Privacy policy

The short version

Your goal and your progress live on your phone. Two things send data off it, and a third only if you switch it on. First, your steps are written by OpenAI's API, through our backend: your goal and your answers when the path is first written, and later what you did with your steps and what you told the app about them, so the next ones fit you — and the app asks your permission before the first time anything is sent, naming OpenAI and what is sent, with a switch in Settings to take it back. Second, your goal and your progress are copied to our backend as a backup, so a new phone can get them back. Those two need an account: generating a path requires you to be signed in, because the backend has nothing to rate-limit or attach a path to otherwise. Third, the app reports which of its features get used and what crashed, so we can fix it — never the text of your goal, your steps or anything else you wrote. In the EEA and the UK that one waits until you agree; the app asks once, at the start of setup. Everywhere it can be switched off in Settings. Everything else — your daily step, your streak, the whole app — runs on your phone with no connection. There is no advertising, no ad identifier and no cookies.

Who is responsible

The controller for this data, in the sense of the GDPR, is:

What is stored on your device

The goal you wrote, the steps you have been given, which ones you marked done, which ones you swapped, your streak, your total number of steps and your level are stored in a local database inside the app on your iPhone. So are the first name you gave during setup, your reminder time and your theme.

That local database is the real one. Every screen reads it, and once you have a path the app runs with no connection at all.

Generating a path is the one thing that needs the network and an account. Everything else — your daily step, ticking it off, your streak, your level, your settings — happens on the phone.

If you have iCloud device backup switched on, iOS may include the app's local data in your own encrypted Apple backup. That backup is yours and is handled under Apple's terms, not ours.

What leaves your device, and when

Writing your steps

You type a goal and answer a few questions about it. The app sends the goal and your answers over an encrypted connection (HTTPS) to our backend, which runs as Supabase Edge Functions hosted in the EU. The backend passes them to OpenAI's API, which writes the follow-up questions, the steps and the commitment sentence. They come back the same way and are stored on your device.

The path is not written once. Three more things go the same way, to OpenAI through our backend, under the same permission:

• More steps, as your path runs low. About every ten days the app asks for the next stretch. With the request go your goal, your answers, the steps already in your path, which of them you did, skipped or swapped away — with the reason you picked for a swap — and what you told the app about them: your check-in answers and notes, the notes you send to your path with the note button beside the tabs, and the sentence you wrote about a step you turned down. The finished steps wait on our backend until the app next opens and collects them, and are deleted from it as they are collected.
• A new step for one you turned down. If you swap a step away as "not for me" and say what was wrong with it, the step you turned down and your sentence go with your goal, your answers, the steps you did recently and the steps you swapped before, and one new step comes back while you wait, with a line saying what changed. The screen where you write the sentence says that it goes to OpenAI.
• A voice note, turned into text. If you record a voice note in the journal, the recording goes to OpenAI's transcription and the text comes back into your entry. Our backend passes the recording through and does not keep it; it only counts how many it has passed on for you that day, to cap it. The text you write in the journal is not sent to OpenAI.

Nothing is sent until you agree to it. The first time you finish typing a goal, before any request leaves the phone, the app shows a sheet headed "Before we write your path" whose first line reads: your steps are written by OpenAI. It names everything listed above — your goal and your answers, which steps you did, skipped or swapped and what you tell it about them in check-ins and notes, and voice notes you record in the journal — and what is never sent: your name, your email or anything about your phone. Two buttons, equally weighted. Tap "Not now" and no request is made; you are returned to the goal field with what you typed still in it.

You can take that permission back at any time under Settings, Privacy & Legal, "Writing with AI". Switching it off stops every transfer: no new goal can be written, your path is no longer topped up when it runs low, a step you turn down is not rewritten, and voice notes are not turned into text. What has already been written stays on your phone and keeps working. Switching it back on is the same one tap and shows the same disclosure again.

You have to be signed in for this. The backend refuses a request without an account, because an account is what the daily limit and the path both hang on. Without a connection, or without an account, there is no way to generate a path.

