Calibra Pro Privacy Policy
Version 30.10.2026 · Applies to the Calibra Pro iOS application
1. Who is responsible
Synaptik GmbH
Azaleenweg 56, 60433 Frankfurt am Main, Germany
Registered at Amtsgericht Frankfurt am Main, HRB 142389
Managing Director: Andrei Georgescu
Contact: calibra@synaptik.life
This policy covers the Calibra Pro mobile application. Our website is covered by a separate policy at calibra.health/privacy, which deals with waitlist signup, enquiries and website analytics. Your contract with us for using the app is in our Terms of Service.
2. Data protection officer
Katrin Dahmen
exkulpa gmbh, Waldfeuchter Str. 266, 52525 Heinsberg, Germany
dahmen@exkulpa.de · +49 2452 99 33 11
3. Age
Calibra Pro is for adults. You must be 18 or older to register. We ask for your date of birth on the first screen, before anything else, and we do not create an account if it shows you are under 18. When you connect Apple Health we compare the age it reports with the date you gave us, and tell you if the two do not agree. We do not knowingly process data from anyone under 18.
4. What Calibra Pro is, and is not
Calibra Pro reads physiological, nutritional and contextual signals and turns them into daily guidance on four signals: Readiness, Movement, Nutrition and Context.
It is not a medical device. It does not diagnose, treat or prevent any condition, and it does not replace a doctor, coach or clinician.
The guidance is advisory. It produces no binding consequence, and following or ignoring it carries no penalty. Later guidance may adapt to what you actually did.
5. What we process
| Category | Examples | Source | Purpose | Legal basis |
|---|---|---|---|---|
| Account data | Name, email address, an internal account identifier, account creation and login events | You, at registration | Creating and operating your account | Art. 6(1)(b) |
| Date of birth | Date of birth | Apple Health, or entered by you | Confirming you are 18 or older; age-dependent physiological baselines | Art. 6(1)(b); Art. 9(2)(a) where used in health computation |
| Biological sex | Biological sex | Apple Health | Sex-dependent physiological baselines and nutrition calculation | Art. 9(2)(a) |
| Wearable and Apple Health data | Steps, heart rate, resting heart rate, heart rate variability, respiratory rate, sleep, workouts, body mass, height. With an Apple Watch, also the heartbeat series behind heart rate variability and, on iOS 27, Apple's own heart rate variability value, used only for your overnight reading; we do not store the heartbeat timings or analyse your heart rhythm. For each night, which device and which measure recorded it, and how many readings fell inside your sleep, but never a serial number or a name you gave the device. WHOOP data reaches us only through Apple Health | Apple Health, and connected wearables through our own ingestion service | Producing your Readiness and Movement signals and your daily guidance | Art. 9(2)(a) |
| Nutrition data | Meals, foods, quantities, nutrition totals, eating patterns | Entered by you, or connected nutrition sources | Producing your Nutrition signal and its guidance | Art. 9(2)(a) |
| Dietary preferences | Dietary choices you set, including preferences that may reflect a religious practice such as halal | You, in onboarding | Keeping meal guidance within what you will eat | Art. 9(2)(a) |
| Meal photographs | Photographs of meals you choose to add | You | Identifying and estimating what you ate | Art. 9(2)(a) |
| Self-reported state | Weight entries; an optional afternoon energy check-in (Steady or Dipped) on days a meal reminder was sent, kept 90 days and used only to show you your own pattern | You | Calibrating guidance to your own reporting; showing you your own pattern | Art. 9(2)(a) |
| Safety answers | Whether you have diabetes, a heart condition, or are pregnant | You, on the safety screen | Making your guidance more careful: any yes, or no answer, means no calorie deficit, and movement plans stop one level below the highest | Art. 9(2)(a) |
| Derived values | Your Readiness, Movement, Nutrition and Context signals, personal baselines, your usual load over the last four weeks, your usual meal times, three values from your overnight heart rate (the lowest five-minute average, the night average and when the low fell), and the guidance cards and notifications generated for you. To set your usual when you connect, we read the past 28 days of step totals and workouts your Apple Health already shares, and keep only daily totals | Computed by us from the above | Delivering the product | Art. 9(2)(a) |
| Assistant conversations | Messages you send to the in-app assistant, and the physiological context attached to them | You, and computed context | Answering your questions | Art. 9(2)(a) |
| Calendar data | When entries start and end, whether they are all-day, their status, free or busy, your own response, whether you organise them, whether they have a meeting link, and an identifier that recognises the same entry in two of your calendars; from Google also whether they are focus time and how many people are invited. Never titles, descriptions, locations, attachments or who is invited. Kept as daily totals only | Your Google Calendar, Microsoft Outlook or Microsoft 365 calendar, with your permission | Reading the demands of your week, and producing your Context signal | Art. 6(1)(b); Art. 9(2)(a) where used in health computation |
