Privacy policy

The short version

Your goal and your progress live on your phone. Two things send data off it. First, when you ask 1% for a path, the text of your goal goes to our backend and on to Google's Gemini API, which writes the steps. Second, if you create an account, your goal and your progress are copied to our backend as a backup, so a new phone can get them back. An account is optional and the app works fully without one. There is no analytics SDK, no advertising, no tracking and no cookies.

Who is responsible

The controller for this data, in the sense of the GDPR, is:

What is stored on your device

The goal you wrote, the steps you have been given, which ones you marked done, which ones you swapped, your streak, your total number of steps and your level are stored in a local database inside the app on your iPhone. So are the first name you gave during setup, your reminder time and your theme.

That local database is the real one. Every screen reads it, and the app runs with no connection and no account.

If you never create an account, none of it is uploaded anywhere. The only thing that leaves the phone is the goal text at the moment a path is generated, described below.

If you have iCloud device backup switched on, iOS may include the app's local data in your own encrypted Apple backup. That backup is yours and is handled under Apple's terms, not ours.

What leaves your device, and when

Generating a path

You type a goal. The app sends that text over an encrypted connection (HTTPS) to our backend, which runs as Supabase Edge Functions hosted in the EU. The backend passes the text to Google's Gemini API, which writes the steps. The steps come back the same way and are stored on your device.

This happens whether or not you have an account. Without a connection there is no way to generate a path.

The backup, if you have an account

Creating an account is optional. The app asks once during setup and you can skip it, and everything except the backup works the same afterwards.

If you do sign in, the app copies your local database to our backend and keeps that copy up to date — when you finish setup, when you finish a step, when you swap one, and when the app goes into the background. The copy exists for one purpose: putting your goal and your progress back on a new or reinstalled phone when you sign in there.

What the copy contains:

• Your goal, in the words you typed, and the generated path attached to it.
• Each day's step, its date, and the text of any generated step.
• Which steps you completed or skipped, and when.
• Which steps you swapped away, and when.
• Your reminder time, your locale, your theme, and the first name you gave during setup.

Row-level security in the database means a signed-in account can read and write only its own rows. Deleting your account deletes this copy — see below.

The processors involved

• Supabase — our backend, database and sign-in. Edge Functions and project data are hosted in the EU.
• Google — the Gemini API, which generates the step text.
• Resend — delivers the sign-in codes, if you use an email address rather than Apple. It handles your address and the message; it never sees your goal or your progress.

We do not send your usage patterns anywhere. There is no analytics pipeline behind any of this.

Please do not put names, addresses or other sensitive personal details into your goal text. It does not make the steps better, and it is the field that goes furthest — through our backend to Google.

The steps are written by AI

Every step you see in 1% is generated by a large language model. It is not written by a coach, an editor or any other person, and it is not reviewed by a person before you see it.

We state this here, and in the app, because Article 50 of the EU AI Act requires that you know when you are interacting with AI-generated content. A language model can be wrong, repetitive or badly judged. Use your own judgement about whether a given step is right for you, and skip anything that is not.

1% is a general self-improvement app and is not a substitute for professional advice or care.

Accounts

An account is optional. Its only job is the backup described above: it is what carries your goal and your progress to a new phone. You can use 1% without ever creating one, and the app does not create one for you in the background.

Sign in with Apple

Apple gives the app an opaque user identifier, and — only if you agree to share it — an email address. That address may be one of Apple's private relay addresses, which is fine; we never need to know your real one. Apple also passes your name once, on the very first sign-in; the app keeps the first name on your device as a suggestion for the name screen and nothing more. We receive no photo, no profile and no password.

Email and a one-time code

If you would rather not use Apple, you can use an email address instead. There is no password: you type the address, we send a six-digit code to it, and entering that code signs you in. We store the address and nothing else about you.

The same thing happens whether or not the address already has an account, so this form cannot be used to find out which addresses are registered. The emails are delivered by Resend. We send nothing else — no newsletter, no product mail, no re-engagement nudges.

What the identifier is for

We use it to recognise the same account on a new device, to attach your backup to you, and to keep your subscription status with the right account. We use an email address, if we have one, to reply to you if you write to support.

