Privacy Policy

1Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

A data protection officer has not been appointed and is, by current assessment, not legally required (no case under Art. 37 GDPR / § 38 BDSG).

2Overview of processing

Ankaa is a personal life system (app and wall display): routines, health and habit tracking, habit reduction, an AI coach, financial overview, calendar, and optional smart home control. To provide these functions we process the data described below. The app is designed so that each user account is technically isolated from other accounts, and hosting is targeted at the EU.

3Legal bases

We process personal data on the basis of the GDPR, in particular:

• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) - providing app functions, account, and paid services.
• Consent (Art. 6(1)(a) GDPR) - e.g. for the processing of health data (Art. 9(2)(a) GDPR), for optional third-party integrations (smart home, calendar, smartwatch), and for signing up to a waitlist/newsletter.
• Legitimate interests (Art. 6(1)(f) GDPR) - security, abuse prevention, technical stability, and further development; only to the extent your legitimate interests do not override ours.
• Legal obligation (Art. 6(1)(c) GDPR) - e.g. commercial and tax law retention requirements in connection with payments.

Health data (e.g. recovery values, pain/complaint information, habit/addiction tracking) are special categories of personal data under Art. 9 GDPR. We only process them with your explicit consent and exclusively for the purposes of providing the functions you have chosen.

4Categories of data processed

• Master data / account: email address, password (encrypted/hashed), account and subscription status.
• Usage data: completed routines, daily goals, notes entered, app settings, device/sync status.
• Health & habit data (sensitive): habit/reduction tracking, self-reported complaints (e.g. back pain), optionally recovery values (sleep, resting heart rate, HRV) from a connected smartwatch/health source.
• Financial data (if used): budget/portfolio information you enter yourself. This is for your personal overview only and does not constitute investment advice.
• Calendar & smart home data (optional): when actively connected: appointments and control commands/status of connected devices.
• AI coach content: your chat/voice inputs to the coach and the relevant context. As soon as you use the coach, these inputs are transmitted to the AI service providers listed as active in section 6: Groq, Cloudflare Workers AI and OpenAI. They process the data in the USA; the legal basis for each transfer is stated with the service in the table. Only one stage of the chain is queried at a time, the next one only if the previous one fails. If you do not want this, do not use the coach; the remaining Ankaa features work without it.
• Error and crash data: time, error message, app version, device type and the technical path to the error. Free text, email addresses, identifiers and content from the health and finance areas are stripped before sending.
• Product events (consent only): a pseudonymous user ID and a short, fixed list of events such as "app opened" or "routine completed". No content, no health or finance data. Switchable off in the app settings at any time.
• Communication & waitlist data: email and information you provide when making enquiries or signing up to the waitlist.
• Technical data: IP address, timestamps, technical logs (e.g. for attack prevention), shortened/aggregated where possible.
• Payment data: collected by the payment service provider; we typically receive only transaction/subscription status, not full payment instrument details.

5Purposes of processing

• Providing, personalising, and synchronising the app across your devices.
• Operating the AI coach (generating responses, suggesting routines/appointments, executing actions with your confirmation).
• Health, habit, and financial overview within the modules you have chosen.
• Processing subscriptions/purchases and fulfilling legal obligations.
• Security, stability, abuse prevention, and bug fixing.
• Communication (support, service emails, optionally waitlist).
• Where carried out at all: statistical analysis exclusively on an aggregated, anonymised basis - no sale of personal data.

6Services used & recipients (processors)

To provide Ankaa we use carefully selected service providers with whom data processing agreements under Art. 28 GDPR exist or are to be concluded. The Status column separates services that actually process data in the app today from services that are technically prepared but not yet active. A prepared service only receives data once the corresponding feature is switched on and this policy has been updated accordingly.

Data is only disclosed to authorities where legally required. We do not sell personal data and do not share it with third parties for advertising purposes.

7Transfers to third countries

Where service providers process data outside the EU/EEA (e.g. in the United States), this only occurs on the basis of appropriate safeguards under Art. 44 et seq. GDPR - in particular EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework, plus supplementary protective measures. We aim to process data primarily within the EU and to minimise third-country transfers.

• Processed in the EU: Supabase (EU region), PostHog (EU host eu.i.posthog.com).
• Edge processing with an EU focus: Cloudflare (delivery and storage happen as close to your location as possible; configuration is aimed at the EU).
• Third country possible, with safeguards: Sentry (crash reports) and Stripe (payments), based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
• AI coach, USA, with safeguards: Groq LLC based on the EU Standard Contractual Clauses, Cloudflare, Inc. based on the EU-US Data Privacy Framework plus the Standard Contractual Clauses, and OpenAI through OpenAI Ireland Limited with Standard Contractual Clauses for the onward transfer to the US. The order and the full details are in the table above.
• Deliberately not used: The AI coach does not query providers from countries without an adequacy decision and without reliable safeguards. Providers processing in China have been removed from this chain.
• Not yet active: Speech output, the Gemini stage of the AI coach and the Google integrations for calendar and dictation. We will update this policy before switching any of them on.

8Retention & deletion

• App and usage data are retained for as long as your account exists and deleted within a reasonable period after account deletion (suggestion: no later than 30 days after a deletion request, minus data subject to statutory retention obligations).
• Invoice/payment data is retained within the applicable statutory retention periods (commercial/tax law, generally up to 10 years).
• Waitlist/newsletter data is processed until withdrawal or the purpose ceases to apply.
• Technical logs are deleted or anonymised promptly.

9Security of processing

We implement technical and organisational measures in accordance with Art. 32 GDPR: encrypted transmission (HTTPS/TLS), account isolation at database level (Row-Level-Security), access controls, and regular review of the services used. Despite all due care, complete security cannot be guaranteed; please protect your login credentials.

10Your rights as a data subject

Under the GDPR you have, in particular, the following rights:

• Access (Art. 15) to the data processed about you.
• Rectification (Art. 16) of inaccurate data.
• Erasure (Art. 17) - the "right to be forgotten".
• Restriction of processing (Art. 18).
• Data portability (Art. 20) in a common, machine-readable format.
• Objection (Art. 21) to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)) with effect for the future.

To exercise your rights, simply send a message to [email protected]. You can also initiate account deletion in the app settings; every step, and what exactly is removed, is described on the delete account and data page.

11Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. In Germany, the competent authority is generally that of the federal state in which the controller is based: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Str. 22, 20459 Hamburg.

12Changes to this policy

We update this privacy policy when the processing or the legal framework changes. The version published here at any given time applies. Version date: 3 September 2026.