Simstim
Privacy Policy
Draft. This text describes how Simstim actually works (checked against the code) but has not been reviewed by a lawyer yet. Parts still to be completed are highlighted: [to fill in: …].
In short
- Simstim is a personal log of food, workouts, body and sleep. Almost everything you keep in it is health data, and we treat it that way.
- Your data lives on our server at Hetzner in Germany (EU). Backups are kept there too, for 14 days.
- Some data goes to AI (Anthropic Claude, Google Gemini, USA) - only what you send for an estimate yourself: food photos and descriptions, scale reports, strength workout notes. Your name, email and other records do not.
- Data goes to services (Strava, Hevy, Zwift, TrainerDay) and to Health Connect / Apple Health only if you connect them, and only what is switched on in that connection's settings.
- Friends see only what you open to them in Privacy. Support sees your data only when you ask for help, for 30 minutes, logged, and you are notified.
- We do not sell data, show ads, or use trackers or third-party analytics SDKs.
- You can download all your data and delete your account in the app: Profile → Privacy → My data.
- Simstim is not a medical device: estimates and targets are recommendations, not a substitute for a doctor or dietitian (see the Terms).
- Who is responsible for your data
- What data we collect and where it comes from
- Why, and on what legal basis
- Where data is stored
- Artificial intelligence
- Who may receive data
- Transfers outside the EU
- How long we keep data
- Your rights and how to use them
- Security
- Age
- Consumer health data (US states)
- California residents
- Changes to this policy
- Contact
1. Who is responsible for your data
The data controller is [to fill in: name or company, address, country of registration].
Privacy contact: [to fill in: address, e.g. privacy@simstim.app]. EU representative (GDPR Art. 27): [to fill in]; UK representative: [to fill in]. There is no Data Protection Officer yet - [to fill in if appointed].
2. What data we collect and where it comes from
| What | Source | Details |
|---|---|---|
| Account | you, at sign-up | email (also your login), name, country (chosen once), your phone's language and time zone, who invited you, password - stored only as a hash (scrypt), consents with document version and time |
| Food | you | meals, ingredients, calories and macros, photos of dishes and labels, captions (including dictated ones), your own foods and dishes with photos |
| Body and goals | you, smart scales via Health Connect / Apple Health, screenshots of scale reports | weight, body composition (fat, muscle, water, bone, resting energy), measurements, sex, birth year, height, goal and pace, an event with a date, how you feel, notes |
| Sleep and recovery | Health Connect / Apple Health | sleep duration, sleeping heart rate, resting heart rate, heart rate variability (HRV), SpO₂, respiratory rate, body or skin temperature |
| Activity and workouts | Health Connect / Apple Health, connected services, .fit files, you | steps, floors, workouts: type, time, duration, distance, calories, heart rate, power, cadence, speed, elevation, GPS route (if recorded), strength sets; the name of the app that recorded the workout and the device model |
| Service connections | you | API keys, OAuth tokens, and for Zwift your Zwift login and password; sync state and event queue |
| Friends | you and your friends | friendships and requests, reactions, dishes you share (a snapshot of ingredients and photo), invite codes (stored only as a hash), temporary “Friends nearby” tokens |
| Phone | the app | a random install ID, model, OS and app version, language, time zone, which permissions are granted, battery restrictions, time and result of the last sync - so support can troubleshoot; push token (Android) |
| Sign-ins and security | the server | sessions (device name), sign-in log: time, IP address, browser or app, the login entered, success or failure; server technical logs with IP addresses |
| Data log | the server | what came from Health and services and what happened to it - to answer “where did this value come from” |
| AI call log | the server | model, token counts, cost, request type, success and time - without the text of requests or answers |
| Support requests | you and support | the request, correspondence, actions taken |
| Subscription | the server | plan, status, dates; subscriptions are currently granted manually, there are no in-app payments |
What we do not collect: advertising IDs, analytics or crash reports from third-party SDKs (the apps have none), contacts, your phone's location (coordinates reach us only as the route of a workout that was already recorded), voice recordings (see section 5).
