Privacy Policy

1. Controller

Seihan Kahirov, Wittenberger Straße 44, 12689 Berlin, Germany. Email: support (at) insiegel.com

If you have questions about data protection, you can reach us at the email address above or at support (at) insiegel.com (see “Support”).

2. What data we process and why

2.1 Account

You need an account for insiegel. For this, we process your email address, a name if you want to give one, and an identifier that Firebase Authentication assigns (Firebase UID). You sign in with email and password, with your Google account, or with your Apple ID. When you sign in with Google or Apple, we receive from them the account data needed for signing in, usually your name and email address.

2.2 Tasks, completions, and lock settings

The app stores your tasks and their completions on your device. It also syncs them with our cloud database (Cloud Firestore, data center in Frankfurt, europe-west3), so they are kept when you switch devices. Each account can read and write only its own data area. Security rules on the server enforce this.

For each task, the title, description, time window, and proof types go to the cloud. For each completion, the time, the status (done or skipped), a value you entered, and your note, if you write one, go there as well. Notes are free text. Write in a note only what may be stored in your account.

Your lock settings are also part of your tasks. They are stored unencrypted (in plain text) in your own Firestore area:

• Coordinates, radius, and label of a location proof, if you choose this proof type.
• The app IDs (package names) of the apps that are blocked during a lock window, and the list of apps you allow.

We deliberately do not encrypt these fields, because a second device has to read them when syncing. According to the security rule, only your own signed-in account has access.

Location proof. If you create a place as proof, the app reads your current location once and stores it as the target (see above). When you give proof, it reads your location once more and compares it with the target on the device. This second location is not stored and not transmitted. The only exception is the AI check (see 2.12). The app asks for your location only while you are using it, never in the background.

2.3 Photos as proof

If you prove a task with a photo, the app stores the photo only on your device. It is deleted when you delete the task or the completion entry. Without the AI check, it does not go to our servers or to third parties. If you choose the AI check for a task, a downsized copy goes to our server for the check (see 2.12).

2.4 Step count

If you choose steps as proof, the app reads your device’s step counter while the proof is running. The number stays on the device. It is not stored and not transmitted. Only the fact that the task is done is stored.

2.5 Partner

With insiegel, you can set up a second person as your partner. They hold the second key: without their approval, an active lock cannot be loosened, skipped, or lifted. The partner lock is part of Premium. Restoring an existing pairing on a new device is free.

Pairing runs offline through a QR code, and so does restoring. Your device and your partner’s device exchange a shared secret in the process. It never goes to our servers and is never stored in our cloud database. Your own Firestore area holds only two items about the partner lock:

• A flag “partner lock set up” (true or false). After a reinstall, a new device uses it to recognize that a partner had been set up.
• A partner ID. It is a string of 64 characters. The app calculates it from your Firebase UID and the shared secret, using the one-way calculation SHA-256. As things stand today, the secret cannot be worked out from the ID. The ID serves only to restore an existing pairing: if the pairing is missing on a device, for example after a reinstall, you scan your partner’s QR code. The app calculates the ID of that code on your device and compares it with the ID in your account. If both match, the app restores the pairing. If not, nothing changes. The scanned secret does not go to our servers in the process.

The app creates the ID as soon as the pairing is confirmed. For a pairing from an earlier app version, it adds the ID later, as soon as a paired device starts the app with internet. There is at most one ID: if you change your partner, the new one replaces the old one. The ID is stored in the same area of the cloud database as the rest of your account (Cloud Firestore, data center in Frankfurt, europe-west3, see 2.2). It stays until you choose “Remove partner lock” in the app or delete your account. Your partner does not see the flag or the ID and has no access to your account.

What your partner sees: the display name you choose when pairing. For an approval attempt, whether the code entered is correct, and a waiting time after failed attempts.

What your partner does not see: your tasks, photos, places, step counts, and all other content. There is no cloud function through which your partner can reach your account or your data.

