Privacy Policy
Data Controller
Samuel Kittinger, Magdalenenstraße 15/20, 1060 Vienna, Austria
E-Mail: support@sta7us.app
The principle first
STA7US is built so that your content stays on your device. Your tasks, streaks, progress photos, net-worth and strength numbers are stored locally on your iPhone only and are never transmitted to us or to third parties. Everything we process beyond that is fully described in this policy.
1. Anonymous account
On first launch, the app automatically creates an anonymous account with our provider Supabase (hosted in Frankfurt, EU). This generates a random user identifier — no name, no e-mail address, no password. Purpose: your subscription can be tied to your account rather than just your device, and you can delete your account inside the app.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
You can delete your account at any time in the app (Settings → Delete account). This removes the Supabase account and all local data on the device.
2. Purchases and subscriptions
Purchases are processed by Apple. To manage your subscription status we use RevenueCat (USA; data transfers based on EU Standard Contractual Clauses).
Processed data: your anonymous user identifier, transaction identifiers and subscription status — no payment details; those remain with Apple.
Legal basis: Art. 6(1)(b) GDPR.
3. Usage analytics (only with your consent)
If you agree during setup, we collect anonymous usage events with PostHog (hosted in the EU): for example which task types get completed or skipped, streak milestones, and whether the purchase screen was shown. We never collect content: no photos, no values from your checkpoints, no titles of tasks you create yourself.
Legal basis: Art. 6(1)(a) GDPR (consent).
You can withdraw consent at any time in Settings ("Share usage data"); from then on no further events are collected.
4. Ad measurement
If you install the app through an ad, we receive an aggregated, anonymous campaign report via Apple's SKAdNetwork. Apple designed this mechanism so that it does not allow any conclusions about you or your device. We do not build cross-device advertising profiles.
5. Notifications
Reminders are scheduled locally on your device. There is no server push infrastructure that would require any of your data.
6. Retention
Account data exists until you delete your account. Analytics data is kept in aggregated form for product decisions. Local data on your device is under your control (Settings → Reset or Delete account).
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. Contact us at support@sta7us.app. You may also lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).
8. Changes
As the app evolves, we will update this policy. The current version is always available at sta7us.app/privacy.