Sixteen
Contents
Privacy Policy
Last updated: 6 September 2026
*This is an English translation provided for convenience. The German version at https://mk-sd.com/sixteen/privacy is the authoritative text; in case of any discrepancy, the German version prevails.*
1. Controller
Maximilian Kuchlbauer
Flurstr. 1
84524 Neuötting
Germany
Email: maximilian.kuchlbauer@gmail.com
2. What this app actually does (the technical basis of this policy)
This policy describes the app's actual data processing, as verified against the source code:
- No servers of our own, no tracking, no analytics SDKs, no advertising. The app contains no network calls to our own or to third-party servers (no
URLSession, and no analytics, crash-reporting or advertising SDKs such as Firebase, Mixpanel, Amplitude or Sentry were found in the code). The only match for the word "Analytics" in the code is the app's own training review screen (the "Analytics" tab), which evaluates locally stored training data on the device itself and sends nothing to anyone. - Local storage. All training data (workouts, exercises, settings, templates) is stored with SwiftData exclusively on the device.
- iCloud sync is disabled in the currently published builds. The code optionally supports private CloudKit sync through the user's own iCloud account, but this is hard-set to NO in shipped builds via the
SixteenCloudKitEnabledInfo.plist flag. While that flag isNO, the app runs entirely locally and no transfer to iCloud takes place, regardless of the state of the "iCloud" switch visible in the app. This section must be updated as soon as iCloud sync is enabled in a published build. At that point the user's private CloudKit database (iCloud.app.sixteen.training) would be used, which only the user can access through their own Apple Account; even then the controller has no access to that data, because Apple operates the infrastructure and the controller has implemented no server-side access mechanism. - Health data via Apple HealthKit (Apple Watch app only). The watch app reads heart rate from HealthKit during a workout and writes finished workouts back to Health. This data stays inside Apple's HealthKit framework on the user's device; the app sends it to no server of ours.
- Purchases through Apple's in-app purchase system (StoreKit 2). Purchase processing, payment data and subscription management run entirely through Apple. The controller receives no payment or banking data from Apple, at most aggregated sales reports through App Store Connect.
- Export, import and deletion by the user. Settings offer a manual export of the user's own data as JSON/CSV through the system share sheet, a manual import of a previously exported JSON file, and a "Delete all data" function that irreversibly removes all workouts, templates, custom exercises and settings from the device.
- Athlete profile and training goals (optional, voluntary). On first launch the app asks, one question at a time and each individually skippable, for name, biological sex, date of birth, height and weight, and for training goals (target division, target finish time, race date, weekly training frequency, optional target weight). These entries are stored exclusively on the device and serve two purposes: personalising the app (for example the greeting by name on the Training tab, and goal comparison on the Analytics tab) and estimating daily energy requirement using the Mifflin-St Jeor formula. That estimate is not a substitute for medical advice; see the health notice in the Terms of Use. Every field is optional and the app works fully without a profile. The user can edit the profile at any time under Settings, "Profile & Goals", or remove it entirely with "Delete profile"; "Delete all data" removes it as well.
3. Categories of data processed, and the purposes
| Category | Examples | Purpose | Storage location |
|---|---|---|---|
| Training data | Workouts, stations, times, repetitions, weights, race simulations | The app's core function: recording and reviewing training | Locally on the device (SwiftData); optionally, in future, the user's private iCloud database, see section 2 |
| Settings | Division, next race date, rest times, language choice | Personalising the app | Locally on the device |
| Athlete profile (optional) | Name, biological sex, date of birth, height, weight, target time, target date, training frequency, target weight | Personalisation (greeting, goal comparison) and estimated daily energy requirement | Locally on the device, editable and deletable in Settings |
| Health data (Art. 9 GDPR) | Heart rate during a workout; optionally date of birth, height, weight and biological sex in the athlete profile | Showing heart rate with the workout, writing finished workouts back to Apple Health, calculating the energy estimate | HealthKit on the user's Apple Watch / iPhone, or locally on the device, never on servers of the controller |
| Purchase and subscription data | Product ID, purchase state, subscription period | Unlocking Sixteen Pro | Exclusively at Apple (StoreKit); the app only reads the unlock state |
No location data, no contacts, no microphone or camera access and no advertising identifiers are collected.
4. Legal bases
- Training data and settings: Art. 6(1)(b) GDPR (performance of the usage contract for the app) and Art. 6(1)(f) GDPR (legitimate interest in a functioning app).
- Health data (heart rate) as a special category of personal data under Art. 9(1) GDPR: processed only after the user's explicit HealthKit permission, and used solely for display inside the app on the user's own device. The legal basis is the user's explicit consent under Art. 9(2)(a) GDPR, technically expressed through the iOS system permission prompt.
- Athlete profile (date of birth, height, weight, biological sex, goals): voluntary entry during onboarding, with every single question skippable. The legal basis is consent under Art. 6(1)(a) GDPR, supplemented by Art. 9(2)(a) GDPR where the data is health-related (body measurements, age). Consent can be withdrawn at any time by editing or deleting the profile in Settings.
- Purchases: Art. 6(1)(b) GDPR (performance of a contract), noting that the purchase contract itself is concluded between the user and Apple.
5. Recipients and transfers to third countries
- Apple Inc. processes purchase, payment, device and where applicable iCloud and HealthKit data as an independent controller (not as a processor acting for the operator of this app), in the course of the user's use of the App Store, StoreKit, iCloud and HealthKit, under Apple's own privacy policy (https://www.apple.com/legal/privacy/). The controller of this app has no influence over that and receives no personal data from Apple beyond aggregated sales figures.
- The controller of this app operates no servers and transmits no data to any further third parties, processors, analytics services or advertising services.
6. Retention
Training data and settings remain locally on the device until the user changes or deletes them through the export, import or delete functions in Settings, or until the app is uninstalled. No server-side storage by the controller takes place.
7. Rights of the data subject
Because all personal data is stored exclusively on the user's device (see section 2) and the controller has no access to it, the user exercises the following rights directly in the app:
- Access (Art. 15 GDPR) and data portability (Art. 20 GDPR): through the export function in Settings (JSON/CSV).
- Rectification (Art. 16 GDPR): by editing the training and settings data directly in the app.
- Erasure (Art. 17 GDPR): through "Delete all data" in Settings, or by uninstalling the app.
- Restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR): by revoking the HealthKit permission in the iOS system settings, or by not using individual features.
- Right to lodge a complaint (Art. 77 GDPR): with a data protection supervisory authority, in particular the authority responsible for the user's place of residence.
For questions that go beyond what the app itself can do, the user can also write to maximilian.kuchlbauer@gmail.com.
For data that arises at Apple itself (purchases, and where applicable iCloud or HealthKit cloud sync), those rights are to be exercised against Apple.
8. Children
The app is not directed at children under the age of 16.
9. Data security
Because all data remains on the device, the protections of the iOS operating system apply (sandboxing, file system encryption). The controller takes no additional server-side security measures, because no servers are operated.
10. Changes to this policy
This policy will be updated when the app changes functionally, for example if iCloud sync is enabled or analytics or advertising services are added. The current version is available in the app under Settings → Legal.