2.6 Crash reports and usage statistics (Crashlytics, Analytics)

insiegel can use Firebase Crashlytics (crash reports) and Google Analytics for Firebase (usage statistics). Both are controlled by one shared switch in the app: Settings, Privacy and legal, Usage statistics & crash reports.

Until the question, insiegel collects nothing. When you sign in and during setup, the app sends neither usage statistics nor crash reports. Until then, Firebase’s automatic events are turned off. This applies in every region.

When the app asks. The question appears as a prompt on the “Today” screen. It appears as soon as you have saved your second task after setup. If you have not done that, it appears at the latest when you open “Today” on the calendar day after setup. Your device’s clock counts. If you have already decided, the app does not ask again. Your decision is stored only on your device. If you reinstall insiegel, the app asks again.

How the app asks. This depends on your region:

• Outside the US (EU, EEA, United Kingdom, Switzerland, and all other countries): The app asks one question with two equal buttons, “Yes, share usage statistics” and “No, thanks.” The default is off. Nothing is collected until you say yes. You cannot swipe the prompt away. You choose one of the two answers. With “No,” the app works exactly the same.
• US: The app does not ask. It shows a notice instead. The notice says that insiegel collects crash reports and usage statistics, and offers you “Turn off.” The default is on, but only after this notice. Until it has appeared on your screen, the app collects nothing. If you tap “Continue” or close the notice without answering, it stays on.

The usage statistics in the question have nothing to do with Android’s “Usage access” in 2.10. The data of that access stays on the device.

The app determines the region once at first launch, from the country of the system language and the time zone. When in doubt, the app asks as it does outside the US. In every region, you can change your decision at any time with the switch in Settings.

What goes to Google with your consent:

• Your account identifier (Firebase UID) as user ID. No name, no email address.
• Which areas of the app you open (for example Today, Tasks, Stats, Settings, Premium).
• Your decision: If you say yes, this goes to Google as an event. In the US, it is sent that the notice was shown to you. We never send a no. That is why we cannot see who declined.
• Signing in and creating an account, each with the method (email, Google, Apple), and your steps through setup, including whether you complete or skip it. This goes out only if your decision already exists. On a fresh install, the question comes after both, so the first sign-in and setup are not measured. If you sign in again later, the sign-in method goes out.
• Permissions: After a request from the app, whether you granted or denied the permission. Which one it was (Usage access, Display over other apps, Notifications, Battery optimization, or Alarms & reminders) and where the request came from (setup, the protection card on “Today”, or Settings). This shows us at which permission users drop out.
• Protection turned on: that you turned protection on (at the end of setup or through the card on “Today”) and how many permissions were still missing. This shows us whether setup is complete.
• When you create or change a task: frequency, strictness, and the number and type of proofs (for example photo or steps). No title, no place. For a task from a template, the name of the template, a fixed text from the app. Also that you delete a task.
• That you complete or skip a task. When you complete one: whether a value and whether a note were included, never their content, plus which proof types you used to complete it (checkbox, value, photo, NFC tag, steps, timer, location, photo or location with AI check). When you skip one: whether a partner lock is set up on the device.
• Proof attempts: For every proof, the type, whether the AI check was involved, and how it ended (succeeded, failed, or canceled). For a failure, the reason from a fixed list (does not match, limit reached, network error, other reason). Never the photo, the location, or the step count. This shows us which proofs fail in daily use. If you close the proof screen without finishing, it counts as canceled.
• Partner approval: When the app requires your partner’s approval, which action it was (for example skipping, editing, or deleting a task, removing protection, signing out, or deleting your account) and how it ended (approved, wrong code, canceled, no partner paired). Never the code, the PIN, or anything about your partner. This shows us whether the partner lock holds up in daily use.
• That pairing with a partner succeeded. No name, no identifier of your partner.
• That you tried to open a blocked app during a lock. Which app it was does not go to Google.
• When the Premium screen appears and for which feature, whether you start or complete a purchase (with the package you choose, for example the Yearly plan), and whether you restore purchases. If a purchase did not go through, also whether you canceled it or an error occurred. This shows us where a purchase fails.
• What the analytics tool itself collects: first open, sessions, usage duration, app updates, uninstall, country (derived from the IP address), language, phone model, Android and app version.
• Crashlytics: crash reports and error messages from the app with the technical sequence (stack trace), phone model and versions, without your user ID. Only in the store version of the app, never in developer builds. By our rule, error messages contain no text that you entered.

