Privacy policy of Pencal

1. Summary

• Pencal is a diary for your treatment with a weight-loss injection. You enter health data: injections, weight, side effects, notes. This is especially protected data.
• You need an account (email address, Apple or Google). Your entries are stored on your device. With your explicit consent they are transferred in encrypted form after you sign in and stored in your account at Google Firebase in Frankfurt am Main (EU).
• We show no advertising, use no tracking and do not sell data.
• Error reports (Sentry, stored in the EU) are switched on until you switch them off. They contain no health data.
• Usage statistics (PostHog, EU) exist only if you agree. After you sign in they are linked to the ID of your account, but never to health data.
• For purchases we use the App Store or Google Play and the service RevenueCat. Purchase data goes there, but no health data.
• You can delete everything in the app: Settings > Delete all data or Settings > Account > Delete account. Without the app, send an email to support@glp1tracker.de.

2. Controller

The controller under the GDPR is:

Jan Colak, Jürgen-Töpfer-Straße 4, 22763 Hamburg, Deutschland

Email: support@glp1tracker.de

We have not appointed a data protection officer.

3. What data we process, why and on what basis

Without your consent to the health data the app cannot store entries. The statistics are voluntary, and you can switch off the error reports. Otherwise you are only required to provide purchase data, if you buy Plus.

4. Legal bases and your consent

Health data is specially protected (Art. 9 GDPR). Before the app stores health data we ask for your explicit consent (Art. 9(2)(a) GDPR). It covers storage on your device and, after sign-in, in your account in the cloud (Google Firebase, Frankfurt am Main). Consent is requested on every device on which you set up Pencal. Statistics and error reports are separate.

If the wording or purpose of the consent changes, the app asks you again. Until you agree, it uploads nothing.

You can withdraw any consent at any time with effect for the future: Settings > Privacy. Withdrawing is as easy as giving consent. If you withdraw consent to the health data, the app asks whether it should delete your data. Without consent it stores no health data any more. The lawfulness of processing before the withdrawal is not affected.

For your account (sign-in, email address) the legal basis is the usage contract (Art. 6(1)(b) GDPR). For error reports, app updates and the website it is our legitimate interest (Art. 6(1)(f) GDPR).

5. Storage on your device and in your account

The app stores your entries in the protected storage of the app on your device. After sign-in and with your consent it transfers the entries over an encrypted connection (TLS) to your account at Google Cloud Firestore (region europe-west3, Frankfurt am Main) and keeps both copies in sync. Without internet the app keeps working; changes are uploaded as soon as a connection is available again.

The security rules of the database allow each person only their own area and only with a confirmed email address (Apple and Google count as confirmed). As the operator we have technical access to the database. There is no end-to-end encryption. We do not read your entries for our own purposes.

Not sent to the cloud: your proof of consent, the switches for statistics and error reports, the appearance, the error log, the purchase status from the store and a remembered password for backup files.

If you lose the device or delete the app, your entries stay in your account. After you sign in on a new device the app loads them again. Your device may also be backed up by the operating system (for example iCloud backup or Android backup); the app database can be part of it. This depends on your system settings and the terms of Apple or Google.

6. Account and sign-in

Sign-in works through Google Firebase Authentication. You can sign in with an email address and a password or with Apple or Google. With email sign-in you must confirm the address; Firebase sends the emails for confirmation and for resetting the password. Google does not store the password in plain text.

If you sign in with Apple or Google, Firebase receives the ID and the email address from the provider. With Google, Firebase also takes the name and the address of the profile picture from your Google profile into your account, even if the app neither shows nor uses them. With Apple it can be the relay address if you hide your email address. For the sign-in itself Apple and Google are independent controllers and have their own privacy notices.

Technically, Google receives your IP address at every sign-in. The account ID is a random string; the app shows the email address only to you in the settings.

7. Error reports (Sentry)

So that we can find crashes and errors, the app sends a report to Sentry (Functional Software, Inc., EU data region) when an error occurs. The report contains only: type of error, error code, the place in the program (list of called program parts with file names and lines), app version, operating system and version, platform, time and a random ID of the report.

The report never contains health data (weight, medication, dose, entries, notes), no email address, no ID of your account, no device name and no screen contents. A filter in the app rebuilds every report before sending from these allowed details only. There is no session recording, no performance measurement, no screen recording and no history of user actions.

When sending, your IP address technically reaches the Sentry server. We have set Sentry not to store it.

The switch “Send error reports” is on until you switch it off (at first start and under Settings > Privacy). Reports are sent only after you have seen the notice and consented to the storage of your data. When switched off the app sends no reports; the app works the same.

8. Usage statistics (PostHog, only with consent)

If you agree at first start or later under Settings > Privacy, the app sends neutral events to PostHog (PostHog, Inc., Cloud EU, servers in Frankfurt am Main). Examples: app opened, setup completed, first entry saved, paywall shown, purchase completed, backup created, pack saved, error shown. In addition: app version, platform, language, subscription status and, for errors, the error code.

We never send: medication, dose, date of an injection, weight, side effects, body measurements, injection site, notes or free text. The type of an event does show that you use the app and which functions you open. The app records no screens and uses no automatic capture.

ID: before sign-in the app uses a randomly generated ID. After sign-in with a confirmed email address the statistics are linked to the ID of your account (not to your email address) so that we can help you with problems. This is personal data. Events that arise before your consent are not sent, not even later. We have set PostHog to discard IP addresses.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Withdrawal: Settings > Privacy, switch off “Send statistics”. The app then sends nothing, discards waiting events and resets the ID on the device. Events already sent we delete on request by email to support@glp1tracker.de by hand in the PostHog project; the app does not trigger this deletion itself. This also applies if you delete your account.

