Privacy Policy for the "LeibFit" app
Last updated: 13 July 2026
This is a courtesy translation of the German "Datenschutzerklärung". In case of any discrepancy, the German version is legally binding.
1. Data controller
Sebastian Leib
Ahornweg 26a
68623 Lampertheim
Germany
Email: sebastian.leib@me.com
We are not required to appoint a data protection officer, as the legal requirements for doing so are not met.
2. Core principle: processing happens exclusively on your device
LeibFit is designed as a "privacy-first" app. All data generated within the app – your training profile, your equipment, your workouts, training logs and the evaluations derived from them – is stored and processed exclusively locally on your iPhone.
We do not operate our own server, there is no user account, no registration, and no transfer of your training or health data to us or to any third party. We never have access to this data at any point. There is no tracking, no analysis of your usage behavior, and no advertising or reach measurement.
3. Processing by the operating system and Apple
a) Provision and purchase of the app
The app is provided via the Apple App Store. When you download, install, subscribe, or update the app, Apple Distribution International Ltd. (Ireland) or Apple Inc. processes personal data (e.g. your Apple ID, payment data, purchase history) as an independent data controller. We have no influence over this. Apple's privacy policy applies: https://www.apple.com/legal/privacy/
b) On-device storage (SwiftData)
Your entries are stored locally on the device using Apple's SwiftData technology. If you have enabled iCloud backups for your device, this local data set may be processed by Apple as part of your device backup. This is a setting of your device that you control yourself.
4. On-device AI (Apple Foundation Models)
To assemble your workouts, LeibFit uses Apple's on-device AI model (Apple Intelligence / Foundation Models framework). Processing takes place entirely locally on your device. No data is transmitted to Apple or to us for this purpose. No cloud-based AI is used.
5. Health data (Apple Health / HealthKit)
LeibFit can – only if you explicitly grant permission – access certain health and fitness data via Apple's HealthKit interface (heart rate variability (HRV/SDNN), resting heart rate, respiratory rate, wrist temperature during sleep, body temperature as a fallback value, sleep analysis, as well as – when importing other workouts from Apple Health – workout entries, heart rate, active energy, and distance covered).
Type of processing: This data is evaluated exclusively locally on your device to give you training and recovery guidance. It is not transmitted to us or to any third party and does not leave your device.
Writing back to Apple Health: If you grant permission, LeibFit writes your workouts completed in the app back to Apple Health as workout entries (duration and, where available, heart rate), so your workouts appear there in full. This process, too, takes place exclusively between the app and Apple Health on your device; no data is transmitted to us or to third parties.
Legal basis: Since this involves health data and therefore a special category of personal data, processing takes place solely on the basis of your explicit consent pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. You grant this consent via Apple's system dialog before the app accesses the respective data.
Withdrawal: You can withdraw permission at any time – in full or for individual data types – via iOS Settings → Privacy & Security → Health → LeibFit or in the Health app. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal, the corresponding features may no longer be available.
Note: The evaluations in LeibFit are for orientation purposes only and do not constitute a medical diagnosis.
6. Contacting us by email
If you contact us at sebastian.leib@me.com, we process the data you provide (email address, content of the message) to handle your request. The legal basis is Art. 6(1)(b) GDPR (for contract-related requests) or Art. 6(1)(f) GDPR (legitimate interest in responding). We delete this data as soon as it is no longer required and no statutory retention obligations apply.
7. Recipients / transfers to third countries
Beyond the processing by Apple described in Section 3, we do not disclose personal data to third parties. We do not initiate any transfer to third countries ourselves.
8. Your rights
Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).
Since we ourselves do not store or have access to any of your training and health data, you can exercise these rights regarding your locally stored data directly yourself: you can view and change your data within the app, and remove it completely by deleting the app.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the data protection commissioner of Baden-Württemberg (Landesbeauftragter für Datenschutz Baden-Württemberg).