| Settings you choose | Your working week, days you mark as away (with one of three reasons: holiday, work trip or something else; deleted 28 days after the period ends), whether you use meal pacing, your meal pattern, the time your kitchen closes, and whether you want meal reminders | You, in the app | Fitting your guidance and your week to how you live | Art. 6(1)(b); Art. 9(2)(a) where used in health computation |
| Card interactions | Whether a teaching card has been shown, and for nutrition cards and meal reminders, when they were shown. The nutrition card history is kept for 30 days, then deleted. The time the meal-pattern confirmation was first shown is kept only while it still decides your pacing, otherwise for the same 30 days. Whether a teaching card has been shown is kept while your account exists | Your use of the app | Deciding when a card can be shown again, and keeping nutrition cards to your limits and spacing | Art. 6(1)(b) |
| Subscription data | Subscription status, purchase and renewal events, offer code redemptions | Apple, through our subscription provider | Giving you access to what you paid for; accounting | Art. 6(1)(b); Art. 6(1)(c) |
We do not process location data.
Whatever you answer on the safety screen, if your body mass index is under 18.5, or your height or weight is missing, we do not set a calorie deficit.
From a wearable you connect, we keep its history only from when you started wearing it: the first recorded night after your latest gap of three or more days without one, within the 28 days before you connected. Anything dated earlier is deleted by the end of the first week after you connect, and earlier data that arrives later is not stored.
We do not keep skin or body temperature from any device. Nothing in Calibra detects, flags or names an illness, and we do not analyse your heart rhythm.
We do not process menstrual cycle or fertility tracking data, and we integrate no source that provides it. The one exception is the safety screen: if you tell us you are pregnant, we hold your nutrition guidance at maintenance. What you told us is never included in anything we send to the language model; only the resulting targets are. Answering is optional.
Calibra reads your calendar only. It never creates, edits or deletes anything in it. We read the timing and shape of your entries, as listed in the table above, never their contents, and calendar access is optional. You can use Calibra Pro without connecting a calendar.
Google Calendar data specifically
If you connect a Google Calendar, Calibra requests one scope: https://www.googleapis.com/auth/calendar.readonly. Read-only is the narrowest scope that allows us to read event times, and there is no narrower read scope for calendar events.
What we do with it. We read when your events start and end, whether they are all-day, their status, free or busy, your own response, whether you organise them, whether they have a meeting link, whether they are marked as focus time, how many people are invited, without their names or email addresses, and an identifier that recognises the same entry in two of your calendars. We ask Google for these fields only. We use them to produce your Context signal, which describes the demands of your week, and keep daily totals rather than individual events. We do not read event titles, descriptions, locations, attachments or who is invited, and we do not write to, modify or delete anything in your calendar.
Who we share it with. Google Calendar data is processed only by us and by Microsoft Ireland Operations Limited, which provides the hosting and database infrastructure the app runs on, as our processor under a data processing agreement. It is stored in EU regions on that infrastructure. See section 11.
We do not share, transfer or disclose Google user data to any other third party. It is not shared with RevenueCat, with Expo, with Apple, or with any analytics, advertising or data-broker service. We do not sell it and we do not use it for advertising.
We do not use it to train AI or machine-learning models. Where the app generates guidance text with a language model, that generation runs on Microsoft Azure infrastructure in the EU Data Zone and your data, including any Google user data, is not used to develop, improve or train that model or any other model.
When you connect a calendar, Calibra also reads the 28 days before, to set your usual.
How long we keep it. The daily totals Calibra computes from your calendar are kept while your account exists and your consent is in place, so your usual stays accurate if you reconnect. Disconnecting stops Calibra reading anything further. Withdrawing consent or deleting your account deletes them, as described in sections 7 and 8. When you disconnect a Google Calendar we delete our access token and revoke our access at Google.
We revoke the connection for you. When you delete your account we revoke Calibra's access at Google ourselves, rather than leaving a dormant grant behind. To do that we keep your encrypted Google token after the rest of your data is deleted, until the revocation succeeds, and then delete it. See section 8. You can also revoke our access yourself at any time in your Google account security settings, at myaccount.google.com/permissions.
