Privacy policy

Last updated 27 October 2026 · version 2026-10-27

Unpound records what you eat, what you weigh and how much you move. That is health information about your own body, and it is treated as such: it is stored to show you back to yourself. Beyond that it is only counted into a few totals that tell us whether Unpound works, never into a profile of you.

Who is responsible

The controller of the personal data described here is:

Kai Vijzelaar, trading as Unpound
De Slufter 4
1771 JB Wieringerwerf
The Netherlands
Chamber of Commerce (KvK) number 42128648
VAT identification number NL005517249B05
privacy@unpound.com

Unpound is a sole trader, so there is no company between you and the person responsible — the controller is the individual named above, and nothing in this policy is limited by an entity that does not exist.

What is stored, and why

What	Why	Legal basis
A sign-in identifier from Apple, your email address where Apple confirms that it is verified, when the account was made, and roughly when you last used it	To recognise your account and let you back into it, and to erase it after two years unused	Performance of our contract with you
The token Sign in with Apple gives the app, encrypted with a key that is kept outside the database	Only to ask Apple to end Unpound's access to your Apple sign-in when you delete your account, as Apple requires	Performance of our contract with you
Your height, date of birth, biological sex and activity level	To work out an energy target. Without them the app can count but not advise	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Weights you record, and the dates you recorded them	To show your trend over time	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Each week, your measured maintenance as it stood then: the estimate, and the logged days and weigh-ins it rests on	To show how it changed over time without working it out again	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Foods and meals you log, the meals you plan, the meals you save, any foods you add to your library, and the days you mark as complete	To keep your diary and total your day	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
How much you drink each day, as a running total	To fill the day towards the target you set	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Your eating window, if you keep one: when it opens and how long it lasts, per weekday if you set that; and the times you usually have breakfast, lunch and dinner	To say when your window closes, and to place your meals on the day	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Steps, active energy, exercise minutes and walking distance per day, read from Apple Health with your permission. iPhone only	To count movement without you having to log it	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Weigh-ins read from Apple Health, if you switch that on: each is kept as a weight. Workouts read from Apple Health: the app uses them on your phone to tick off a session you planned, and only that tick, marked as coming from Health, is stored	So a smart scale or a workout fills in what you would otherwise type	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Training schedules you make, with their exercises; the sessions you tick off; and the sets you log, with their weight and reps	To show what you planned, what you did, and what you lifted last time	Performance of our contract with you, and your explicit consent (Article 9(2)(a) GDPR)
Whether your subscription is in trial, active, lapsed or cancelled, whether it renews, its start and end date, the product, the store and the transaction identifier the store gave it	To know whether to let you in, and to react when the store tells us something changed	Performance of our contract with you
How you want figures shown and the day set up: weight, distance and liquid units, what one tap on the liquid card adds and the daily figure it fills towards, and an energy target you set yourself	To show you your own numbers the way you asked for them	Performance of our contract with you
Which version of this policy and of the terms you agreed to, and when	To be able to show which wording you were given rather than assert that you were given one	A legal obligation — Article 7(1) GDPR puts the burden of demonstrating consent on us — and performance of our contract for the terms
A correction or completion you propose for a product in the catalogue, and a barcode you tell us belongs to one; and, for a food you add with a barcode, that it waits for review	For Unpound to review and, if accepted, publish into the shared catalogue, as described under Foods you add	Performance of our contract with you, and our legitimate interest in a catalogue that finds more of what people scan
If we ever suspend an account under the terms: the date and the reason we give you	To withdraw access for a breach of the terms, and to be able to tell you why	Performance of our contract with you, and our legitimate interest in a service that is not abused
When a warning or error occurs: technical connection and security data, such as your IP address, the time and address of the request, a request ID, the response status and technical error information	To secure the service, prevent abuse and resolve technical problems	Our legitimate interest in a secure and reliable service
If you email us: your sender address, technical message headers, and the content and any attachments of your message	To provide support, handle privacy requests and administer the related correspondence	Performance of our contract for support; a legal obligation for GDPR requests; and our legitimate interest in handling other correspondence carefully and, where necessary, establishing a legal claim
For thirty days, a record that a notification from Apple about a subscription or a sign-in was handled: its message number and when it arrived	So the same notification is never acted on twice	Our legitimate interest in a secure and reliable service
After you delete your account: a deletion marker, which is a keyed hash of the account's internal number and the time of deletion, kept in a separate database	So that restoring a backup cannot bring a deleted account back; and so that a subscription Apple keeps renewing for the deleted account goes to the new account you make with the same Apple Account	A legal obligation: an erasure under Article 17 GDPR has to stay erased; and performance of our contract for the subscription you still pay for
The dates you logged on, when your account was made, and whether you have a measured maintenance, counted each night into totals	To know whether the product works, as described under Counts, not profiles	Our legitimate interest in understanding whether Unpound works, and your explicit consent (Article 9(2)(a) GDPR)

Unpound never stores your payment details or the amount you paid. Apple tells us only which purchase belongs to your account and whether it gives you access.