Two records are kept on our side after the steps come back:

• A request log. Your account identifier, the normalised goal text, the time and which kind of request it was — a path, more steps or a rewritten step — once per request. It is what enforces the daily generation limit and stops the backend being drained by automated requests. Nothing else is in it, no client can read it, and it is deleted with your account.
• A shared cache. A generated path is stored under the normalised goal text, so that "get fitter" is written once and everyone who types it gets it instantly instead of waiting. The cache row keeps one example of the wording someone actually typed, so we can review which goals are popular. It is not attached to an account, and any signed-in user of the app can be served it. Assume a goal you type may be read by someone else in this form, and see the note below about what not to put in it.

The backup

The backup comes with the account you already need in order to generate a path. There is no separate opt-in and no way to have one without the other.

The app copies your local database to our backend and keeps that copy up to date — when you finish setup, when you finish a step, when you swap one, when you change your name, language, reminder or theme, and when the app goes into the background. The copy exists for one purpose: putting your goal and your progress back on a new or reinstalled phone when you sign in there.

What the copy contains:

• Your goal, in the words you typed, and the generated path attached to it.
• Each day's step, its date, and the text of any generated step.
• Which steps you completed or skipped, and when.
• Which steps you swapped away, when, the reason you picked for the swap, and — for a step you turned down as "not for me" — the sentence you wrote about it.
• Your check-ins: how the steps are going, how hard they feel, and anything you wrote with them, and the notes you send to your path.
• Your journal: what you wrote on each day, how you felt, and the photos and voice notes you added to it.
• The order the steps of your path were shuffled into, so a new phone deals them the same way.
• Your reminder time, your locale, your theme, and the first name you gave during setup.
• The answers you gave during setup that shaped the path: how much time a day you said was realistic, the anchor you chose, and the commitment sentence — which is written for you by the model while your path is being generated, not typed by you.

Row-level security in the database means a signed-in account can read and write only its own rows. Deleting your account deletes this copy — see below.

Sharing a progress card

If you tap share, the app draws a card with your streak and your step count on it and hands the image to whatever you pick — Photos, Messages, Instagram, anything else on your phone that accepts an image. It goes straight from your phone to that app; it does not pass through our backend, and we do not learn that you shared or where. Once it is in another app it is under that app's own privacy policy, not ours. Nothing is shared unless you tap.

Product analytics and crash reports

The app can send a small stream of events to PostHog so we can see which parts of ippo are actually used and what is breaking. It is first-party and product-only: we are looking at the app, not at you.

If your phone is set to a country in the EEA or the UK, none of it happens unless you say yes. The app asks once, when you tap through the first screen of setup: two buttons, no pre-ticked box, and nothing collected before you answer. Say no and it does not ask again — there is no "later" that comes back tomorrow.

We ask there because saying yes is what puts an identifier into the app's storage on your phone, and § 25 TTDSG treats writing to your device as something you agree to first unless the app genuinely cannot work without it. This one can: with the analytics off, ippo does exactly the same things.

Everywhere else the analytics are on from the first launch, under Article 6(1)(f) GDPR — our legitimate interest in knowing which parts of the app are used and which are broken, which is what a one-person app has instead of a support team. That rule is not ours to apply worldwide: it is a European one, tied to where you are rather than to where we are, so outside its reach the app does not stage a question whose answer is already settled. What is collected is identical either way, and the list below is the whole of it.

Which side you land on is read from your phone's Region setting, falling back to its timezone. That is an approximation and we would rather say so: a German phone on holiday abroad still reads as German, and an English-language phone in Berlin may not. Whichever side you are on, the switch in Settings is the real answer — turning the analytics off there works everywhere, immediately, and is the same one tap. It closes the connection and clears the identifier described below from your phone; turning them on later starts a fresh one with no link to anything from before.