Before anything is sent to the language model we reduce it to the minimum the answer needs, and remove detail that is not required to produce it. Your first name is never sent. When you write to the assistant, email addresses, phone numbers, postal addresses, card and account numbers, ID numbers, web links and the names of people, including your own, are replaced with placeholders before your message reaches the model; your own conversation keeps your words. If that step cannot run, your message is not sent. The assistant sees the last seven days of your nutrition and logged training. If a question needs more, the app asks you first and shows what it would use, and only if you agree does it use up to 90 days, as weekly totals, for that question.
Calibra Pro contains no analytics software and no crash-reporting software. We record whether a teaching card has been shown, so it is not repeated too soon. Our service records technical events, such as whether a request succeeded and how long it took, with your internal account identifier but no health values; on the subscription screen this includes your App Store country and the price shown, so we can catch a price shown for the wrong country. We keep these logs for 30 days. When your wearable data syncs, we record that the sync ran, for which source, when, and how many records of each type arrived, but not the readings themselves; we keep these sync records for up to 90 days, and delete them straight away if you withdraw consent or delete your account. We do not track you across other apps or websites, and we do not build a marketing profile of you.
When the app syncs, it sends a small amount of technical performance information about the device at that moment, including battery level, thermal state and available memory. We use it to decide whether a sync can run and then discard it. It is not stored and not linked to your health data.
6. Consent for health data
Everything above marked Art. 9(2)(a) is special category data. We process your health data only with your explicit consent (Art. 9(2)(a) GDPR, together with Art. 6(1)(a) GDPR). You give that consent on a dedicated screen before any health data leaves your device.
The consent control is never pre-ticked, the disclosure text carries a version stamp, and every grant and withdrawal is recorded with its version, timestamp and categories.
We ask for three separate consents, and you can give the first without giving the others.
1. Running the service. This covers all the health categories above and the language model that turns them into guidance. It is a single grant, because the product cannot produce guidance from a subset of the signals, and because there is no version of the service that works without the model. If you do not give this consent, we cannot provide the service at all.
2. Improving the system. Optional: help improve how your signals are calculated. If you switch this on, we use your reading history to check and improve how the signals are calculated. Declining changes nothing about the service you get.
3. Keeping what we send to the language model. Optional, and off unless you turn it on. If an answer goes wrong, this lets us keep the full text we sent to the language model for that answer for up to 30 days, so we can find out why and fix it. We use it for nothing else. A message the language model provider's safety filter blocks is never kept, whatever you chose. Your conversation history with the assistant is kept either way, until you delete it, withdraw your consent or delete your account.
You are not required by law or by contract to give us your data. Calibra Pro cannot work without the data covered by the first consent, so without it we cannot provide the service. The two optional permissions can stay off; Calibra Pro works without them.
7. Withdrawing consent
You can withdraw your consent at any time, from the settings in the app. You can also write to calibra@synaptik.life and we will action it without undue delay.
Withdrawal is destructive and immediate. It stops all further processing of your health data, disconnects your wearable and Apple Health connections, and deletes the data we hold about you. Your personal baselines are reset, so granting consent again starts calibration from the beginning, and your notification settings go back to their defaults. If something was being processed for you at that exact moment, anything it saves afterwards is deleted within fifteen minutes. A notification already on its way may still arrive. An export you have not yet downloaded is deleted with your data.
One thing we cannot do for you. Disconnecting stops us receiving anything further, but it may not revoke the permission you granted inside your wearable provider's own account, such as Polar, and it does not revoke it inside your Microsoft account if you connected an Outlook or Microsoft 365 calendar. To be sure it is removed, withdraw Calibra's access in that provider's settings. We delete the data on our side either way.
These things survive a withdrawal:
- Your account and login, so you can grant consent again.
- Your date of birth and age, which we keep to confirm you are over 18. We hold these to meet a legal obligation, not under the consent you are withdrawing, so they are unaffected by it.
- Your billing record, which we keep on a separate legal basis and which a withdrawal never erases.
- Our audit data: the record that you gave consent and then withdrew it, which we keep as evidence that we handled your consent lawfully. We keep it for three years after your account is deleted.
- Records of staff access to our database, as described in section 8.
Nothing else survives.
Withdrawal does not delete your account and does not cancel your subscription. If you do not want it to renew while the service is stopped, cancel it separately with Apple. See section 9.
