Privacy policy — Exercise Snack¶

This is a translation of the German version. Both versions have the same content. If you notice a discrepancy, please let us know.

Last updated: 26 September 2026

This privacy policy applies to

the Exercise Snack iOS app,
this publicly accessible legal information website, and
messages you send to our support service.

It provides information in particular under Art. 13 of the General Data Protection Regulation (GDPR) and, where applicable to people in Switzerland, under the Swiss Federal Act on Data Protection (FADP). The app, website and support are described separately because they involve different data flows.

1. Controller and contact¶

The controller is:

Joel Puta
Landgrafenstieg 5
07743 Jena
Germany
Email: joel.puta@icloud.com

You can send data protection enquiries to this email address. No data protection officer has been appointed; given the current organisational and processing circumstances, there is no legal obligation to appoint one.

2. Summary of data flows¶

App: Profile, exercise, breathing and health values are processed locally on your device. We do not operate an app backend and do not receive these values.
Optional Apple services: Only if you grant the relevant permission does the app read or write certain data through Apple Health (HealthKit). Apple also processes data when you obtain the app from the App Store, under its own terms.
Website: When the website is accessed, the hosting provider GitHub receives connection data required for technical reasons, in particular your IP address.
Support: If you write to us, we process your message and contact details to handle your enquiry. The mailbox is provided through Apple iCloud Mail.
No advertising or user tracking by us: As designed, the app contains no analytics, advertising or crash-reporting services. We do not use analytics, advertising trackers or externally hosted web fonts on the website.

Part A — Data processing in the app¶

3. Local processing and purposes¶

Exercise Snack is a local-first app. The following data is processed in the protected app area on your device:

3.1 Profile and reference data¶

age or date of birth, biological sex, height, weight, resting heart rate and optionally VO₂max/cardio fitness;
purpose: personalisation and, where a suitable scientific reference is available, non-medical comparison of your own fitness values;
source: manual entry or, for fields technically supported and with your permission, Apple Health. In the current app version, VO₂max is maintained manually and is not read from Apple Health.

The reference comparison for the 60-second sit-to-stand test is intended only for the age range covered by the study used, from 20 to 79 years. If no sex-specific assignment covered by the source is possible, the app must not show a sex-specific comparison.

The reference group, reference values and any linear percentile estimate shown are calculated exclusively on the device from the number of repetitions, age and the profile entry relevant to the source. This creates no additional recipient of data and involves no transmission to us.

3.2 Movement snack¶

repetitions in the 60-second sit-to-stand test, duration, timestamps, and trend and values for orientation derived from them;
purpose: performing the test and displaying your personal history.

3.3 Heart rate and recovery¶

heart rate before, during and after an exercise, peak value, individual readings and recovery values calculated from them;
source: your choice of Apple Watch/HealthKit or a local optical estimate using the iPhone camera;
purpose: displaying your own fitness and recovery values and their history. The values are not intended for diagnosis, disease monitoring or treatment decisions.

3.4 Breathing and mental snacks¶

selected breathing exercise and duration, optional mood rating before and after the exercise, free-text note and audio mode;
purpose: performing the exercise and personal review. Mood and free text may contain particularly sensitive information about how you feel.

3.5 Settings and local notifications¶

goals, onboarding status, feature and consent settings, selected heart rate source and, where applicable, local reminder settings;
purpose: providing and personalising the app. Local reminders are scheduled on the device; we do not operate a push server for this purpose.

For the optional Exercise Snack widget, the app stores a minimised snapshot in an iOS-protected app group area shared only with its own widget extension. It contains calendar days for the last 60 days, only the number of completed movement and breathing snacks per day, any carry-over needed to calculate a streak, and the calendar day of the update. In particular, it contains no heart rate, recovery or repetition values, times, mood, notes or profile data.

Its sole purpose is to display the local widget. Widget views containing data are marked as confidential in the app; how iOS actually displays them on a locked device also depends on your system and widget settings. The app reset deletes the snapshot and then requests an empty widget display.

4. Legal bases and special categories of personal data¶

For people in the EU or EEA, we rely on Art. 6(1)(b) GDPR for processing necessary to provide an app feature you have requested. If health data or other special categories of personal data are involved, feature-related processing takes place only with your explicit consent under Art. 9(2)(a) GDPR.

For people in Switzerland, we process personal data in accordance with the principles of the FADP. Health data is sensitive personal data. Optional health-related features are activated only after a clear, feature-specific permission has been granted.

Providing data is voluntary. Without certain information or permissions, only the features dependent on them are unavailable, such as Watch heart rate or an age-based comparison. The app remains usable otherwise.

When you connect to Apple Health, the app's internal Health read and write access grants are made in a shared step. You can then withdraw those grants individually in the app. iOS also manages system permissions for Health, the camera and notifications.

The distinction is important:

Turning off a feature in the app stops its future use, but does not automatically revoke a permission already granted at iOS level.
Change system permissions in iOS Settings or, for Health data, in the Health app.
Withdrawal takes effect for the future. Processing already carried out lawfully is unaffected.

