1 Controller
Jörg Kornbrodt
Hans-Holbein-Str. 2
50999 Cologne, Germany
Email: jkornbrodt@gmail.com
A data protection officer has not been appointed, as the thresholds of Art. 37 GDPR / § 38 BDSG are not met.
2 Core principle & data processed
TheHold is a “local-first” app. Your breathing sessions and settings are stored primarily on your device. If you keep iCloud sync enabled, your sessions are additionally synced with your private iCloud so they stay up to date across your devices and can be restored after reinstalling the app (see section 5). We operate no servers of our own, no central user database and no user accounts; we do not transfer this data to us and have no access to your iCloud data.
The app processes the following categories of data:
- Practice data: your breathing sessions (e.g. breath-hold times, chosen technique, duration, number of rounds, timestamps) as well as app settings and goals.
- Health data (only with your permission): values exchanged via Apple Health – on Apple Watch the heart rate measured during a session, and the mindful minutes written to Apple Health (see section 3).
- Trial & purchase status: a local timestamp of your first app launch (stored in the device Keychain) to manage the free trial week, and the information provided by Apple about a valid purchase entitlement (see section 4).
Health data is a special category of personal data (Art. 9 GDPR) and is processed only with your explicit consent. It is never shared with third parties for advertising.
3 Apple Health (HealthKit)
If you explicitly allow it, the app exchanges data with Apple Health. You control each category in your iOS/watchOS settings and can revoke permission at any time.
Read from Apple Health (if allowed):
- Heart rate – on Apple Watch during an active breathing session, solely to display it live on the watch.
Written to Apple Health (if allowed):
- Mindful minutes for completed breathing sessions.
Purpose: live display of your heart rate during practice, and recording your mindful time in Apple Health.
Storage: locally on your device and in Apple Health. These values are not transmitted to us.
Legal basis: explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR); revocable at any time in your iOS/watchOS settings.
Technical note on live heart rate: To obtain a continuous heart rate on Apple Watch, the app starts a short “Mind & Body” activity for the duration of the session. This activity is automatically discarded at the end and is not saved as a workout in Apple Health or the Fitness app.
4 Purchases (Apple)
You can try TheHold free for one week; after that, full use requires a purchase. Purchases are handled exclusively through Apple’s App Store / StoreKit system. Apple is independently responsible for this. We receive no payment data, only the information that a valid entitlement exists. Apple’s privacy policy applies in addition.
To manage the free trial week, only a local timestamp of your first launch is stored on your device (see section 2). It never leaves your device.
5 iCloud sync (Apple)
If you are signed in to iCloud on your device and iCloud sync is enabled in the app, your stored breathing sessions are synced through Apple iCloud within your private iCloud database. This keeps your data up to date across devices and lets you restore it after reinstalling the app. You can disable syncing in the app’s settings at any time.
Purpose: cross-device synchronization and backup of your sessions.
Storage: your private iCloud database at Apple. We have no access to this content.
Legal basis: Art. 6(1)(a)/(b) GDPR. Control: can be disabled in the app at any time; additionally in iOS settings under “Apple ID › iCloud”.
Apple is responsible for the iCloud infrastructure; Apple’s privacy policy applies in addition. Processing may also take place in the USA (see section 6).
6 International transfers (USA)
Apple (including App Store / StoreKit purchases and iCloud sync) processes data, among other places, in the USA. Apple processes purchases and iCloud data as an independent controller; the Apple Developer Program License Agreement and Apple’s privacy policy govern this. Where applicable, transfers rely on appropriate safeguards, in particular the Standard Contractual Clauses (Art. 46 GDPR) or – where certified – the EU-US Data Privacy Framework.
Switzerland: For users in Switzerland, the revised Federal Act on Data Protection (revFADP) also applies. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).
7 Data security
We take appropriate technical and organisational measures to protect your data. Because the app uses no servers of its own and most data never leaves your device, the attack surface is deliberately minimal. The only regular data transfer – if you enable it – is to Apple (iCloud, App Store) over their secured, encrypted infrastructure.
8 No ads, no tracking
TheHold contains no advertising and no tracking. No third-party analytics, advertising or tracking SDKs are embedded. No personal data is sold or shared for advertising or profiling purposes.
9 Retention
- Local data remains stored until you remove it in the app or delete the app.
- Data synced to iCloud remains there until you delete it in the app (deletions propagate to your devices and iCloud) or disable iCloud sync (section 5).
- The local trial-week timestamp stays on your device and is removed when you delete the app.
- Values written to Apple Health are managed in the Health app; you can view and delete them there at any time.
10 Your rights
You have the rights to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time (Art. 7(3) GDPR), e.g. via iOS/watchOS permissions or by deleting the app. As we process data solely locally or in your private iCloud and cannot attribute it to you, you can view and delete it yourself at any time in the app / on your device.
Contact: jkornbrodt@gmail.com. You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany. You may also contact any other supervisory authority; in Switzerland, the FDPIC.
11 Children
TheHold is not directed at children under 16. We do not knowingly process children’s data without parental consent. If we become aware of such data, we delete it without undue delay.
12 Health, safety & no medical advice
TheHold is an app for breathing exercises and relaxation. The content, analyses and suggestions shown are for general guidance only and do not constitute medical, therapeutic or diagnostic advice. They do not replace advice from doctors or other qualified professionals.
Important safety notice: Intense breathing techniques (e.g. Power Breathing) and breath holding can cause dizziness, tingling or, in rare cases, fainting.
Never practise in or near water, while driving, or while operating machinery – only in a safe seated or lying position.
If you are pregnant or have cardiovascular disease, high blood pressure, epilepsy or other pre-existing conditions, please seek medical advice before use. Stop immediately if you feel unwell.
13 Additional notices for U.S. users
The following additional notices apply to users resident in the United States. Our core principle is unchanged: data stays local on your device or in your private iCloud, we run no ads or tracking, and we do not sell data.
13.1 Breach notification (FTC Health Breach Notification Rule)
With your permission, TheHold may process health data (e.g. heart rate, mindful minutes). Should unauthorized access to, or unauthorized disclosure of, unsecured identifiable health data occur, we will notify affected users and – where legally required – the U.S. Federal Trade Commission (FTC) in accordance with the FTC Health Breach Notification Rule.
13.2 California (CCPA/CPRA)
We do not sell personal information and do not share it for targeted advertising (“sale”/“sharing” under the CCPA). This was also true in the past twelve months. Health data is treated as “sensitive personal information” and used solely to provide the app. As a California consumer you have the right to know, delete and correct. To exercise: jkornbrodt@gmail.com.
13.3 Washington & similar laws (My Health My Data Act)
For users in Washington and states with comparable rules, we treat health data as protected “consumer health data”. We process it only with your consent, do not sell it, and do not share it without separate consent. You may withdraw consent at any time and request deletion.
14 Changes to this policy
We may update this privacy policy when the app, the underlying services or the legal framework change. The version published here and linked in the app always applies. The “Last updated” date above indicates when the current version was last changed.