8. Deleting your account
You can delete your account from within the app. Deletion is a hard delete carried out in a single transaction. There is no restore path and we cannot recover the account afterwards.
We keep encrypted backups so that we can restore the service after a failure, corruption or a security incident. They are retained for thirty-five days, with a geo-redundant copy held on the same schedule, so a copy of your data may remain in backup for up to thirty-five days after deletion, after which it is overwritten. This is a backup rotation window, not a grace period, and it is not a route to recovering your account.
These things survive account deletion:
- Your billing record, which German tax law requires us to keep for eight years, counted from the end of the calendar year in which the record arose.
- Our audit data: the consent record described in section 7, the record that you accepted our terms and which version, and a record of the deletion itself, holding an internal account identifier and the times the deletion was requested and completed, so we can show we carried out your request. While the deletion is still being completed at one of our providers, that record also holds the reference the provider needs, and we remove it as soon as the provider confirms. It holds no name, no email address and nothing about how you used Calibra. We keep all of it for three years.
- Record of staff database queries. From 15 November 2026, so that we can show what our staff did and did not access, we keep a record of the queries staff run on the production database through their personal logins. It does not record every administrative action on the database. It names you only by an internal identifier, never by name, email address or health value, and keeps a fingerprint of each query rather than its text. Each entry is kept for up to 36 months under a lock and deleted automatically. Legal basis: our legitimate interest in the security of processing and in being able to show it (Art. 6(1)(f) GDPR). If you ask what we hold about you (Art. 15 GDPR), the answer includes when staff queries touched your data.
- A record of your free trial, held as a one-way hash of your email address and the date the trial started, so the same person cannot take the five-day trial repeatedly. Apple does not track this for us, because the trial runs before any subscription exists. We keep it for twelve months, on the basis of our legitimate interest in preventing that abuse (Art. 6(1)(f)), and it cannot be read back to recover your email address.
- Your Google connection, briefly. If you had a Google Calendar connected, we keep your encrypted Google token after deletion for one purpose: revoking our own access at Google on your behalf, so you do not have to. The revocation runs as a separate process shortly after the deletion, and we dispose of the token within about a day. If disposal fails, we keep the token only until the next attempt succeeds, and our team is alerted to every failed attempt. Nothing is read from your calendar in that time, and the token is used for nothing else. You can also remove our access yourself at any time in your Google account security settings.
You can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). While the lock runs, we may refuse a request to delete an entry where it is needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR).
Your Microsoft calendar connection is not revoked for you. Microsoft offers no way for us to revoke it on your behalf. Remove Calibra's access in your Microsoft account settings. We delete the data on our side either way.
If your subscription lapses. If your subscription ends and you neither resubscribe nor delete your account, we keep your account and data for twelve months from the day it lapsed, so that you can pick up where you left off. After twelve months we delete it, exactly as if you had deleted it yourself. Thirty days before that, we tell you, with a link to export your data and a way to resubscribe.
9. Your subscription is separate
Your subscription is with Apple, not with us. Deleting your account or withdrawing your consent does not cancel it, and we cannot cancel it for you. If you do not cancel it in your Apple subscription settings, Apple will charge you at the next renewal.
10. Where your data is processed
Your data is stored and processed on infrastructure located in the European Union. Our application, database and cache run on Microsoft Azure in EU regions, and backups are replicated within the EU.
Where guidance text is generated by a language model, that generation runs in Microsoft Azure's EU Data Zone. Your data is not used to train the model.
Support access from outside the EU. Your health data is not copied out of the European Union. But our infrastructure provider operates a global support organisation, and its personnel located outside the EU may remotely access the systems your data sits on where that is necessary to operate, troubleshoot, support or secure the service. Under European law that access counts as a transfer, even though the data itself stays on EU infrastructure.
Where that happens it is covered by the EU Standard Contractual Clauses, and the provider's own published terms restrict it: no standing access, granted only where a task requires it, only for as long as necessary, limited to what is needed, by personnel using secured workstations, with the access logged and audited.
Administration from outside the EU. One of the people who run our infrastructure works from North Macedonia, which is outside the EU. When they administer the systems your data sits on, that access also counts as a transfer, even though the data stays on EU infrastructure. It is covered by the EU Standard Contractual Clauses. You can get a copy by writing to calibra@synaptik.life.
We tell you this rather than claim no transfers occur, because for any provider operating global support that claim would be very difficult to make truthfully. The subscription data described in section 11 also leaves the EU, on the basis set out there.