6. Apple Health (HealthKit) and Apple Watch¶

After the shared Apple Health permission is granted during connection, Exercise Snack can read the following data:

date of birth for local age calculation,
biological sex,
height and body weight,
resting heart rate,
(live) heart rate for the relevant exercise.

While the app's internal Health write access grant is active, the app can write the following data:

a sit-to-stand session as a workout,
breathing sessions as a “Mindful Session”, and
one heart rate value from the rest minute, namely the average of the last 15 seconds as the baseline heart rate before the test. The other individual readings from the rest minute are not stored in Apple Health. The heart rate readings from the Apple Watch during the test and recovery phase are also written, as before.

Automatic launch of the Exercise Snack app on your Apple Watch. When you open the preparation for a sit-to-stand test on your iPhone (the “Are you ready?” screen), Exercise Snack automatically launches the watch app in the background. The watch app does not need to be open for this. This happens only if all of the following requirements are met: Apple Watch is selected as the heart rate source; the app’s internal Health write access grant and the Apple Health permission for workouts in iOS have been granted; the Apple Watch is paired and the watch app is installed. The watch must also be worn on your wrist and unlocked. Otherwise, it does not start and the test runs without heart rate measurement. Without the app’s internal Health write access grant, the watch does not start heart rate measurement; if the watch app is already open, it can at most display repetitions and Stop. The watch starts a workout session and measures heart rate from the preparation onwards, during the rest minute (60 seconds of sitting quietly before the test), during the test and during the recovery phase. The session ends when the recovery phase or the test ends, if you cancel the test in the app, or if you tap “Stop” on the watch. Technical status details are exchanged between iPhone and watch through Apple system services (WatchConnectivity) and stored by the system on both devices: whether the app’s internal Health write access grant is active, including its version identifier; whether a session is active; and the timestamp of the last start or stop. These details contain no health values and are not transmitted to us. When you reset the app, they are overwritten with neutral values (consent off, no session).

Camera-based heart rate estimates are not written to Apple Health as heart rate readings.

HealthKit data is used only for the fitness and wellbeing features described here, not for advertising, marketing or data mining. We do not receive Health data on a provider server. Apple is responsible for Apple-side storage, iCloud synchronisation and platform processing under its own privacy policy.

If you want to delete values written to Apple Health or fully revoke the Health permission, you must also do so in the Health app or iOS Settings. An app reset does not do this.

7. Heart rate estimate using the iPhone camera¶

If you enable this optional feature, the app analyses changes in brightness at your finger in front of the rear camera (an optical PPG method). The following applies:

camera images are analysed locally in memory during the measurement;
no photos or videos are created for us or transmitted to us;
only the calculated heart rate estimate is stored, if you save the measurement;
the camera is used only during a measurement that you start.

The camera reading is an estimate under everyday conditions, not a validated or certified medical measurement. It may be inaccurate, particularly because of movement, finger position, lighting, blood flow in the skin or device characteristics. Do not use it for diagnoses, monitoring an illness or treatment decisions.

8. Storage, export, reset and uninstallation¶

Storage location: App data is held in the local app database in the iOS app sandbox.
Storage period: It remains there until you delete individual entries, reset the app or uninstall it.
CSV export: Only at your request does the app create a temporary file from the local data covered by the export and open the iOS share sheet. You choose the destination and recipient. From that point, the third party you choose may carry out its own data processing.
App reset: The reset deletes the data stored locally in Exercise Snack and internal feature settings, cancels pending local reminders, and deletes the widget snapshot and any temporary export files still present. It does not delete data already written to Apple Health, revoke iOS system permissions or delete export files you have previously shared with other apps or services.
Uninstallation: It removes the local app container. Health data stored independently and exports already shared remain in place.
Device backup: Under the intended technical configuration, the app marks the local database, its controlled settings file and the widget snapshot for exclusion from the general iCloud device backup. As a result, this app data is not automatically restored when you change devices; export it beforehand if needed.

9. Security and no automated decisions¶

The local database is in the iOS sandbox and uses device-side iOS Data Protection. Also protect your device with a passcode, Face ID or Touch ID, and keep iOS up to date.

Exercise Snack does not engage in advertising profiling and does not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Art. 22 GDPR. Fitness and recovery displays are local, non-medical aids for orientation.

Part B — This legal information website¶

10. Hosting through GitHub Pages¶

This static website is delivered through GitHub Pages. Under GitHub's current privacy policy, the GitHub entities that receive and process data may include, depending in particular on how the specific processing is assigned:

GitHub B.V.
Prins Bernhardplein 200
1097 JB Amsterdam
Netherlands

GitHub, Inc.
88 Colin P Kelly Jr Street
San Francisco, CA 94107
USA

When the website is accessed, GitHub may, in particular, process your IP address, time of access, requested address, browser and device information, referrer and security-related log data. This is technically necessary to deliver the page, defend against attacks and secure its operation. We do not have access to GitHub's complete IP-based server logs. GitHub determines how long such operational and security data is stored under its privacy policy. GitHub describes the processing of its security logs there as processing for which GitHub itself is responsible as controller. We therefore do not describe GitHub as our processor for this processing without separate evidence.

