Privacy Policy

1.Who is responsible

If you are in the EU or EEA, this is the “controller” within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).

2.What the app handles, and where it lives

Debloater is a diary. You may enter:

• meals, ingredients, portion sizes and preparation methods
• symptoms, their severity and time of onset
• stool records (Bristol scale, colour, pain, urgency)
• daily context such as illness, alcohol, NSAID use or menstruation
• an optional PIN, and optionally your device biometric unlock

Some of this is health data, a special category of personal data under Article 9 GDPR. It is treated accordingly: it never leaves your device.

All of it is stored in a local SQLite database inside the application’s private sandbox directory, protected by the operating system so that other apps cannot read it.

No data is transmitted to us or to anyone else. There is no account, no sign-up, no login, no cloud sync and no backup to our systems, because no such systems exist.

3.What the app does not do

• No analytics. No usage statistics, no event tracking, no session recording.
• No advertising. No ad SDKs. The Android manifest is built with the advertising ID permission (com.google.android.gms.permission.AD_ID) removed.
• No third-party crash reporting. No Sentry, Firebase, Crashlytics or similar.
• No third-party SDKs that transmit data.
• No profiling and no automated decision-making producing legal or similarly significant effects (Art. 22 GDPR). The statistical output is shown only to you, on your device.
• No sale or sharing of personal information, as those terms are used in the California Consumer Privacy Act (CCPA/CPRA).

These are not merely assurances. They are verified in the source code by an automated test suite that fails the build if a network call, telemetry dependency or remote URL is introduced, and by a check against the final compiled Android package confirming that the INTERNET, ACCESS_NETWORK_STATE and ACCESS_WIFI_STATE permissions are absent.

4.When data does leave your device — only because you chose it

Debloater can generate a PDF summary of your diary to show a clinician.

That PDF is created on your device; nothing is uploaded to produce it. What happens next is entirely your choice: if you share it, you do so through your operating system’s own share sheet, to a recipient you pick. We are not involved in, and have no visibility of, that transfer.

Once you hand a PDF to another app, service or person, this policy no longer governs it — theirs does.

5.Legal basis for processing

Because we do not receive, store or otherwise process your personal data, there is no processing by us that requires a legal basis under Article 6 or Article 9 GDPR.

Processing that happens locally on your device is carried out by you, for your own purely personal purposes.

6.How long data is kept

For as long as you keep it. There is no retention period set by us, because the data is not held by us.

The app includes a function that erases the diary from your device. Uninstalling the app also removes its private storage, in the manner your operating system defines.

7.Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection (Articles 15–21), and the right to lodge a complaint with a supervisory authority (Article 77).

In practice these are exercised directly in the app, because we hold nothing to disclose or delete:

• Access and portability — your data is on your device; the PDF export produces a human-readable copy.
• Rectification — edit or delete any entry.
• Erasure — use the in-app reset, or uninstall the app.

If you believe we hold data about you, contact us at the address in section 1 and we will respond within one month, as Article 12(3) requires.

8.Purchases

Debloater is a one-time purchase. The transaction is handled entirely by Apple’s App Store or Google Play. We never see your payment details. Those companies process the transaction under their own privacy policies: Apple, Google.

We may receive aggregated, non-identifying sales reports from those stores. These contain no information about who you are or what you entered into the app.

9.Children

Debloater is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children — indeed, we do not knowingly collect data from anyone, as described above.

10.Not a medical device

Debloater is not medical advice and is not a medical device. It is a self-tracking tool: you record what you eat and how you feel, and the app offers theories about which foods you may not tolerate well.

It does not diagnose anything. Where a pattern looks worth investigating, it points you towards a doctor and towards the established laboratory tests a clinician can order — it does not perform or interpret those tests for you. And if you record a symptom that warrants medical attention, the app stops suggesting self-directed changes and tells you to seek care.

This is stated here because it bears on how you should read what the app shows you — not merely as a legal formality.

11.Changes to this policy

If this policy changes, the “last updated” date above changes with it, and the revised version is published at this address. Because the app performs no network requests, it cannot notify you in-app; please check here if you want to be certain.

Any change that would introduce data collection would require a new app version, an updated store data-safety declaration, and — where the law requires it — your consent.

12.Contact

Questions about this policy, or about privacy in Debloater:
julien@rotorsolutions.de