1. Controller
2. Scope of this policy
This policy covers the Skali iOS app, this website and requests you send us. Skali primarily stores weight and other health information on your device. There is no separate Skali account or server of our own for your weight entries. The app has no advertising or integration for advertising tracking across other apps or websites.
The app does not send your weight entries, notes, body measurements, progress photos or Apple Health values to our support service or RevenueCat. Separate processing includes technical connections and purchase data at Apple and RevenueCat, website visits, your emails, and exports, Health sharing and device backups you initiate or enable. RevenueCat may process data before a purchase; see section 6.
3. App Data
The app may store locally: weight entries, date and time, target weight, starting weight, notes, context markers, onboarding information, goals, motivation, activity level, sleep quality, stress level, weighing frequency, habits, body measurements, body fat estimates, and progress photos.
Progress photos are stored locally in the app. Camera and photo library access is used only when you take or select a photo.
The app may also store local technical onboarding events and related settings, such as the setup step reached or an optional answer about how you discovered Skali. This local storage is not website visitor analytics.
4. Apple Health
Apple Health is optional. If you enable the connection and permit the relevant iOS access, Skali can read and write body weight and read steps and sleep. These values support your weight history and local insights. You control individual data categories in Apple Health and can change or revoke access there at any time. Revocation does not automatically delete previously imported entries or data in Apple Health.
Apple Health values are not used for advertising, marketing or data trading. Technical iOS permission is distinct from any consent required under data protection law; see section 9.
5. Widgets, Live Activities, reminders and app lock
For widgets and shortcuts, the app provides a reduced local data snapshot in a shared app group. Widgets and Live Activities can show selected information outside the open app, including on the Home Screen or Lock Screen. Consider visibility to other people and your iOS display settings. An app lock does not automatically protect these system displays, exports or backups.
Reminders are triggered locally by iOS. Live Activities do not use a push token sent to our server. iOS handles Face ID or passcode authentication; Skali receives the result, not biometric facial data or your passcode.
6. Apple, RevenueCat and purchases
For Skali Plus, the app uses Apple in-app purchases and the SDK of RevenueCat, Inc., USA. The SDK is initialised when the app starts. Technical connections, assignment of a pseudonymous app user ID, and requests for offerings and existing entitlements may therefore occur even if you do not make a purchase. Pseudonymous does not mean anonymous.
Processing may include the app user ID, IP address used for the connection, app/operating-system and device information, and product, price, currency, transaction, receipt, trial, subscription and renewal status. These functions load offerings, unlock, restore and validate purchases, and enable purchase-related analysis. The app does not provide RevenueCat with weight values, Health values, notes or photos. Skali does not receive the payment details you provide to Apple as a result.
Apple processes App Store and payment data under its own terms. Further information: Apple Privacy Policy, RevenueCat Privacy Policy and RevenueCat Data Processing Addendum.
7. Email support
If you write to buidlingworld@gmail.com, we process your email address, message and included information to handle your request. The mailbox is provided through Google’s Gmail service, which also processes messages and connection data. Email is not an end-to-end encrypted channel for health information.
Please do not send weight diaries, Health exports or progress photos for general technical questions. The app version, iOS version and an issue description without health data are usually sufficient. Purchase requests may require suitable transaction details for identification; never send your Apple password or full payment details.
8. Website, hosting and cookies
This website is delivered through Cloudflare Pages, provided by Cloudflare, Inc., USA. Technical connection data is processed when you visit, including IP address, time, requested URL, browser/device information and, where applicable, the referring page. This enables delivery, security and troubleshooting. Our legitimate interest is the secure and reliable operation of the website (Art. 6(1)(f) GDPR).
The website does not use its own analytics or advertising cookies, pixels, fingerprinting or visitor profiles. There is no newsletter or contact form. Fonts and images are served with the website. Language selection uses the page URL and is not stored in your browser. This does not exclude technically necessary security functions operated by the hosting provider.
Hosting information: Cloudflare Privacy Policy. Opening an external link, such as an App Store link, means the destination provider processes your visit under its own privacy policy.
