Privacy Policy

1. Controller

The controller for the processing of personal data under the General Data Protection Regulation (GDPR) is:

2. What data is processed

ATEM Hybrid processes only what the app needs to work. There is no usage analytics, no advertising, and data is never sold or passed on for marketing.

Health-related data

Body weight and training data may allow conclusions about physical condition and can therefore qualify as health data under Art. 9 GDPR. They are processed solely to deliver the function the user asked for, are not analysed further and are not disclosed. Entering them is voluntary, though using the app requires it.

Nutrition is a separate, optional area. What someone eats is health data; ATEM Hybrid only processes it after explicit consent in the app (Art. 9(2)(a) GDPR). Before that, no nutrition data is read or stored. You can withdraw consent at any time under Settings › Nutrition; withdrawing deletes all your own nutrition entries, the goal and the details on year of birth, height and formula.

Data from Health Connect

If you choose to, ATEM Hybrid reads data from Health Connect (Android). Each data type is granted separately; you can revoke access at any time in the Health Connect settings or in the app.

In addition, the answers of the optional check-in (sleep, energy, soreness on a scale of 1 to 5) are stored in Cloud Firestore.

The legal basis for this health data is explicit consent under Art. 9(2)(a) GDPR, given by granting access in Health Connect or by filling in the check-in. You can withdraw it at any time with effect for the future.

ATEM Hybrid's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements: the data serves only the functions listed above, is not used for advertising, not sold and not shared with third parties.

3. Where the data is stored

ATEM Hybrid uses Google services as processors under Art. 28 GDPR:

• Firebase Authentication — signing in with a Google account.
• Cloud Firestore — storing training, profile and settings data.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Access from third countries cannot be entirely ruled out in technical terms, for example during Google support or maintenance. Google bases such transfers on the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.

Local storage on the device

The app also caches data on the device so it stays usable without an internet connection. That copy is removed when the app is uninstalled; unfinished drafts are discarded when a different account signs in. It is excluded from device backups and device-to-device transfer.

Food data and camera

The basic foods (German Nutrient Database BLS 4.0 by the Max Rubner Institute) ship with the app; searching them never leaves the device.

For brands the app queries the open database Open Food Facts (Open Food Facts, France). Only the search term or the scanned barcode is sent, together with the technically necessary connection data (IP address, time). Your account, entries, goal or other details are not sent. The legal basis is Art. 6(1)(b) GDPR (the search you asked for). See the Open Food Facts privacy notice.

The camera is used only to scan a barcode and only after you grant access in Android. Recognition happens on the device; no images are stored or transmitted.

Contact form

If you use the contact form on this website, you send your email address, your message and optionally a name. These are stored together with the time of sending in Cloud Firestore (location eur3, see above), solely to answer your request. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), for questions about using the app Art. 6(1)(b) GDPR. The message is deleted once the request is dealt with, at the latest after six months. The form sets no cookies and uses no analytics or tracking.

4. Disclosure to third parties

Beyond the processors named in section 3 there is no disclosure — with one exception: the search term or barcode of a brand search goes to Open Food Facts (see "Food data and camera"). No analytics, tracking or advertising services are embedded. No profiles are built for advertising, and no automated decision-making within the meaning of Art. 22 GDPR takes place.

The figures shown in the app — such as the readiness score — are calculated from the user's own training data and have no legal or similarly significant effect.

5. Retention

Data is kept for as long as the account exists. If the account is deleted, the associated training, profile and settings data is deleted with it. Deletion can be triggered in the app or requested informally by email — the way without the app is described under Delete account.

6. Your rights

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common format (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)

An informal message to the address in section 1 is enough.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in the country of your habitual residence, place of work, or the place of the alleged infringement.

7. Testing phase and block list

ATEM Hybrid is in a testing phase; who takes part is decided by the tester list on Google Play. When you sign in, the app checks whether the account is blocked. The list used for this holds only an identifier, an email address and a status; it contains only blocked accounts and the provider's test accounts.

8. Changes to this policy

This policy will be updated when the processing changes, for instance with new features. The version published here is the one that applies; the date above gives its status.