Privacy Policy — BioApex

Regulamin → Usuń konto i dane →

Note: Content should be kept in sync with the actual data flows described in this repo’s docs/REVENUECAT.md and root README.md — if you add a new source of personal data to the app, update this document in the same change.

This engine is white-labeled (see root README.md) — the identity block, app name, and bundle identifiers below assume the shipped Biohacker skin (“BioApex”). Update them to match whichever skin and legal entity is actually publishing a given build.

Version: 1.1.0 · Last updated: 2026-07-24

1. Data Controller

The data controller for BioApex is:

LogicLoom Kamil Zwarycz Sole proprietorship (JDG), Poland NIP: 5871749235 · REGON: 540001576 ul. Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland

Privacy contact: contact@kzlab.dev (placeholder — set to the real domain this app ships under before publishing)

Given the scale of processing (sole proprietorship, no large-scale processing of special-category data, no systematic large-scale monitoring), formally appointing a Data Protection Officer is not required under GDPR Article 37. The contact above serves as the data-protection point of contact.

2. This app is local-first — most of what it does never reaches us

Unlike a typical account-based app, BioApex has no user accounts, no sign-in, and no server we operate. Your habit-tracking data — the daily checklist, its history, your subjective readiness scores, and (where enabled) HealthKit sleep data — lives entirely in local storage on your device (an on-device MMKV store and an on-device SQLite database). It is never transmitted to us, and we have no way to access it. Uninstalling the app deletes it permanently, along with everything else on the device.

The only data that leaves your device is described in §3.

3. What we collect, why, and its legal basis

Category	Examples	Purpose	Legal basis (GDPR)
Subscription/purchase data	Product identifier (yearly/monthly), transaction identifier, an anonymous app-user identifier generated by our subscription vendor (RevenueCat)	Granting and verifying premium (trial/paid) access	Art. 6(1)(b) — performance of a contract
Local notification preferences	Your chosen daily-reminder time, whether reminders are enabled	Scheduling the reminders you opted into, entirely on-device	Art. 6(1)(b)
Crash reports — only if you turn on “Crash Reports” in Settings; off by default	Stack trace, device/OS version, app version. Never your habits, journal-like content, or location	Diagnosing and fixing bugs	Art. 6(1)(a) — your explicit consent, given by enabling the toggle

We do not operate a backend server for this app, so there is no server-side account, profile, or database of users for us to hold beyond what our subscription vendor (RevenueCat) processes on our behalf to validate your purchase with Apple/Google, and — only if you’ve opted in — what our crash-reporting vendor (Sentry) receives (see §5).

4. What we do NOT collect

No account, email address, name, or password.
No location data.
No microphone or camera data.
No contacts from your device.
No behavioral tracking, advertising identifiers, or third-party analytics SDKs. (Crash reporting, if you opt in per §3, is diagnostic error data only — configured to exclude session/behavioral tracking; see §5.)
No special-category data (GDPR Art. 9 — health, ethnicity, religious belief, etc.) is transmitted anywhere. HealthKit sleep data (iOS only, read with your permission) is used to draw a chart entirely on your device and is merged into your local SQLite history only — it is never sent to us or to any third party.
We do not sell or share personal data for marketing purposes, because we do not collect enough personal data to do so in the first place.

5. Recipients of data (subprocessors)

We share data with exactly one third party, and only for the purpose of validating your subscription purchase:

Party	Purpose	Location
RevenueCat	Subscription/entitlement management — receives the store transaction receipt from Apple/Google and confirms your purchase back to the app	US (EU-US Data Privacy Framework certified)
Apple App Store / Google Play	Payment processing for subscriptions	Processed directly by Apple/Google — we never see or store card details
Sentry — only if you enable “Crash Reports” in Settings	Receives crash/error diagnostic data (stack trace, device/OS version, app version) so we can fix bugs. Session tracking, performance tracing, and screenshot attachment are all disabled in our configuration	US/EU (configurable data region)

We do not use any push-notification server, analytics vendor, or LLM/AI API in this app as of the version this document was last updated for. Crash reporting exists but is opt-in and off by default (§3, §5) — see §12 if that changes.

6. International data transfers

RevenueCat may process data outside the European Economic Area. Where this occurs, the transfer relies on the mechanisms provided for under GDPR — in particular the EU-US Data Privacy Framework (DPF) for certified US entities. Current certification status can be verified at https://www.dataprivacyframework.gov/.

7. Data retention

Category	Retention
Habit-tracking data (checklist, history, readiness scores, HealthKit sleep data)	Lives only on your device, for as long as the app is installed. Deleted permanently when you uninstall the app. We have no copy.
Subscription/purchase data (held by RevenueCat)	Per RevenueCat’s own retention policy, for as long as needed to service your subscription and comply with financial record-keeping obligations
Local notification preferences	On your device only, until you disable reminders or uninstall the app
Crash reports (held by Sentry, only if opted in)	Per Sentry’s own retention policy — see their documentation for the current default

8. Your rights

Under GDPR you have the right to:

Access and erasure of your habit-tracking data — because this data never leaves your device, exercising this right is as simple as deleting it in-app or uninstalling the app. There is no server copy for us to delete.
Access, correction, or erasure of subscription data held by RevenueCat — contact us at the address in §1, or RevenueCat directly; we will forward/assist with the request.
Object to processing based on legitimate interest, and request restriction of processing — contact us at the address in §1 (this currently applies only to subscription data, per §3).
Lodge a complaint with a supervisory authority — in Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl. EU users may also lodge a complaint with their own national supervisory authority.

We respond to rights requests without undue delay, and no later than one month after receipt (GDPR Art. 12(3)).

9. Children’s data

BioApex does not knowingly collect personal data from children. The app has no account system and no age-gate, so no age-related declaration is collected at all — see §2 for why there is very little personal data to protect in the first place. If a specific skin of this engine is marketed toward a younger audience, that skin’s publisher is responsible for adding appropriate age-appropriate design controls before publishing.

10. Cookies

This app does not use cookies. If a companion website is published for this app, that website’s own cookie usage (if any) will be documented separately.

11. Data security

All habit-tracking data stays within your device’s app sandbox, protected by the operating system’s standard app-data protections.
We do not store any password, because there is no account to log into.
Subscription/purchase validation happens through Apple’s/Google’s own secure purchase APIs and RevenueCat’s SDK — we never see or handle raw payment details.

12. Changes to this policy

We will provide at least 30 days’ notice of material changes to this policy, via an in-app notice and/or the contact channel in §13. The “last updated” date at the top of this document reflects the most recent revision.

13. Contact

Privacy: contact@kzlab.dev
Support: contact@kzlab.dev
Correspondence address: LogicLoom Kamil Zwarycz, ul. Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland.