Kettra

Contents

The short version
1. Controller
2. What the app actually does
3. What data is processed
4. Legal bases
5. What leaves your phone anyway
6. Recipients
7. Retention
8. Your rights
9. Children
10. Security
11. Automated decision-making
12. Changes to this policy

Privacy Policy for the Kettra app

Last updated: 6 September 2026

*The German version of this document is the authoritative one. This is a convenience translation, provided because Apple links the privacy policy from every storefront.*

The short version

Kettra stores everything you enter on your iPhone and nowhere else. There is no server of ours, no account, no sign-in, no sync, and no analytics or advertising services. We cannot see your habits or your entries, because they are never sent anywhere.

Three things do leave your phone anyway, and they are at the top of this page rather than buried in it:

Purchases. The "Kettra Pro" subscription (monthly or yearly, each with a free week) is handled entirely by Apple. On every launch the app asks Apple for the products' prices and whether a valid subscription exists. Apple therefore learns that this app is being used on this device.
Your device backup. If you have iCloud Backup or a computer backup switched on, Kettra is part of that backup like every other app. A copy of your entries then sits with Apple, or on your computer. You control this, not the app.
This web page. Tapping "Privacy policy" or "Terms of use" in the app opens your browser and requests this page, which transmits your IP address to the host.

Section 5 covers all three in detail.

1. Controller

Maximilian Kuchlbauer
Flurstr. 1
84524 Neuötting
Germany
E-mail: maximilian.kuchlbauer@gmail.com

No data protection officer has been appointed.

2. What the app actually does

This section does not describe what would be nice. It describes what was checked in the app's source code, and names the files where it is written.

No server of ours, no account, no sync. The app contains no network call to any server of ours or of a third party. The whole source tree was checked for URLSession, URLRequest, WKWebView, CloudKit, NSUbiquitousKeyValueStore and for analytics, crash-reporting and advertising libraries (among them Firebase, Crashlytics, Sentry, Amplitude, Mixpanel, PostHog, RevenueCat, Adjust, AppsFlyer). None of those appear anywhere in the code. The only frameworks imported are SwiftUI, SwiftData, StoreKit, Foundation, Observation, Combine, UIKit and os.log.
Local storage via SwiftData, in a location shared with the widget. Habits and daily entries live in a database (Sources/Core/Models.swift, Sources/Core/HabitStore.swift). The store is created with no CloudKit container (Sources/App/KetteApp.swift), but it does live in an App Group (group.de.kette.app, Sources/Shared/AppGroup.swift), because the widget extension is a separate process that needs to reach the same database to let you tick a habit off from the home screen. That does not change the processing: the location is still a sandbox on the same device, only a second, system-controlled extension of ours can read it. Nothing leaves the device because of it.
Further stored values, none of them an identifier. The app's UserDefaults (partly in the App Group above, partly the app's own) hold: whether a valid subscription has ever existed (hasEverHadAccess, Sources/Core/EntitlementStore.swift), whether onboarding has already been shown (Sources/Core/OnboardingStore.swift), the chosen appearance, light, dark or system (Sources/Core/AppearanceStore.swift), and the app version that last asked for a rating (Sources/Core/RatingPromptStore.swift). None of these values holds a name, an identifier or a receipt.
One system permission: notifications, for reminders you switch on yourself. If you set a reminder time for a habit, the app asks iOS once for permission to show local notifications (Sources/Core/Notifications.swift, UNUserNotificationCenter.requestAuthorization). Those notifications are scheduled and delivered entirely on the device; there is no push service and no server involved. Without a scheduled reminder, the app never asks. Beyond that there is no access to location, camera, photos, microphone, contacts, calendar or Apple Health, and no NS...UsageDescription key besides the notification permission is set in the project configuration (project.yml).
No advertising identifier, no tracking. The app reads neither advertisingIdentifier nor identifierForVendor, and does not ask for App Tracking Transparency. No tracking across apps or websites takes place.
An export function you trigger yourself. Under Settings, Export, the app can assemble your habits and daily entries into a CSV file and hand it to the system share sheet (Sources/Features/Settings/SettingsView.swift, Sources/Core/HabitStore.swift, KetteCore/Sources/KetteCore/CSVExport.swift). The file is created only when you tap, sits briefly in the app's temporary directory afterwards, and is handed to whatever destination you choose in the share sheet (for example Mail, Files or AirDrop). We receive nothing from this: the file goes directly from your device to the destination you picked.
A widget for the home screen and Lock Screen. The widget reads the habits and daily entries stored in the App Group and can tick a habit off directly, without opening the app (KetteWidgets/, Sources/Shared/). It is our own extension, signed by Apple, not a third party, and it sends nothing to a server. Setting up a widget makes the habit names it shows visible to anyone looking at your unlocked or locked screen; that is a visibility question on your own device, not processing by us.
System log. In several failure cases (for example: save failed, products could not be loaded, purchase failed, entitlement check inconclusive, a reminder could not be scheduled) the app writes one line to the iOS system log (os_log, Sources/Core/HabitStore.swift). Those lines contain the technical error message, but no habit names and no entries. The system log stays on the device; we have no access to it.

