Sledge

Sledge Privacy Policy

Version: 2.11

Effective date: 21 October 2026

Last updated: 21 October 2026

Language: English

This policy describes the account-based Sledge release. It is provided in English, the language of the Sledge app and its legal texts.

See the separate Consumer Health Data Privacy Policy for health-data categories, recipients, choices, requests and appeals.

1. Controller and contact

The controller is:

Burlis Management GmbH
Philippstraße 27
52349 Düren
Germany

Managing Director: Alexander Burlis
Commercial Register: HRB 7595, Local Court of Düren
VAT identification number: DE316238171
Telephone: +49 177 6436530
Email: support@sledge.fit

For a privacy request, put “Sledge privacy” in the subject line. For a safety or moderation matter, put “Sledge safety” in the subject line. You can also write to the postal address above. No data protection officer contact is published.

2. What is available in this release

The account-based iPhone release is for people aged 18 or older. Availability depends on Apple offering Sledge in your territory. Sign in with Apple or email is required. Sledge provides a local workout log, manual food logging with on-device food search, barcode lookup and optional meal-photo estimates, progress views, optional AI Agent and optional Apple Health integration. Using Sledge requires an active Sledge Pro trial or subscription. Without one, the subscription screen still offers Restore purchases, Account, where you can sign out or delete your account, and links to the End-User Licence Agreement (labelled Terms of Use) and this policy. Android store activation is separate; Android storage and Health Connect information below applies where you already use that platform.

The camera is used only when you choose it: to photograph a meal or to scan a product barcode. Barcode frames are processed on your device. A meal photo is sent for an estimate only after your separate food-photo consent, as described in “Food search, barcodes and optional photo estimates” below.

Optional account saving lets you continue from the last successful save after signing in on another phone. Section 5 describes its separate choice, scope and limits. This release has no general database-file import, web checkout or subscription Family Sharing. Data & privacy also offers a separate local rights copy as described in Section 5.

Sledge shows no in-app advertising and has no cross-app tracking, session recording, remote push notification service or location permission. Optional account analytics and subscription processing through Superwall are described in Section 6. Separate website analytics and the website's Privacy settings are described in Section 10.

3. Data stored on your device

The following data are stored in Sledge's local database:

The complete device database is not uploaded. Signing in links this installation to one Sledge account. If you separately enable account saving, the account service receives only the eligible records and meal photos described in Section 5. Health-derived data are excluded from account saving. Optional Agent processing is described below and requires a separate choice. An issue report sends the contextual snapshot you review and submit, as described in Section 8; it does not attach the database.

Setup answers are stored on this device and used to build your training plan. They are included in account saving only after its separate consent. If you separately enable Agent and select goals or training context, the resulting goals and routines can be included in that request as described in “Optional AI Agent”. Sledge excludes the local database containing setup answers from automatic backup and device transfer, as described in Section 5.

Rest between sets and rest between exercises have separate settings. Superset detection runs on your device. The between-exercise rest setting, current rest type, active-workout supersets and dismissed superset suggestions stay on this device and are not included in account saving.

The rest-over sound plays through the phone's audio session, including connected headphones, and temporarily lowers other audio. A local rest notification uses a custom sound; its visible alert is suppressed while Sledge is on screen. On iPhone, the Live Activity shows generic workout and rest information without exercise names or weights. These features use no remote push service.

For ordinary local functions requested by you, the legal basis is Article 6(1)(b) GDPR. Fitness, nutrition, body-weight and Health-platform information may be data concerning health. The separate explicit choices for Health-platform access and optional Agent processing are described below; agreeing to the Terms does not grant either of those permissions.

4. Apple Health and Health Connect

Health access is optional. Before the operating system asks for permission, Sledge separately asks for explicit consent for the precise categories involved: reading steps, body mass, height, body-fat percentage, age from date of birth (on Apple Health), heart rate, resting heart rate, sleep and workouts, and writing completed workouts. Sledge derives age on the device; the date of birth does not leave the native Health reader. Weight and height can calculate BMI locally; age and body-fat percentage are optional and are not required for BMI. If you choose suggested nutrition targets during setup, weight, height and age can also calculate those targets locally. Targets derived from Health stay on this device, remain excluded from account saving and are removed on withdrawal. Heart-rate reads are limited to the period a Sledge workout was running, and are shown to you beside the sets of that workout. Resting heart rate and sleep are read as one value per day, and other apps' workouts as a summary (activity, duration and active energy), only for Agent replies; workouts Sledge wrote to Health are left out. If you also agree to Agent, the Health data it uses is sent to OpenAI as described in Optional AI Agent; otherwise Health data is not sent for Agent processing. Separate private review and deliberate issue reports use only relevant already-used information under their own disclosed permission. On Android, older history and complete sleep/workout summaries require Health Connect history permission; unsupported or declined access remains visibly unavailable rather than an empty health record. The local receipt records policy version 1.4, the language shown, the categories and the time of consent. The receipt stays on your device. A consent given under an earlier version does not cover a category added later, so Sledge asks again rather than widening what it reads.

On iPhone with iOS 26 or later, Sledge can start an Apple Health workout session for an active indoor strength workout to keep the rest clock, rest alerts and Live Activity current while the phone is locked. This requires your current Sledge Health consent and Apple's workout write permission, the same permission used by Export. The session collects no samples and saves no workout to Apple Health; only choosing Export saves a completed workout. Sledge requests Apple's permission only in the foreground, at most once for a workout during the app's current run. The session ends when the workout ends, Health consent is withdrawn or denied workout permission is detected. This session is unavailable on Android and earlier iOS versions.

You may refuse without losing the ordinary workout or manual food log. You can withdraw through Sledge settings at any time. Withdrawal stops Sledge from reading or writing Health data, invalidates the consent receipt and removes Sledge's Health-derived step cache, imported body-profile values and matching/export links. Manually entered body-profile values remain. It does not delete an ordinary workout that you logged yourself, and it does not remove a workout already written to Apple Health or Health Connect. You can also revoke the operating-system permission in device settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

Apple or Google controls the copy already held in its Health service. Its own terms and privacy information apply to that service.