3. Why, and on what legal basis
For people in the EU and UK we state the GDPR basis. We process health data only with your explicit consent (Art. 9(2)(a)), which you give with a separate checkbox at sign-up. The service cannot work without it - that is what it is for.
| Purpose | Basis |
|---|---|
| Account, sign-in, sessions | contract (Art. 6(1)(b)) |
| Storing records and calculations: food budget, workout energy, readiness, body assessment, Progress, awards | contract + explicit consent to health data |
| AI estimates of food, products, scale reports and strength workouts | contract + explicit consent; you send the request |
| Exchange with services and Health Connect / Apple Health | your instruction: connecting and the “what to import / what to send” switches |
| Friends, feed, leaderboard, sharing dishes, Friends nearby | contract + consent you express through Privacy settings |
| Push and in-app notifications | contract; announcements - legitimate interest, you can turn them off |
| Support and fixing problems | contract and legitimate interest; access to personal data only on your request |
| Security: sign-in logs, brute-force protection, support action log | legitimate interest and the duty to keep data secure (Art. 32) |
| Records of consents, data requests and deletions | legal obligation (Art. 5(2), 7(1)) |
| Anonymous statistics to improve the service (daily aggregates, no names) | legitimate interest |
| Backups | legitimate interest and the duty to keep data available |
Neither AI nor Simstim's calculations make decisions with legal or similarly significant effects on you (GDPR Art. 22): they are suggestions you check and edit yourself.
4. Where data is stored
- Server. All records, photos and logs are stored in a PostgreSQL database on our server at Hetzner Online GmbH, data centre in Falkenstein (Germany, EU). Hetzner is our processor (hosting) and does not use the data itself.
- Backups. A full copy of the database is made daily; copies are kept on the same server for 14 days and then deleted automatically. There is no off-site backup storage at the moment - [to fill in if added: provider, country, encryption].
- Phone. The app keeps a cache of server responses, meal drafts, photo copies, a widget summary and 90 days of history. Your sign-in token is encrypted with a key from the system keystore (Android Keystore; on iPhone, the Keychain). On Android, app data is excluded from phone backups and device transfer. [to check: whether app files are excluded from iCloud backup on iPhone]. Signing out erases settings and drafts on the phone; to remove everything from the phone, uninstall the app.
5. Artificial intelligence
Some features use large language models. Only what you send for an estimate yourself goes to AI, and only at the moment of the request.
What goes to AI
- Food estimates: photos of the dish and labels (compressed, without EXIF metadata or geotags), the caption or description, including dictated text; corrections and answers to follow-up questions; the previous estimate when you correct it.
- Your foods: up to 60 of your most used foods - name, aliases, calories and macros, usual serving and ingredients - so the AI can recognise them in photos. If you save a food without a category, the AI receives its name and ingredients to pick one.
- Smart scale reports: the screenshot you upload (weight and body composition are read from it).
- Strength workouts: the description or screenshots, corrections and answers; when sets are added to a workout from your watch, its start time and duration.
- Technical context with the request: current local time (for strength workouts), the answer language, the Simstim exercise catalogue.
What does not go to AI
Your name, email, login, account ID, the weight in your records, heart rate, sleep, workouts, routes and your friends' data are not included in AI requests. Requests are sent from our server, not from your phone, so the AI provider does not see your IP address either.
Who processes it
- Anthropic PBC (Claude models), USA;
- Google LLC (Gemini models), USA.
Which model is primary and which is the fallback (when one is overloaded) is a server setting; a request always goes to one of these two providers. Currently the primary is [to fill in: production models]. The providers process requests as our processors under their API terms: [to fill in: signed DPAs; that providers do not train models on our requests; how long providers keep requests; paid tier of the Gemini API]. We add a new AI provider only after signing an agreement with it and updating this policy.
We keep a log of AI calls - model, tokens, cost, request type, success - without the text of requests or answers.
AI estimates are approximate and can be wrong: you see the result and can edit it before saving.
Voice input
Dictation is recognised by your phone's system (on Android, the speech recognition service, usually Google; on iPhone, Apple). We never receive the audio, only the resulting text. The system may process the audio on Google's or Apple's servers under their terms.
AI coach (Claude via MCP)
You can connect your own Claude account to Simstim (MCP protocol, OAuth sign-in). Your Claude then reads and writes your data when you ask it to - this is a transfer at your instruction, and Anthropic is your provider under your own agreement with it. To disconnect: Sign-in and sessions in the app, or the “Coach sees my data” switch in Privacy.
6. Who may receive data
Our processors
| Who | What they receive | Where |
|---|---|---|
| Hetzner Online GmbH | everything stored on the server (hosting) | Germany |
| Anthropic, Google (Gemini) | the AI requests described in section 5 | USA |
| Google Firebase Cloud Messaging (Android only) | the phone's push token and a “something new” signal with no text - the phone fetches the notification text from our server | USA / worldwide |
| Email provider | email address and messages with links (password reset, export, deletion confirmation). No emails are sent yet - [to fill in: provider, country] | - |
There are no push notifications on iPhone yet.