3. What data is processed

Category	Examples	Purpose	Where it is stored
Habits	Name, symbol, colour, schedule (daily, chosen weekdays, or n times per week), daily target, start date, order, optional reminder times	Core function: showing the habit, computing the chain and, if switched on, reminding you locally	On the device only, in the App Group (SwiftData)
Daily entries	The date as `YYYY-MM-DD` and how many times the habit was completed that day	Core function: chain, week grid and history	On the device only, in the App Group (SwiftData)
Subscription state	One boolean, "has had access at some point"	Unlocking Kettra Pro, and making sure habits already created do not disappear when a subscription lapses	On the device only (`UserDefaults`)
Settings	Appearance (light/dark/system), whether onboarding was shown, version of the last rating prompt	Showing the app the way you set it and not asking for a rating more often than makes sense	On the device only (`UserDefaults`)
Purchase and payment data	Apple Account, payment method, receipt, subscription term	Handling the subscription	With Apple only. The app reads back nothing but whether a valid subscription exists

The app collects no account data, no contact details, no location data, no health data within the meaning of Art. 9 GDPR, no contacts and no advertising identifiers. It never asks for a name, an e-mail address or a date of birth.

Whether the entries you create yourself are personal data within the meaning of Art. 4(1) GDPR depends on what you write in them. Either way we do not process them, because they never reach us.

4. Legal bases

Habits, daily entries and subscription state on the device: the processing happens entirely in your own terminal equipment and serves only the function you asked for. To the extent this constitutes processing by us at all, it rests on Art. 6(1)(b) GDPR (performance of the contract for use of the app).
Storing data on your device (§ 25 TDDDG, the German implementation of the ePrivacy Directive): storing your entries is strictly necessary in order to provide the service you explicitly requested, namely keeping and evaluating your habits. That falls under the exemption in § 25(2)(2) TDDDG and requires no consent. Nothing is stored on your device for any other purpose, in particular not for measurement or advertising.
Purchases: Art. 6(1)(b) GDPR. The contract for the subscription is concluded between you and Apple, not between you and us.
Serving this web page: Art. 6(1)(f) GDPR (legitimate interest in delivering the page reliably and securely).

5. What leaves your phone anyway

The claim "your data never leaves your phone" describes what the app does: Kettra sends your entries to nobody. It does not describe what Apple and you do with the device. These three paths are set out for completeness.

5.1 Purchases through the App Store (StoreKit)

Kettra Pro is a subscription group with two terms, both handled through Apple's in-app purchase system and each with a free week: monthly (product identifier de.kette.app.pro.monthly) and yearly (product identifier de.kette.app.pro.yearly).

What the app does (Sources/Core/EntitlementStore.swift, Sources/App/RootView.swift): on every launch it asks Apple for the description and price of both products and checks whether either is a valid subscription. When you buy, iOS presents Apple's own purchase sheet. When you tap "Restore purchases", the app asks Apple to refresh the device's purchase history.

What we learn: only whether this device holds a valid subscription for either product. Apple gives us no name, no e-mail address, no postal address, no payment details and no identifier by which a purchase could be traced to a person. App Store Connect shows us aggregated sales and subscription figures and nothing more.

What Apple processes: Apple Inc. and Apple Distribution International Ltd. process the purchase, payment and device information **as independent controllers**, not as our processor. Apple's own privacy policy applies (https://www.apple.com/legal/privacy/). We have no influence over it. Rights concerning purchase data must be exercised against Apple.

5.2 Your device backup

Kettra keeps its database in the App Group's data directory (section 2), so the app and the widget can read the same database. iOS includes that directory in the device backup, and the app does not exclude it. In practice:

With iCloud Backup switched on, a copy of your habits and entries sits inside your device backup on Apple's servers. Apple encrypts backups in transit and at rest, and end-to-end when Advanced Data Protection is enabled. Those are Apple's statements, not measurements of ours.
If you back your iPhone up to a computer instead, the copy is there.
If you make no backup, none of this leaves your device.

You control this yourself, in iOS Settings under your name → iCloud → iCloud Backup. Backup can be switched off entirely there, and iOS also lets you exclude individual apps from it.

Apple, not us, is the controller for the backup. We have no access to your backup and cannot see whether one exists or what is in it.