Subscriptions and payment

Subscriptions are sold by Apple through the App Store and managed with RevenueCat, which keeps track of whether a given account has an active subscription.

The app never sees your card details, your name or your billing address. Apple handles the payment and Apple's own privacy policy covers it. What RevenueCat holds is an anonymous app user identifier, the transaction identifiers Apple issues and the status of your subscription.

What we do not do

• No analytics SDK. We do not measure screens, sessions or funnels.
• No advertising and no ad identifiers. We do not ask for tracking permission because we have nothing to track you with.
• No third-party cookies. No first-party cookies either, in the app or on this site.
• No fingerprinting, no device graph, no cross-app or cross-site profiles.
• No selling or sharing of personal data. There is nothing to sell.

If crash reporting is ever added, it will be stated here first, and it will carry technical crash information only — never your goal text, your steps or anything else you wrote.

Legal grounds

Generating your steps

Article 6(1)(b) GDPR — performing the contract you entered into by using the app. Without sending the goal text there is no path to give you.

Account and subscription records

Article 6(1)(b) GDPR — running your account and your subscription.

Backing up your goal and progress

Article 6(1)(b) GDPR — the backup is the thing an account is for, and creating one is your choice. No account, no copy.

Sign in with Apple, if you use it

Article 6(1)(b) GDPR, and Article 6(1)(a) for an email address you choose to share.

Sign-in codes by email

Article 6(1)(b) GDPR — with no password there is no other way to prove the address is yours.

Keeping the service working and stopping abuse

Article 6(1)(f) GDPR — our legitimate interest in a backend that stays up and is not being drained by automated requests.

Where the data is

Our backend and database run on Supabase infrastructure in the EU. Your account and your backup live there and are not moved anywhere else.

Google's Gemini API may process your goal text outside the EU, including in the United States. That transfer is covered by the European Commission's Standard Contractual Clauses together with Google's own transfer safeguards. If you would rather your goal text stayed inside the EU only, the honest answer today is that generating a path is not possible on those terms, and you should not use the app.

How long things are kept

• On your device — until you delete the app or clear its data. Deleting the app from your iPhone removes the local database with it.
• Account records — until you delete your account. Deletion removes the account row and everything attached to it.
• Your backup — for as long as the account exists. It is deleted with the account, in the same step. It is not archived and there is no separate retention period for it.
• Generated paths — a generated path may be kept on our side as a cache so the same request does not have to be regenerated. After account deletion, anything retained is held without any link to a person or an account.
• Support email — kept as long as needed to deal with your message, then removed.
• Subscription records — Apple and RevenueCat keep transaction records for as long as tax and accounting rules require. That part is not ours to erase.

Your rights

Under the GDPR you can ask us for:

• Access — a copy of what we hold about you.
• Correction — a fix for anything wrong.
• Deletion — removal of your account and its records.
• Portability — your data in a machine-readable file.
• Restriction and objection — including objecting to anything we do on the grounds of legitimate interest.
• Withdrawal of consent — where you gave it, with no effect on what happened before.

The fastest route for deletion is inside the app: Settings, then Account, then Delete Account. It happens immediately. More about deletion.

For anything else, write to support@onepercentapp.xyz. We reply within two business days and answer inside one month, as the GDPR requires.

You also have the right to complain to a data protection supervisory authority — the one for the German state we are based in, or, under Article 77 GDPR, the one where you live or where you believe the problem happened. Write to us and we will name ours.

Children

1% is not directed at children. Do not use it if you are under 13, or under 16 in the European Union. We do not knowingly keep data from anyone in that range; if you believe a child has an account, write to support@onepercentapp.xyz and we will remove it.

This website

This site is static HTML and CSS. It sets no cookies, loads no fonts, embeds no scripts, and makes no requests to any other origin. Your visit is not counted anywhere. Standard access logs may be kept by whoever hosts the files.

Changes

If this policy changes in a way that matters, the date at the top changes and the app tells you the next time you open it. Small wording fixes will not get an announcement.

Contact

Privacy questions: support@onepercentapp.xyz
Everything else: support@onepercentapp.xyz

Postal address and responsible person are on the imprint.