5. Local storage and backups

Optional Watch dataset recording

The Watch recorder is included only in Sledge's internal test builds. App Store builds contain no Watch app and do not offer this recording. In an internal test build, the optional Watch recorder keeps continuous wrist motion, sensor timing and device configuration alongside your manual exercise and set annotations in separate local recording files. Heart-rate recording is off by default. Enabling it in Watch debug records your separate consent and its time locally; Apple also asks for heart-rate read permission. Reads are limited to samples from the local Watch during your Sledge capture. The recorder does not read unrelated Health history or save a separate diagnostic workout to Health.

Stop tracking to end collection, or turn heart-rate recording off before the next capture. In an internal test build, existing recordings remain available for the test build's recording export; account/data replacement removes them through Sledge's local-data controls. Recordings are excluded from automatic device backup. Sledge does not upload these recordings to its server, analytics or AI services. You choose whether to share a recording export and with whom.

App database

Sledge stores its database in the app sandbox. The device's access controls and encryption protect that sandbox; Sledge does not separately encrypt every database field.

On iOS, Sledge marks its SQLite data directory as excluded from automatic device and iCloud backup before opening the database and reapplies that setting when the app opens the database again. The database holds data read from Apple Health, which Apple does not allow in iCloud backup. Sledge does not copy the whole database into account saving. Only the last successfully saved eligible records can be restored from your account. Unsaved records and excluded Health-derived data can be lost if you delete the app or replace the phone.

Optional account saving

Account saving is off until you give separate explicit consent. Its permission revision is account-save-1. Accepting the Terms, acknowledging this policy, Health access, Agent processing, chat review or analytics does not enable it. Refusing or withdrawing preserves your account and local log. On the existing setup finish, Agree and save is the main action and records that consent; Not now finishes setup without enabling account saving. Earlier refusals and withdrawals stay off. You can also enable saving in Account or Data & privacy after reading its separate consent statement. The purpose is to let you continue your own Sledge log after sign-in on another phone, under Article 6(1)(a) and explicit Article 9(2)(a) GDPR consent for health-related information. It is not permission for advertising, AI analysis, model training or product-improvement review.

An enabled save includes your setup answers, first name, preferences, goals, manual body-profile values, equipment, user plans and their referenced programme instructions, custom exercises, workouts and sets including Trash and an active session, progression evidence, schedules, rest deadlines, food and nutrition records with their source information, water entries, kept meal photos, and eligible Agent conversations and proposals independent of Health-derived data. Health-derived information is excluded, including imported Health workouts, steps, heart rate, matching/export identifiers, Health-sourced body values, Health permissions and affected Agent content. Unknown provenance is excluded. Sign-in tokens, analytics choices/events, AI/chat-review permissions, raw device settings, Watch research files and transient Agent attachments are also excluded.

Sledge sends this account-linked snapshot and prepared JPEG meal photos over TLS to the account service hosted by Hetzner in Nuremberg, Germany. Payloads and photos are encrypted at rest with authenticated server-managed encryption. They are not end-to-end encrypted: the service and authorised operators with the required key can decrypt them to provide restoration and verified rights requests. Account identifiers, consent/revision/size metadata and required operating records are separate from this payload encryption. Device sandbox encryption remains distinct. Account-save content is not sent to OpenAI, PostHog, Sentry, Superwall or email-notification providers by this feature.

Saving runs while Sledge is open after eligible changes and when it returns to the foreground. Offline changes remain on the phone until accepted by the server; only the displayed successful save time confirms their receipt. There is no automatic merge of two different logs. If another phone has changed the save, or this phone has unacknowledged work, Sledge stops and asks you to keep this phone's log or use the saved log. Choosing the saved log requires explicit confirmation before discarding local work. A failed restore leaves the prior log available; choosing local setup after that failure leaves saving off. The limits are 32 MiB per snapshot, 5 MiB per prepared photo and 128 MiB of photos per account. A limit, unavailable service or unavailable encryption key can prevent saving or restoration. Account saving does not recover changes that were never saved or guarantee recovery after loss of the hosting machine.

Only the current snapshot and referenced photos are kept. Replacing it removes the previous live snapshot and photos no longer referenced. Unreferenced staged photo uploads expire after 24 hours and are removed at the next successful daily cleanup, normally within about 48 hours of upload. There is no extra version history. Local pending-save bytes are removed after reconciliation or definitive cancellation; temporary old-photo bytes are removed after restore or rollback. Deleting a local record or clearing eligible chat removes it from the next accepted save; until then the earlier server copy remains.

Turn off account saving in Account or Data & privacy. Sledge immediately stops this phone's dispatch and requests account-wide withdrawal, deleting the live snapshot and all saved/staged photos. Offline withdrawal remains visibly pending until authenticated confirmation. Its account-bound request survives sign-out, restart and clearing this phone's log; another account cannot fulfil it. Re-enabling requires a fresh explicit choice. Minimal content-free consent and disabled-state evidence remains while the account exists. Account deletion removes the live snapshot, photos and this consent state. Encrypted free pages, write-ahead logs and restricted recovery archives may retain ciphertext until normal reclamation; the seven daily recovery archives normally expire within about seven days. This is not immediate physical sanitisation. Recovery cannot reintroduce withdrawn or deleted content; Section 10 describes its limits.

You can request a rights copy of the server-held snapshot and referenced photos through Section 13, without Pro. Identity verification and secure delivery protect this sensitive copy. The local JSON rights copy below has its own scope and excludes images; it is not the account restoration format.

Your local-data copy

In Data & privacy, Get a copy of my data prepares a JSON file of records created locally by the currently signed-in account. It includes profile answers, goals, targets, equipment, custom exercises, plans, schedules, local workouts and sets (including Trash), food records with their source fields, and saved Agent messages and proposals where independent of imported Health data. Body weight is included only in the current profile and local workout snapshots.

Imported Health workouts and step caches, Health-derived Agent answers/proposals, records with unknown ownership or provenance, sign-in tokens, settings, diagnostics, raw database files, images and Watch research files are excluded. The copy is not a backup and cannot be imported or restored in Sledge. It is available without an active Pro subscription.

