Privacy Policy
This policy explains which personal data the BoringWise app ("App") and its related services process, why, for how long, and what rights you have. It covers the iOS app, the BoringWise server at mcp.boringwise.com, the invitation links at join.boringwise.com and this website.
1. Controller
Kürsat Atan
BoringWise
Lina-Hähnle-Str. 27
72172 Sulz am Neckar
Germany
Email: support@boringwise.com
A data protection officer is not legally required and has not been appointed.
2. In short
- Without an account everything stays on your iPhone. Workouts, nutrition, supplements, profile and body measurements are stored locally. There is no tracking, no advertising SDK and no analytics service.
- With an account your fitness data is synced to our server so it is available on several devices and in the optional ChatGPT coach. The database is located in Frankfurt, Germany.
- Apple Health data is read and evaluated on the device. Only your body weight and the heart-rate trace of your workouts reach the server, and only with an account.
- Health data is never used for advertising, marketing or data mining and is never sold.
- The AI coach runs on your device (Apple Intelligence). The optional ChatGPT connection sends data to OpenAI only if you enable it yourself in your own ChatGPT account.
- You can delete your account in the app. All server data is deleted.
3. Processing on your device (without an account)
The App is fully usable without signing in. The following data is stored only locally in the app database on your iPhone:
- Training plans, workout sessions, sets, reps, weights, personal records
- Nutrition plans, meals, calories, macro- and micronutrients, water and caffeine intake
- Supplements, intake schedules and intakes
- Health profile: first name, last name, gender, date of birth, height, activity level, goals
- Body weight, body fat and other body measurements
- Profile picture (local only, never transmitted)
- Settings such as language, units, appearance, reminder times
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for health data your explicit consent given by entering it (Art. 9(2)(a) GDPR). This data does not leave your device unless you sign in (section 5) or use a sharing feature (section 11). An iCloud backup of your device may include the local app database; Apple's privacy terms apply to it.
4. Apple Health (HealthKit)
If you grant access to Apple Health, the App reads the following data to evaluate progress, recovery and training load:
- Body weight, body fat percentage, lean body mass, height, waist circumference
- Heart rate, resting heart rate, heart rate variability, respiratory rate, blood oxygen, VO₂max
- Steps, active energy, exercise and stand minutes, workouts
- Sleep analysis
- Blood glucose, water, caffeine, energy and nutrient intake
With your permission the App also writes to Apple Health: your manually logged body weight and body fat, your meals (energy and nutrients) and your workout sessions.
What happens to Health data: it is read and evaluated on the device (dashboard, statistics, baselines, coach). It is not stored permanently in the App but read again from Apple Health when needed. Exceptions: body weight imported from Apple Health is added to your weight history, and the heart-rate trace of a workout is attached to that workout. Both are synced when you have an account (section 5).
Health data is not used for advertising, marketing or data mining, is not sold or disclosed to third parties and is not stored in iCloud. It reaches OpenAI only if you enable the ChatGPT connection yourself (section 8).
Legal basis: your explicit consent in the iOS Health dialog (Art. 9(2)(a) GDPR). You can withdraw it at any time in the Health app under "Privacy → Apps" or in iOS Settings.
5. Account, sign-in and sync
5.1 Sign-in
An account is optional. It is required for sync, the ChatGPT coach, the referral programme and BoringWise Pro. Two options:
- Sign in with Apple: Apple provides us with an anonymous user identifier, your name and your email address. If you choose "Hide My Email" we receive a relay address from Apple.
- Sign-in link by email (magic link): we store your email address and send you a one-time sign-in link from
noreply@boringwise.com.
Sign-in is handled by Supabase Auth (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992; data hosted in the Frankfurt region, eu-central-1). Stored: email address, user identifier, sign-in timestamps and session tokens. Sign-in emails are sent via Resend (Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) with delivery through Amazon SES in the Ireland region (eu-west-1).
5.2 Sync
After sign-in the App transmits the data listed in section 3 (except profile picture and local settings) over TLS to the BoringWise server and keeps it in sync across your devices. Additionally stored: a random device identifier per installed app, change timestamps, version counters and a change log that enables multi-device sync.
The application server runs on Railway (Railway Corp., 548 Market St PMB 68956, San Francisco, CA 94104, USA) in the Amsterdam region; the database is hosted by Supabase in Frankfurt. Access to your data is restricted to your account (row level security).
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for health data (body weight, body fat, heart rate, nutrition) your explicit consent given by signing in, which the App points out before the first sync (Art. 9(2)(a) GDPR). You can withdraw consent by signing out or deleting the account.
6. Server logs and security
When you access our servers (mcp.boringwise.com, join.boringwise.com, this website) technically necessary access data is processed: IP address, time, requested URL, status code, user agent. It serves debugging, abuse prevention and security. Diagnostic and security logs are deleted after 30 days at the latest. join.boringwise.com and this website are delivered through Cloudflare (Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA), which processes the IP address transiently to protect against attacks. This website sets no cookies and uses no analytics.
Legal basis: legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).
7. AI coach with Apple Intelligence
The coach in the App uses the Apple Intelligence language model on your device (FoundationModels framework). To answer, the App provides the model with excerpts of your local data: profile, goals, weight history, training and nutrition history. This processing happens entirely on the iPhone; no data is transmitted to us or to Apple servers.
