Privacy Policy

Last updated: 3 September 2025

1) Who we are

Potik apps (including "Femo" and other applications) are provided by Ihor Vashchenko, Berlin, Germany ("we", "us").

Contact (data controller): hello@potik.app

Our postal address appears in the website Impressum and may be used for written requests.

No ads & sensitive data: Our apps do not show third-party ads. Any health-related data you enter (e.g., exercise logs) stays within the app's functionality, is not used for advertising, and is processed only with your explicit consent.

2) What data we collect

• Account & device identifiers: Apple ID–related identifiers provided by the OS, device model, language, OS version, country/region, app version.
• Purchase data: subscription product, price tier, currency, purchase/renewal status, refunds (via Apple and our subscription SDK). We do not store your full payment card details.
• Usage & diagnostics: screen views, feature usage, paywall views, crash logs, performance metrics.
• Health data (optional): exercise logs (e.g., sets, duration), reminders, goals, self-reported symptoms/notes. Processed only with your explicit consent.
• Support data: messages you send to support (email and in-app).

3) Purposes and legal bases

• Provide the service & subscription features (Art. 6(1)(b) GDPR — contract).
• Health features & personalized plans (Art. 9(2)(a) GDPR — explicit consent).
• Analytics, app safety & troubleshooting (Art. 6(1)(f) GDPR — legitimate interests, minimal data, opt-out controls).
• Legal compliance (Art. 6(1)(c) GDPR).

You may withdraw consent in the app settings at any time (does not affect prior processing).

4) Third-party SDKs (processors) we use

We carefully scope these providers to only what's necessary. We do not share your health entries with these providers, and we never use health data for ads or ad targeting.

A) Adapty (subscription infrastructure & paywall analytics)

Purpose: manage in-app purchases/subscriptions, validate receipts, show paywalls, measure paywall performance, server-to-server events. Data categories: device/app identifiers, country/locale, paywall impressions, product identifiers, purchase/renewal status, trial start/end, refunds. Legal basis: performance of a contract; legitimate interests for analytics limited to paywall performance. Transfers: may process outside the EEA with appropriate safeguards (e.g., SCCs). Opt-out/controls: you can use the app without analytics personalization; disable "Analytics" in Settings to limit paywall/usage analytics to strictly necessary events.

B) Firebase by Google — Analytics & Crashlytics

Purpose: understand aggregate usage (which screens/features are used), improve UX, and fix crashes. Data categories: app instance ID, device info (model, OS, language), in-app events (e.g., session start, feature usage), crash traces, coarse IP for routing. Legal basis: legitimate interests (product analytics & reliability); you can disable analytics in Settings. Transfers: may be processed outside the EEA with appropriate safeguards. Opt-out/controls: toggle Analytics off in the app (we stop sending analytics events); Crash reporting can also be disabled in Settings → Privacy.

C) Meta (Facebook) SDK — attribution & deep linking (no ads shown in-app)

Purpose: measure the effectiveness of our own marketing campaigns (e.g., did an ad lead to an install) and support secure deep linking into the app. Data categories: app events (install/open), coarse device data, and IDFA only with your consent (see ATT below). Legal basis: legitimate interests in measuring our campaigns; IDFA only if you consent under iOS AppTrackingTransparency. Transfers: may be processed outside the EEA with appropriate safeguards. Opt-out/controls: if you deny tracking in Apple's prompt, we do not access IDFA and rely on SKAdNetwork for aggregated attribution. You can also reset your advertising identifier in iOS settings.

Important: We do not send any health entries (exercise logs, symptoms, goals) to Facebook/Meta. Attribution is strictly aggregated and separate from health data.

5) Apple frameworks

• In-App Purchases: Apple processes your payment.
• AppTrackingTransparency (ATT): We request permission only if we need the IDFA for attribution. If you decline, functionality remains; we simply don't access IDFA.
• SKAdNetwork: We use SKAdNetwork for privacy-preserving, aggregated campaign performance.

6) International transfers

If data are transferred outside the EEA, we rely on recognized safeguards (e.g., Standard Contractual Clauses) and implement supplementary protections where appropriate.

7) Retention

• Subscription & purchase records: while your account is active and as required by tax/accounting law.
• Health logs: until you delete them or withdraw consent, then promptly deleted from active systems and scheduled for backup purge.
• Analytics & crash data: typically 12–24 months (or shorter if you disable analytics/crash reporting).
• Support messages: as long as needed to resolve your request and for record-keeping.

8) Your rights (EU/EEA)

You may access, rectify, erase, restrict, object, port your data, and withdraw consent at any time. You can also complain to your local authority (Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit). We respond without undue delay.

9) Children

Our apps are intended for users 16+. If you are under 16, please do not use the app.

10) Security

Encryption in transit, least-privilege access, audit logging, and vendor due diligence. No vendor receives health entries for advertising or profiling.

11) Controls inside the app

• Health data consent toggle (enable/disable health features & storage).
• Analytics toggle (limit or disable analytics events to Firebase/Adapty).
• Crash reporting toggle (disable Crashlytics).
• Reset data (clear local health entries).
• Export data (provide a machine-readable export on request via support).

12) Changes

We'll post updates here and change the "Last updated" date. Material changes may be notified in-app.

13) Contact

Email: hello@potik.app

Provider: Ihor Vashchenko, Berlin, Germany