Privacy Policy

1. Who is responsible

The controller for the Nerivao app (iPhone and Apple Watch) and the website nerivao.donner.io under the General Data Protection Regulation (GDPR) is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany
Email: app-support@donner.io

In this policy, “I” means Dennis Donner. There is no data protection officer, as none is required by law. Send any privacy question or request to the email address above.

2. In short

3. Apple Health data

Nerivao reads data from Apple Health (HealthKit) only after you allow it in the iOS permission sheet, and only the categories you switch on there. Access is requested in two steps:

• During setup: sleep, heart rate variability, resting heart rate, heart rate, workouts, respiratory rate, sleeping wrist temperature and VO₂ max. These feed Today, Recovery, Sleep and Train.
• When you first open “All categories”: the other categories Apple Health offers, for example activity and steps, workout routes and effort, body measurements, blood oxygen, dietary entries including alcoholic drinks, blood glucose, mindfulness, state of mind, and the health characteristics date of birth and biological sex.

Nerivao copies the values it needs into a local database on your iPhone and calculates its indices (for example recovery, sleep, load and stress context) there. I never receive these values. Nerivao does not write to Apple Health and does not change or delete your Health originals.

Health data is a special category of personal data. Legal basis: your explicit consent through the iOS permission (Art. 9(2)(a) and Art. 6(1)(a) GDPR). You can withdraw it at any time in iOS Settings → Health → Data Access & Devices → Nerivao; Nerivao then stops reading the categories you switch off.

4. Data you enter and data stored on your device

Besides the Health copies, Nerivao stores what you enter yourself: daily check-ins (for example energy, muscle feel, sleep feel and stress on a 1–5 scale), journal answers and notes, the perceived effort (RPE) of your training sessions, your training plan, sleep target, experiments and settings. All of this is health-related and stays in the local database on your iPhone. I have no copy of it and cannot see it.

Nerivao’s database is excluded from iPhone backups and is not synced with iCloud. Deleting the app removes it. Legal basis: your explicit consent when you enter the data (Art. 9(2)(a) GDPR) and the performance of the contract for using the app (Art. 6(1)(b) GDPR).

5. Apple Watch and widgets

The Watch app receives a short daily summary from your iPhone through Apple’s WatchConnectivity, directly between your devices. Check-ins you make on the Watch are sent back to the iPhone the same way. Widgets read the same summary from a shared container on your iPhone. Nothing of this passes through a server of mine.

Values are only shown on the Watch and in widgets if you turn on Show values on Watch and widgets. The setting is off by default, because the Lock Screen and the watch face can be seen by others.

6. Notifications

If you turn on the evening journal reminder, Nerivao asks for the iOS notification permission and schedules one local notification per day at 21:00 on your iPhone. The text contains no Health values. There is no push server. Legal basis: your permission in iOS (Art. 6(1)(a) GDPR), which you can withdraw in iOS Settings → Nerivao → Notifications.

7. Export and deletion

You can export your data as a JSON file covering 7 to 365 days and choose whether it contains journal entries, check-ins and daily indices. The file is created on your iPhone and only leaves it if you share it through the iOS share sheet; the recipient you choose is then responsible for it.

Delete all local data in the settings removes Nerivao’s database, the widget summary and the Watch copy. Your originals in Apple Health are not affected.

8. Usage analytics (Amplitude)

To understand how Nerivao is used and where it fails, the app sends usage events to Amplitude, Inc., stored in Amplitude’s EU data centre. Events are linked to a random device ID created by the Amplitude SDK, not to your name or Apple Account.

What is sent: app start and session events; setup steps; whether a permission was requested and granted (not which values exist); whether an import succeeded or failed; which tab or screen was opened; that a check-in, journal entry, experiment, export, deletion or settings change happened; shown error codes; whether a rating request was made; app version, platform, language setting and the install attribution described below.

What is never sent: Health values, index scores, check-in answers, journal text, notes, your IP address (IP tracking is switched off), the advertising identifier (IDFA), the identifier for vendors (IDFV), your carrier or a precise location. Amplitude may derive the country from the IP address of the connection; city, region and DMA lookup are switched off.

Analytics is switched off in test and demo modes. Legal basis: my legitimate interest in improving the app and fixing errors (Art. 6(1)(f) GDPR). You can object at any time by email (see “Your rights”). Amplitude’s privacy policy: amplitude.com/privacy.