What never goes to Google: the title, description, and note of your tasks, photos, your location and place names, your step count, names and package names of other apps, your PIN, the partner code your partner gives you, and anything about your partner. The app sends no list of your installed apps and does not record your screen. Every event carries only values from fixed lists, numbers, or yes and no, never text that you entered.

insiegel never reads your device’s advertising ID or the Android identifier SSAID, not even when the switch is on. We do not use this data for advertising and do not pass it on to advertising networks.

If you turn the switch off, the app stops collecting anything right away. Crash reports not yet transmitted and the analytics data buffered on the device are deleted, the user ID is removed, and the device’s identifier for analytics is reset. Data already transmitted stays with Google until its retention period ends (see 4).

2.7 Payments (Google Play, RevenueCat)

You buy Premium through Google Play. Only Google sees payment details such as your card number or account. We never receive them.

As of the date of this policy, payment features are not yet active. Nothing goes to RevenueCat yet. Once they are enabled, we transmit your Firebase UID to RevenueCat. RevenueCat uses it to assign a purchase to your account and to keep it valid on all your devices. For this, RevenueCat receives the purchase data from Google Play (product, time, billing period, subscription status).

2.8 Visiting this website

The images, design, and script of this website are on the same server as the page. Without your consent, the website sets no cookies, and your browser does not connect to other providers when you open a page. Only if you choose “Accept” in the cookie notice does the website load Google Analytics (see 2.14). If you open insiegel.de, insiegel.eu, insiegel.app, or insigel.de, you reach this website through a server of Spaceship (see 2.15).

The page is hosted on GitHub Pages. When you open it, GitHub processes the connection data that is technically necessary, mainly your IP address, and stores it, by its own statement, for security purposes. We ourselves receive no access logs from GitHub.

Your choice in the cookie notice. On your first visit, the website shows a notice at the bottom with two equal buttons, “Reject” and “Accept”. The website stores your choice in the local storage of your browser (localStorage, entry “insiegel-consent” with the choice, the version of the notice, and the time). The entry does not leave your browser, and we do not receive it. It stays until you delete the data of this website in your browser. Without it, the website would have to ask you again on every visit. This is why storing it is strictly necessary and does not need consent (Section 25(2) No. 2 TDDDG). If JavaScript is turned off in your browser, no notice appears and Google Analytics never runs.

2.9 Waitlist

As of the date of this policy, the waitlist is not yet open. Nothing goes to Brevo yet.

If you join the waitlist, we process your email address to write to you about the launch of insiegel: when tester spots open up and when the app is available on Google Play. We do not use the address for anything else.

Joining works by double opt-in. First you get an email with a confirmation link. Only after you click it do we add you to the list. As proof of your consent, we store the time you joined and the time you confirmed. We do not ask for a phone number and do not send text messages.

For the signup and for sending the emails, we use Brevo SAS (106 boulevard Haussmann, 75008 Paris, France) as our processor. Brevo stores the list on servers in the EU. We do not measure whether you open our emails or click links in them. Brevo’s open and click tracking is turned off.

You can unsubscribe at any time with the link in every email or by writing to support (at) insiegel.com. After that, we remove your address from the waitlist.

2.10 Lock and usage access

For the lock to work, insiegel needs Android’s “Usage access” (access to usage data). During a lock window, the app uses it to read which app is currently in the foreground and places the lock over it if that app is blocked. With the same access, the app calculates your screen time for recent days during setup and the time won back in Stats. All of this stays on the device. Which apps you use and for how long does not go to our servers or to Google.

