Privacy Policy
This policy covers the Penhold app (sections 2–5) and this website with its waitlist (sections 6–12).
1. Controller
Benedict Meeske
Prenzlauer Allee 127, 10409 Berlin, Germany
Email: ttbene99@gmail.com
The app
2. Data in the app
The app does not collect any personal data about you as a person; for the purely technical update check, see section 3; for verifying purchases, section 4. Everything you create in the app — generated training sessions, your training plan, your favourites and your ticked-off drills — is stored solely on your device. There is no user account and no sign-in. We never have access to this data; it is transmitted neither to us nor to any third party. Deleting the app deletes it.
The app contains no analytics, tracking or advertising services and sets no cookies.
3. App program updates
On launch, the app checks whether a newer program version is available. This request goes to Expo (Expo, Inc., USA), our service provider for delivering app updates.
Only technical information is transmitted: app and runtime version, platform, and a randomly generated installation identifier that identifies neither you nor your device. As with any request on the internet, your IP address is technically transmitted in the process. No content from the app is transmitted.
The legal basis is our legitimate interest in keeping the app up to date and free of errors (Art. 6(1)(f) GDPR). The data is transferred to servers in the USA; Expo is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). We do not store this data ourselves; Expo retains it only as long as necessary to deliver updates.
4. Purchases and subscriptions
If you buy Penhold Pro or start a free trial, payment is handled exclusively by Apple or Google. We do not receive your payment details.
To determine whether your purchase is valid, we use RevenueCat (RevenueCat, Inc., USA) as a processor. The data transmitted is a randomly generated identifier that contains neither your name nor your email address, your Penhold purchases (product, dates, term, store), country and currency, and — as with any request on the internet — your IP address.
The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR). The transfer to the USA is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). So that the app also works without an internet connection, it stores locally on your device when your purchase was last confirmed.
5. Crash reports
The app itself contains no crash-reporting or analytics software. If you have allowed your device to share diagnostic data (iOS: ‘Share With App Developers’, Android: ‘Usage & diagnostics’ with Google), Apple or Google provides us with automatically generated crash reports — containing technical information such as device model, operating system version and the point in the program at which the app crashed (Art. 6(1)(f) GDPR). If you take part in a test version via Apple TestFlight or a Google Play test, we additionally receive the feedback you actively submit there.
Apple and Google are each an independent controller for collecting these reports; their respective privacy policies apply. Whether you allow this sharing is entirely up to you, in your device settings.
This website
6. What data we collect
When you join the waitlist, we process your email address and the time of your consent (the checkbox in the signup form). Because sign-up uses the double opt-in procedure, our sending provider Brevo additionally stores the IP address and the time of your sign-up and of your confirmation — as proof of your consent (Art. 6(1)(f) GDPR — legitimate interest in being able to prove consent, Art. 7(1) GDPR). We do not collect any further data (no name, club, etc.).
7. Purpose and legal basis
The sole purpose is to notify you about the app launch and to send you occasional project updates. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time via the unsubscribe link in every email.
8. Recipients / processors
We use Brevo (Sendinblue GmbH / Sendinblue SAS, EU) to send emails. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Your email address is stored there for list management and sending. We do not use open or click tracking within the emails.
9. Storage period
We store your email address until you unsubscribe or the project is discontinued. After withdrawal it is deleted promptly. We additionally keep the proof of your consent and a suppression entry (Brevo keeps unsubscribed addresses on a blocklist so they are not emailed again) until the statutory limitation period expires (generally 3 years, § 195 BGB).
General
10. Your rights
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17)
- Restriction of processing (Art. 18) and data portability (Art. 20)
- Objection to processing based on legitimate interest (Art. 21)
- Withdrawal of consent with effect for the future (Art. 7(3))
- Complaint to a supervisory authority (Art. 77)
11. Hosting of this website
The site is hosted on Vercel (Vercel Inc., USA). Technically necessary server logs (e.g. IP address, timestamp and the page requested) may be generated; no cookie-based analytics are used.
The legal basis is our legitimate interest in a functioning and secure website (Art. 6(1)(f) GDPR). Processing also takes place on servers in the USA; Vercel Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). These server logs are only available to us briefly; we do not store them separately ourselves.
12. Audience measurement
To see how often these pages are opened, we use Vercel Web Analytics — the counting feature of our host (Vercel Inc., USA). It records the time and the page requested, the referring page, an approximate location (country, region, city) as well as operating system, browser and device type.
The service sets no cookies and stores nothing on your device. In order to tell repeat visits from new ones, Vercel derives an identifier from your request on the server side; your IP address is not stored in the process, and the identifier is discarded after 24 hours. Recognising you across sites, or building a profile about you as a person, is therefore not possible.
The legal basis is our legitimate interest in designing this website to meet actual demand (Art. 6(1)(f) GDPR). For processing in the USA, what is said in section 11 applies. You may object to this processing at any time (Art. 21 GDPR).
13. Fonts and scripts
All fonts, images and JavaScript libraries on this site are served from the same server as the site itself — including the counting script named in section 12. Nothing is loaded from third-party networks — in particular not from Google Fonts, cdnjs or jsDelivr. Your IP address is therefore not passed on to any additional provider. The site sets no cookies and consequently needs no consent banner.
Last updated: 22 September 2026.
This is a courtesy translation. The German version is the legally binding one.