For people in the EU/EEA, website operation is based on Art. 6(1)(f) GDPR. Our legitimate interest is to provide the information required by law and by the platform securely, reliably and in a way that is generally accessible. For people in Switzerland, processing for the same operational and security purposes follows the principles of the FADP.

11. Transfers to third countries through website hosting¶

The GitHub group of companies provides its services through entities in the EU and the USA. Under GitHub's privacy policy, data may be processed in the relevant region, in the USA and in other countries listed there.

For covered transfers from the EU/EEA, GitHub states that it relies on certification under the EU-U.S. Data Privacy Framework and the related adequacy decision (Art. 45 GDPR). Where this mechanism does not cover a specific transfer, GitHub names in particular the EU Standard Contractual Clauses as an additional or alternative safeguard (Art. 46(2)(c) GDPR).
For covered transfers from Switzerland, GitHub refers to the Swiss-U.S. Data Privacy Framework. Where it does not apply, the necessary contractual safeguards recognised under Swiss law, in particular appropriately adapted Standard Contractual Clauses, may apply.

Which basis applies in an individual case depends, among other things, on the GitHub service making the transfer and the GitHub entity involved. GitHub publishes further information in the privacy policy linked above.

12. No website analytics by us¶

On this website, we ourselves use

no analytics or advertising tracking,
no marketing cookies,
no externally hosted web fonts, and
no social media plugins.

This does not affect technically necessary processing by GitHub as the hosting provider. If further services are added to this website in future, we will update this policy before using them.

Part C — Support and other recipients¶

13. Contact by email¶

If you write to us, we process your email address, message, timestamp and metadata needed to handle it. The purpose is to handle support, data protection or other enquiries.

In the EU/EEA, the legal basis depends on the enquiry: Art. 6(1)(b) GDPR (pre-contractual or contractual communication), Art. 6(1)(c) GDPR (legal obligations) or Art. 6(1)(f) GDPR (efficient handling of other enquiries and protection against misuse). In Switzerland, processing for these purposes follows the FADP.

Our mailbox is provided through Apple iCloud Mail. In connection with transmission and mailbox provision, Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and other Apple entities named in Apple's privacy information may process data. Apple's privacy policy contains information about recipients, storage locations and international transfer mechanisms.

Apple states that personal data from the EEA and Switzerland is generally controlled by Apple Distribution International Limited and may be stored worldwide, in particular by Apple Inc. in the USA. According to Apple's privacy policy, international transfers from the EEA and Switzerland rely on Standard Contractual Clauses. The policy also gives a contact route for requesting a copy of these clauses.

Please do not send us health data, camera images or complete data exports. If such information is exceptionally needed for a specific support case, we will agree with you in advance on a secure and legally permissible method. We do not use sensitive information sent to us unsolicited for other purposes, and delete or reduce it as soon as it is no longer needed to handle the enquiry.

We delete support correspondence once the enquiry is complete and no statutory documentation or retention requirements remain. Content that must be retained by law is blocked from use for other purposes and deleted once the retention period expires.

14. Apple App Store and export destinations you choose¶

Apple processes app acquisition, payments, refunds and Apple Account data under its own terms. We do not receive complete payment details. Apple's privacy policy applies to this platform processing.
If you send a CSV export to a service through the iOS share sheet, you choose the recipient and destination. The selected service's information and settings apply to its subsequent processing.

Part D — Your rights¶

Where the GDPR applies, you have in particular the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent for the future (Art. 7(3)).

For app data stored only locally, we have neither access to it nor the ability to identify you from it. You can therefore view, rectify, export and delete it directly in the app. Please take the limits of the app reset in Section 8 into account. For website or support data, you can contact us using the details in Section 1.

You can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority normally responsible for the controller is:

Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI)
Häßlerstraße 8, 99096 Erfurt
www.tlfdi.de

16. Rights in Switzerland¶

Where the FADP applies, you may in particular request access under Art. 25 FADP and, if the requirements are met, data delivery or transmission under Art. 28 FADP. Other claims, in particular for rectification, erasure or prohibition, are governed by Art. 32 FADP and other applicable provisions.

You may also contact the FDPIC (EDÖB), the Federal Data Protection and Information Commissioner: www.edoeb.admin.ch.

17. Adult target group¶

Exercise Snack is intended for adults. We do not carry out our own online age verification in the app or on this website. The app does not send us a date of birth; a date of birth entered manually or read from HealthKit stays local and is used only for the app's functionality. The scientific reference comparison for the 60-second sit-to-stand test covers only people aged 20 to 79.

18. Changes¶

We update this privacy policy when features, services used or the law change. The date above indicates the date of the published version.

Exercise Snack · See date above.