If you try to open a blocked app during a lock, the app writes this to a log on the device, without the name of the app. This log never leaves the device. For usage statistics, see 2.6.

2.11 QR code when pairing and restoring (Google ML Kit)

When pairing with a partner and when restoring a pairing, the camera of one device reads the QR code. Google ML Kit does this. It is a library that is built into insiegel and runs on the device. The camera image and the content of the QR code do not go to Google. According to Google, however, ML Kit sends diagnostic and usage data to Google: phone model, manufacturer, Android version, package name and version of the app, performance values (such as the duration of a detection), and detection settings (such as image format).

2.12 AI check of proofs (only with your consent)

As of the date of this policy, the AI check is not yet active. Until then, no AI checks your proofs.

You can choose to have an AI check your photo proofs and location proofs. Before you choose this for the first time, the app asks for your consent.

• Photo: The app sends the photo (downsized to at most 1600 pixels), the title and description of the task, and your hint to our server. There, Gemini, an AI model from Google, checks whether the photo shows that you did the task.
• Place: When you check off the task, the app sends your current location, the title and description of the task, and your hint to our server. The server uses the location to look up places nearby (Google Places API) and has Gemini check whether a fitting place is among them. Gemini gets the list of places, not your location.

Our server is a Google Cloud Function in Belgium (europe-west1). Gemini runs through Google Vertex AI in the EU. The answer goes back to the app with the result (fits, does not fit, unclear) and a one-sentence reason. The task counts as done only if the result is “fits.”

We store neither the photo nor your location. Only for a repeat of the same task, our server keeps the places from the last search, together with your location, in working memory for up to four hours, not in a database. After that, both are gone. For each account, we store how many AI checks you have run today (at most 30 checks a day), and a log without content: which completion, which type, which result, when, and with which model. Google does not use the photo and the text to train its models. For the place search, Google receives only coordinates, not your account.

An AI can be wrong. It can reject a real photo and accept a staged one. You can try again. As always, you can skip the task only under the rules of your partner lock.

Your consent is voluntary. You can withdraw it at any time in Settings under Privacy and legal. After that, the app sends nothing more, and you can no longer choose the AI check.

2.13 Protecting our server (Firebase App Check)

To make sure that only the real insiegel app uses our services, Firebase App Check checks at startup, and regularly after that, whether the app comes unchanged from Google Play and runs on a real device. For this, the app asks Google’s Play Integrity API through Google Play services. Google receives information about the app and the device in the process. We receive only a check token, with no information about you.

2.14 Web analytics with Google Analytics (only with your consent)

This section applies to the website. For the app, see 2.6.

With your consent, we use Google Analytics 4 on this website, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). With it, we measure how many people visit the website, which pages they read, and which links, searches, and campaigns bring them here. This shows us what works on the website. Only when you choose “Accept” in the cookie notice does your browser load the script from Google and send data to Google. Before that, and after “Reject”, no request goes to Google.

What goes to Google:

• Which pages you open, when and for how long, and which page you come from (referrer).
• Campaign details in the address of the page, for example UTM parameters.
• What you do on the website, for example how far you scroll and which links to other websites you click.
• Device type, browser, operating system, screen size, and language.
• An approximate location (country, region, city) that Google derives from your IP address. According to Google, Google Analytics does not store the IP addresses of users in the EU, but discards them afterwards.
• Online identifiers in cookies, by which Google Analytics recognizes your browser on a later visit.

Cookies. Google Analytics sets two cookies on insiegel.com: “_ga” distinguishes visitors, and “_ga_<ID>” stores the state of your visit. <ID> is the identifier of our Analytics property. Both expire after 2 years at the most.

Google signals and all advertising features are turned off. We do not link the data to an insiegel account and do not use it for advertising. Google stores it for 14 months (setting in our property) and then deletes it.

