A private space
for your days.

1. Who is responsible

This policy covers the WellDiary iPhone app, its account and backup services, and this app-specific website. It does not describe our other apps. Provider details are in our legal notice.

2. Your journal

You may record wellbeing ratings and times, tags, notes, saved links and photos. Preferences include your language, diary time zone, display settings and optional feature choices. Ratings, symptom tags and notes can reveal health or other sensitive information.

The free diary is stored in the app’s private storage using iOS file protection. Journal and photo files are excluded from the app’s system backup. Free has no WellDiary export, import or server backup, so losing the device or deleting the app may lose local records. Premium backup is described below and does not include photos or imported Health readings.

We do not use journal content for advertising profiles or usage analytics. Opening a saved link contacts its destination, which handles the resulting requests under its own policy.

3. Apple Health

Connecting Health is optional and read-only. You select supported metrics and grant access through iOS. Readings, times and source information are used on your iPhone to display selected measurements alongside your diary. WellDiary does not write or delete Apple Health samples.

Imported Health readings are not uploaded to our backup server or sent to Analytics or advertisers. Disconnect Health in WellDiary Settings and manage permissions in Apple Health or iPhone Settings. Disconnecting clears WellDiary’s displayed Health state; it does not delete the original samples.

Health-related information is sensitive. Where GDPR applies, processing special-category information requires a condition under Article 9, including explicit consent where required. System access permissions and this notice do not replace any separately required explicit consent. Your manually entered ratings, symptom tags and notes are diary content; if you choose Premium backup, those records are included even though imported Health readings are not.

4. Photos

The system picker lets you choose attachments. WellDiary creates a local image copy with EXIF and GPS metadata stripped. A photo-library identifier, sanitized-image fingerprint and available capture date may be kept locally to manage attachments and duplicate album copies. Photos and these attachment records are outside server diary backup.

The optional Well Diary album requests Photos access to create or select an album and save independent copies. Removing a diary attachment does not delete the Photos original or album copy. If iCloud Photos is enabled, Apple may synchronize your photo library separately under your Apple settings.

5. Device authentication

Optional app locking uses iOS Face ID, Touch ID or the device passcode. WellDiary receives only the authentication result, not biometric templates or your passcode. The lock preference stays on the device. The app locks after entering the background, and a privacy cover hides diary content when inactive.

6. Location and routes

Recording is off by default. If you enable it and grant iOS permission, WellDiary records latitude, longitude, timestamps, accuracy and available speed, including in the background where permitted. A route may also contain stop-duration information. When recording is active, the last known point can be carried forward as the next day’s assumed starting location; this is not a new GPS measurement.

Routes stay on the iPhone unless you sign in with active Premium and separately enable Settings → Location & Routes → Save Routes to Server. The confirmation explains that existing and future coordinates, times and speed will be transferred. Turning this option off stops further transfers; it does not automatically erase existing server copies. Account deletion and server retention are described below.

Precise routes are not supplied to Analytics or advertisers. Apple Maps may receive the map-area and technical requests needed to display maps; Apple handles those requests under its privacy policy. Recording and backup choices are separate; buying Premium does not start GPS recording.

7. Account and Premium backup

Sign in with Apple is optional. We receive the provider’s account identifier, email address (which may be an Apple relay address) and an available display name. We store an internal account ID, session credentials and service preferences. Sessions are revocable and expire after 30 days. Changing your contact email requires verification.

Premium automatically backs up diary ratings, tags, notes, saved links, their dates/times and selected settings for the signed-in account. Routes need the separate choice above. Photos and Apple Health measurements remain local. Server access is restricted to your account; transmissions use HTTPS, and diary payloads, route payloads and certain account fields are encrypted by the server application. This is not end-to-end encryption: the service can decrypt records to provide synchronization and recovery.

Apple processes subscription payments. We receive transaction/product identifiers, subscription status, expiry and verification information to grant access and prevent purchases being assigned to the wrong account. We do not receive your payment-card or bank details. Manage or cancel a subscription through Apple; deleting a WellDiary account does not cancel it.

8. Optional usage analytics

With your permission, we use Google Analytics for Firebase to understand first launches, active use, sessions, engagement and visits to general screens such as the calendar, a day, Settings and Premium. The SDK also measures supported purchase/subscription events. Google receives an app installation identifier and standard app/device metadata such as app version, operating system, device model, language, event times and approximate geography derived from the network address. These statistics are not completely anonymous.

Collection is off until you choose Allow Analytics. Choosing Not Now does not restrict the diary or require payment. Change your choice at any time in Settings → Privacy → Usage Analytics. Turning it off stops future collection and resets local Analytics data and the installation identifier; it does not automatically delete information already received by Google.

We pass no account ID, email, diary dates or contents, ratings, tag names, notes, URLs, Health readings, photos or route coordinates to Analytics. Analytics advertising personalization is denied; the app’s Analytics library has no IDFA collection capability, and Analytics IDFV collection is disabled. We do not use these Analytics events to target personalized advertisements.

Our current Analytics retention settings are 2 months for event data and 14 months for user data. The user-data period resets with new activity. Google applies deletion on its retention schedule; standard aggregated reports are not limited by these settings. Details: Analytics retention and Analytics app data disclosures.

9. Advertising

The free version integrates Google AdMob and Google’s User Messaging Platform (UMP). Development and test builds may show Google test banners; test inventory still contacts Google. Premium suppresses banners. Advertising personalization and Google’s publisher first-party identifier are disabled in the current configuration; the app does not request IDFA access or use diary contents to target ads.

Ad/consent requests can involve an IP address and derived approximate location, app- or device-bounded identifiers, consent choices, ad impressions/interactions, app interactions, crash information and performance/other diagnostic data. Google uses the applicable information to deliver and measure ads, prevent fraud, provide consent choices and maintain SDK reliability. Non-personalized advertising still involves data processing.