The file contains personal fitness information. You choose where to save or share it through your device's system share sheet; Sledge does not send it to support. The receiving app or service may process it under its own terms. Sledge removes its temporary copy after the share sheet completes or fails, on account changes and at the next ordinary startup after an interruption. Sledge cannot retract a copy already received elsewhere. Exclusion from this file does not limit a legal right to request other data through the contact in Section 1.

Sledge excludes its local database, including Health-derived rows and Agent chat, from automatic Android backup and device transfer. Session credentials are also excluded. Other eligible app files may follow your device and Google account backup settings; Burlis does not receive that backup.

Signing out keeps the local log attached to that account. Before another account can use the installation, Sledge requires explicit clearing of the previous log. Clearing removes the live database, kept meal photos and continuity staging files. It does not by itself delete the account save; a pending account-wide withdrawal remains until matching confirmation.

In-app account deletion also clears this phone's local records after server deletion is confirmed, unless another Sledge account owns them. An interrupted deletion or clear resumes before Sledge opens a workout database. A web deletion request cannot remotely wipe a device. Removing the app removes its live sandbox subject to copies you or the operating system previously made.

6. Account, authentication and subscriptions

A Sledge account is required and is restricted to people aged 18 or older. Ordinary sign-in uses Apple on iOS, Google on Android, or an email address and a six-digit one-time code. Sledge processes:

Account processing is necessary to provide the contract under Article 6(1)(b) GDPR. Email codes expire after 10 minutes; Apple and Google challenges and linking proofs expire after five minutes. Sessions expire after 90 days or earlier on sign-out, revocation or deletion. Account and legal evidence are retained until deletion, subject to the report rules below. Apple and Google email claims are not used to merge accounts or create an email sign-in method automatically. Linking requires proof of control of the current account and the added method. Apple operates its sign-in service under its own terms and privacy information. Google operates Google sign-in under its own terms and privacy information. Signing out clears Sledge’s Credential Manager session on Android without removing your device’s Google account. Verified Apple revocation/deletion notifications invalidate affected Sledge sessions; they do not remotely erase your local workout log.

From this version, the account service keeps a minimal history of Terms acceptance, Privacy-notice acknowledgement, and optional permission decisions and withdrawals. Each record contains the account reference, purpose, action, notice version, server time, and language or permission revision where actually received. It contains no health content. Later choices do not overwrite earlier records. History starts when this recording is introduced; we do not invent earlier events from the current setting. This evidence supports accountability under Article 6(1)(c) GDPR, including Article 7(1) where applicable. It is removed with the account, subject to separately justified legal retention.

To handle repeated or delayed Apple notifications safely, we retain a one-way hash of each notification identifier. Revocation records also contain a one-way hash of Apple's account identifier and the revocation time. These security records expire 30 days after receipt and are removed by daily cleanup, including when the Sledge account has been deleted. They prevent revoked sign-in proofs from being reused and protect a newer valid authorization from an older notification. This processing relies on Article 6(1)(f) GDPR for our legitimate interest in secure account access.

An isolated synthetic store-review account may use a reusable account-scoped review credential. The server holds only its one-way hash, and it cannot sign in to another account. It is removed or rotated when review access ends. This processing relies on Article 6(1)(f) GDPR for secure store review.

For email sign-in, our Mailwerk email service sends the address and code to Amazon Simple Email Service (SES) in Stockholm, Sweden (eu-north-1). Mailwerk is operated by Burlis and stores the email address, a random contact reference and delivery records separately from Sledge account data. The code is passed only for delivery; Mailwerk does not store it in the contact, event or message history or in logs. Sledge stores only its short-lived hash for verification; the code expires after 10 minutes. Synthetic store-review credentials are not sent by email. No sign-in email open or link tracking is enabled, and sign-in does not subscribe you to marketing.

After 30 days without a sign-in email request, the inactive Mailwerk contact, address and identifying delivery history are erased by the next successful daily cleanup, normally within 31 days. Account deletion also erases the Mailwerk contact before Sledge confirms deletion. Minimal pseudonymous suppression and send-claim records remain to prevent blocked delivery and duplicate sends. Existing protected backups expire under their retention policy; a restore must reapply erasure before sending resumes. This email-contact retention does not delete your Sledge account or your account email address.

AWS is a US-parented provider. Its data-processing agreement governs processing and international transfers, including contractual safeguards where required. EU-region delivery does not mean that all email processing stays in the EU: your chosen mailbox provider receives the message under its own locations and terms.

Optional account analytics

Account analytics is optional and separate from the Terms and this Privacy Notice. If you allow account analytics, Sledge sends a small allowlisted set of account and app-use events to PostHog, an EU-hosted analytics processor: account creation after consent, completion of first-run setup and app foreground use at least 30 minutes after the previous recorded session start. With the current analytics choice, this also includes paywall views, checkout outcomes (including cancellation, pending purchase and restore), and freshly verified trial or subscription access. These events carry a random checkout identifier, phone platform, bounded outcome, store source and sandbox/production category; no purchase amount or transaction identifier is sent. Existing version-1 permission covers lifecycle events only; subscription measurement starts only after a new affirmative choice. Sledge creates a random analytics identifier for the account. With a new affirmative version-3 choice, Sledge links the account name and verified email address to that identifier, including its earlier analytics history, and counts which main tabs you open (Train, Recap, Fuel and Agent), at most once per tab per recorded app session. Names and email addresses are set only on the person profile, from the server's account record; the app cannot submit arbitrary identity properties. Existing version-1 and version-2 choices remain without names, emails or tab counts until you explicitly agree to the update in Data & privacy. Version 2 continues its existing subscription measurement. Sledge does not send the Sledge account UUID, Apple identifier, session token, device or advertising identifier, IP address, workout, exercise, set, nutrition, body or Health data, free text or automatic SDK data in these events. The event timestamp is the time Sledge records the event; a signup event is only recorded when the account was newly created in that first sign-in flow and you then opt in.