Google Ireland processes the data for us as a processor. Google may also process it in the US (Google LLC, Mountain View). Google LLC is certified under the EU-U.S. Data Privacy Framework. This transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). In addition, Google has agreed to Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The legal basis is your consent: Section 25(1) TDDDG for the cookies and for reading information from your browser, and Art. 6(1)(a) GDPR for processing the data. Consent is voluntary. Without it, the website works the same. You can withdraw it at any time with effect for the future: click “Cookie settings” at the bottom of any page and choose “Reject”. The website then deletes the Google Analytics cookies and reloads without Google Analytics.

2.15 Domains, redirects, and email (Spaceship)

Our domains insiegel.com, insiegel.de, insiegel.eu, insiegel.app, and insigel.de are registered with Spaceship, Inc. (USA). Spaceship also runs the name servers (DNS), the redirects, and the forwarding of our email addresses.

• Redirects: If you open insiegel.de, insiegel.eu, insiegel.app, or insigel.de, your browser first connects to a server of Spaceship, which redirects you to insiegel.com. Spaceship processes your IP address, the address you opened, the time, and the details your browser sends.
• DNS: So that your browser finds insiegel.com, your device asks the name servers of Spaceship. This request usually comes from the DNS server of your internet provider, not from your device itself.
• Email: Spaceship receives emails to our addresses at insiegel.com and forwards them to a mailbox at Google (Gmail). Spaceship processes the content and metadata of the email, for example sender, recipient, subject, time, and the IP address of the sending server (see 2.16).

This is a transfer to a country outside the EU and the EEA. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is that our addresses can be reached, that all domains lead to the right website, and that emails arrive. If you write to us about your account or a purchase, it is Art. 6(1)(b) GDPR.

2.16 Contact by email

If you send us an email, we process your email address, your name if you give it, the content of your message, and the time. We use this only to answer your request, for example about your account, about deletion, or about a question on the app.

The legal basis is Art. 6(1)(b) GDPR if your request concerns your account, a purchase, or the use of the app. Otherwise, it is Art. 6(1)(f) GDPR. Our legitimate interest is to answer requests.

Spaceship forwards emails to our addresses to a mailbox at Gmail (see 2.15). The provider of Gmail is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process the emails in the US (Google LLC, see 2.14).

We keep your email as long as we need it for your request. After that, we delete it, unless a law requires us to keep it longer, for example for business letters.

2.17 Beta test through a Google Group

The “Become a beta tester” button on the home page leads to our Google Group insiegel-beta. You join it with your Google account. Only members of this group get the test version of insiegel in the closed test on Google Play. We use your membership for this and for notes about the test, for example how to install the test version.

Google processes your joining and your membership in Google Groups and Google Play. The provider is Google Ireland Limited (see 2.14). Google may also process the data in the US (Google LLC). As the owner of the group, we see the email address of your Google account and the name under which you appear in the group. The legal basis is Art. 6(1)(b) GDPR: you want to take part in the test. You can leave the group at any time. When the beta ends, we delete the group.

