App Privacy Policy
This policy explains how personal data is handled in Peace of Mind. The website is covered by a separate Website Privacy Policy.
1. Controller
Ömer Akyürek, Friedrich-Str. 61b, 40217 Düsseldorf, Germany. Contact: hi@oemerax.com. Further details appear in the imprint.
2. How the app works
Peace of Mind lets a person voluntarily send a daily check-in. Approved family members can see whether the check-in arrived. The app may send reminders and notifications about missed check-ins. A check-in is a statement made by its sender, not an objective health measurement. This app is not an emergency service.
3. Categories of personal data
Account and access: Depending on the available sign-in method, a user identifier, email address and information necessary for authentication may be processed. Sign in with Apple may provide a private relay email address. We do not receive your Apple password.
Setup and relationships: Setup may include the invited loved one's name or label, phone number, relationship and selected reminder time. Family access may involve the names, phone numbers and memberships of additional invited people.
Invitations and participation: Contact details and an invitation link or access code may be processed to deliver an invitation. Recipients decide whether to participate. Invitations are used only for setting up the service.
Check-ins and notifications: Using the service may involve the date and time of a check-in, associated access permissions and technical delivery or device information needed for reminders and notifications. Push notification device identifiers may change.
Optional wellbeing information: Mood, health, medication, frailty, falls or free-text information may reveal special categories of personal data. Where applicable, processing requires a separate explicit consent by the person concerned under Article 9(2)(a) GDPR, as well as a legal basis under Article 6 GDPR. Information entered by a family member does not replace consent from the person concerned.
Subscriptions: Purchase or restore functions may process subscription identifiers and status information. Apple handles payments through the App Store; we do not receive complete card details.
Operational data: IP addresses, times, error identifiers and technical requests may be processed to detect faults, protect access and prevent misuse.
4. Purposes and legal bases
Processing for accounts, configured family access and check-ins is based on Article 6(1)(b) GDPR as necessary to provide the service you use. Data relating to people who have not yet registered, and processing needed for security, may be based on Article 6(1)(f) GDPR. The legitimate interests are delivering an invitation requested by a user and protecting the service. Data subjects may object on grounds relating to their particular situation. Features requiring consent rely on Article 6(1)(a) GDPR and, for special categories of data where applicable, additionally on Article 9(2)(a) GDPR. Consent is voluntary and can be withdrawn for the future at any time.
5. Data about invited people
An invited person's name and phone number may be supplied by the person setting up Peace of Mind. The invited person must receive the required privacy information no later than the first contact, within the requirements of Article 14 GDPR. Participation is voluntary. Declining an invitation must not result in a new user account being created.
6. Recipients and service providers
Depending on the functions enabled, relevant providers or provider categories include Supabase (accounts, database and backend), Apple (App Store, Sign in with Apple and push notifications), RevenueCat (subscription management when active), an SMS provider (invitations sent by text message) and an email provider (support and possible sign-in emails). Within a family group, information is displayed only to its authorized members. Providers receive only information necessary for their purpose. Their legal role depends on the specific service supplied.
7. International transfers
Use of international providers, in particular Apple and where relevant RevenueCat or an SMS provider, may involve processing outside the European Economic Area. Where required for such transfers, an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, including EU Standard Contractual Clauses, must apply. You can request information about the specific recipients and safeguards at hi@oemerax.com.
8. Retention and account deletion
Account information, memberships and check-ins are generally stored only for as long as necessary to provide the service. Invitations that have not been accepted and access codes are removed when no longer needed. When an account is deleted, associated personal data is erased or anonymized, unless statutory retention requirements or overriding legitimate grounds require continued retention. Billing records may be subject to legal retention periods. Deleting an account does not automatically cancel an Apple subscription. Contact hi@oemerax.com for help with deletion.
9. Your rights
Subject to applicable legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. You can withdraw consent at any time for the future. You may lodge a complaint with a data protection authority, including the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
10. Automated decisions
Displaying and notifying a received or missed check-in does not constitute a solely automated decision producing legal or similarly significant effects under Article 22 GDPR.