Health data

Weight, body measurements, food intake, eating windows, training and movement are special category data under Article 9 of the GDPR, or treated as such here. Two things have to be true before we may hold it, and they are not the same thing. We rely on our contract with you under Article 6(1)(b) GDPR, because a food diary cannot be provided without processing what you put in it; and on your explicit consent under Article 9(2)(a) GDPR, which is what lifts Article 9's prohibition on health data. The app asks for that explicit consent on its own screen before you enter anything — and the server insists on it, refusing to store a profile, a diary entry or a weight until it is on record. Granting Apple Health access is a second, separate consent, asked for by iOS.

You can withdraw that consent at any time. You can do so in the app by deleting your account, or by writing to us at the address below. Withdrawal is as easy as giving consent and does not affect the lawfulness of earlier processing. Because Unpound cannot provide its core service without this health data, we will then close the account and erase that data.

Data read from Apple Health is never used for advertising or marketing, is never sold, and is never shared with anyone. Apple requires this, and we would do it anyway.

Counts, not profiles

Each night the server counts a few totals for the day before: how many accounts were made, and how many of those logged something within a day or logged twice on their first day; how many people logged something; how many came back after five or more days away; and, per week, how many logged on four days or more and how many have a measured maintenance. Only the totals are kept. They hold no account, name or identifier, and nobody outside Unpound sees them.

We count to know whether the product works, which is our legitimate interest under Article 6(1)(f) GDPR. Because the counts are taken from your diary, they also rest on the explicit consent you give to this policy. You may object at privacy@unpound.com.

What we do not do

No advertising, and no advertising identifiers. The app contains no advertising software of any kind.
No trackers, no third-party analytics and no behavioural profiling. There is no analytics, tracking or crash-reporting SDK in the app: nothing records which screens you opened, how long you stayed or what you tapped. The nightly totals described above are counted on our own server and hold no one's identity. The limited technical server and database logs needed for security and troubleshooting are not behavioural analytics, and this website measures nothing either.
No selling or renting of personal data, on any terms.
No automated decision-making with legal or similarly significant effects. The app does work out an energy target and a measured maintenance from your own figures, which the GDPR counts as an automated assessment of your health. It is shown only to you, as information, and decides nothing about you.

Who else sees it

The app communicates only with its own server and Apple. Scaleway processes the app data for us; DigitalOcean serves this website and answers the domain's DNS; Google Workspace processes email for us. Apple acts on its own account for sign-in and the sale of a subscription. Other people who use Unpound see nothing of yours, except a product published into the shared catalogue as described under Foods you add, and that without any link to you.

Apple — sign-in, and subscription purchases on iPhone. Apple tells us whether a subscription is valid; we tell Apple nothing about your health data. When you delete your account, we ask Apple to end Unpound's access to your Apple sign-in.
Scaleway — our hosting processor for the app, in the Amsterdam region: the app's servers, its database, technical logs and backups. This is where your diary actually lives.
DigitalOcean — this website, and the DNS that turns unpound.com into an address. The website is a set of files with no account behind it, so your diary never reaches it; what DigitalOcean handles is the connection that fetches a page — your IP address, the page asked for and the time. The files are served from its Amsterdam region, but DigitalOcean puts Cloudflare's network in front of them, so a page may be delivered from an edge location outside the European Economic Area and that connection handled there. Both are United States companies, and the safeguards described below apply.
Google Workspace — our processor for email sent to privacy@unpound.com and support@unpound.com. Google processes the sender, message headers, content and any attachments under its data processing terms. Storage of data at rest is set to Europe for data covered by Google Workspace data regions. The app does not send your diary to Google Workspace.

The app and its database are hosted in Amsterdam, and your diary and health data entered in the app remain in the European Union. The website is a separate thing from them and holds none of it. Apple processes its own account and transaction data for sign-in and any purchases under its own privacy policy. Google may also process Workspace correspondence outside the European Economic Area; the European data-at-rest setting does not mean that all processing takes place exclusively in Europe. Applicable safeguards, such as an adequacy decision or standard contractual clauses, are used for transfers outside the EEA. You may ask us at privacy@unpound.com for more information about those safeguards.

Do not send health data by email unless it is necessary for your question. If it is necessary, include this statement in your message: “I explicitly consent to Unpound processing the health data in this message to handle my request.” This is your explicit consent under Article 9(2)(a) GDPR; handling the question itself rests on the bases described above. If that confirmation is missing, we will ask for it before using the health data substantively. You may withdraw consent, although this can mean that we cannot continue handling the question.

Cookies

This website sets one cookie, and not one we chose. Cloudflare, which delivers the site on DigitalOcean's behalf, sets __cf_bm to tell a browser apart from a bot. It expires after thirty minutes, it contains no name, email address or account, and we neither read it nor get anything out of it. It is set without asking because it is strictly necessary to deliver the site you asked for, securely — and for that, Dutch law does not require your consent first.

There is nothing else. No analytics cookie, no advertising cookie, no tracking pixel, and no script, font, image or stylesheet loaded from any other domain — every page here is served from this one. The app sets no cookies at all.