3. Legal bases

• Account, task syncing, lock with usage access, location proof and steps proof, partner feature: Art. 6(1)(b) GDPR, the EU General Data Protection Regulation (performance of the contract for using the app).
• Crashlytics and Analytics outside the US (EU, EEA, United Kingdom, Switzerland, and all other countries): Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG (consent that the app asks for after your first tasks, see 2.6). You can withdraw your consent at any time in Settings.
• Crashlytics and Analytics in the US: Art. 6(1)(f) GDPR. Our legitimate interest is to find crashes and to understand how the app is used. Collection begins as soon as the notice has been shown to you (see 2.6). You can object at any time in Settings.
• Diagnostic data from Google ML Kit when pairing and restoring: Art. 6(1)(f) GDPR. Our legitimate interest is a working QR scanner.
• AI check of proofs: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent), and for photos that relate to health, Art. 9(2)(a) GDPR. You can withdraw your consent at any time in Settings.
• Counter and log of the AI check: Art. 6(1)(f) GDPR. Our legitimate interest is to limit costs and to detect abuse.
• App Check: Art. 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG. Our legitimate interest is a server that only the real app can use.
• Payment processing through Google Play and RevenueCat, once active: Art. 6(1)(b) GDPR.
• Delivery of this website and security logs during hosting: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable website.
• Google Analytics on this website: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent in the cookie notice, see 2.14). You can withdraw it at any time under “Cookie settings”.
• Storing your choice from the cookie notice in your browser: Section 25(2) No. 2 TDDDG (strictly necessary) and Art. 6(1)(f) GDPR. Our legitimate interest is to respect your choice without asking you again on every visit.
• Domains, redirects, and email forwarding at Spaceship: Art. 6(1)(f) GDPR, see 2.15.
• Contact by email: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR, see 2.16.
• Waitlist: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time. Proof of consent: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

4. Retention period

We keep account and task data as long as your account exists. We keep the partner ID (see 2.5) until you choose “Remove partner lock” in the app or delete your account. If you delete your account in the app, we delete your data in our cloud database and your sign-in account without undue delay: the app deletes them right after your confirmation, before it signs you out. If you request deletion by email, we delete without undue delay, at the latest within one month (Art. 12(3) GDPR).

After deletion, only the partner lock security log and a cache of the cloud database remain on the device. Both disappear when you uninstall the app or when you clear the app data in Android Settings. The security log (for example failed attempts) never leaves the device. For photos, see 2.3.

Crashlytics and Analytics: Google stores crash reports for 90 days. Google stores analytics data for as long as we set in Analytics: 14 months. On request, we delete it sooner.

Google Analytics on the website: Google stores the data for 14 months. The cookies expire after 2 years at the most, or sooner if you reject or delete them in your browser. Your choice in the cookie notice stays in your browser until you delete the data of this website there.

Emails: as long as we need them for your request. After that, we delete them, unless a law requires us to keep them longer (see 2.16). Spaceship decides itself how long it keeps connection data of the redirects.

Waitlist: Your address stays on the list until you unsubscribe, at the latest until six months after the public launch on Google Play. After that, we delete the list. We keep the proof of your consent for three years after the end of the consent to be able to present it if needed.

AI check: We do not store the photo or your location. We delete the daily counter at the latest 30 days after your last check, and the log without content after 30 days. If you delete your account, we delete the counter and the log as well. Google Cloud Logging stores the connection data of our server (IP address, time, and for every check your account identifier and the result) for 30 days.

5. Recipients

• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as processor for Firebase and Google Cloud: Authentication, Cloud Firestore (region europe-west3, Frankfurt), Cloud Functions (region europe-west1, Belgium), Vertex AI (Gemini, EU), App Check, Crashlytics, and Analytics (see 2.6). Google may also process data from Analytics and Crashlytics in the US (Google LLC, Mountain View).
• Google Ireland Limited as processor for Google Analytics on this website, only with your consent (see 2.14). Google may also process the data in the US (Google LLC, certified under the EU-U.S. Data Privacy Framework).
• Google for the diagnostic data of ML Kit (see 2.11).
• Google as provider of Google Maps Platform (Places API) for the place search during the AI check of a location proof (see 2.12). Google receives only coordinates, no account, and processes them under its own responsibility.
• Google as provider of Google Play for purchase and payment, once Premium is sold. In the EEA, Google is the seller here and processes your payment data under its own responsibility.
• RevenueCat, Inc. (San Francisco, USA), once payment features are active (see 2.7). This is a transfer to a country outside the EU and the EEA.
• GitHub (GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands, and GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA) as host of this website, see 2.8. By its own statement, GitHub takes part in the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses.
• Spaceship, Inc. (USA) for domains, DNS, the redirects, and the forwarding of our emails, see 2.15. This is a transfer to a country outside the EU and the EEA.
• Google as provider of the mailbox (Gmail) where emails to our addresses arrive, see 2.16.
• Brevo SAS (Paris, France) for the signup and the sending of the waitlist emails, once the waitlist is open, see 2.9.
• Your partner is not a recipient within the meaning of this policy, see 2.5.