11. Who else is involved
| Recipient | Role | What they receive |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Ireland) | Hosting, identity, model inference | Account data, health data, calendar data including Google Calendar data, assistant conversations. Acts on our instructions under a data processing agreement, except for the abuse monitoring Microsoft carries out on its own account, where it acts as an independent controller rather than for us. That check is automated; only content it flags may be reviewed by authorised Microsoft staff, who for our EU deployment are located in the European Economic Area, and we cannot switch it off. Support personnel outside the EU may access the systems involved; see section 10 |
| Apple or Google, if you sign in with them | Confirming who you are when you sign in, as their own controller | Your name, your email address (with Apple, possibly a private relay address) and the fact that you signed in. Your account with them is covered by their own privacy policy. Signing in with an email address involves neither |
| Apple | Merchant of record for your subscription | Purchase and subscription data. Apple's own privacy policy applies to your purchase |
| RevenueCat, Inc. (United States) | Subscription state | A pseudonymous account identifier, your subscription status and purchase events, and device information such as device model, operating system version and country. Transfers to the United States are covered by the EU Standard Contractual Clauses in our data processing agreement with them. No health data |
| Expo (650 Industries, Inc., United States) | Push notification delivery | Your device's push token, and the title and body of the notification. Notification text is short and generic and contains no health data: that your briefing or forecast is ready, or, if you turn on meal reminders, only the meal and the time, such as "Lunch in 30 minutes." Transfers to the United States are covered by the EU Standard Contractual Clauses incorporated in Expo's terms |
The recipients above are the only parties who receive your data. We do not sell your data. We do not share it with advertisers or data brokers. Health data and calendar data are never used for advertising, and we do not track you across other companies' apps or websites. We do not use your data to train or improve AI or machine-learning models.
12. Automated processing
Calibra Pro generates guidance automatically from your data. This is not automated decision-making producing legal or similarly significant effects within the meaning of Art. 22. The guidance is advisory and produces no binding consequence. Following or ignoring it carries no penalty, though later guidance may adapt to what you actually did. You decide what to do with it.
13. Your rights
You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw your consent at any time.
You can export your data in the app. The file is prepared for you, kept only until you download it or for at most seven days, and then deleted. Data the language model was sent is not in the export, but you can ask us for it.
If you want a copy of your data, take the export before you withdraw consent or delete your account. Both are immediate, and we will not restore your data afterwards to fulfil a later request.
Write to calibra@synaptik.life or to our data protection officer at the address in section 2.
You may also complain to a supervisory authority. Ours is:
Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
14. Security
Your data is encrypted in transit and at rest. Access to production data is limited to named people working under contract, each bound by a data processing agreement (Art. 28 GDPR), who act only on our instructions, and each protected by multi-factor sign-in. We have an incident procedure.
15. Changes to this policy
We will update this policy when what we do changes. Material changes affecting your consent are presented in the app and require a fresh grant.
Changelog
| Version | Change |
|---|---|
| 30.10.2026 | §5 sync records kept for up to 90 days and deleted on withdrawal or account deletion, matching what we do. §6 conversation history kept until you delete it, withdraw consent or delete your account. §8 the record of staff database queries stated as starting on 15 November 2026, covering queries through personal logins and not every administrative action; the Art. 15 answer stated as when staff queries touched your data. Following the data protection officer review of 29.10. |
| 27.10.2026 | §5 skin and body temperature stated as not kept from any device, replacing the Polar nightly-difference sentence. §5 retention periods added for service logs (30 days), sync records (while the account exists), days marked as away (deleted 28 days after the period ends) and card history (nutrition cards 30 days; the meal-pattern confirmation only while it decides pacing, otherwise the same 30 days; teaching cards while the account exists). §5 the cross-calendar identifier named in the calendar row and the Google Calendar section. §6 the legal basis stated as Art. 9(2)(a) together with Art. 6(1)(a) GDPR; the improvement permission described in the consent screen's words; an Art. 13(2)(e) statement added that giving the data is neither a statutory nor a contractual requirement and that the two optional permissions can stay off. §8 the record of staff database queries restated with a query fingerprint rather than its text, a 36-month lock and automatic deletion, with Art. 15 and a separate Art. 21 objection paragraph. §14 contributors stated as bound by a data processing agreement under Art. 28 GDPR; the security text reduced to the measures in place today. |
