Privacy policy

The short version

• We collect what the app needs to work: your weigh-ins, your goal, your settings, a sign-in identifier from Apple, and whether your subscription is active.
• Your weigh-ins are stored on your iPhone and on our own server in Germany. They are never sold, never used for advertising and never sent to an analytics or advertising company.
• We have no ads, no tracking SDKs and no analytics in the app. This website sets no cookies.
• You can export everything as a file, and deleting your account in the app deletes your data from our server.

Who is responsible for your data

The data controller is the business that makes Nala Tracker:

We are a small business and are not required to appoint a data protection officer. Write to support@nalatracker.app about anything on this page and a person will answer.

What we collect, why, and on what legal basis

The legal bases below are the ones in the EU General Data Protection Regulation (GDPR). Body weight, and goals expressed as a weight, are data concerning health under Article 9 GDPR, which gets stricter treatment than ordinary personal data.

Your weigh-ins and your goal

For each weigh-in: the date and the weight. For your goal: the target weight, an optional target date and the weight you started from. We use these only to show you your history, your trend and your progress, and to sync them between your devices and keep them safe if you lose your phone.

Legal basis: your explicit consent (Article 9(2)(a) and Article 6(1)(a) GDPR), which the app asks for before your weigh-ins are stored on our server. You can withdraw it at any time — seeyour rights — and withdrawing it does not make anything we did before unlawful.

Your account

You sign in with Apple. Apple gives us a stable identifier that is unique to you and this app, and — the first time only — an email address, which is either your real one or a private relay address that forwards to you, as you choose on Apple’s sign-in screen. We never see your Apple password. We also store your unit preference (kilograms or pounds) and when your account was created, and we keep sign-in sessions (stored only as one-way hashes) so you stay signed in.

We do not send marketing email. We keep your address so we can reach you about your account if we have to — for example about a security problem or a change to these terms.

Legal basis: it is necessary to provide the service you signed up for (Article 6(1)(b)).

Your subscription

Apple takes your payment; we never see your card or bank details. Our subscription provider, RevenueCat, tells the app and our server whether your subscription is active, which plan it is and when it renews or ends. It knows you only by a random identifier we create — it does not receive your weigh-ins, your goal or your email address.

Legal basis: necessary to provide the service (Article 6(1)(b)).

Error reports

When our server hits an unexpected error, it sends a technical report to Sentry so we can fix it. Reports are configured to carry no request contents, no headers, no cookies and no IP addresses, which means no weight values; a report can include the random identifier of the account the error happened to. The iPhone app itself contains no crash-reporting or analytics software.

If you have chosen to share crash data with app developers in your iPhone’s settings, Apple may also give us crash logs and anonymous usage statistics for the app. That is between you and Apple, and you can turn it off in Settings → Privacy & Security → Analytics & Improvements.

Legal basis: our legitimate interest in running a reliable, secure service (Article 6(1)(f)).

Security and abuse protection

Our server briefly uses your IP address to limit how many sign-in attempts can come from one address. That count is kept in memory for about a minute and is not written to our logs or database. Our server logs record technical events, such as an account being deleted, by the account’s random identifier — not by name, email or IP address.

Legal basis: our legitimate interest in protecting the service and its users (Article 6(1)(f)).

When you contact us

If you email us — directly, or with “Send feedback” in the app — we receive your email address and what you write. The app adds three lines so we can tell which build you are on: the app version, the platform and the iOS version. You can see and edit all of it before you press send. Nothing about your weight is included.

Legal basis: our legitimate interest in answering you and improving the app (Article 6(1)(f)), or providing the service where your message is about your account (Article 6(1)(b)).

What we never do

• Sell, rent or trade your data.
• Show ads, or share anything with advertising networks or data brokers.
• Send weight values to any analytics, marketing or crash-reporting service.
• Use your data to train AI models, or to make automated decisions about you.

What stays on your iPhone

The app keeps a copy of your weigh-ins and settings in its own storage on your phone, so it works without a connection. Your sign-in session is kept in the iPhone’s secure keychain. Reminders are scheduled on the phone by iOS; their contents never pass through our server. Signing out removes the app’s copy of your data from the phone.

Who else handles your data

We use a small number of service providers. Each handles data only on our instructions, under a data processing agreement, except Apple, which acts on its own account where marked.

Transfers outside the EU

Our server and its database are in Germany, our backups are stored in the EU, and error reports are stored in Sentry’s EU region. Some providers above are US companies, so data they handle may be accessed from or processed in the United States. Where that happens we rely on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s standard contractual clauses in our agreement with the provider. Write to us for a copy of the relevant safeguards.

How long we keep it

• Your account, weigh-ins and goal: until you delete your account. We delete them immediately when you do.
• Backups: each nightly backup is kept for 30 days and then deleted, so data you delete disappears from backups within about 30 days. A backstop rule removes any backup older than 45 days if the normal clean-up ever fails.
• Sign-in sessions: expire after 60 days without use, and end immediately when you sign out.
• Error reports: kept by Sentry for its standard retention period, after which they are deleted.
• Server logs: overwritten on a rolling basis as new entries are written.
• Support emails: for as long as we need them to help you, and no longer than two years after your last message.
• Subscription records held by RevenueCat and Apple are not removed by deleting your account in the app. Ask us and we will have RevenueCat delete its record of you. Apple keeps its own purchase records under its own policy.

Your rights

Under the GDPR you have the right to:

• Get a copy of your data. Settings → Export as CSV in the app gives you every weigh-in at any time. Write to us for everything else we hold.
• Take it elsewhere (data portability). The export is a plain file any spreadsheet can open.
• Correct it. Edit or delete any weigh-in in the app, or ask us.
• Delete it. Settings → Delete account in the app deletes your account and all its data from our server. You can also ask us by email.
• Withdraw your consent to us processing your weight data, at any time. Deleting your account is the quickest way; or write to us and we will delete your weigh-ins and goal from our server.
• Object to processing based on our legitimate interests, and ask us to restrict processing while a question is being resolved.

We answer within one month. If you are unhappy with how we handle your data, please tell us first — and you can always complain to a data protection authority. Ours is the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. You can also complain to the authority in the EU country where you live.

How we protect it

• Everything between the app and our server is encrypted in transit (HTTPS).
• There are no passwords to leak: you sign in with Apple, and our sessions are stored only as one-way hashes.
• Backups are encrypted with a key kept offline, away from the server and from the backup storage.
• The server is hardened, receives security updates automatically and accepts administrative access by key only.
• Error reports are stripped of request contents before they leave the server, and an automated test checks it.

If we ever have a breach that puts your data at risk, we will notify the Danish Data Protection Agency and, where the law requires it, you.

Children

Nala Tracker is not meant for children. You must be at least 16 to use it.

This website

nalatracker.app sets no cookies, runs no analytics or tracking scripts, and loads no fonts, images or scripts from anyone else. It is hosted by Cloudflare, which necessarily processes your IP address and browser details to deliver the pages and to protect the site from attacks (our legitimate interest, Article 6(1)(f)). If you email us from the website, the section above on contacting us applies.

Changes to this policy

If we change what we collect or why, we will update this page and its date before the change takes effect, and tell you in the app if the change is significant. If a change needs your consent, we will ask for it.