You can leave this choice off or turn it off at any time under Data & privacy. Sledge stops local collection immediately, clears pending events and asks PostHog to delete the event history for the random identifier. A failed server update is shown as pending and retried; Sledge does not describe the deletion as complete until PostHog confirms it. Turning analytics on again creates a new random identifier. Account creation, authentication, legal evidence and other required account processing continue when analytics is off. The analytics disclosure version is sledge_account_analytics_v3; the lawful basis for this optional processing is your consent under Article 6(1)(a) GDPR, which you may withdraw without affecting earlier processing.

The analytics processor is PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, acting under its data-processing agreement. Sledge uses PostHog's EU Cloud. PostHog may also process data outside the EU, including in the United States. Such transfers are governed by PostHog's Data Processing Agreement, including the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses where required.

Sledge's server deletes a queued analytics event in its daily cleanup once the event is seven days old, whether or not it has been sent. PostHog keeps the events of a random analytics identifier until Sledge asks for their deletion after you withdraw this consent or delete your account, subject to the event-retention terms of the PostHog plan in use. PostHog guarantees one year of retention on its free plan and seven years on paid plans; data beyond the retention period may remain until PostHog deletes it. These plan terms do not guarantee an exact automatic deletion date. Sledge keeps a minimal erasure record with the random analytics identifier, the account reference and request and completion times to complete and evidence each deletion request while it is pending. Once completion is recorded, this operational receipt is removed after 30 days during the next successful startup or daily cleanup. Restricted recovery archives follow Section 10's separate window. This does not shorten or replace the provider's erasure obligation.

Account totals

Sledge also reduces existing server account records to daily totals: the number of legally ready accounts, excluding developer accounts, and the number with account analytics enabled. Only these independent integer totals and their observation time go to PostHog, on a fixed population stream with person profiles and location lookup disabled. They cannot identify an account or be joined to individual analytics records. Missing observations are not historical zeros. Creating these totals requires no additional device access. The local aggregation relies on Article 6(1)(f) GDPR: understanding the size of the service and how much optional analytics represents. You can object by contacting support@sledge.fit. Sledge keeps a written assessment with its privacy records. Account operation does not depend on analytics consent.

Optional Apple Ads measurement

On iPhone, Ad measurement separately asks whether Burlis Management GmbH may measure which Apple ads lead to installs and subscriptions. Allow ad measurement and Not now are equally available. It is off until you explicitly allow it, including for existing accounts. Usage analytics does not authorize this purpose. Refusal leaves normal app and subscription use available.

After the server confirms your choice, Apple's AdServices framework supplies a short-lived attribution token. Sledge sends it to its own account API, which exchanges it with Apple. The token is processed transiently, never stored in Sledge's database or diagnostic logs. Apple may return campaign, ad group, keyword, ad and organization identifiers, country or region, attribution date, and download or redownload details. Missing or unavailable attribution is not classified as organic traffic. No IDFA, fingerprint, new persistent device or install identifier, precise location, workout, Health, food or Agent data is used.

With this separate permission, Sledge also reads independently verified Apple subscription transactions that occurred after permission: trials, paid purchases, renewals and supported refunds or reversals, including price and currency when provided. Account identifiers join these records only within Sledge's existing SQLite database on its German Hetzner server. Sledge combines aggregate results with Apple's campaign and keyword performance reports for internal acquisition analysis. These data are not sent to PostHog or used to change subscription access. Apple processes its attribution and store data under its applicable privacy terms.

This optional purpose relies on Article 6(1)(a) GDPR and, for optional device access, section 25(1) TDDDG. The disclosure version is sledge_ad_measurement_v1. Turn Ad measurement off in Settings → Data & privacy to stop this installation immediately and request account-wide erasure. An offline withdrawal is remembered and sent before a later grant or collection. Withdrawal or account deletion erases live account-linked attribution, transaction measurement and exchange joins. A minimal choice receipt remains to honor Off. An unlinkable token digest prevents replay for at most 24 hours. Account-linked measurement is kept for at most 13 months from collection; expired records are excluded from reads and removed by the next maintenance pass. Aggregate Apple performance rows have no account linkage. Recovery archives follow Section 10. Withdrawal does not affect earlier lawful processing or retract a request Apple already processed.

Optional service-improvement review

After signup and before checkout, Help improve Sledge offers Yes, continue and Not now. It asks permission to save future meal photos, estimates and Agent conversations for human review to improve meal estimation and coaching. This can include relevant health information already used in those features. Both choices are remembered. Refusal preserves normal app use. Settings offers the same disclosure to enable sharing later. The permission is separate from Agent/meal processing, account saving, analytics and one-time issue reports. Disclosure revision: chat-review-3. Earlier grants retain their original text-only scope until you deliberately accept this expanded permission.

Collection starts only for activity dispatched after the server acknowledges the new grant. A meal sample contains the prepared, metadata-stripped photo used for estimation, clarification, structured estimate, outcome, model/prompt version and a linked correction when available. Agent samples contain new prompts and replies in order and relevant context already supplied for those requests, including requested attachments and read results. Sledge does not backfill older history, import more Health data or upload the workout/Health database for review. Relevant already-used context can include connected steps, sleep, resting or workout heart rate, workout summaries, weight/body measurements and related nutrition or goals. The purpose is improving Sledge's health-management features, not marketing, pricing analysis, general profiling or provider model training.

Account-linked samples are encrypted in the existing SQLite database on Sledge's German Hetzner server. Restricted Burlis operators can decrypt them for human review; this is not end-to-end encryption. Content never goes to PostHog, Sentry, Superwall or notification email. The lawful bases are Article 6(1)(a) and explicit Article 9(2)(a) GDPR consent. Sledge records revision, choice, time and version.

Revision-3 and revision-2 samples expire after 90 days; revision-1 keeps its original 30-day deadline. Expired samples cannot be read and are removed by the next scheduled cleanup. Minimal request metadata bound to a sample lasts until that sample expires; other request metadata keeps its 30-day limit. Settings → Data & privacy → Stop sharing and delete review copies immediately stops this installation's optional capture, clears pending optional uploads and requests account-wide erasure of review copies. Normal app history remains. Offline deletion remains visibly pending until acknowledged. Withdrawal and account deletion erase live review samples; recovery archives follow Section 10. Withdrawal does not affect earlier lawful processing.

