wiegemichnichtPrivacy Policy
Last updated: October 2026
1. Controller
Carsten Fregin
spielgestalt
Pracherdamm 106
25436 Tornesch
Germany
Email: wiegemichnicht@spielgestalt.de
2. Overview
wiegemichnicht is an app for tracking calories, activities, and weight. Using it requires an account. This policy describes what personal data is processed, for what purpose, on what legal basis, and what rights you have.
The app does not use advertising, tracking, or analytics software (e.g. Google Analytics). Only the data necessary to operate the app itself is processed.
3. Registration and sign-in
An account requires an email address and password, or you can sign in with your Google account (Google Sign-In; provided by Google Ireland Limited, Google's privacy policy at policies.google.com/privacy also applies) or, on iPhone and iPad, with your Apple ID ("Sign in with Apple", Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). With Sign in with Apple we receive your email address or, if you choose "Hide My Email", a relay address generated by Apple. If you delete your account, we revoke the link to your Apple ID. Sign-in runs through Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for users outside the EEA: Google LLC, USA). The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract).
4. Body and health data
To calculate a calorie target, we record, based on your input: height, weight, age, biological sex, activity level, and optionally a goal weight or (with the "wiegemichnicht Plus" subscription) a target body fat percentage. Combined, this data may allow inferences about your health, so we treat it as health data within the meaning of Art. 9 GDPR.
The legal basis is therefore your explicit consent under Art. 9(2)(a) GDPR, given separately (distinct from the terms of use) the first time you use the app. You can withdraw this consent for the future at any time by deleting your account (see section 14). Without this information the app cannot calculate a calorie target; withdrawal is therefore only possible together with deleting your account. To help with problems we can view your profile (height, weight, age, sex, activity level) and change it at your request; we do not see your diary or your weight and Health entries in doing so.
5. Food, activity, and weight diary
Meals, activities, and weigh-ins you log (including their timestamp; with the "wiegemichnicht Plus" subscription optionally also the body fat percentage shown by your scale), your own recipes (name, servings, ingredients with amounts and nutritional values, and for imported recipes the address of the source), your favourites and, if you connect Apple Health or Health Connect (section 6), your daily step totals are stored in Cloud Firestore to show you your history and balance. We also store your diary settings there, such as your meal times and, with the "wiegemichnicht Plus" subscription, your eating rhythm (eating window or fasting days with a calorie goal). The legal basis is Art. 6(1)(b) GDPR.
6. Apple Health and Health Connect (optional)
On iPhone and iPad (Apple Health) or on Android devices (Health Connect) you can turn on the import when setting up the app or later under Profile → Apple Health or Health Connect. The app then reads, through Apple's HealthKit or Google's Health Connect interface, your weight, your workouts (type, time, calories burned), and your steps (daily totals) for the last 30 days, and afterwards newly added data whenever you open the app. With the "wiegemichnicht Plus" subscription this also happens on iPhone and iPad while the app is closed: Apple Health wakes the app in the background when new data of these types is available, and it imports it in the same way. The data is stored in Cloud Firestore as weight, activity, and step entries so it appears in your diary, balance, and weight history. We also store whether the import is turned on and up to which point data has already been imported, so that nothing is imported twice or again. With the "wiegemichnicht Plus" subscription the app also reads your body fat percentage (for example from a body composition scale that records its measurements in Apple Health or Health Connect) and stores it with the weight entry measured at the same time, together with the average of your latest measurements (body fat percentage and the lean mass calculated from it), to show you how your body composition develops and, if you choose a target body fat percentage, to calculate your calorie and protein targets; without Plus, body fat percentage is neither requested nor read or stored from Apple Health or Health Connect, and the field for entering it by hand (section 5) is not available. When the subscription ends, no new values are imported; values already stored remain until you delete the entry or your account. On Android, Health Connect additionally requires read permission for total energy burned and distance in order to read workouts; the distance is not stored. Optionally, you can have your steps counted as the activity "Everyday movement": the app then creates one activity entry per day with the extra energy calculated from it (from steps, height, and weight). For this it also reads how many steps occurred during your workouts, so they are not counted twice.
With the "wiegemichnicht Plus" subscription you can also turn on writing back: the app then adds your meals (name, time, calories, protein, carbohydrates, fat) and weight values entered in the app, from the day you turn it on, to Apple Health or Health Connect and applies edits and deletions. We store which entries were written (identifier of the app entry, time, checksum) in Cloud Firestore so nothing is added twice. Values imported from Apple Health or Health Connect are not written back. Once data is in Apple Health or Health Connect, it is subject to Apple's or Google's settings and privacy policy; it remains there when you delete your account and can be deleted there.