We do not sell personal data and do not pass it on for advertising.

6. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority, for example with the Berlin Commissioner for Data Protection and Freedom of Information. For any request, write to us at support (at) insiegel.com. These rights apply to you no matter which country you live in.

7. Delete account

You can delete your account directly in the app (Settings, Account, Delete account). Instructions are on the “Delete account” page of this website. You can also request deletion by email to support (at) insiegel.com without any formalities, from the email address of your account.

8. Children and teenagers

You must be at least 16 years old to use insiegel. From age 16, you can consent to the processing of your data yourself in Germany (Art. 8 GDPR). insiegel is not directed at children. We do not knowingly collect data from persons under 16 years of age. If we learn that an account belongs to a person under 16, we delete it. You may buy Premium from age 18 or with the consent of a parent or guardian (see Terms of Service).

9. Your US privacy rights

• We do not sell your personal information and do not share it for advertising across apps and websites (“sell” and “share” as defined in the California Consumer Privacy Act, CCPA). insiegel shows no ads and does not read the advertising ID.
• Crashlytics and Analytics turn on in the US as soon as a notice has been shown to you. It appears after your second task, at the latest on the day after setup (see 2.6). You turn both off in the notice or later in the app: Settings, Privacy and legal, Usage statistics & crash reports.
• The step count stays on the device (see 2.4). insiegel does not recognize faces or other biometric identifiers.
• Do Not Track: The website does not respond to Do Not Track signals from your browser. It only measures if you agree in the cookie notice (see 2.14). The app does not respond to Do Not Track signals either, because there are none in an app. In the app, you turn off usage statistics and crash reports with the switch (see 2.6). With your consent, Google Analytics collects data about your visits to this website over time, with Google signals and advertising features turned off (see 2.14). Apart from that, other parties do not collect personal information about your online activities over time and across different apps and websites when you use insiegel.
• insiegel is not for children under 13 years of age. We do not knowingly collect data from them (Children’s Online Privacy Protection Act, COPPA). The minimum age for insiegel is 16 (see 8).
• You can request access, correction, and deletion at any time, no matter which state you live in. Write to support (at) insiegel.com. We will not discriminate against you for exercising your rights.

10. Users in Latin America

• You have the same rights as in 6: access, rectification, erasure, and objection, plus the right to withdraw consent. In Mexico, they are called ARCO rights. For any request, write to support (at) insiegel.com in Spanish, English, or German.
• Your data is located in the EU (Frankfurt). Analytics and Crashlytics, Google Analytics on the website, Spaceship, Gmail, and RevenueCat may process data in the US (see 5). This is a transfer to another country.
• You can lodge a complaint with the data protection authority of your country, for example with the ANPD in Brazil or the AAIP in Argentina. In Mexico, the Secretaría Anticorrupción y Buen Gobierno has been responsible since March 21, 2025.
• In Mexico, this policy also serves as the privacy notice (aviso de privacidad) under the LFPDPPP. We respond to ARCO requests within 20 days.
• In Argentina, you can request access to your data free of charge at intervals of at least six months (Ley 25.326, Art. 14(3)). The AAIP, as the supervisory authority, accepts complaints.
• In Brazil, send requests under Art. 18 LGPD to support (at) insiegel.com.
• In other Latin American countries, you exercise your rights under the law of your country through the same address.
• This policy is also available in German and Spanish. In case of discrepancies, the German version prevails.

11. Changes to this policy

We update this policy when the app or the law changes. The current version is always on this page. The effective date at the top shows which version applies. If something significant changes in the app, such as which data it transmits, we tell you in the app beforehand.