Services you connect
These are independent companies with their own policies. Data flows to and from them only after you connect them and only for the switches you leave on (Profile → Apps → the service). Keys and tokens are stored on our server; we delete them when you disconnect.
| Service | We import | We send |
|---|---|---|
| Strava | Only if you turn on “Fetch workouts from Strava” (off by default): workouts that are not on your phone or in other sources - summary, laps, data streams - heart rate, power, cadence, speed, elevation, temperature, GPS route. Under the Strava API terms only you see them: they are not shown to friends, in the leaderboard or to the AI coach, are not mixed with your data from other sources, and we keep them no longer than 7 days after the workout; deleting in Strava deletes our copy. A workout we sent to Strava ourselves is not fetched back - we keep only a link to it | “Send workouts to Strava” - only with your consent (off by default, the app asks when you connect): workouts from Health Connect / Apple Health that are not in Strava yet - type, time, distance, route, heart rate, power and calories; walks and hikes only with “Upload walks too”. You can turn it off at any time; what has been sent stays in Strava under its policy |
| Hevy | strength workouts: exercises and sets (weight, reps, RPE, time), routines as plan templates, exercise catalogue | edits to a plan created from a Hevy routine; workouts and routines you ask the coach to create |
| Zwift | rides: original .fit files (power, heart rate, cadence, speed, distance). Sign-in uses the Zwift login and password you enter (an unofficial method, see the Terms) | nothing |
| TrainerDay | planned workouts from your calendar and completed rides (.fit) | edits and deletion of linked plans; new plans only with “New bike plans go to the calendar automatically”; workouts you ask the coach to create (with power targets from your FTP) |
Disconnecting a service in Simstim does not revoke access on the service's side: for Strava, revoke it in Strava settings (Settings → My Apps). Workouts already imported stay with us until you delete them or your account; those fetched from Strava - no longer than 7 days.
Health Connect and Apple Health
These run on your phone: Google and Apple receive nothing from us. We read only what you allow in the system dialog: steps, floors, sleep, heart rate, resting heart rate, HRV, SpO₂, respiration, temperature, weight, workouts with routes. We write back (if enabled): daily food totals (calories and macros), weight and body composition, workouts from other sources. What to read and write is set in Profile → Apps → Health. Data from Health Connect is used only to run Simstim, never for advertising, and is not shared with third parties except as described in this policy.
Maps
To show a workout route, your phone loads the map background itself: on Android from OpenFreeMap (OpenStreetMap data), on iPhone from Apple Maps. The map provider sees your phone's IP address and which map tiles are requested - that is, the rough area of the route. The route itself is not sent to them.
Friends
- Friends see only the areas you open in Privacy: workouts, awards and steps are visible to friends by default; weight and body, food and sleep are only you by default. For each area you can choose “only me”, “friends” or “everyone” (“everyone” means anyone signed in to Simstim).
- Workout routes are never shown to friends; weight in a workout only if your body area is open.
- People can find you only by your exact login or email, and only if you allow it (by default - friends of your friends).
- A dish you share is sent as a snapshot - ingredients and photo. Anyone signed in to Simstim who has the link can open it.
- The steps leaderboard among friends can be turned off.
Friends nearby
Off by default. If you turn it on, while Simstim is open on screen your phone broadcasts a temporary random token over Bluetooth - without device name, login or location - and listens for tokens nearby. Only the tokens heard are sent to the server - without signal strength, time or coordinates. A “nearby” pair is created only if you are friends and both have it on; pairs expire quickly, expired data is erased, and turning the feature off immediately erases all your tokens and pairs.
Support
Without a request from you, a staff member sees only a card without personal data: login, email, dates, record counts, connected services without their settings, sessions without tokens, sync errors. They open your settings (privacy, notifications, devices, sign-ins) and your records only for your open support request: records need a separate 30-minute grant, for one person, with a reason. Every view is logged, you get a notification and can see the history in the app (Privacy → Support access). Support cannot see photos, routes or raw service responses.
Required by law
We disclose data to authorities only when legally required, and no more than necessary - [to fill in / lawyer: procedure and notifying the user].
What we do not do
We do not sell data, share it for advertising, or use it for advertising profiles. There are no ads, trackers or analytics cookies in the apps or on the website.