This data is health data within the meaning of Art. 9 GDPR. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give by granting access in the system dialog from Apple or Google that the app opens during setup or when you turn the respective switch on; there you choose yourself which data you share. Granting access is voluntary; without it, all other functions of the app remain fully usable. You can withdraw your consent for the future at any time by turning the switch off and/or revoking access in iOS Settings under Health → Data Access & Devices or in Health Connect under App permissions. Entries already imported remain until you delete them or delete your account (see section 14).
Data from Apple Health and Health Connect is not used for advertising or marketing, is not sent to the AI analysis (section 7), and is not shared with third parties; the only recipients are the service providers named in section 15 (Google Cloud/Firebase) for storage.
7. Calorie estimation (AI analysis)
If you upload a photo of a meal, it is stored in Firebase Storage and sent to Google's Gemini API (Google Ireland Limited / Google LLC) for analysis, which produces a calorie and macronutrient estimate. We use the Gemini API on the paid tier; Google processes the submitted content as a processor and, under its terms, does not use it to improve its products; to detect abuse, Google retains the requests and responses for a limited period. The same applies if you describe a meal as text instead (including by voice on the Apple Watch, section 11), have the energy burned by an activity estimated, or import a recipe (section 8): in that case only the respective text or only the recipe's ingredient lines are transmitted; for the activity estimate, additionally your current body weight from your profile, because the energy burned depends on it. A small preview copy (thumbnail) is additionally generated from the original photo. Both images are deleted when you delete the corresponding entry. The legal basis is Art. 6(1)(b) GDPR (core function of the app) combined with your consent under section 4, insofar as the photo allows inferences about your diet and thereby indirectly about your health.
8. Barcode scanning, food search and recipe import
Scanning a barcode sends only the barcode number (no other personal data) to the free, open-source Open Food Facts database to retrieve nutritional information. In the food search, the search term you enter is forwarded through our server (Google Cloud, Frankfurt region) to Open Food Facts; Open Food Facts receives neither your user ID nor any other information about you. To speed things up, we cache search terms together with their result list for at most three days, without any link to your account. The search in basic foods and dishes (Bundeslebensmittelschlüssel of the Max Rubner-Institut) runs entirely on your device; no data is transmitted. Your recently logged foods for the suggestion list are read from your own diary.
With the "wiegemichnicht Plus" subscription you can import recipes from websites by pasting a link or sharing a page from another app with wiegemichnicht. The app then retrieves the page directly from your device; as with any page visit, the site operator receives your IP address and technical details of your device. Only the title, servings and ingredient list are imported; the ingredient lines are sent to the Gemini API to convert them into amounts and nutritional values (section 7). If you open a recipe page from the app, this happens in a browser window governed by that provider's privacy policy. The same applies when you open one of the publications linked under Profile → Sources.
The legal basis in each case is Art. 6(1)(b) GDPR.
9. Purchasing "wiegemichnicht Plus" (RevenueCat)
If you buy the "wiegemichnicht Plus" subscription, Apple (App Store; Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) or Google (Google Play; Google Commerce Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) handles the purchase and payment as an independent controller; we do not receive any payment data. Apple's or Google's privacy policy applies in addition. To verify purchases and unlock Plus, we use the RevenueCat service (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) as a processor. This involves: your app user ID (no email address, no name), the purchase data from Apple or Google (product, purchase, renewal and expiry dates, transaction identifiers, trial, country and currency), and technical details of the app's requests (including IP address, device model, operating system and app version). We additionally store the resulting status (Plus active/inactive, expiry date, product) in Cloud Firestore so that the app and our server know your plan. The legal basis is Art. 6(1)(b) GDPR (performance of the subscription contract). If you delete your account, we also delete your data at RevenueCat; your purchase history at Apple or Google is not affected. The transfer to the US relies on the EU Standard Contractual Clauses, which form part of our data processing agreement with RevenueCat.
10. Push notifications (optional, iPhone, iPad and Android)
On iPhone, iPad and Android the app can send you notifications if you turn them on in the app and allow them in Apple's or Android's system dialog: reminders about meals, weighing yourself, drinking and your eating window, news about the app and notices about your account and subscription. For this we store in Cloud Firestore a device identifier for notifications (push token), your time zone, your language and your settings (which reminders, at what times). Notifications are delivered through Firebase Cloud Messaging (Google) and, on iPhone and iPad, additionally through the Apple Push Notification service (Apple). The content of the notification (e.g. that no meal has been logged for today yet) is also transmitted to Google or Apple for delivery.
So that you are only reminded when necessary, before a meal, weighing or drink reminder our server checks whether you have already logged something for that meal, a weight or a drink today. To do so it reads your entries for the day; they are neither shared nor stored in the process. For eating-window reminders it reads your eating rhythm and your subscription status; with an eating window, meal reminders that would fall into your fasting time are also skipped. This is processing of health data based on your consent under section 4 and on turning on the respective reminder (Art. 9(2)(a) GDPR). You only receive news if you have turned it on. In individual cases (e.g. about a request from you or about your account) we send you a personal notification, provided you have allowed notifications in the system; we log its text and time and delete this log together with your account. Otherwise the legal basis is Art. 6(1)(a) and (b) GDPR.