Server-side error diagnostics

Sledge automatically reports minimized technical failures and rate-limit warnings from its account API and Agent relay to find and fix faults and maintain reliable service. This purpose relies on our legitimate interest under Article 6(1)(f) GDPR. It is separate from optional account analytics through PostHog and uses disclosure version sledge_server_diagnostics_v1.

Reports contain a random event identifier, event time, server software revision, fixed service/failure category and, for unexpected errors, technical coordinates in server source files. Agent-relay failures may also include a random server-created request reference, fixed failure cause and upstream status, processing stage and a bounded history of up to eight stages, duration bucket, attempt count and terminal/recovery state. Fixed provider phase, timeout owner and photo-processing check categories can distinguish technical failures; no photo or other input content is included. They contain no app crash report, workout, Health, nutrition, body, food or Agent content, email address, Sledge UUID, Apple identifier, session token, device or advertising identifier, or free text. Requests, raw error messages, breadcrumbs and automatic context are removed before sending. Session recording, tracing, profiling, diagnostic log collection and screenshots are not enabled. Sledge suppresses IP inference in the stored event; the processor receives our server's connection IP to deliver the report. We do not describe this network processing as anonymous.

Server fault reporting has no account-specific collection setting or identifier and continues independently of the account-analytics choice. You may contact us to object under Article 21 GDPR; we assess your circumstances and the applicable legal conditions rather than promising an account-specific server toggle.

Mobile crash reports

Sledge's iOS and Android app reports minimized technical crashes and unexpected software failures by default to help us diagnose and fix faults. You can turn Crash reports off in Settings → Data & privacy, independently of account analytics. Turning it off stops new reports and removes queued reports from this installation; the choice is remembered after relaunch and backup restore.

Reports contain a random event identifier, time, app version and build, platform, distribution channel, fixed failure category and technical stack/image coordinates needed to locate faulty code. Eligible failures can include fixed processing stage, failure class, attempt count and billing failure site, plus an ordered chain of up to five safe exception causes with at most 80 technical stack frames in total. These describe technical failures without user content or transaction identifiers. They exclude workout, Health, nutrition, food, body, chat and photo content, account/device identifiers, raw error messages, request bodies, screenshots and free text. Sessions, replay, performance traces, profiling and diagnostic log streams are off. The app may retain a bounded local crash cache for delivery on a later launch while reports remain enabled. Failures before the saved preference can be read are not collected. Disclosure version: sledge_crash_diagnostics_v1.

Sledge replaces the stored event's IP field with a neutral value; Sentry still receives the device's connection IP to deliver a report. We do not describe that network processing as anonymous. This purpose is separate from account analytics; turning analytics on never adds data to a crash report.

We use Sentry, provided by Functional Software, Inc. in the United States, to diagnose technical errors. We use its EU region: error reports and related backups are stored in Frankfurt, Germany. Certain account and organization metadata, and information shared with Sentry support, are stored in the United States. EU storage does not exclude access or processing outside the EU. International transfers are governed by Sentry's Data Processing Addendum, including the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses where required.

We use events only to investigate and correct faults within the provider's event-retention window. Access is restricted to people investigating service failures. Because reports contain no account or installation identifier, account deletion cannot reliably locate a person's earlier reports. For access, erasure or objection requests, we use proportionate information you supply where it permits identification, without collecting extra identity data solely to link reports.

Store purchases and Superwall

Apple on iOS and Google Play on Android handle payment and subscription management. Sledge uses Nest 22, Inc. (Superwall) to display subscription offers, make and restore store purchases, and verify which Sledge account has access. The app identifies your Sledge UUID before presenting a purchase. Superwall receives that UUID and its generated identifiers, app/device and connection metadata, product and transaction identifiers, purchase/renewal state, dates, store environment and entitlement information. Sledge disables Superwall SDK event collection; necessary account, receipt and offer requests remain separate from the optional PostHog account analytics described above. Apple receives the account token associated with the purchase. Sledge does not send your workout database, training-day marks, Health records, email address or display name to Superwall.

For Apple purchases, our server verifies current purchases directly with Apple using the transaction identifier supplied by the app. Apple's signed account token must match your Sledge UUID. We retain the original transaction identifier and store environment with your account so future access checks work after relaunch; this link is removed when you delete your account. Existing accounts without that link continue to be checked through Superwall. A device receipt alone cannot grant another Sledge account access. Server responses are cached per account for at most 60 seconds. A secure confirmation on the phone can support up to seven days offline, ending sooner at the known subscription or session expiry. Grace access without a verified future expiry requires an online check. These records support the subscription contract under Article 6(1)(b) GDPR and access security under Article 6(1)(f) GDPR.

For Google Play purchases, our server checks configured Play subscription products and their status through Superwall for your Sledge account. It does not perform the direct Apple-transaction check described above. A complimentary Pro grant can also provide access; it involves no store checkout or renewal.

Superwall acts as our processor. Its DPA incorporates EU Standard Contractual Clauses for restricted transfers. Its listed infrastructure includes processing in the United States and global content delivery; EU-only storage is not promised. You may request information about these safeguards from us.

Superwall's records have a separate provider erasure process. Resetting its SDK or receiving Sledge's deletion confirmation does not erase those records. Burlis initiates provider erasure through Superwall's published compliance-contact procedure; you do not need to submit a second request. Until the provider confirms completion, we keep only its customer UUID and request time in a restricted handling record, then remove it immediately. We explain any legally required retention. We do not promise immediate provider erasure or a fixed provider retention period that has not been established. Apple and Google retain store records under their own applicable terms and legal duties.

7. Optional AI Agent, food search and photo estimates

Optional AI Agent

Agent input, including the bounded recent conversation, undergoes OpenAI's automated moderation before any reply is generated. Replies then appear as Agent writes them, and a suggested change is checked against product limits before it can be applied. Moderation results remain transient and are not added to your account or analytics. These checks can make mistakes and do not constitute a medical or human review.

When available, Agent requires verified Sledge Pro access, a signed-in account and separate Agent consent. On Android, access uses the configured Google Play subscription or another valid account entitlement. Meal photos taken with the camera for food estimates are available on iOS and Android and follow the separate food-photo consent described in the next section.

