1. Controller
2. Scope of this policy
This policy covers the Skali iOS app, this website and requests you send us. Skali primarily stores weight and other health information on your device. There is no separate Skali account or server of our own for your weight entries. The app has no advertising or integration for advertising tracking across other apps or websites.
The app does not send your weight entries, notes, body measurements, progress photos or Apple Health values to our support service or RevenueCat. Separate processing includes technical connections and purchase data at Apple and RevenueCat, website visits, your emails, and exports, Health sharing and device backups you initiate or enable. RevenueCat may process data before a purchase; see section 6.
3. Data on your device
Skali stores your weight journal with dates, notes and context markers, profile and goals, habits, body measurements, progress photos and calculated trends and reports locally. Selected or captured photos are copied into app storage. Depending on device settings, local files may be included in device backups. Skali does not provide its own cloud synchronisation.
The app also retains up to 300 local feature events, such as timestamps, the feature used, a random session identifier and technical details. This is independent of the separate analytics choice during onboarding. Onboarding events are a separate list: they are stored with the corresponding consent, limited to 200 events and removed when consent is declined. The reviewed app code does not transmit these event lists to a separate analytics service.
4. Apple Health and background updates
Apple Health is optional. With permission for each data type, Skali can read and write body weight and read steps, sleep and menstrual flow. Local context analysis reads up to 180 days of steps and sleep and up to 210 days of menstrual-flow dates. These inputs help put possible patterns over time into perspective; they are not used for diagnosis. Skali does not write sleep, step or cycle data to Apple Health.
With access enabled, iOS can notify the app of changed step data in the background. The app maintains a local cache and requests hourly background delivery; iOS determines actual delivery. Health data may temporarily be unavailable while the device is locked.
You can allow each data type separately and revoke access in Apple Health at any time. Revocation does not automatically erase previously imported data. Resetting Skali stops background updates but does not bulk-delete Apple Health records. Manage those separately in Apple Health. Skali does not use Health data for advertising or data trading and does not send it to RevenueCat.
5. Widgets, Live Activities, reminders and app lock
For widgets and shortcuts, the app provides a reduced local data snapshot in a shared app group. Widgets and Live Activities can show selected information outside the open app, including on the Home Screen or Lock Screen. Consider visibility to other people and your iOS display settings. An app lock does not automatically protect these system displays, exports or backups.
Reminders are triggered locally by iOS. Live Activities do not use a push token sent to our server. iOS handles Face ID or passcode authentication; Skali receives the result, not biometric facial data or your passcode.
6. Apple, RevenueCat and purchases
For Skali Plus, the app uses Apple in-app purchases and the SDK of RevenueCat, Inc., USA. The SDK is initialised when the app starts. Technical connections, assignment of a pseudonymous app user ID, and requests for offerings and existing entitlements may therefore occur even if you do not make a purchase. Pseudonymous does not mean anonymous.
Processing may include the app user ID, IP address used for the connection, app/operating-system and device information, and product, price, currency, transaction, receipt, trial, subscription and renewal status. These functions load offerings, unlock, restore and validate purchases, and enable purchase-related analysis. The app does not provide RevenueCat with weight values, Health values, notes or photos. Skali does not receive the payment details you provide to Apple as a result.
Apple processes App Store and payment data under its own terms. Further information: Apple Privacy Policy, RevenueCat Privacy Policy and RevenueCat Data Processing Addendum.
7. Email support
If you write to buidlingworld@gmail.com, we process your email address, message and included information to handle your request. The mailbox is provided through Google’s Gmail service, which also processes messages and connection data. Email is not an end-to-end encrypted channel for health information.
Please do not send weight diaries, Health exports or progress photos for general technical questions. The app version, iOS version and an issue description without health data are usually sufficient. Purchase requests may require suitable transaction details for identification; never send your Apple password or full payment details.
8. Website, hosting and cookies
This website is delivered through Cloudflare Pages, provided by Cloudflare, Inc., USA. Technical connection data is processed when you visit, including IP address, time, requested URL, browser/device information and, where applicable, the referring page. This enables delivery, security and troubleshooting. Our legitimate interest is the secure and reliable operation of the website (Art. 6(1)(f) GDPR).
The website does not use its own analytics or advertising cookies, pixels, fingerprinting or visitor profiles. There is no newsletter or contact form. Fonts and images are served with the website. Language selection uses the page URL and is not stored in your browser. This does not exclude technically necessary security functions operated by the hosting provider.
Hosting information: Cloudflare Privacy Policy. Opening an external link, such as an App Store link, means the destination provider processes your visit under its own privacy policy.
9. Purposes and legal bases
- Contract-related communication and processing necessary to provide agreed purchase and subscription features: Art. 6(1)(b) GDPR.