You can turn off individual notifications in the app or disallow them entirely in the iOS or Android settings at any time. When you sign out or delete your account, we remove the device identifier.
11. Apple Watch (optional)
If the wiegemichnicht app is installed on your Apple Watch, your iPhone transfers your daily status directly to it through Apple's WatchConnectivity interface: calorie goal, calories eaten and burned, protein, carbohydrates and fat, and with the "wiegemichnicht Plus" subscription also your favourites and recently used foods (name, calories) and your last weight. This information is stored on the watch so that the app and complications can display it, and is overwritten with every change. What you log on the watch is sent by the watch to the iPhone, which stores it like an entry made in the app. If you dictate a meal, Apple's dictation converts the speech to text on the device or at Apple, depending on your settings; only this text is transmitted for the estimate (section 7). The legal basis is Art. 6(1)(b) GDPR in conjunction with your consent under section 4.
12. Feedback
If you send us feedback through the app, we store your user ID, email address, and message text to evaluate it and improve the app. These entries are not visible to you or other users within the app. If you delete your account, we remove your user ID and email address from your feedback; the message text is retained without reference to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the app); you decide yourself whether and what to send us.
13. App Check (abuse protection) and crash reports
To protect against automated abuse, the app uses Firebase App Check (Google): on iPhone and iPad, Apple's App Attest confirms that requests come from a genuine, unmodified app; on Android, Google's Play Integrity API; in the web version, reCAPTCHA Enterprise (Google). This evaluates technical signals from the device or browser to distinguish automated access from genuine use; no content of your inputs is transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the app and its associated costs from abuse).
The iOS, Android and macOS apps use Firebase Crashlytics (Google) to detect and fix crashes and program errors. When an error occurs, technical details are transmitted: the error message and code location, device model, operating system and app version, free memory, and a random installation identifier. The content of your entries, health data, your email address or your user ID are not transmitted. Reports are deleted after 90 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free app). The web version does not use Crashlytics.
Operating the app also produces technical logs on our server (Google Cloud Logging): time, function called, your user ID, error messages and, for requests, the IP address; the content of your entries and photos is not logged. Logs are deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operation, troubleshooting and abuse prevention).
14. Retention and deletion
Your data is stored for as long as your account exists. You can delete your account directly in the app at any time (Profile → Delete account). This irrevocably deletes your profile, all food/activity/weight/step entries, your recipes and favourites, your settings (including for health import and notifications), the device identifiers for notifications and the log of personal notifications, uploaded photos, and your sign-in account. We also delete your data at RevenueCat (section 9). Feedback already submitted is excluded (see section 12). Deleting your account does not cancel a running subscription; cancel it in your Apple Account settings or in Google Play under "Payments & subscriptions". Alternatively, you can request deletion informally by email to the address above.
15. Recipients and international transfers
Processing runs on Google Cloud/Firebase. Cloud Functions servers are fixed to the europe-west3 (Frankfurt) region. For individual Firebase services (e.g. Authentication), processing cannot be fully restricted to the EU; insofar as data is transferred to the US as a result, this relies on the EU Standard Contractual Clauses with Google. Google operates the Gemini API (section 7) without a fixed region; photos and texts submitted for estimation may therefore also be processed in the US. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses in Google's data processing terms apply. For Plus purchases, Apple or Google and RevenueCat are added (section 9), for notifications on iPhone and iPad Apple (section 10).
16. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to withdraw any consent given at any time with future effect (Art. 7(3)). You also have the right to lodge a complaint with a data protection supervisory authority – among others, the Unabhängige Landeszentrum für Datenschutz Schleswig-Holstein (ULD) is competent; you may also contact the supervisory authority of your place of residence.
You can exercise access and data portability directly in the app (Profile → Download my data): you receive a ZIP archive with all data stored for your account – profile, nutrition, activity and weight entries, recipes, settings, photos, consent records and your feedback messages – in a structured, machine-readable format (JSON, plus CSV). For this, the archive is provided briefly (about 30 to 45 minutes) in our storage (Google Cloud Storage, europe-west3) and then deleted automatically; the download link is intended for you only. One export is possible per 24 hours. For further requests you can also reach us using the contact details in the legal notice.
17. Minimum age
The app may only be used from the age of 18.
18. Changes
We update this policy whenever data processing changes. For material changes (in particular new processing purposes for health data), we will ask for your renewed consent.
This English version is provided for convenience only. The German version is legally binding.