Everywhere, Agree and start chatting consents to OpenAI processing of your messages and a bounded recent eligible conversation, including health details you enter, together with your Sledge goals, workouts, food and confirmed body weight and, when you have connected Apple Health or Health Connect under its own consent, your steps, sleep, resting heart rate, Health workouts and Health weigh-ins. There is no partial mode; to stop sharing, turn off Agent. Opening Agent or typing a message gives no permission. An acceptance given before 11 October 2026 did not cover Health data, so Agent asks again. Your message, a bounded recent eligible conversation and summaries of those records pass transiently through Sledge's relay to OpenAI. When an answer needs older records than that summary holds, such as an earlier workout, an exercise history or a longer trend, Agent asks your phone for them and the phone sends only the records asked for, within the same reply. Health data is read for that reply only. Relevant already-used context can be retained separately for private health-management improvement or a deliberate issue report only under the explicit permission described in Sections 6 and 8. Sledge does not automatically attach your account identifier, account email address or authorization token to model input. Text or photos you choose to send can still identify you or another person; these requests are not treated as anonymous. Without separate chat-review consent, the account service processes only consent, access and usage metadata for an ordinary Agent request. If you allow Help improve Sledge under the expanded permission, future ordered exchanges and relevant already-used context are retained for the encrypted human review described in Section 6; earlier history is not backfilled. A separately submitted issue report sends only the previewed contextual case and optional comment for handling described in Section 8, even if ongoing review was declined. It does not attach unrelated conversations or the Health/workout database. The relay does not persist message content.

The Agent processing-consent and optional chat-review flows are the same worldwide. The app does not request a country-specific Agent layout.

You may attach one photo using the system photo picker. Before you send, the preview explains that OpenAI receives the photo for automated safety checks and, if accepted, Agent analysis. The app resizes and re-encodes it and removes EXIF, XMP, IPTC and comment metadata. Image bytes pass transiently through the relay; they are not stored in chat, included in backups, or logged by Sledge. Temporary picker and processing copies are removed after preparation. Photos are not resent with later messages; photo-derived text replies remain in your chat. A rejected photo or unavailable safety check prevents Agent inference. Automated moderation can make mistakes. OpenAI's provider retention rules below also apply to image processing.

Conversation and proposal records are stored in the local app database. Eligible conversations and proposals can be included in separately consented account saving; Health-derived content and content of unknown provenance are excluded. Clearing eligible local chat removes it from the next accepted account save. This own-user continuity purpose is separate from Agent processing and Help improve Sledge private review. These local records are excluded from automatic backup and device transfer on iOS and Android; see Privacy Policy Section 5. You can stop a reply, clear the local chat or withdraw Agent consent. Stopping or local deletion cannot retract a request already processed by OpenAI. OpenAI API data is not used for model training by default. We request store:false; default abuse-monitoring logs may retain content for up to 30 days, subject to exceptions. This is not a promise of zero retention or exclusively EU processing. OpenAI Ireland Ltd. processes this data as our processor under OpenAI's Data Processing Addendum; transfers outside the EEA rely on EU Standard Contractual Clauses or an adequacy decision. See OpenAI API data controls.

Agent may be wrong. It provides general fitness information, not diagnosis, treatment or medical advice. A change you explicitly ask for, such as logging a meal or your weight, is applied at once and its card offers Undo; a change Agent suggests on its own changes nothing until you select Apply, and a deletion always waits for you to select Delete. Sledge checks current records before committing any change. Applied changes remain in your log after chat deletion. Availability and usage limits may prevent a reply without affecting your existing local records.

Optional processing uses consent under Article 6(1)(a) GDPR and, for health-related information, explicit consent under Article 9(2)(a). You may withdraw prospectively without losing local logging, existing history or account controls. Contact the controller above for access or erasure requests; local deletion does not guarantee immediate erasure of provider-held security records.

Food search, barcodes and optional photo estimates

Generic food searches run on your device using a versioned BLS/USDA catalogue. When you explicitly search packaged products or look up a barcode, the app sends that query or product code directly to Open Food Facts. Open Food Facts also receives ordinary network information, including your IP address and the Sledge app identifier. No account token, diary history or photo accompanies this lookup. Barcode scanning processes camera frames locally. Selected nutrition values and their source snapshot are saved locally only when you add the food; public catalogue data can be incomplete or incorrect.

Photo estimates need an eligible account and separate current food-photo consent. One prepared meal or nutrition-label photo and an optional clarification pass through the Sledge relay to OpenAI for safety checks and to identify food or read the label. The account service receives only consent, authorization, digest and usage metadata. When you add the meal, Sledge keeps that prepared photo with it on this device and, after separate account-saving consent, in your current account save until replacement, account-saving withdrawal or account deletion. Deleting the local meal removes it from the next accepted save. The kept photo is excluded from automatic device backup; other image copies are temporary. Estimates remain editable and do not change your diary until you add the meal. The OpenAI retention information in the Agent section also applies; store:false is not a zero-retention guarantee. Withdraw food-photo consent in Data & privacy. Withdrawal stops new requests and cancels in-flight transport, but cannot retract data already processed. Photos already kept with meals stay until you delete those meals.

8. Optional issue reports

Report an issue is available from Settings/Help, Agent chats and meal results, including when ongoing sharing was declined and without a paid-access check. The existing report sheet shows the actual snapshot, an optional What went wrong? comment, Privacy, Send report and Cancel. App reports include the screen name, app/build/platform and relevant error state; no automatic screenshot. Chat reports include the current conversation's prompts/replies and relevant request details/attachments. Meal reports include the estimation photo, clarification, estimate and correction when available, plus request/app details. The preview identifies a bounded section containing the reported message when all of a chat cannot fit; it never labels that section the whole conversation. No unrelated conversation or workout/Health database is attached.

Beside Send, a chat report says: “Send this conversation and app details to Sledge to investigate and reply. It may include health information.” A meal report names the meal photo and estimate; an app-only report names app details. Send gives explicit permission for that one case, including its relevant health information. It never enables ongoing review or analytics or adds the report to a training feed. Opening sends nothing. Cancel and confirmed submission clear the temporary local snapshot. A manual retry reuses the frozen snapshot/request ID; account changes abort and clear it. Existing account contact details are used for replies; no duplicate email field is required.