| 21.10.2026 | §5 wearable data: WHOOP only through Apple Health; Apple Watch heartbeat series and native heart rate variability for the overnight reading, no rhythm analysis; device and reading count per night. Self-reported state narrowed to weight entries and the optional afternoon energy check-in, kept 90 days. Safety answers: no calorie deficit and movement capped one level below the highest. Derived values: usual load, usual meal times, overnight heart-rate values, and the 28-day read at connect. Calendar fields listed as actually read; the 28 days read at connect; retention of daily totals restated (kept while the account and consent exist; disconnecting stops reading). New row for settings you choose. Card interactions narrowed. Model minimisation: first name never sent; assistant messages cleaned of contact details, identifiers, links and names; seven-day window and the longer look-back on request. Technical events, App Store country and price on the subscription screen, and sync records described. §6 the improvement consent worded as approved; filtered messages never kept. §7 late writes after withdrawal deleted within fifteen minutes; undownloaded export deleted; WHOOP removed from the provider example. §8 terms acceptance and pending-erasure references in the audit data; Google token disposed of within about a day, retried with alerts. §10 administration from North Macedonia disclosed, covered by the EU Standard Contractual Clauses. §11 meal reminders in the notification text. §13 export described. §5 wearable history kept only from when you started wearing the device. §7 provider-side permissions worded to stay true once Calibra revokes them itself. §8 records of staff database access, up to thirty-six months, internal identifier only. §14 administrative access stated as three named people with multi-factor sign-in; per-task access and the unalterable log stated as work in progress. |
| 25.09.2026 | §5 the internal account identifier named under account data, and the sync information described as technical performance information, matching the App Store privacy label and the iOS privacy manifest. §7 notification settings stated as reset on withdrawal. §8 the Google token bounded at twenty-four hours with the failure case stated: the token is deleted at the deadline whether or not revocation succeeded, and the user is told to revoke our access themselves if it did not. Following the data protection officer review of 22.09. §3 age verification described. §5 minimisation before the model stated. §6 replaced by three separate consents: running the service, improving the system, and keeping assistant messages. §7 consent record retention stated as three years. §8 backup purpose stated, deletion record retention stated as three years, the free-trial record separated out as its own survivor with a hashed email, a twelve-month period and a legitimate-interest basis. §11 Microsoft named as an independent controller for its own abuse monitoring. |
| 22.09.2026 | §8 twelve-month retention after a subscription lapses, with thirty days' notice; §11 Apple and Google named as sign-in providers; §11 Microsoft named as a separate controller for abuse monitoring of the language model service; §8 the purpose of backups stated; §8 the deletion record reduced to an identifier with deletion times and a keyed code of the email address with the free-start date; name and usage summary no longer kept; retention periods for the audit data stated in §§7 and 8, as agreed with our data protection officer |
| 21.09.2026 | §5 the pregnancy sentence corrected: the answer itself never reaches the language model, the targets it produces do; §7 Microsoft calendar added to the permission we cannot revoke for you; §8 the Google bullet limited to Google Calendar, a paragraph added that Microsoft calendar grants are removed by the user, and the purposes of the deletion record aligned with the in-app deletion screen |
| 20.09.2026 | §8 the Google token stated as a third survivor of account deletion, with the revocation-on-your-behalf purpose, and the §5 Google retention paragraph matched to it; §7 date of birth and age stated as a separate survivor of withdrawal, held on a legal obligation rather than the consent being withdrawn; §5 the card-interaction description corrected to the events actually recorded; §5 dietary preferences added as a category, covering choices that may reflect a religious practice; the reproductive sentence narrowed to menstrual cycle and fertility tracking, with the optional pregnancy safety answer stated; safety answers and card interactions added to the table; the no-usage-profile sentence corrected to describe what is recorded; new Google Calendar section covering scope, use, recipients, training and retention; §11 recipients stated as exhaustive. |
| 17.09.2026 | First published version. Four-signal naming through §4, §5 and §12; Terms of Service link in §1; advisory and no-binding-consequence language in §4 and §12. |
| 16.09.2026 | §8 ten-year deletion-record period withdrawn as unsupported and returned to the data protection officer; §8 backup retention corrected to thirty-five days plus a geo-redundant copy; §5 device telemetry on sync disclosed rather than denied; §7 wearable-side permission stated as surviving deletion; §13 export-before-erasure sequence added; §10 and §11 support access from outside the EU disclosed; §14 rewritten to state the administrative-access concentration. |
| 09.09.2026 | First draft. Written to the ruling that withdrawal and deletion are the same destruction minus the account, and to the audit-data terminology. |