7. Transfers outside the EU
Primary storage is in the EU. Data leaves the EU to: AI providers in the USA (section 5), Google for push, the map provider, and services you connect yourself (many of them operate in the USA). For our processors the transfer mechanism is [to fill in: EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses; how to request a copy]. Transfers to services you connect happen at your instruction.
8. How long we keep data
| Data | Period |
|---|---|
| Records, photos, goals, connections, friends | while your account exists; after deletion - erased (from backups within 14 days) |
| Sign-in log | 365 days |
| AI call log (no text) | 395 days |
| Data log (“where a value came from”) | 730 days |
| Service sync events | completed - 30 days, failed - 90 days |
| Support action and data-access grant logs, account deletion log (no personal data, email only as a hash) | 6 years |
| Closed support requests | 3 years after closing |
| Friends nearby tokens and pairs | minutes; erased automatically |
| Database backups | 14 days |
| Server technical logs (with IP) | overwritten by size - [to fill in: period, no more than 30 days] |
When an account is deleted, the sign-in log keeps entries without the login and device, and support grant records keep no data about you: they are needed to show who had access and when.
9. Your rights and how to use them
Right in the app
- Download all data - Profile → Privacy → Download all data: a JSON file with all records, your account, settings, consents, subscriptions, friends and shared dishes. Photos, workout data streams and service keys are not in the file yet - you can get them on request.
- Correct - any record can be edited or deleted; fields you edit by hand are not overwritten by sync.
- Restrict - what friends see, search, leaderboard, coach, nearby - in Privacy; what to import and send - in each service's settings.
- Delete your account - “Delete account and data” with your password: the account and all data are erased immediately (from backups within 14 days).
- Withdraw consent to health data - this means deleting the account: the service cannot work without that data. You can download your data first.
By request
Write to [to fill in: address] or contact support from the app: access, a machine-readable copy, correction, deletion, restriction, objection, the list of recipients. If you forgot your password, deletion goes through support: the account is disabled immediately and data is erased after 7 days (you can cancel during that time). We verify your identity through your account or by email to its address. We reply within one month (EU, UK; extendable by two more months for complex requests, and we will tell you) or 45 days (US states; extendable by 45 more). If we refuse, you can appeal by replying to our message - we decide within 45 days.
You may complain to the data protection authority of your country (EU), the ICO (UK) or your state attorney general (USA).
10. Security
HTTPS only; passwords hashed with scrypt, tokens and codes hashed with sha256; brute-force protection; each person's data isolated on the server; staff have roles, two-factor sign-in and an action log; access to records only on request and for 30 minutes. No protection guarantees everything: if a breach happens, we will notify you and the authorities within the time the law requires. [to fill in: encryption of backups and service keys, once in place]
11. Age
Simstim is for people aged 16 and over. If we learn that an account belongs to someone younger, we will delete it.
12. Consumer health data (Washington, Nevada and other US states)
This section is our consumer health data privacy policy under the Washington My Health My Data Act and similar laws.
- What data: weight and body composition, height, sex, birth year, weight goals, food and food photos, sleep, heart rate, HRV, SpO₂, respiration, temperature, workouts with routes, how you feel and notes, and what is derived from them (food budget, readiness, body assessment, AI estimates).
- Sources: you, Health Connect / Apple Health, services you connect, Simstim calculations and AI.
- Why: only to provide the service - to store, calculate and show it to you, and share it with whom you choose.
- Who we share it with: the processors in section 6 (Hetzner, Anthropic, Google); services and friends at your instruction. We have no affiliates. We do not sell it.
- Consent: to collection - the checkbox at sign-up; to sharing - connecting a service, opening areas to friends and sending items for AI estimates.
- Rights: to know what data we have and who received it (with a list of recipients), to delete it - including at processors - and to withdraw consent; how - section 9, including appeals.
- We do not use geofences around healthcare facilities.
13. California residents
In the last 12 months we collected the categories in section 2: identifiers (email, login), health data, precise geolocation (workout routes only), and activity in the service. We do not sell or “share” personal information as defined by the CCPA (for advertising); we use sensitive personal information only to provide the service, so no “Limit the Use” link is required. We honour the Global Privacy Control signal - we do not share for advertising in any case. Rights to know, delete, correct and not be discriminated against - section 9; you may use an authorised agent with your written permission.
14. Changes to this policy
The policy has a version (at the top). For material changes we will tell you in the app before they take effect and, if the change affects your consent to health data, ask for consent again. We store the version you accepted together with your consent. Previous versions - [to fill in: where the archive is published].
15. Contact
[to fill in: controller, postal address, privacy email, EU and UK representatives]