Foods you add

Unpound ships with a catalogue of packaged products so that scanning a barcode usually finds something. That catalogue contains no personal data.

Foods that you create are private: only you can find them, and they are erased with your account. There is one exception. A food you create with a barcode tells us the catalogue is missing that packet, so it is queued for Unpound to review. If we accept it, a copy of its name, brand, barcode, serving and nutrition values is published into the shared catalogue, where everyone can find it. That copy carries no link to you, and it stays when you delete your account. Your own food stays private, as it was.

The same goes for a correction or completion you propose for a product in the catalogue, and for a barcode you tell us belongs to one: it waits for review, and if we accept it, it changes the shared product for everyone. A proposal still waiting when you delete your account stays in the queue without the link to you.

Name and brand are free-text fields. Do not put a name, email address or other personal data in them. If you do, the text itself may stay recognisable once it is published, even without a link to you. Tell us at privacy@unpound.com if such text needs to be removed or replaced.

How long it is kept

For as long as your account exists. Delete your account — Settings, your account at the top, then Delete account, or from the page for it if you no longer have the app — and your account, diary, weights, library, training, settings, subscription data and every session are erased from the database immediately, and we ask Apple to revoke Unpound's sign-in.

What remains after that:

products published into the shared catalogue from what you added or proposed, without any link to you, and a proposal still waiting for review, without the link to you;
the deletion marker, so that a backup cannot bring the account back and a subscription still renewing for it can find your new account. It holds no name, diary or Apple identifier, and only someone with both the account's internal number and our key can match it. It is kept for as long as a backup or a renewing subscription from before the deletion may exist;
for thirty days, the acknowledgement of a notification from Apple, which holds only the message number, without a name, account or subscription data;
the nightly totals, which never held you.

Deletion from the active database does not immediately alter an existing database backup. A backup may therefore still contain a copy of deleted data. Backups are kept outside the active service, cannot be accessed through the app and are used only to restore the service as a whole after a serious failure — not to retrieve a deleted account. If we ever restore one, every account deleted since it was made is erased again, found by its deletion marker, before the service is back in use. Automatic backups are made daily and deleted after seven days. A backup made before a change to the database is deleted after thirty days.

Technical platform logs in Scaleway Cockpit are erased after seven days. Technical database logs are kept for no more than thirty days. We do not use these logs to analyse your use or build a profile of you. Requests are logged on the app server only at Warning: ordinary successful requests do not enter the application log. The server's own events — a background job run, an erasure, a subscription that changed — are logged too, naming an account at most by its internal number.

Visits to this website are logged by DigitalOcean and Cloudflare to run and protect it, on their own retention periods. Those logs record a connection, not a person: there is no account behind this website to attach one to. We do not use them to analyse you, and nothing in them is joined to your Unpound account.

Email sent to support or privacy, including attachments, is deleted twelve months after our last substantive response. We delete health data sooner once it is no longer needed for the question. The period is extended only for as long as an ongoing complaint, legal claim or statutory retention duty makes that necessary.

An account that nobody has signed into for two years is erased on its own in the same way. Health data should not sit in a database belonging to somebody who has moved on, and an account with no end is what that would be. The two years run from the last time you were here rather than from when you signed up, so using the app keeps it indefinitely. An account with a subscription that is still renewing is not erased this way: someone who still pays has not left.

Your rights

Two of these you can exercise yourself, without asking and without waiting. In Settings, under your account at the top, Export my data hands you one file with your whole account in it, and Delete account erases it. Both are free and neither needs a reason.

Under the GDPR you may also ask us to:

give you a copy of your data, in a portable form;
correct anything that is wrong;
erase your data, which the app does for you at any time;
restrict or object to how we process it;
withdraw a consent you gave, without affecting what came before.

Write to privacy@unpound.com. We will respond without undue delay and within one month. The GDPR lets us extend that period by two months only for a complex request or many simultaneous requests, in which case we will tell you within the first month. If you are not satisfied with the answer you may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.

Children

Unpound is for people aged 16 and over, and the app will not accept a younger date of birth. Sixteen because holding health data rests on your consent, and below that age the law in several countries — including the Netherlands and Germany — asks for a parent's agreement instead, which Unpound has no way to obtain. We do not knowingly keep data about anyone younger; if you believe a child has an account, write to us and it will be removed.

Security

Traffic is encrypted in transit. The sign-in token that keeps you signed in is held in your device's secure storage — the iPhone's keychain — rather than in ordinary app storage, tied to that device and left out of backups. Only a one-way hash of it is stored on our side, so a copy of our database would yield nothing anyone could sign in with. Access to the database is restricted to the application and, for maintenance, to the controller named above.

No system is perfect. Where notification is required, we will report a personal-data breach to the competent supervisory authority, where feasible, within 72 hours after becoming aware of it. If it is likely to result in a high risk to you, we will tell you without undue delay.

Changes

The app records which version of this privacy information was shown to you. If the policy changes materially, we will tell you before the change takes effect. For a new purpose or a materially different use that requires consent, we will separately ask for your explicit consent again. The version at the top is the one in force. Smaller corrections are published here with a new date and no new version.