What an event carries, once it is on:

• That something happened. A goal was submitted during setup; the follow-up questions were written; permission to write with AI was given, declined or taken back; a path was written for it, or failed to be; a goal was replaced by running setup again; the tour of the app was finished or skipped; a step was started, completed, swapped, given a reason for the swap, or swapped back; a new step was written for one you turned down, or failed to be; a check-in was written; a note was sent to your path; a sign-in was attempted; the notification prompt was answered; a reminder time was chosen or switched off; the analytics themselves were switched on; the subscription plans loaded; a subscription purchase was started, and bought or restored, or was not. Plus the app being installed, opened, updated, or sent to the background.
• Which screen you opened, and in what order. By its address in the app — /welcome, /paywall, /settings. Setup runs to nearly thirty screens and this is how we find out which one people close the app on. One screen is left out of this, on purpose: see below.
• A few values attached to those. The length of your streak, whether you levelled up, which of the three fixed swap reasons you tapped, whether a subscription is monthly or yearly and whether it started with a trial, whether you allowed notifications, whether you signed in with Apple or a code, and how each of those ended — the name of the failure when one failed, from a fixed list. For a path: how long it took to write, how many of the setup questions you answered, and whether it came from the shared cache. For the follow-up questions: how many were asked and how many were filled in. For a step: whether it happens on your own or out among other people, and how long you took if you timed it. For a step written for one you turned down: whether it worked, whether it came with a line back, and how long it took — never the sentence you wrote. For the tour: whether you skipped it, and on which page. For the reminder: the hour of day you picked, and nothing about the day you picked it on. For the analytics switch: which of the two moments you were asked at, or that your region did not require asking. None of it is free text.
• The device. Model, manufacturer, iOS version, and whether it is a simulator. No advertising identifier; not the name you gave your phone.
• An identifier. A random one the app generates on first launch and stores locally. Once you sign in, events carry your account identifier instead, and your email address is attached to that profile so a support message can be matched to what we see.
• Errors. When the app throws something it does not handle, the type of the error, its message and the stack trace are reported.
• Your IP address, at the moment events are sent. PostHog derives an approximate country and region from it.

What an event never carries: the text of your goal, the text of any step, your commitment sentence, your check-in notes, the sentence you wrote about a step you turned down, your journal, your name, or anything else you typed. An event says a step was completed. It does not say which step, or what it said.

A recording of the screen, with the words taken out. Alongside those events, the app records what its own screens looked like while you used them, so that a step nobody can find or a button that does nothing is something we can watch rather than guess at. Every piece of text is masked before the picture leaves your phone — your goal, your steps, your check-ins, your name, everything — and so is every image. What remains is the shape of the screen and where you tapped. Nothing is recorded through the camera or the microphone, and nothing outside this app is ever in the picture. Switching the analytics off in Settings switches this off with them.

The one screen we do not record. The app checks what you type, on the device, for signs of an acute crisis; if it finds them it stops and shows a screen with helplines on it instead of a path (more on Support). That screen is excluded from the analytics by name, and the screen recording stops for as long as it is open — masked or not, a recording that contained it would say the same thing about you that the event would. Every other screen address says only which part of the app was open; that one would say something about you, and it is not a thing we want in a database, tied to an account, whatever the funnel would have shown. You can reach it without us ever learning that you did.

Where the install came from

If we are running an ad in the App Store, we want to know whether the people who arrive through it get anything out of the app. Apple has a way of answering that without tracking anyone, and this is it.

On first launch the app asks iOS for an attribution token and posts it to Apple's attribution endpoint (api-adservices.apple.com). Apple answers with the campaign, ad group and keyword behind the install, or says there was none. Those numbers are attached to the analytics profile described above, so that a funnel can be read per campaign.

Three things this is not. It is not the advertising identifier, and there is none in the app. It is not App Tracking Transparency — the app never asks to track you, because Apple's attribution works without it and nothing here follows you into another app. And it is not a profile of you: the token describes the install, it carries nothing you typed, and it is asked for exactly once and never again.

It rides on the same consent as everything else in this section. With the analytics off, the token is never read and nothing is sent to Apple.

The processors involved

• Supabase — our backend, database and sign-in. Edge Functions and project data are hosted in the EU.
• OpenAI — the API that writes your questions and steps from what is described under "Writing your steps", and turns journal voice notes into text.
• Resend — delivers the sign-in codes, if you use an email address rather than Apple. It handles your address and the message; it never sees your goal or your progress.
• PostHog — the product analytics and crash reporting described above, on their EU cloud. It never sees your goal text, your steps or your backup.
• Apple — the App Store attribution described above, and only where we are advertising. It answers which ad produced an install; it is not sent anything you wrote.

