Last updated: 28 October 2026
This policy explains what data the BATT app and its website process, why, who it is shared with and how you can exercise your rights. It is governed by the General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Owner: Hugo Nieto Martínez
- Tax ID (NIF): 54396592M
- Address: Boadilla del Monte
- Contact email: shnietomar@outlook.com
2. What data we process
- Account data: email, name and identifier from Sign in with Apple or another sign-in method.
- Health and physical activity data: steps, distance and activity that we read from Apple Health (HealthKit) only if you give permission. Later on, data from other fitness apps you choose to connect.
- Camera (future feature): to count exercises, the image is processed on your phone in real time. It is not recorded or sent to our servers. We only keep the result (for example, the number of reps).
- Screen time: we use Apple’s Screen Time API to block the apps you choose. Apple only gives us encrypted identifiers: we can’t see which apps they are or what you do in them, and that data never leaves your phone.
- BATT usage data: logged exercise, streaks, unlocked time and statistics.
- Social features: username, statistics visible to your friends and on leaderboards, and the videos you record for challenges.
- Invitations: your invite code, which users signed up with it and the rewards earned.
- Technical and analytics data: device model, system version, language, app identifiers, IP address and how you use the app’s screens.
- Advertising: Apple’s advertising identifier (IDFA), only if you accept Apple’s tracking prompt (ATT).
- Subscriptions (once available): subscription status, plan, dates and country. Payment is handled by Apple: we never see your card.
- Support: the messages and data you send us by email or through the website’s support and feedback forms.
- Website: the website doesn’t use cookies or tracking tools. When you visit it, our hosting provider processes your IP address and technical browser data to show you the pages and protect them from attacks.
3. Why we use the data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and manage your account | Account | Performance of a contract (art. 6.1.b) |
| Count your activity and unlock apps | Health and activity, camera | Explicit consent (art. 9.2.a), which you can withdraw in Settings > Health or Settings > Camera |
| Block apps with Screen Time | Screen time | Performance of a contract; you grant the permission in iOS |
| Streaks, statistics and social features | Usage, social features | Performance of a contract |
| Invite program | Invitations | Performance of a contract |
| Improve the app with analytics | Technical and analytics | Consent, which you can turn off in BATT’s settings |
| Measure ads on Meta and TikTok | IDFA, install and purchase events | Consent (Apple’s ATT prompt) |
| Manage subscriptions | Subscriptions | Performance of a contract |
| Send you news or offers (if we do) | Consent, which you can withdraw in every message | |
| Handle support and feedback | Support | Performance of a contract and legitimate interest |
| Security and fraud prevention | Technical, invitations | Legitimate interest (art. 6.1.f) |
| Serve the website and protect it | Website | Legitimate interest (art. 6.1.f) |
| Meet tax and legal obligations | Subscriptions | Legal obligation (art. 6.1.c) |
We don’t make automated decisions with legal effects on you, and we don’t build profiles from your health data.
4. Health data: specific commitments
- We only use it to make BATT work: counting activity and unlocking time.
- We don’t use it for advertising or share it with Meta, TikTok or analytics services.
- We don’t sell it or hand it over to third parties.
- You can withdraw permission at any time in Settings > Health.
5. Who we share data with
We don’t sell your data. It is only shared with the providers we need to run the service, under a data processing agreement:
| Provider | Purpose | Where it processes data |
|---|---|---|
| Supabase | Database, sign-in and video storage | European Union |
| PostHog | Product analytics | European Union |
| RevenueCat | Subscription management | United States |
| Superwall | Subscription screens | United States |
| Cloudflare | Website hosting and security | United States and other countries |
| Web3Forms | Website support and feedback forms: forwards your message to us by email | United States |
| Apple | Health, Screen Time, Sign in with Apple and App Store payments | As per Apple’s policy |
| Meta and TikTok | Ad measurement, only if you accept ATT | United States and other countries |
Also:
- Other users see your username, photo, statistics and challenge videos when you use social features.
- Authorities, if a law or a court order requires us to.
- A buyer, if BATT is sold or merged into another company, with the same safeguards.
6. Transfers outside the EU
Some providers process data in the United States. We do this with GDPR safeguards: the EU–US Data Privacy Framework when the provider is certified under it, or the European Commission’s standard contractual clauses.
7. How long we keep data
| Data | Period |
|---|---|
| Account, activity and statistics | While your account is active |
| After you delete your account | Deleted within 30 days; backups within 90 days |
| Challenge videos | Deleted when the challenge ends, and no later than 7 days after recording |
| Analytics | Up to 24 months |
| Support messages | 2 years from the last contact |
| Subscription data | The periods required by tax law |
8. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time. Write to us at shnietomar@outlook.com and we’ll reply within one month at most.
You can delete your account and all its data from Settings inside the app. If you disagree with our reply, you can file a complaint with the Spanish Data Protection Agency (AEPD).
9. Minors
BATT is only for people aged 16 and over. If we learn that someone under 16 has given us data, we will delete it.
10. Security
We use encryption in transit, access controls and providers with security certifications. No system is 100% secure; if there were a breach that affects you, we would notify you and the AEPD as required by law.
11. Changes to this policy
If we change anything important, we’ll let you know in the app or by email before it takes effect. The date at the top shows the latest version.