UMP presents the choices required for your region before ad requests are permitted. Refusing consent does not block the local diary. Revisit available choices in Settings → Advertising → Advertising Privacy Choices; the entry appears when Google requires privacy options. If advertising cannot be requested under the resulting status, no banner request is made. Analytics consent is independent of these choices.

Ad-related retention varies by the data and purpose, including ad delivery, security and legal obligations, under Google’s advertising privacy information and retention policy. Google may process data independently for its described purposes. See Google Mobile Ads SDK data disclosures.

10. Messages and notifications

Public in-app announcements can be fetched without an account. Read/deleted-message state is stored locally. Optional push notifications require iOS permission and your app choice. We send the APNs device token, delivery environment and enabled status to our server and use Apple Push Notification service to deliver announcements. A push token is stored encrypted and can exist without a signed-in account.

Optional email announcements use your verified account email and a separate opt-in. You can disable them in notification settings or use the unsubscribe link. Account-security, verification and subscription-retention messages are service messages, separate from optional announcements. We do not put diary contents, Health readings or routes in these messages.

Disable push in WellDiary notification settings to update the server preference, and use iPhone Settings to revoke system permission. Disabled device registrations and delivery records may remain for service operation and troubleshooting; contact us to request erasure where applicable.

11. Support and this website

If you use support or email us, we receive your email, message and any screenshots you submit. The form accepts up to three PNG/JPEG/WebP images, up to 4 MiB each. Attachments are sent by email using temporary upload files rather than saved in the public website or diary database. Please hide private and health details unless necessary for your request.

The support form uses an essential session/CSRF cookie, validation and an IP-based submission limit. The static landing and this privacy page contain no analytics, advertising scripts or third-party fonts and do not set application cookies. Web/API delivery still involves technical requests and server logs, including network address, request time, URL, status and client information, for operation and security. Support correspondence is used to answer your request and handle follow-up, not for ad targeting.

The company’s separate website has its own website privacy and cookie policy; this WellDiary policy does not enable Analytics on the landing.

12. Recipients and international transfers

TimSoft Solutions operates the diary backend, landing and support service on STRATO hosting in Germany; STRATO also supplies our email infrastructure. Authorized service providers may process information to host, maintain and secure the service. We disclose information to authorities only where legally required.

Apple provides sign-in, App Store subscriptions, push delivery, Health/Photos permissions and Maps. Google provides Analytics, AdMob and UMP through Google Ireland Limited and/or Google LLC and their service providers, depending on the service and your location. Apple and Google may process information outside the EEA, including in the United States, under their applicable service terms and privacy notices.

Where required, international transfers rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Google describes its certified US entities’ Data Privacy Framework participation and contractual safeguards in its transfer information. See also Firebase privacy, Google privacy and Apple privacy. Contact us for information about applicable safeguards.

13. Retention and deletion

• Local records: kept until you delete them or the app’s local data. Offloading can keep data; uninstalling normally removes app storage. Apple Health originals, Photos originals and album copies must be managed separately.
• Server diary and routes: retained while the service is active. After confirmed Premium expiry, server access stops and the diary/route copy is scheduled for deletion after 90 days. Renewal before deletion cancels that scheduled purge. Local records remain available.
• Account deletion: use Delete Account under Your Diary/Premium in Settings. This deletes the account and active server diary/route copy, revokes sessions and signs you out while retaining your local diary. It does not cancel the Apple subscription. Signing out or disabling route backup alone does not delete existing server data.
• Recovery copies: encrypted server backups are rotated after 30 days. Minimal deletion records containing account identifiers/generations are kept to prevent deleted data reappearing after recovery and for as long as recoverable copies or deletion-enforcement needs remain. Deleted content is not restored to active service.
• Analytics and advertising: see the respective sections above. Revoking consent stops future relevant collection; deletion of previously received data is a separate request.
• Other service records: account, subscription, consent/preference, delivery, security and support records are retained only as needed for the relevant service, enquiry, fraud prevention, legal obligations or claims. Some may have to remain after a deletion request where the law permits or requires it.

We cannot remotely restore or erase a local diary never sent to us. Contact us about server-held information or a deletion request that cannot be completed in the app.

14. Your choices and rights

You can use the local diary without an account, Health, location recording, push notifications or Analytics. Where GDPR applies, providing requested account, subscription, backup and support services may rely on Article 6(1)(b); optional analytics, optional promotional messages and consent-dependent advertising on Article 6(1)(a); necessary operation, security and fraud prevention on Article 6(1)(f); and legal retention on Article 6(1)(c). We seek consent for optional device storage/access where applicable law requires it. Health-related data additionally needs an applicable Article 9 condition; choosing one feature does not consent to unrelated uses.

You may have rights to access, correction, erasure, restriction, portability and objection, subject to legal conditions. Withdrawal of consent applies to future processing and does not affect earlier lawful processing. The absence of a product export button does not remove statutory rights. For a request, contact info@timsoftsolutions.de; we may need proportionate information to verify it.

We do not sell diary contents or provide Health readings or routes for cross-context advertising. Where US state privacy laws apply, you may request applicable access, correction or deletion and exercise advertising opt-outs through the available privacy choices or by contacting us, without discrimination for exercising your rights.

You may complain to a data-protection authority, especially where you live, work or believe a breach occurred. Our local authority is the Lower Saxony Commissioner for Data Protection. We do not use your journal to make automated decisions with legal or similarly significant effects.

15. Changes

We update this policy when WellDiary’s processing changes. Material new uses will be explained and, where required, new consent requested before they begin. The date above identifies this version. Older app versions may not offer every feature described here.