- Website delivery and protection and necessary technical security measures: Art. 6(1)(f) GDPR. Our interest is reliable operation protected against abuse.
- General enquiries unrelated to a contract: Art. 6(1)(f) GDPR; our interest is responding to your request.
- Processing that requires consent, particularly optional analysis that is not necessary: Art. 6(1)(a) GDPR.
- Retention or disclosure required by a specific legal obligation: Art. 6(1)(c) GDPR.
Health data has additional protection. Where our processing requires explicit consent, Art. 9(2)(a) GDPR is also relevant. This privacy policy does not obtain consent. Device permission or merely using the app does not automatically replace informed, explicit consent. Processing based on consent must stop for the future when that consent is withdrawn.
You do not have to email us health data. The website cannot be delivered without necessary connection data; purchases and entitlements cannot be associated without the required purchase data. You can decline optional Health access.
10. Recipients and disclosures
Depending on the feature used, Apple (App Store and Apple services you enable), RevenueCat (purchase management), Cloudflare (website delivery), and Google (email mailbox) receive the data described in the relevant sections. You choose the recipient or destination app when exporting data. Providers may use further service providers to deliver their services. Data is disclosed to authorities where legally required.
This list does not mean that every provider receives your health values: Skali does not provide the website or purchase services with local weight histories or progress photos.
11. Processing outside the EEA
The international providers named above may process data outside the European Economic Area, particularly in the United States. This is separate from local storage of your weight values. The processing involved depends on the service used and your Apple or device settings.
RevenueCat’s published Data Processing Addendum provides EU Standard Contractual Clauses for covered restricted transfers and supplementary provisions for the United Kingdom and Switzerland. A transfer subject to GDPR must actually have an applicable transfer basis and any necessary additional safeguards. Provider privacy policies alone do not replace these requirements. You can request information about the safeguards used for your data and a copy through our contact above.
12. Retention, export and deletion
Local health and profile data generally remains on your device until you delete it. The reset function removes weight entries, habits, body measurements, profile information, photo references and step caches, and ends reminders and Live Activities. It does not currently erase every technical file: the local feature-event list remains, and technical backup copies of damaged sync files may remain. Failed file removals may be retried later.
Deleting individual journal entries does not automatically delete source records from other apps in Apple Health. Even after a full app reset, values previously written to Apple Health may remain there. Remove Health records separately in Apple Health. Fully uninstalling an app including its data differs from offloading it.
CSV and PDF exports include the weight, goal and body-measurement information provided for the selected period. They are not complete archives of all photos, settings and habits. Export files are initially created in a temporary directory; you choose the destination app and recipient when sharing. Resetting the app does not erase exports, shared copies or device backups.
Support messages are retained while required to handle the request or meet specific legal retention obligations and legal claims. Hosting and purchase data follows the relevant service and retention rules. Contact us for access to or deletion of data in our support and purchase processes. Purchase evidence and legal obligations may prevent immediate deletion. Apple maintains its own transaction records. Deleting the app or its data does not cancel a subscription.
13. Your privacy rights
GDPR applies to processing in the context of our establishment in Germany, including if you live outside the EU. Subject to the relevant legal conditions, you can request access, rectification, erasure, restriction and data portability. Portability concerns automated processing based on consent or a contract. This does not exclude additional applicable rights in your country.
Objection: Under Art. 21 GDPR, you can object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time for future processing; this does not affect the lawfulness of previous processing.
Email buidlingworld@gmail.com. We generally respond to GDPR requests within one month at the latest. We explain any legally permitted extension within that month. If there are reasonable doubts about identity, we request only the information needed to resolve them. We do not routinely require identity document copies or health data. We have no remote access to exclusively local app data; you can still address requests about our support or purchase processing to us.
You can complain to a data protection supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred. The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is a contact for our place of business.
14. Children and Health
The app is not directed specifically at children. It is intended for personal tracking and motivation and does not replace medical advice, diagnosis, or treatment.
This audience description does not replace legally required consent from a parent or guardian. An App Store age rating is not consent under data protection law.
15. Local analysis and Apple Intelligence
Trends, patterns, estimates and reports are calculated locally from your entries and permitted context data. On supported devices running iOS 26 or later, Apple Foundation Models can generate wording from calculated facts, periods, habits, milestones and goals. The model must be available on the device. Skali does not integrate a separate external AI service for this.
Activation differs by feature: pattern narration checks Apple Intelligence activation and the separate consent setting. Smart reports currently use the report or Apple Intelligence setting. The separate consent setting alone is therefore not a single off switch for every report feature. Disable smart reports and Apple Intelligence as well if you do not want model-generated text.
Generated text may be inaccurate. Patterns do not establish causes, and forecasts do not promise results. No automated decisions with legal or similarly significant effects within Article 22 GDPR are made.