5.3 Requesting this web page

The "Privacy policy" and "Terms of use" links in the app open your browser. Requesting this page (mk-sd.com) and Apple's standard terms (apple.com) is an ordinary web request.

This page is served through Cloudflare, Inc. In doing so Cloudflare processes technically necessary connection data, in particular the IP address, the time of the request, the address requested and the browser identification, in order to deliver the page and to fend off attacks. Cloudflare acts as our processor under Art. 28 GDPR. A transfer to the United States may occur; it is covered by the European Commission's standard contractual clauses and Cloudflare's certification under the EU-US Data Privacy Framework.

This page sets no cookies, loads no fonts or scripts from third-party servers, and contains no analytics or advertising tools.

5.4 If you send us an e-mail

This is the one case in which we actually process personal data about you, which is why it is stated here explicitly.

If you write to maximilian.kuchlbauer@gmail.com, we process your e-mail address and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR where the matter concerns the app or your subscription, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The mailbox is operated by Google Ireland Ltd. The message is deleted once it has been dealt with and no retention obligation stands in the way.

The app itself never asks you to write, and contains no contact function.

6. Recipients

Beyond the cases in section 5, no data is passed to anyone. There are no processors for app data, no analytics, advertising or marketing providers, and no sale or exchange of data. A sale would not even be technically possible, because we hold nothing to sell.

7. Retention

Your habits and entries stay on your device until you delete them. Deleting a habit also removes all of its daily entries. Deleting the app makes iOS remove the app's entire data store from the device.

Worth knowing, because it otherwise comes as a surprise: an existing backup is not affected by any of that. As long as a backup exists, so does the copy inside it, until you delete or overwrite the backup yourself.

No retention period arises on our side, because nothing is stored there.

8. Your rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).

How they work out in practice for this app:

Access (Art. 15): we hold no data about you from the app and therefore cannot disclose anything about your habits or entries. A request will be answered with exactly that statement. Everything the app knows about you is fully visible in the app itself. If you have written to us, the right of access covers that correspondence (section 5.4). Since you cannot identify yourself to us without first giving us data for the purpose, Art. 11(2) GDPR applies.
Rectification (Art. 16): directly in the app, by editing a habit or changing a daily entry.
Erasure (Art. 17): in the app, by deleting the individual habit or by deleting the app. Both take effect immediately and completely; there is no copy on our side that would have to be deleted separately. On existing backups, see section 7.
Portability (Art. 20): under Settings, Export you create a CSV file with your habits and daily entries yourself (section 2) and choose where it goes. Beyond that we cannot hand you anything, because we do not process the data.
Objection and restriction (Art. 18, 21): since no processing takes place on our side, these rights have nothing to act on against us. You can end the processing at any time by not using the app, or by deleting it.
Withdrawing consent (Art. 7(3)): the one system permission the app asks for is notifications, for reminders you switch on yourself (section 2); that is iOS's own permission, not a data-protection consent, and you can turn it off at any time in iOS Settings under Kettra → Notifications. Beyond that the app asks for no consent because it needs none: it stores nothing for analytics or advertising purposes, and its storage of your entries falls under the exemption in § 25(2)(2) TDDDG (see section 4). You can cancel a purchase in your Apple Account settings, and switch your device backup off in iOS Settings (section 5.2).
Purchase data: to be exercised against Apple, see section 5.1.
Complaint (Art. 77): you may complain to a data protection supervisory authority, in particular the one responsible for your place of residence. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Questions: maximilian.kuchlbauer@gmail.com

9. Children

The app is not directed at children. It collects no data for which consent under Art. 8 GDPR would have to be obtained. The subscription is purchased through the Apple Account and is subject to Apple's rules on Family Sharing and Ask to Buy.

10. Security

Since all data stays on the device, the protections that apply are those of iOS: the app sandbox, file system encryption and the device passcode. We take no additional server-side measures because we run no servers. This page and the others on mk-sd.com are served over HTTPS only.

11. Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The chain the app shows you is an arithmetic rule applied to your own entries and has no legal or similarly significant effect.

12. Changes to this policy

This policy describes the state of the app on the date given above, including the reminder function, the export function, and the widget with its shared storage location (section 2). It will be changed before any further feature ships that changes it. That applies in particular to:

iCloud or CloudKit sync (which would mean entries leaving the device by design, not only inside a backup),
analytics, crash reporting or advertising services of any kind (after which "no tracking" would no longer be true),
a watch app, or any shared storage location beyond the App Group named above.

The current version is always at https://mk-sd.com/kettra/privacy

*This policy describes the data handling verified in the Kettra app's source code as of 6 September 2026. It is not legal advice and does not replace review by a qualified lawyer.*