Privacy Policy

1. Controller

The controller responsible for personal data processed in connection with Hyse is:

Lukas Hammer (private individual)
Falkenstraße 12
01067 Dresden
Germany
Email: hyse@minipliy.net

Privacy requests may be sent to this email address.

2. Visiting this website

When you visit this website, the server processes technically necessary connection data. This may include your IP address, request time, requested URL, transferred data volume, referrer, browser and operating-system information. This processing ensures secure, stable and error-free delivery.

The legal basis is Article 6(1)(f) GDPR (legitimate interests in secure operation and prevention of misuse); Article 6(1)(b) GDPR may additionally apply to pre-contractual measures. These public product pages use no analytics, advertising or marketing cookies.

Cookies and external content

Simply visiting the product pages does not set a browser cookie, and no analytics or advertising scripts run. Only when you click the language switch do we save your choice in hyse_language (value de or en; expires after 180 days; SameSite=Lax and Secure). This lets language-neutral URLs open in your chosen language on later visits. You can delete the cookie in your browser at any time. Without a choice, the homepage uses your browser language.

The App Store appears only as a link. The public product pages load no content from Apple before you click; Apple’s data processing applies when you open the link.

Hyse and its self-hosted PocketBase backend run on infrastructure provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes data as a processor when providing the server infrastructure.

3. Data processing in the Hyse app

Local use

Hyse can be used without an account. Foods, recipes, meals, quantities, calorie and nutrition data, water intake, categories, workout data, body and profile data (such as age, height, weight, activity level and optional body-fat data), goals, preferred units and app settings are stored locally on the device. They leave the device only when you expressly use a feature requiring transmission, such as account synchronisation, barcode lookup or Apple Health.

Purposes and legal bases

Data is processed to display and edit entries, calculate daily balances and goals, provide food and recipe functions and save settings. Article 6(1)(b) GDPR applies where processing is necessary to provide the app. Optional access, particularly to health data, is based on consent under Article 6(1)(a) and Article 9(2)(a) GDPR.

When you start a dynamic-deficit phase, Hyse processes the initial weight, initial body-fat fraction, local start date and calculated phase day. For signed-in users these settings may be synchronised through PocketBase so that the calculation remains consistent across devices. Because body-fat information can reveal health information, this function is optional and its use is based on explicit consent, including Article 9(2)(a) GDPR where applicable.

4. Accounts, PocketBase and sign-in

Hyse operates an optional account backend based on PocketBase. Depending on the chosen sign-in method, data may include user ID, username, email address, verification status, authentication identifiers and technical timestamps. Passwords are not stored in plain text in the app; session tokens are stored in the iOS Keychain.

Diary, nutrition, training, profile and settings data are synchronised with the backend only after separate, explicit consent to processing possible health data. Previously installed app versions may send an App Store receipt to the Hyse server after sign-in to link an earlier Apple purchase to an account. Receipts and product or transaction identifiers may be processed and stored for this purpose. This data is used to verify earlier purchases, handle refunds or defend legal claims. New purchases are not offered. Available features depend on the installed app version. Without consent, Hyse can be used locally without an account. This can include diary, nutrition, training, profile and settings data, such as entry name and quantity, unit, meal, time, notes, nutrition snapshots, dynamic-deficit phase inputs and technical IDs. The purpose is account-based provision, backup and cross-device synchronisation. Article 6(1)(b) GDPR applies to technical account provision; Article 6(1)(a) and Article 9(2)(a) GDPR apply to synchronisation of possible health data. Hyse remains usable locally without signing in.

Consent and preferences

Hyse records the accepted Terms version, acknowledged Privacy Policy version, decision time and language. If you opt in to product-news and app-tip emails, Hyse also stores the status and most recent change time of that optional choice. The email choice is not required to use Hyse and can be withdrawn at any time in Settings. Hyse currently does not use an analytics SDK and does not request analytics consent.

