Privacy Policy
Last updated: 18 August 2026
This is an English translation provided for convenience. The German version at https://mk-sd.com/datenschutz.html is the authoritative text; in case of any discrepancy, the German version prevails.
1. Controller
Maximilian Kuchlbauer Flurstr. 1 84524 Neuötting Germany Email: [email protected]
2. What this app actually does (the technical basis of this policy)
This policy describes the app's actual data processing, as verified against the source code:
- No servers of our own, no tracking, no analytics SDKs, no advertising.
The app contains no network calls to our own or to third-party servers (no URLSession, and no analytics, crash-reporting or advertising SDKs such as Firebase, Mixpanel, Amplitude or Sentry were found in the code). The only match for the word "Analytics" in the code is the app's own training review screen (the "Analytics" tab), which evaluates locally stored training data on the device itself and sends nothing to anyone.
- Local storage. All training data (workouts, exercises, settings,
templates) is stored with SwiftData exclusively on the device.
- iCloud sync is disabled in the currently published builds. The code
optionally supports private CloudKit sync through the user's own iCloud account, but this is hard-set to NO in shipped builds via the SixteenCloudKitEnabled Info.plist flag. While that flag is NO, the app runs entirely locally and no transfer to iCloud takes place, regardless of the state of the "iCloud" switch visible in the app. This section must be updated as soon as iCloud sync is enabled in a published build. At that point the user's private CloudKit database (iCloud.app.sixteen.training) would be used, which only the user can access through their own Apple Account; even then the controller has no access to that data, because Apple operates the infrastructure and the controller has implemented no server-side access mechanism.
- Health data via Apple HealthKit (Apple Watch app only). The watch app
reads heart rate from HealthKit during a workout and writes finished workouts back to Health. This data stays inside Apple's HealthKit framework on the user's device; the app sends it to no server of ours.
- Purchases through Apple's in-app purchase system (StoreKit 2). Purchase
processing, payment data and subscription management run entirely through Apple. The controller receives no payment or banking data from Apple, at most aggregated sales reports through App Store Connect.
- Export, import and deletion by the user. Settings offer a manual export
of the user's own data as JSON/CSV through the system share sheet, a manual import of a previously exported JSON file, and a "Delete all data" function that irreversibly removes all workouts, templates, custom exercises and settings from the device.
- Athlete profile and training goals (optional, voluntary). On first
launch the app asks, one question at a time and each individually skippable, for name, biological sex, date of birth, height and weight, and for training goals (target division, target finish time, race date, weekly training frequency, optional target weight). These entries are stored exclusively on the device and serve two purposes: personalising the app (for example the greeting by name on the Training tab, and goal comparison on the Analytics tab) and estimating daily energy requirement using the Mifflin-St Jeor formula. That estimate is not a substitute for medical advice; see the health notice in the Terms of Use. Every field is optional and the app works fully without a profile. The user can edit the profile at any time under Settings, "Profile & Goals", or remove it entirely with "Delete profile"; "Delete all data" removes it as well.
3. Categories of data processed, and the purposes
| Category | Examples | Purpose | Storage location |
|---|---|---|---|
| Training data | Workouts, stations, times, repetitions, weights, race simulations | The app's core function: recording and reviewing training | Locally on the device (SwiftData); optionally, in future, the user's private iCloud database, see section 2 |
| Settings | Division, next race date, rest times, language choice | Personalising the app | Locally on the device |
| Athlete profile (optional) | Name, biological sex, date of birth, height, weight, target time, target date, training frequency, target weight | Personalisation (greeting, goal comparison) and estimated daily energy requirement | Locally on the device, editable and deletable in Settings |
| Health data (Art. 9 GDPR) | Heart rate during a workout; optionally date of birth, height, weight and biological sex in the athlete profile | Showing heart rate with the workout, writing finished workouts back to Apple Health, calculating the energy estimate | HealthKit on the user's Apple Watch / iPhone, or locally on the device, never on servers of the controller |
| Purchase and subscription data | Product ID, purchase state, subscription period | Unlocking Sixteen Pro | Exclusively at Apple (StoreKit); the app only reads the unlock state |
No location data, no contacts, no microphone or camera access and no advertising identifiers are collected.
4. Legal bases
- Training data and settings: Art. 6(1)(b) GDPR (performance of the usage
contract for the app) and Art. 6(1)(f) GDPR (legitimate interest in a functioning app).
- Health data (heart rate) as a special category of personal data under
Art. 9(1) GDPR: processed only after the user's explicit HealthKit permission, and used solely for display inside the app on the user's own device. The legal basis is the user's explicit consent under Art. 9(2)(a) GDPR, technically expressed through the iOS system permission prompt.
- Athlete profile (date of birth, height, weight, biological sex, goals):
voluntary entry during onboarding, with every single question skippable. The legal basis is consent under Art. 6(1)(a) GDPR, supplemented by Art. 9(2)(a) GDPR where the data is health-related (body measurements, age). Consent can be withdrawn at any time by editing or deleting the profile in Settings.
- Purchases: Art. 6(1)(b) GDPR (performance of a contract), noting that the
purchase contract itself is concluded between the user and Apple.
5. Recipients and transfers to third countries
- Apple Inc. processes purchase, payment, device and where applicable
iCloud and HealthKit data as an independent controller (not as a processor acting for the operator of this app), in the course of the user's use of the App Store, StoreKit, iCloud and HealthKit, under Apple's own privacy policy (https://www.apple.com/legal/privacy/). The controller of this app has no influence over that and receives no personal data from Apple beyond aggregated sales figures.
- The controller of this app operates no servers and transmits no data to any
further third parties, processors, analytics services or advertising services.
6. Retention
Training data and settings remain locally on the device until the user changes or deletes them through the export, import or delete functions in Settings, or until the app is uninstalled. No server-side storage by the controller takes place.
7. Rights of the data subject
Because all personal data is stored exclusively on the user's device (see section 2) and the controller has no access to it, the user exercises the following rights directly in the app:
- Access (Art. 15 GDPR) and data portability (Art. 20 GDPR): through the
export function in Settings (JSON/CSV).
- Rectification (Art. 16 GDPR): by editing the training and settings data
directly in the app.
- Erasure (Art. 17 GDPR): through "Delete all data" in Settings, or by
uninstalling the app.
- Restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR):
by revoking the HealthKit permission in the iOS system settings, or by not using individual features.
- Right to lodge a complaint (Art. 77 GDPR): with a data protection
supervisory authority, in particular the authority responsible for the user's place of residence.
For questions that go beyond what the app itself can do, the user can also write to [email protected].
For data that arises at Apple itself (purchases, and where applicable iCloud or HealthKit cloud sync), those rights are to be exercised against Apple.
8. Children
The app is not directed at children under the age of 16.
9. Data security
Because all data remains on the device, the protections of the iOS operating system apply (sandboxing, file system encryption). The controller takes no additional server-side security measures, because no servers are operated.
10. Changes to this policy
This policy will be updated when the app changes functionally, for example if iCloud sync is enabled or analytics or advertising services are added. The current version is available in the app under Settings → Legal.