STRATO AG as processor

Third country

No

Server logs are deleted automatically after a short time.

Registration and sign-in for the app and website are handled by Auth0, a service of Okta, Inc., 100 First Street, San Francisco, CA 94105, USA. We use an Auth0 tenant in the EU region. You can sign in with an email code or, optionally, with your Google or Apple account; in the latter case, we only receive the information needed for sign-in (email address, name) from Google or Apple. We send sign-in codes via our email server at STRATO.

Purpose

Account management and secure sign-in

Data

Email address, name, account identifier, sign-in logs (time, IP address, device/browser)

Legal basis

Art. 6 (1) (b) GDPR (performance of a contract)

Recipient

Okta, Inc. (Auth0) as processor

Third country

Stored in the EU. A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

In the app you can record training plans, workouts, nutrition, body measurements, weight, complaints and progress photos. This data may constitute health data within the meaning of Art. 9 GDPR. We process it solely to provide the app’s features on our own servers (section 2) and on the basis of your explicit consent (Art. 9 (2) (a), Art. 6 (1) (a) GDPR), which you give during registration and can withdraw at any time by deleting your account. This data is not shared with advertising or analytics services.

If you enable the connection in the app’s settings, the app reads data from Apple Health (iOS) or Health Connect (Android). The app only reads; it does not write any data back. The following is read: steps, distance, floors climbed, active and basal energy, heart rate, resting heart rate, heart rate variability, blood pressure, oxygen saturation, sleep stages and body weight.

The values are cached on our server so that the app can display them across devices; if you wish, your body weight is transferred to your body measurements. Health data is never used for advertising, never for usage analytics and never for profiling, and it is not shared with third parties.

Purpose

Displaying your activity, vital and sleep data and transferring your body weight

Data

the health data listed above (special category under Art. 9 GDPR)

Legal basis

Your explicit consent (Art. 9 (2) (a), Art. 6 (1) (a) GDPR), given via the Apple Health or Health Connect permission prompt

Recipient

No third parties; stored on our servers (section 2)

Third country

No

You can withdraw your consent at any time by disabling the connection in the app or by revoking PhysiqueForge’s permission in Apple Health or Health Connect. Values already transferred are deleted together with your account.

Purchases and subscriptions (PhysiqueForge Pro) are processed by Apple (App Store) or Google (Google Play); only they receive your payment details, not us. Apple and Google act as independent controllers under their own privacy policies. To manage your subscription status, we use RevenueCat, Inc., USA. RevenueCat reports purchase and renewal events to our server.

Purpose

Unlocking and managing subscriptions, restoring purchases

Data

Account identifier, purchased product, purchase and expiry time, price and currency, store country, purchase receipts, device type and app version

Legal basis

Art. 6 (1) (b) GDPR (performance of a contract)

Recipient

RevenueCat, Inc. as processor; Apple or Google as independent controllers

Third country

A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

Users without a Pro subscription can choose to watch a rewarded video in the app. For this we integrate Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The AdMob SDK is initialised when the app starts; the app only loads ads when you request a video. Health, training and nutrition data is never transmitted to AdMob.

Purpose

Serving ads, reach measurement, fraud prevention; personalised ads with your consent

Data

Device advertising ID (IDFA/Android Advertising ID), IP address, device and app information, interactions with the ad

Legal basis

Your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which we request before ads are loaded for the first time; on iOS additionally the App Tracking Transparency permission

Recipient

Google Ireland Limited and Google LLC

Third country

A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

Without consent, AdMob only shows non-personalised ads. You can change or withdraw your choice at any time in the app under Settings → “Ad consent”; on iOS additionally under Settings → Privacy & Security → Tracking.

If you consent in the app, we use PostHog to record how the app is used (e.g. which screens are opened and which features are used) in order to improve it. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA; we exclusively use the EU cloud with its data centre in Frankfurt am Main. With the same consent, we use PostHog to roll out new features gradually.

Purpose

Statistical analysis of app usage and gradual rollout of features

Data

Pseudonymous user identifier, usage events, app version, device type, operating system, approximate location derived from the IP address

Legal basis

Your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG)

Recipient

PostHog Inc. as processor

Third country

Stored in the EU. A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

You can withdraw your consent at any time in the app’s settings; after that, no more usage data is recorded.

Some features of the app process your input with AI models from external providers. Only what is needed for the respective request is transmitted.

a) Recipe import from Instagram Reels

If you submit a Reel link, our own AI service retrieves the publicly available video via HikerAPI and has it analysed by Google Gemini (Google Ireland Limited) to recognise ingredients and preparation steps. Only the link and the public video are transmitted, no data from your account.

b) AI assistant, meal scan and username check

The AI assistant, the nutrition estimate from a meal photo and the check of your username for offensive content use models from OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland). The respective text input, meal photo or requested username is transmitted. Voice commands to the assistant are converted into text by your operating system’s speech recognition (Apple or Google).

Purpose

Providing the AI feature you requested

Data

Reel link and public video; text input, meal photos, username

Legal basis

Art. 6 (1) (b) GDPR (provision of the requested feature)

Recipient

HikerAPI, Google Ireland Limited (Gemini), OpenAI Ireland Ltd., each as processor

Third country

A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

Please do not enter any information in AI features that you do not want to transmit. Health data from Apple Health or Health Connect is not transmitted to AI providers.

For optional push notifications (e.g. reminders), we use Firebase Cloud Messaging, a service of Google Ireland Limited. We do not use any other Firebase services; sign-in and data storage do not run through Firebase.

Purpose

Delivery of push notifications

Data

Device token, content of the notification

Legal basis

Your consent via your device’s notification permission (Art. 6 (1) (a) GDPR); you can disable it there at any time

Recipient

Google Ireland Limited as processor

Third country

A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

For nutrition information and product images, our server queries the public Open Food Facts database and caches product images on our own server. No personal data about you is transmitted to Open Food Facts.

On the website we use Google Analytics 4 (Google Ireland Limited) to statistically analyse website usage — only if you consent in the cookie banner.

Purpose

Statistical analysis of website usage

Data

IP address, device and browser information, pages visited, cookie identifier

Legal basis

Your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG)

Recipient

Google Ireland Limited and Google LLC

Third country

A transfer to the USA is possible; it is safeguarded by the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or by the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

You can withdraw your consent at any time with effect for the future via the cookie settings.

When technical errors occur in the app, website or AI service, we collect diagnostic data. Processing takes place exclusively on our own server using the GlitchTip software (section 2); no data is transmitted to the provider Sentry — we only use its open-source software library.

Purpose

Detecting and fixing errors

Data

Error message and stack trace, app version, device type, operating system, pseudonymous account identifier

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in error-free operation)

Recipient

No third parties

Third country

No

If you subscribe to our newsletter, we process your email address on the basis of your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email.

We store your data for as long as your account exists. You can delete your account in the app at any time (Profile → “Delete account”). We then delete, without undue delay and irrevocably, all data in our database, including all training, nutrition, health and media data, as well as your account at Auth0. Our page Delete your account and data explains how to have your account deleted without the app.

The following is not deleted automatically: purchase receipts held by Apple, Google and RevenueCat, insofar as statutory retention obligations apply; pseudonymous usage data held by PostHog, which is removed once the provider’s retention period expires. On request to kontakt@physiqueforge.de, we will also arrange deletion there, unless a retention obligation prevents it.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected. You also have the right to lodge a complaint with a data protection supervisory authority — the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).