9. Users in Austria and Switzerland
For users in Austria, the Austrian Data Protection Act (DSG) applies in addition; the competent authority is the Austrian Data Protection Authority. For users in Switzerland, the Swiss Data Protection Act (revFADP) applies in addition; the competent authority is the Federal Data Protection and Information Commissioner (FDPIC). The principles above – in particular exclusively local processing – apply unchanged.
10. Changes to this privacy policy
We update this privacy policy whenever changes to the app make this necessary. The version stored in the app or the App Store at any given time applies.
11. Apple EULA
https://www.apple.com/legal/internet-services/itunes/dev/stdeula/
Use of this website (leibfit.de)
Website addendum · Last updated: 28 August 2026
This is a courtesy translation of the German addendum. In case of any discrepancy, the German version is legally binding.
The sections above concern the iOS app LeibFit. The following applies additionally to the operation of this website, leibfit.de. The controller named in Section 1 above is responsible.
a) Reach measurement without cookies
To understand how often the site is visited, how often the App Store button is used, and through which channels visitors find us, we run a simple, data-minimizing statistic. When a page is viewed or the App Store button is clicked, we process: timestamp, page visited, the origin of the visit (referring website or campaign parameters of the visited URL), and device type, operating system, and browser, derived from the browser identifier (user agent) that is transmitted anyway.
This statistic is first-party: it runs exclusively on our own server, without cookies, without accessing information stored on your device, and without disclosure to third parties. No cross-device or cross-site profiles are created.
b) No storage of IP addresses
Your IP address is not stored. Solely to count repeat visits within the same day, a daily-rotating, non-reversible checksum (hash) is created from the IP address and browser identifier. This does not allow any inference about you as a person and cannot be linked across different days.
c) Legal basis and right to object
The legal basis is our legitimate interest in data-minimizing reach and channel measurement without cookies (Art. 6(1)(f) GDPR). Since no cookies are set and no information is stored on or read from your device for this purpose, no consent under Section 25 TTDSG (German Telecommunications-Telemedia Data Protection Act) is required. You can object to this processing at any time (Art. 21 GDPR), for example by email to the address given in Section 1.
The quickest way is to object yourself: open https://leibfit.de/?lf_no_track=1 once. From then on, this browser is recorded neither by our own statistics nor by Google Analytics. For that purpose — and only for that purpose — your browser stores a single technical cookie (lf_no_track) that holds nothing but the value "do not count"; it contains no identifier and no personal data. It serves solely to give effect to your objection (Section 25(2) TTDSG) and is never used for analysis. To undo it, open https://leibfit.de/?lf_no_track=0 or clear this site's data in your browser (counting then resumes).
d) Google Analytics (only with your consent)
In addition to our own cookie-free statistic under (a), we use – only after your explicit consent via this website's cookie banner – Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Without your consent, no script from Google is loaded and no data is sent to Google.
If you consent, your browser sets cookies from Google and transmits usage data (including pages visited, time spent, technical device data, and coarse geographic origin based on the IP address) to Google's servers, including servers in the US. Google Analytics 4 does not store IP addresses in unabbreviated form. The retention period for usage data at Google follows the retention settings configured in our Google Analytics account (a maximum of 14 months).
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TTDSG). You can withdraw your consent at any time with effect for the future – via the "Cookie Settings" link in this website's footer, or by deleting the corresponding site data in your browser. Further information on Google's processing is available in Google's privacy policy: https://policies.google.com/privacy
e) Waitlist for the Amazfit direct connection
On the page about the Amazfit direct connection you can voluntarily join a waitlist. We process: your email address, the time of your sign-up, the language version and the page it came from, plus the version of the consent text you agreed to. In addition, an irreversible checksum (hash) is derived from your IP address; it serves solely to prevent bulk sign-ups. The IP address itself is not stored.
The purpose is one single email: the notification once the feature is available in the app. There is no newsletter, no further mailings, no tracking pixel and no disclosure to third parties. The data is stored on the same server as this website.
The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time with effect for the future — an informal email to the address given under section 1 is enough and your entry will be deleted. Otherwise your address is deleted once the notification has been sent or the project is discontinued, and after twelve months at the latest.