The account service stores the case encrypted with account ownership, request and ticket identifiers, feature, language, receipt time and ai-report-3 disclosure revision. Earlier ai-report-1/2 submissions retain their original acceptance record. Restricted Burlis operators use the case to investigate, reply and improve safety and the reported feature. A receipt confirms encrypted storage, not human review. This is not an emergency service.

The internal notification sent through Mailwerk and Amazon SES contains only an opaque ticket number, without the report text, reason or account identifier. Report content is not sent to OpenAI, analytics or diagnostic services as part of reporting. Hosting and delivery safeguards are described in Sections 6 and 10. If you separately email us, Section 11 applies to that correspondence.

This optional processing relies on Article 6(1)(a) GDPR and, for health information, explicit consent under Article 9(2)(a). You can withdraw consent or request erasure through the contact in Section 1 without cancelling Pro or disabling ordinary logging. Withdrawal stops further consent-based processing; it does not affect processing before withdrawal. Unheld reports, including those awaiting review, are removed no later than 90 days after receipt or 30 days after closure, whichever is earlier, unless an identified legal obligation or legal claim requires restricted retention on a separately documented lawful basis, including an applicable Article 9 exception for health information. Such retention is reviewed and ends when no longer needed. Account deletion removes reports without such a hold. Held reports lose their direct account link, but their content may still identify someone; they are not treated as anonymous. We explain an applicable retention exception when handling your request. Server recovery archives follow Section 10's window and restoration must reapply erasure.

9. Account deletion

Open Account in the app and choose Delete account. The Account screen remains accessible from the subscription, updated-Terms and local-log ownership screens. The app saves a local deletion intent before contacting the server. It clears this phone's local records after server deletion is confirmed, unless another Sledge account owns them. A different account's local records are preserved. If a response is lost, it can recover confirmation after restart without the deleted session. Network failure or an expired session alone never confirms deletion; you may need to sign in again before continuing. If confirmation cannot be recovered, you may instead explicitly choose to clear this phone only. That clears local records and the saved receipt, ends automatic deletion recovery, and does not confirm server account deletion. Without the app, use the deletion page. We may request proportionate proof that the account is yours.

Deletion removes the Sledge account, email, display name, Google identity, Apple identity and stored token, legal evidence, sessions, unused codes, account-save snapshot and saved/staged photos. The Mailwerk email contact is erased before Apple sign-in token revocation or local account removal. If email erasure fails, deletion stays pending and the account reference is kept for retry. Apple sign-in tokens are revoked before the server confirms deletion. If that step cannot finish, deletion remains pending. AI reports follow Section 8's separate deletion and legal-retention rules. Optional Agent chat-review samples and their account consent record are deleted with the account.

The 30-day deletion receipt contains only a one-way hash of a random receipt secret and confirmation/expiry times. It contains no account identifier, email, Apple or Google identity or workout data. The app keeps the corresponding secret securely while deletion is pending. This limited record supports recovery after a lost response and prevents accidental data loss under Article 6(1)(f) GDPR. The separate provider-erasure request described in Section 6 retains only the customer UUID and request time until provider completion is confirmed, under Article 6(1)(c) GDPR to meet the erasure obligation. The separate Apple notification security records follow Section 6's retention period.

After confirmed in-app account deletion, Sledge removes the live local database and kept meal photos unless another Sledge account owns them. A different account's local records are preserved. Another device's records, older operating-system backups and data already written to Apple Health or Health Connect need separate deletion under your control. Account deletion does not cancel an Apple or Google Play subscription: billing continues until you cancel through the store where you purchased it. Superwall erasure is separate as explained in Section 6. If optional account analytics was on, account deletion also clears queued analytics events on Sledge's server and asks PostHog to delete the event history of the account's random analytics identifier, as described in Section 6.

Deletion applies to the live Sledge database when confirmed. Section 10's recovery archives may contain a pre-deletion copy for up to about seven days, until the last archive made before deletion expires. They are unavailable through the app and are used only for exceptional recovery.

10. Website, API operation and security

The Sledge API and legal website run on a Cloud Server supplied by Hetzner Online GmbH in Nuremberg, Germany, and are administered through Coolify. The systems process connection information needed to answer a request and protect the service, such as IP address, time, request method, route template, status, duration and a random request identifier. The app rate limiter holds an IP address in memory for at most 10 minutes. Application logs use route templates, not invitation or session secrets. Operational logs are used under Article 6(1)(f) GDPR for reliable delivery, fault diagnosis and abuse prevention. Docker log retention is size-based rather than time-based: each container keeps at most three 10 MB files. A low-volume entry can therefore remain until the files roll over or the container is removed. A concrete security incident or legal obligation may require a longer documented copy.

Coolify creates a local recovery archive of the account server's persistent volume once per day at 02:00 UTC using its consistent recovery procedure. The seven most recent daily archives are kept on the same Nuremberg host, and older ones are removed. The archives are used only to recover the service after data loss. They are not an off-site backup and do not protect against loss of the whole host. An account or other record deleted after an archive was made can remain in the archives for up to about seven days, until the last archive that contains it expires. A restore is an exceptional security operation: the service must remain unavailable unless the complete current state is verified. An older archive cannot be admitted when later deletion, withdrawal or retention actions cannot be established. Restoring an older copy is not permission to re-enable saving.

Traefik access logging is disabled. Docker uses its json-file log driver with at most three 10 MB files per container, and no external log drain is configured. Sentinel retains infrastructure metric history for 7 days. The host system journal retains entries for at most 30 days and uses at most 500 MB.

The public legal site has nginx access logging disabled. The server and TLS proxy still process an IP address to deliver a page.

Website usage analytics

Website analytics section updated 5 October 2026.

The website uses PostHog EU to measure page views and understand which public pages people use. This is separate from the app's account analytics. Website events are not linked to a Sledge account. We remove URL query strings and fragments, and do not collect typed text, email addresses, account tokens, workout, food or Health data. There is no session recording, automatic click collection, advertising or browser error reporting.