Please do not put names, addresses or other sensitive personal details into your goal text. It does not make the steps better, and it is the field that goes furthest — through our backend to OpenAI, into the request log, and possibly into the shared cache described above, where it is no longer tied to you but can be served to someone else who types the same goal. The same care applies to check-ins and notes: they go to OpenAI too, though never into the shared cache.

The steps are written by AI

Every step you see in ippo is generated by a large language model. It is not written by a coach, an editor or any other person, and it is not reviewed by a person before you see it.

We state this here, and in the app, because Article 50 of the EU AI Act requires that you know when you are interacting with AI-generated content. A language model can be wrong, repetitive or badly judged. Use your own judgement about whether a given step is right for you, and skip anything that is not.

ippo is a general self-improvement app and is not a substitute for professional advice or care.

Accounts

An account does two jobs. It authorises the path generation described above, which is why the app cannot write you a path until you have one, and it carries your goal and your progress to a new phone. The app never creates one for you in the background: it asks, and signing in is a thing you do deliberately. Earlier versions minted an invisible account for every install; that is gone, and nothing about you reaches our backend until you choose to sign in.

Sign in with Apple

Apple gives the app an opaque user identifier, and — only if you agree to share it — an email address. That address may be one of Apple's private relay addresses, which is fine; we never need to know your real one. Apple also passes your name once, on the very first sign-in; the app keeps the first name on your device as a suggestion for the name screen and nothing more. We receive no photo, no profile and no password.

Email and a one-time code

If you would rather not use Apple, you can use an email address instead. There is no password: you type the address, we send a six-digit code to it, and entering that code signs you in. We store the address and nothing else about you.

The same thing happens whether or not the address already has an account, so this form cannot be used to find out which addresses are registered. The emails are delivered by Resend. We send nothing else — no newsletter, no product mail, no re-engagement nudges.

What the identifier is for

We use it to recognise the same account on a new device, to attach your backup to you, and to count your path generations against the daily limit. We use an email address, if we have one, to reply to you if you write to support. It is not sent to RevenueCat and plays no part in your subscription — see below.

Subscriptions and payment

Subscriptions are sold by Apple through the App Store and managed with RevenueCat, which keeps track of whether a subscription is active.

The app never sees your card details, your name or your billing address. Apple handles the payment and Apple's own privacy policy covers it. What RevenueCat holds is an anonymous app user identifier it generates itself, the transaction identifiers Apple issues and the status of your subscription.

We never tell RevenueCat who you are. Your ippo account identifier and your email address are not sent to it, so the subscription is not linked to your account on our side — it follows your Apple ID, the way App Store purchases normally do. On a new phone, Restore Purchases is what brings it back.

What we do not do

• No advertising and no ad identifiers. We do not ask for App Tracking Transparency permission, because we do not track you across other companies' apps or sites.
• No third-party cookies. No first-party cookies either, in the app or on this site.
• No fingerprinting, no device graph, no cross-app or cross-site profiles.
• No selling or sharing of personal data. There is nothing to sell.
• No content in the analytics. Your goal text, your steps and everything else you typed stay out of it — including out of the screen recordings described above.

Earlier versions of this policy said there was no analytics SDK at all. That changed with the version that introduced product analytics and crash reporting — off unless you switch it on, and the section above says exactly what it does and does not carry. A later version added the screen recording, and this list lost the line that said there was none; what replaced it is the section above, which says what a recording shows and what it cannot.

Legal grounds

Generating your steps

Article 6(1)(b) GDPR — performing the contract you entered into by using the app. Without sending the goal text there is no path to give you, and without what you did and said about the steps there is no path that keeps fitting you. On top of that the app asks for your permission before the first transfer, and stops every transfer when you take it back.

Turning a voice note into text

Article 6(1)(b) GDPR — it is the feature you use by recording one, and it happens only when you do.

Account and subscription records

Article 6(1)(b) GDPR — running your account and your subscription.

Backing up your goal and progress

Article 6(1)(b) GDPR — the backup is part of what the account is for, and creating an account is your choice. No account, no copy.

Sign in with Apple, if you use it

Article 6(1)(b) GDPR, and Article 6(1)(a) for an email address you choose to share.