9. Purchases and subscription (RevenueCat, Apple, Google)

The purchase of Plus is handled by your App Store (Apple) or Google Play. We receive no payment data such as card number or bank details. Apple and Google are independent controllers for this and have their own privacy notices.

So that the app knows whether Plus is active we use RevenueCat, Inc. (USA). RevenueCat receives a randomly generated ID, the receipt or purchase token from Apple or Google, the purchase status, the product bought and, technically, your IP address. RevenueCat receives neither your entries nor your email address nor the ID of your account. The legal basis is the contract for Plus (Art. 6(1)(b) GDPR). RevenueCat processes the data on our behalf.

You find your ID for purchases under Settings > Privacy > My ID. With it we can find and delete purchase data on your request. You cancel a subscription in the settings of your app store.

10. App updates (Expo)

At start the app checks whether there is an update for its program part and loads it through the update service of Expo (650 Industries, Inc., USA). With every request, platform, app version, the ID of the installed update, a lasting random installation ID and, technically, your IP address go to Expo. The ID is not linked to your account. The purpose is delivering updates; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

11. Transfers to third countries

Google Cloud Firestore stores your entries in Frankfurt am Main (EU). Google is part of Google LLC (USA); access from the USA cannot be ruled out. Error reports go to the EU data region of Sentry, statistics to PostHog Cloud EU in Frankfurt am Main. Sentry, PostHog, RevenueCat and Expo are companies based in the USA; RevenueCat and Expo process data in the USA.

Where data is transferred to the USA or accessible from there, we rely on the adequacy decision for the EU-US Data Privacy Framework if the recipient is certified, and otherwise on the standard contractual clauses of the EU Commission in the providers' data processing terms.

12. Notifications

Reminders are local notifications on your device. They do not pass through our server. If you decline notifications the app keeps working, only without reminders. By default a notification names no medication. Under Reminders you can switch on that it names medication and dose; the text may then be readable by others on the lock screen.

13. Backup file, export, doctor report and progress picture

A backup file, a CSV export, a doctor report (PDF) and a progress picture contain data from your entries. A backup file is encrypted with a password that only you know. The CSV file and the doctor report are not encrypted. You decide through the share sheet of your device where you save the file or whom you send it to (for example the Files app, email, a doctor's office). From that moment the terms of that service or recipient apply. We have no access and no copy. Give reports only to people you know and trust.

If you switch it on, the app remembers the password of the backup file in the protected keychain of your device. On import the app reads a backup file that you select. The file stays on your device and is not sent to us.

14. Website glp1tracker.de

The website consists of simple pages without cookies, without third-party scripts, without external fonts and without tracking. It is delivered through Firebase Hosting (Google). Server logs arise technically (IP address, time, page requested, browser details). The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

15. No advertising, no tracking, no sharing

The app shows no advertising. We use no advertising ID, no tracking across apps or websites and no ad networks. We do not sell data and do not pass on health data. Apart from the service providers named in this policy (Google Firebase, Sentry, PostHog, RevenueCat, Expo, Apple, Google Play) nobody receives data.

16. Retention

• Entries on the device and in your account: until you delete them, choose “Delete all data” or delete your account.
• Individual deleted entries: the app marks them as deleted in the cloud so that your other devices remove them. The record keeps its previous content until you choose “Delete all data” or “Delete account”.
• Delete account: the app first permanently deletes all documents of your account in Firestore (including those marked as deleted), then the account at Firebase and finally everything on the device. This happens immediately. Google may keep deleted data for a limited time in its own infrastructure backups until they are overwritten.
• Error reports at Sentry and events at PostHog: until the retention period we have set in the respective project ends; on request we delete earlier.
• Purchase data at RevenueCat: as long as your purchase exists; on request we delete it.
• Server logs of the website: only briefly, as provided by the hosting service.
• Support emails: until your request is settled, afterwards only where a legal retention duty exists.

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time (Art. 7(3) GDPR). You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For us that is the Hamburg Commissioner for Data Protection and Freedom of Information; you can also contact the authority where you live.

Right to object: Where we process data on the basis of our legitimate interest (crash reports, app updates, website), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). For crash reports, simply turn off the switch under Settings > Privacy. Otherwise, write to us at support@glp1tracker.de.

You can view your entries in the app, export them as a file and delete them. For data at RevenueCat, PostHog or Sentry write to support@glp1tracker.de, preferably from the email address of your account, and state your ID (Settings > Privacy > My ID).

18. Deletion

• Settings > Delete all data: deletes your entries on this device and in the cloud. The account stays and is empty afterwards. Other devices on which you are signed in delete their entries at the next sync with internet. A device that never goes online again keeps its data until you sign out there or delete the app. Without internet the app can only empty the device.
• Settings > Account > Delete account: deletes all entries in the cloud, your account and everything on this device. You sign in again for this and type the word DELETE.
• Settings > Account > Sign out: removes the data from this device; the data in your account stays.
• Without the app: send an email to support@glp1tracker.de from the address of your account and ask for deletion. Instructions are at https://glp1tracker.de/konto-loeschen.

The app does not trigger any deletion at PostHog, Sentry or RevenueCat. On request we delete the data that belongs to your account there (sections 7, 8, 9 and 18). You cancel a subscription in the settings of your app store.

19. Children

Pencal is intended for people aged 16 and over. We knowingly process no data of people under 16. If you believe a child uses the app, write to us and we will help with deletion.

20. Automated decisions

There is no automated decision-making and no profiling with legal effect. The estimated drug level is a pure calculation from your entries and changes nothing about your rights. The app explains how the calculation works next to the curve.

21. Changes

We adapt this policy when the app or the law changes. The date above shows the version. For significant changes the app shows a notice. If we need consent for a new purpose, we ask you beforehand.