Visitors in the United States may receive website analytics by default only when our verified Cloudflare connection supplies that country. The basis is our legitimate interest in understanding and improving these public pages, Article 6(1)(f) GDPR. Every other country, an unknown country and an untrusted connection require your consent before analytics starts, Article 6(1)(a) GDPR. We honor Do Not Track and Global Privacy Control as objections, including after an earlier acceptance. We do not sell or share this data for advertising.

Use Privacy settings in the footer to allow analytics or turn it off at any time. Refusal is as easy as acceptance and does not prevent use of these pages. Turning analytics off stops collection and pending browser delivery immediately; it does not retract events already delivered. A necessary first-party preference cookie remembers only your versioned choice and its time for 180 days. The SDK also stores a first-party permission flag for up to 180 days; neither cookie contains a visitor identifier. The analytics identifier stays in the page's memory rather than persistent browser storage. If the preference cannot be saved, analytics stays off.

PostHog's provider and international-transfer terms are described in Section 6. Website events use the same EU project and follow PostHog's plan-retention terms above. Website events carry no account identifier and do not change the app's separate consent or its account-erasure flow.

Cloudflare, Inc. provides authoritative DNS and delivers the public legal website through its reverse proxy/CDN. For website requests Cloudflare terminates HTTPS and processes connection IP addresses, request URLs and headers, and security/delivery metadata on its global network. This processing is not restricted to Germany. Its Data Processing Addendum provides transfer safeguards, including EU Standard Contractual Clauses for restricted transfers. The API's origin hosting is separate; the website's proxy configuration does not establish the API's routing. Cloudflare also forwards support email as described in Section 11.

Hosting and security processing is based on Article 6(1)(f) GDPR. Our legitimate interests are secure, available and abuse-resistant services.

App updates

Builds that include Expo over-the-air updates check for compatible JavaScript, interface and asset updates when the app starts. A downloaded update applies on a later launch, without interrupting a workout. Native changes still require a new store build. Earlier builds without this update client cannot receive these updates.

650 Industries, Inc. (Expo) delivers these updates. Requests process your connection IP address, operating system, Sledge project and update channel, native runtime version, update identifiers and a random identifier for this app installation. The update client does not send startup-error text. These requests do not include your account identity, workout database, food log or Health records. Update delivery is separate from the optional account analytics choice and the Crash reports switch. Its purpose is to keep the installed app available and current; our basis is Article 6(1)(f) GDPR and our legitimate interest in reliable app delivery.

Expo may process this information outside the EEA, including in the United States. Expo describes its safeguards and retention in its Privacy Policy and end-user processing explanation.

11. Communications

If you contact us, we process your contact details, message and related records to answer you. The basis is Article 6(1)(b) GDPR for a contractual or pre-contractual request, Article 6(1)(f) GDPR for other correspondence, or Article 6(1)(c) GDPR where a legal duty applies. Our legitimate interest is answering and documenting the request.

Messages to support@sledge.fit are forwarded by Cloudflare, Inc. to a Gmail inbox used for Sledge correspondence. Forwarding processes the sender and recipient addresses, message content, attachments and delivery information. Cloudflare processes this customer content under its Data Processing Addendum. Its email-routing event metrics, including addresses, subject, message identifier and processing decisions, are retained for 31 days. Cloudflare's DPA provides EU Standard Contractual Clauses for restricted transfers and identifies its participation in the EU-U.S. Data Privacy Framework.

Google receives and stores the forwarded correspondence through its consumer Gmail service under Google's own terms and privacy policy. Google identifies Google Ireland Limited, Ireland, as the controller for users based in the European Economic Area. This consumer service has no Google Workspace Data Processing Addendum. Google may process information on servers worldwide and describes its transfer safeguards, including the EU-U.S. Data Privacy Framework for Google LLC, in its privacy policy. Gmail correspondence is not restricted to storage in the European Union.

Earlier company correspondence remains with Proton AG, Switzerland, for as long as it is needed under the retention rules below. Switzerland benefits from an EU adequacy decision; Proton's DPA also requires appropriate safeguards for onward transfers outside Switzerland, the EU or another adequate country. This contact change does not move or erase those earlier messages.

We delete ordinary correspondence when it is no longer needed, normally no later than 12 months after the final answer. Contract, tax, accounting, safety or legal-claim records are kept for the applicable statutory or claim period. This is our correspondence-retention rule. Google separately determines retention for its own service processing under its consumer privacy policy.

12. Recipients and transfers

Personal data are disclosed only where necessary to:

Mailwerk, AWS delivery and transfer safeguards are described in Section 6. Proton processing is covered by the adequacy decision for Switzerland, with contractual safeguards for non-adequate onward transfers. Cloudflare's DNS and website-delivery roles are described in Section 10; its email role and Google's consumer Gmail processing and transfers are described in Section 11. Sledge does not sell personal data.

13. Your rights

Subject to the statutory conditions, you have rights to access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time for the future. Where processing relies on Article 6(1)(f) GDPR, you may object for reasons arising from your particular situation.

Send a request to the controller details in Section 1. We respond without undue delay and normally within one month. The account data held on Sledge's server is available on verified request, including the actual saved snapshot and its referenced meal photos as a secure rights copy for access or portability, without a subscription, and is deleted with your account subject to the separately described lawful retention exceptions. Records kept only on your phone are not held on the server, so Sledge cannot recover them. You can obtain the limited local-data copy described in Section 5 from the app. We may need information sufficient to verify that the request concerns you.

You may complain to a data-protection authority. The authority responsible for our establishment is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2–4 40213 Düsseldorf Germany Telephone: +49 211 38424-0

14. Automated decisions and changes

Sledge performs no solely automated decision with legal or similarly significant effects. Subscription access is checked automatically against account ownership and purchase status; it does not assess health. Sledge creates no advertising profile. Contact us if you believe an access decision is incorrect.

We update this policy before a material processing change takes effect. The app records which version and language of the account notice was shown. A material change to account processing is presented before continued use where required. The current version is available at https://sledge.fit/privacy.

Document history

Newest first. A version entry gives the date that version took effect. An editorial entry clarifies the text and does not start a new version.