Sign-in codes by email

Article 6(1)(b) GDPR — with no password there is no other way to prove the address is yours.

Keeping the service working and stopping abuse

Article 6(1)(f) GDPR — our legitimate interest in a backend that stays up and is not being drained by automated requests. This is the ground for the request log and for the shared path cache, both described above.

Product analytics and crash reports

In the EEA and the UK: Article 6(1)(a) GDPR — your consent, given by answering the question the app puts once at the start of setup, and withdrawn at any time from Settings. § 25(1) TTDSG applies to the same act, because saying yes is what stores an identifier on your device. Elsewhere: Article 6(1)(f) GDPR — our legitimate interest in a working app, with the same switch in Settings as the way out. Withdrawing takes effect immediately either way and does not affect what was collected before.

Where the data is

Our backend and database run on Supabase infrastructure in the EU. Your account and your backup live there and are not moved anywhere else.

The analytics and crash events go to PostHog's EU cloud and stay there.

OpenAI's API may process what is sent to it — your goal and answers, what you did with your steps and wrote about them, and voice notes — outside the EU, including in the United States. That transfer is covered by the European Commission's Standard Contractual Clauses together with OpenAI's own transfer safeguards. If you would rather this stayed inside the EU only, the honest answer today is that generating a path is not possible on those terms, and you should not use the app.

How long things are kept

• On your device — until you delete the app or clear its data. Deleting the app from your iPhone removes the local database with it.
• Account records — until you delete your account. Deletion removes the account row and everything attached to it.
• Your backup — for as long as the account exists. It is deleted with the account, in the same step. It is not archived and there is no separate retention period for it.
• The request log — the account identifier, normalised goal text, time and kind of each request. Deleted with your account, in the same step.
• The voice-note count — how many voice notes were turned into text for your account on each day, nothing else. Deleted with your account.
• Steps waiting to be collected — a finished stretch of your path stays on our backend only until the app next opens and picks it up, and is deleted as it is collected, or with your account.
• The shared path cache — kept for as long as the goal is worth caching, and not deleted with your account, because the row belongs to the goal rather than to you. It carries no account identifier at any point, so after deletion there is nothing left tying it to a person.
• Analytics and crash events — kept in our PostHog project for as long as its retention window, then dropped automatically. Deleting your account in the app stops any further event being tied to you, but it does not reach back and remove the ones already sent. Ask us and we will delete those too.
• Support email — kept as long as needed to deal with your message, then removed.
• Subscription records — Apple and RevenueCat keep transaction records for as long as tax and accounting rules require. That part is not ours to erase.

Your rights

Under the GDPR you can ask us for:

• Access — a copy of what we hold about you.
• Correction — a fix for anything wrong.
• Deletion — removal of your account and its records.
• Portability — your data in a machine-readable file.
• Restriction and objection — including objecting to anything we do on the grounds of legitimate interest.
• Withdrawal of consent — where you gave it, with no effect on what happened before.

The fastest route for deletion is inside the app: Settings, then Account, then Delete Account. It happens immediately. It covers your account, your backup and your request log; the analytics events already sent are the one thing it does not reach, so say so in an email if you want those gone as well. More about deletion.

For anything else, write to support@onepercentapp.xyz. We reply within two business days and answer inside one month, as the GDPR requires.

You also have the right to complain to a data protection supervisory authority — the one for the German state we are based in, or, under Article 77 GDPR, the one where you live or where you believe the problem happened. Write to us and we will name ours.

Children

ippo is not directed at children. Do not use it if you are under 13, or under 16 in the European Union. We do not knowingly keep data from anyone in that range; if you believe a child has an account, write to support@onepercentapp.xyz and we will remove it.

This website

This site is static HTML and CSS. It sets no cookies, loads no fonts, embeds no scripts, and makes no requests to any other origin. Your visit is not counted anywhere. Standard access logs may be kept by whoever hosts the files.

Changes

When this policy changes in a way that matters, the date at the top moves and the change is described in the section it belongs to, rather than being folded in silently — the note about analytics under "What we do not do" is what that looks like. Small wording fixes get neither.

Contact

Privacy questions: support@onepercentapp.xyz
Everything else: support@onepercentapp.xyz

Postal address and responsible person are on the imprint.