9. Crash reports and performance (Google Firebase)

Nerivao uses Firebase Crashlytics, Firebase Performance Monitoring and Firebase Analytics from Google Ireland Limited. If the app crashes, a crash report with the stack trace, device model, iOS version, app version and a random installation ID is sent. Performance Monitoring measures start-up time, time in the foreground and background, screen rendering and the duration of network requests. Firebase Analytics only collects its automatic events (such as first open and app updates); Nerivao sets no own events, user ID or user properties there. Google may derive an approximate region from the IP address. No Health data is sent.

Legal basis: my legitimate interest in a stable app (Art. 6(1)(f) GDPR). Google’s privacy policy: policies.google.com/privacy; privacy information for Firebase: firebase.google.com/support/privacy.

10. Install attribution (Apple AdServices)

After installation, Nerivao asks iOS for an AdServices token and sends it to Apple’s attribution service (api-adservices.apple.com). Apple answers whether the install came from an Apple Search Ads campaign. If Apple gives no answer, the app tries again at the next starts, at most three times in total; after an answer it does not ask again. The result (source, campaign, country and whether it was a paid install) is stored on your iPhone and added to the Amplitude data above. There is no App Tracking Transparency prompt, no advertising identifier and no third-party attribution SDK.

Legal basis: my legitimate interest in knowing which channels lead to installs (Art. 6(1)(f) GDPR). Apple’s privacy policy: apple.com/legal/privacy.

11. Rating prompt

After you have used Nerivao for a while, the app may ask iOS to show Apple’s standard rating dialog, at most once every 60 days. Whether it appears, and what you submit, is handled by Apple. I only see the public ratings and reviews in the App Store.

12. Contact and support

If you email me at app-support@donner.io, I process your address, your message and whatever you include (for example device and iOS version) to answer you. Legal basis: Art. 6(1)(b) GDPR for questions about the app you use, otherwise my legitimate interest in answering (Art. 6(1)(f) GDPR). Please do not send exports or Health data unless I ask for them.

13. This website

nerivao.donner.io is a static website. It sets no cookies, uses no analytics or tracking, has no forms or embedded content and loads fonts, images and scripts only from its own server. No cookie banner is needed for that reason.

When you click EN or DE, the site stores your choice under the key nerivao-lang in your browser’s local storage, and the English start page reads it (or your browser language) to show the German version. The value never leaves your browser; you can delete it with your browser data.

To deliver the pages, the web server processes your IP address, date and time, the requested address, the referring page and your browser’s user agent. These server logs serve operation and security only and are deleted by the hosting configuration. Legal basis: my legitimate interest in a secure website (Art. 6(1)(f) GDPR).

14. Recipients

Amplitude, Google and the hosting and email providers act as processors under data processing agreements where the GDPR requires one. Apple acts under its own responsibility. I do not sell personal data and do not use it for advertising.

15. Transfers outside the EU

Amplitude, Google and Apple are or belong to companies in the USA, so access from the USA cannot be ruled out even when data is stored in the EU. Transfers rely on the EU–U.S. Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

16. How long data is kept

• On your device: until you delete it, use Delete all local data or remove the app. Apple Health keeps its own originals.
• Analytics, crash and performance data: only as long as needed to analyse use and errors, then deleted or anonymised according to the retention settings of each service.
• Support emails: deleted when your request is closed, unless commercial or tax law requires keeping them longer.
• Server logs: only as long as needed for operation and security.

17. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw a consent at any time with effect for the future (Art. 7(3)).

Because there is no account and your Health data stays on your device, I can often only identify analytics data if you send me the device ID concerned; I will help you with this. You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for me:

Brandenburg Commissioner for Data Protection and Access to Information (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

18. Children

Nerivao is not directed at children under 16. I do not knowingly process personal data of children.

19. Permissions and how to revoke them

• Apple Health: iOS Settings → Health → Data Access & Devices → Nerivao.
• Notifications: iOS Settings → Nerivao → Notifications, or turn off the journal reminder in the app.
• Values on Watch and widgets: the Show values on Watch and widgets switch in the app settings.

Revoking a permission only switches off what depends on it; data already stored stays until you delete it.

20. Security

Nerivao’s database is protected by iOS file protection when your iPhone has a passcode. All network connections of the app and of this website are encrypted with TLS. Because your Health data is not on a server of mine, it cannot leak from one. Keep exported files as safe as the data itself.

21. Changes to this policy

I update this policy when the app or the website changes. The current version is always available at nerivao.donner.io/privacy/.