Community and reports

If you choose to use the community, Hyse processes profile details, posts, shared workouts, comments, reactions, friendships and any gym or location details you publish. Visibility follows your sharing choices. For illegal-content reports submitted in the app, including without an account, Hyse processes the link or ID of the reported content, reason, explanation, contact email and handling status to review the report and communicate the decision. To limit abusive guest reports, the network address is pseudonymised; this rate-limit key is removed from the report within 48 hours. Depending on the activity, the legal basis is Article 6(1)(b), (c) or (f) GDPR. Please do not publish sensitive data about others.

Reminders and push notifications

Local reminders for meals, water, planned workouts and missing daily data are scheduled only on the device. For optional push notifications, Hyse processes the APNs device token, platform/environment data, account association, enabled state and notification preferences. The legal basis is your consent under Article 6(1)(a) GDPR; you can disable push notifications in iOS or Hyse settings at any time.

Google Sign-In

“Continue with Google” uses Google's OAuth2 service. Through PocketBase, Hyse receives basic account data you authorise, particularly a provider identifier and, where available, email address and profile name. Google processes the sign-in under its Privacy Policy. Integration by Hyse is based on Article 6(1)(b) GDPR; choosing this method is voluntary.

Sign in with Apple

If offered and selected, Hyse receives identity data supplied by Apple. Apple may provide a relay email address; name and email are generally supplied only on first consent. See Apple's Privacy Policy. Processing by Hyse is based on Article 6(1)(b) GDPR.

OAuth providers receive the technically required sign-in parameters. Hyse never receives your Google or Apple password.

5. Apple Health and health data

With explicit system permission, Hyse can read resting energy, active energy, steps and body weight from Apple Health, and write logged nutrition, water and body-weight data to Apple Health. This is optional and the values are used only for daily balances and goal calculations shown in the app.

Health data is handled through Apple's HealthKit interface. Permission can be withdrawn in iOS Settings or the Health app. Processing is based on explicit consent under Article 6(1)(a) and Article 9(2)(a) GDPR.

6. Barcode lookup and recipients

Local text logging

Text descriptions are currently analysed on the device. Photo analysis and transmission of food data to Google Gemini are disabled. Older app versions receive no analysis from the corresponding server endpoints.

Open Food Facts

For barcode lookup, Hyse sends the scanned barcode to the public Open Food Facts API. The API operator receives necessary connection data such as the IP address. Hyse does not transmit an account ID or personal nutrition history for this request. The legal basis is Article 6(1)(b) GDPR.

STRATO's data-processing terms apply. STRATO states that agreed processing generally takes place in the EU/EEA and that requirements under Articles 44 et seq. GDPR are met where third-country transfers are necessary. Google and Apple may transfer data to third countries depending on the service and account; their respective privacy information and safeguards apply.

7. Retention and deletion

• Local app data: until you delete it, uninstall the app or reset the relevant data.
• Account data: for the life of the account and afterwards only where legal retention duties or defence of claims require it.
• Synchronised diary data: until the entry or account is deleted, subject to temporary technical backups.
• Earlier purchase data: only for as long as needed to handle earlier purchases, refunds or legal claims.
• Push data: APNs device tokens and notification preferences until disabled or account deletion.
• Server logs: PocketBase logs are deleted automatically after two days. Security-relevant records may be retained until an incident is resolved.
• Support requests: until resolved and afterwards only as required by legal retention or evidence obligations.

Signed-in users can permanently delete their account and synchronised data in Hyse settings. Alternatively, email hyse@minipliy.net. Local data can then be removed separately in the app or by uninstalling it.

8. Security

Hyse uses appropriate technical and organisational measures, including HTTPS transport encryption, backend access controls, account-scoped records and iOS Keychain storage for session tokens. No method can guarantee absolute security.

9. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn at any time for the future. You may also lodge a complaint with a competent data-protection authority.

Send requests to hyse@minipliy.net. Appropriate proof of identity may be requested to prevent unauthorised disclosure.

10. Changes

This policy will be updated when features, recipients or legal requirements change. The current version remains available at this URL.

See also the Hyse Terms of Use.