9. Purposes and legal bases
- Contract-related communication and processing necessary to provide agreed purchase and subscription features: Art. 6(1)(b) GDPR.
- Website delivery and protection and necessary technical security measures: Art. 6(1)(f) GDPR. Our interest is reliable operation protected against abuse.
- General enquiries unrelated to a contract: Art. 6(1)(f) GDPR; our interest is responding to your request.
- Processing that requires consent, particularly optional analysis that is not necessary: Art. 6(1)(a) GDPR.
- Retention or disclosure required by a specific legal obligation: Art. 6(1)(c) GDPR.
Health data has additional protection. Where our processing requires explicit consent, Art. 9(2)(a) GDPR is also relevant. This privacy policy does not obtain consent. Device permission or merely using the app does not automatically replace informed, explicit consent. Processing based on consent must stop for the future when that consent is withdrawn.
You do not have to email us health data. The website cannot be delivered without necessary connection data; purchases and entitlements cannot be associated without the required purchase data. You can decline optional Health access.
10. Recipients and disclosures
Depending on the feature used, Apple (App Store and Apple services you enable), RevenueCat (purchase management), Cloudflare (website delivery), and Google (email mailbox) receive the data described in the relevant sections. You choose the recipient or destination app when exporting data. Providers may use further service providers to deliver their services. Data is disclosed to authorities where legally required.
This list does not mean that every provider receives your health values: Skali does not provide the website or purchase services with local weight histories or progress photos.
11. Processing outside the EEA
The international providers named above may process data outside the European Economic Area, particularly in the United States. This is separate from local storage of your weight values. The processing involved depends on the service used and your Apple or device settings.
RevenueCat’s published Data Processing Addendum provides EU Standard Contractual Clauses for covered restricted transfers and supplementary provisions for the United Kingdom and Switzerland. A transfer subject to GDPR must actually have an applicable transfer basis and any necessary additional safeguards. Provider privacy policies alone do not replace these requirements. You can request information about the safeguards used for your data and a copy through our contact above.
12. Retention and Deletion
Locally stored app data remains stored until you delete it in the app or uninstall the app including its data (rather than only offloading it). Data in Apple Health is not automatically removed when the app is deleted. Uninstalling does not delete external purchase records. You can contact us to request access to or deletion of data processed for us through RevenueCat. Necessary evidence of existing purchases and legal retention duties may prevent immediate complete deletion. Apple separately manages its own transaction data.
Support messages are retained for as long as needed to handle the request and, where applicable, satisfy legal retention obligations or resolve legal claims. Technical hosting data is handled under the security and retention rules of the respective provider.
Depending on your iOS settings, local app data may be included in device backups. Exports, shared files and backups are not removed when data is deleted within the app; manage those copies separately. Deleting the app does not cancel a subscription.
13. Your privacy rights
GDPR applies to processing in the context of our establishment in Germany, including if you live outside the EU. Subject to the relevant legal conditions, you can request access, rectification, erasure, restriction and data portability. Portability concerns automated processing based on consent or a contract. This does not exclude additional applicable rights in your country.
Objection: Under Art. 21 GDPR, you can object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time for future processing; this does not affect the lawfulness of previous processing.
Email buidlingworld@gmail.com. We generally respond to GDPR requests within one month at the latest. We explain any legally permitted extension within that month. If there are reasonable doubts about identity, we request only the information needed to resolve them. We do not routinely require identity document copies or health data. We have no remote access to exclusively local app data; you can still address requests about our support or purchase processing to us.
You can complain to a data protection supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred. The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is a contact for our place of business.
14. Children and Health
The app is not directed specifically at children. It is intended for personal tracking and motivation and does not replace medical advice, diagnosis, or treatment.
This audience description does not replace legally required consent from a parent or guardian. An App Store age rating is not consent under data protection law.
15. Local insights and optional system features
Weight trends, patterns and reports are calculated in the app. On supported devices, wording may be generated using Apple’s on-device Foundation Models system. The app does not connect an external AI service for this purpose or send weight entries to OpenAI. Hosting this website through Cloudflare is separate from these local app features.
No automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR is made. Statistical associations and forecasts offer perspective and are not diagnoses.