If you explicitly choose the "Private Cloud Compute" model in Settings (where available), Apple processes the request on Apple servers using Private Cloud Compute. Apple states that it does not store and cannot access this data. Apple's privacy terms apply. Coach answers are guidance, not medical advice; no automated decision-making with legal effect takes place.
8. Optional ChatGPT connection (OpenAI)
BoringWise Pro lets you connect your account to ChatGPT (OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA; for the EEA: OpenAI Ireland Ltd, Dublin). You establish the connection in your own ChatGPT account. On a BoringWise consent page you explicitly allow ChatGPT, via the BoringWise server, to:
- read: nutrition, training and supplement data, your profile (first name, last name, gender, height, date of birth), weight measurements and the heart-rate trace of workouts;
- create or change: plans, your profile and weight measurements you confirm;
- never receive: email address, profile picture, subscription and sync data. ChatGPT can evaluate completed workouts and intakes but cannot change them.
Which data actually flows is determined by your requests in the chat. OpenAI is an independent controller for its processing; OpenAI's terms and privacy policy apply. The chat itself runs in your ChatGPT account; BoringWise receives only the plans and entries ChatGPT stores through the interface. Note: processing by OpenAI may take place in the USA.
Legal basis: your explicit consent on the consent page (Art. 6(1)(a), Art. 9(2)(a), Art. 49(1)(a) GDPR). Withdrawal: remove the BoringWise connector in ChatGPT; the access tokens then expire. You can also end the connection by deleting your account.
9. Subscriptions (BoringWise Pro)
Subscriptions are purchased and billed exclusively through Apple's App Store. We do not receive payment details. Apple sends our server status notifications about the subscription (product, transaction and original transaction identifier, period, environment, renewal or cancellation status). We store these linked to your account to unlock Pro features and the ChatGPT connection.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: until account deletion; billing-relevant records up to 10 years under statutory retention duties (Art. 6(1)(c) GDPR).
10. Referral programme
With an account you get a personal invitation link (join.boringwise.com/CODE). When someone redeems your code we store the link between the two user identifiers, the time, the rewards granted (guest-pass expiry, App Store offer codes, alternative app icons) and their redemption status. The invitation link contains no personal data. Other users see neither your name nor your email address.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
11. Photos, sharing and other permissions
- Photos (selection): only to pick a profile picture; the picture stays on the device.
- Photos (add): on request the App saves your workout card to your photo library.
- Sharing to Instagram or TikTok: hands the workout card you chose to the respective app on your device. Those providers' terms apply to further processing. BoringWise sends no data to these providers.
- Notifications: supplement reminders and the rest timer are scheduled locally on the device. There is no push server.
- Location: the App may request the "location while using" permission. Location data is currently neither collected, stored nor transmitted.
- Live Activities: the rest timer is shown on the lock screen and in the Dynamic Island, entirely on the device.
12. Recipients and processors
| Service | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Apple Inc. / Apple Distribution International | App Store, in-app purchases, Sign in with Apple, Apple Intelligence, HealthKit | EU/USA | Apple is an independent controller; EU-US Data Privacy Framework |
| Supabase Inc. | Authentication, database, storage | Frankfurt (eu-central-1) | Data processing agreement; standard contractual clauses for support access |
| Railway Corp. | Hosting of the BoringWise server | Amsterdam | Data processing agreement; standard contractual clauses |
| Resend Inc. (via Amazon Web Services) | Sending sign-in emails | Ireland (eu-west-1) | Data processing agreement; EU-US Data Privacy Framework |
| Cloudflare Inc. | Delivery of join.boringwise.com and this website, DNS | global edge | Data processing agreement; EU-US Data Privacy Framework |
| OpenAI (only with the ChatGPT connection enabled) | ChatGPT coach | USA / Ireland | Independent controller; your explicit consent (Art. 49(1)(a) GDPR) |
No other disclosure to third parties takes place unless we are legally obliged.
13. Retention and deletion
- Local data: until you delete it in the App or uninstall the App.
- Server data: until you delete your account. Deletion is completed no later than 30 days after the request; encrypted backups rotate out within 30 days.
- Sync log and device identifiers: at most 90 days after acknowledgement by all devices or after a device's last activity.
- Diagnostic and security logs: 30 days.
- Billing records: statutory retention periods (up to 10 years).
Delete account: in the App under Settings → Account → Delete account. This deletes your sign-in account and all related server data; local data on the device remains until you delete it. You can also request deletion by email to support@boringwise.com. Delete server data only (keep the account): also available in the App's account settings.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3)). You can export your data yourself at any time as a JSON file in the App (Settings → Export data).
An email to support@boringwise.com is sufficient. You also have the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.
15. Children
BoringWise is not directed at children under 16. We do not knowingly collect data from children. If you learn that a child has provided us with data, contact us and we will delete it.
16. Security
All connections are TLS-encrypted. Access tokens are stored in the iOS keychain. Server data is separated per account by row level security; backups are encrypted. Sign-in is passwordless (Apple or one-time link).
17. Changes
We update this policy when the App or the law changes. The current version is always available at boringwise.com/privacy/en; the date above shows the version. We inform you in the App about material changes.