Privacy

Last updated: 2026-09-25

This privacy policy applies to the processing of personal data by Joyride GmbH in the context of the app and the online offering at https://www.weightbuddy.com (together, the "Services").

"Personal data" is defined in Art. 4 No. 1 GDPR as any information relating to an identified or identifiable natural person.

Below, in accordance with Art. 13 and 14 GDPR, we inform you about which personal data we process when you use our Services, on what legal basis, with whom we share data, and which rights you have. As the processing may differ between the web and the app, the respective processing activities are presented in separate sections.

Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Joyride GmbH Bartenbacher Str. 4, 73033 Göppingen, Deutschland Email: privacy@weightbuddy.com

Data Protection Officer

For any data-protection-related inquiries you may reach our data protection officer at:

Florian Klytta DS Compliance GmbH, Carlsplatz 24, 40213 Düsseldorf Email: f.klytta@wecomply.de

Supervisory authority

The data-protection supervisory authority competent for Joyride GmbH is Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg, reachable at https://www.baden-wuerttemberg.datenschutz.de/ and by email at poststelle@lfdi.bwl.de.

You have the right under Art. 77 GDPR to lodge a complaint with this or another supervisory authority if you believe that the processing of your personal data violates the GDPR.

Processing via our online offering (Web)

The following processing activities relate to the use of our online offering. Each describes the purpose, the legal basis, and the categories of personal data. Recipients and retention are set out in the "Recipients (Web)" section and in the "Retention period" section.

Website contact

Purpose: Handling enquiries received via the website contact form or email.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: IP address, Email address, Access date & duration, Name, Contact message content (website)

Recipients (Web)

In the context of our online offering we share your personal data only with carefully selected recipients, and only where this is necessary for the stated purposes or you have consented. Where we engage external service providers to process data on our behalf, we have entered into data processing agreements with them pursuant to Art. 28 GDPR.

International data transfers (Web)

Where we transfer personal data in the context of our online offering to countries outside the scope of the GDPR ("third countries"), we do so in accordance with Art. 44 et seq. GDPR. In the absence of an adequacy decision of the EU Commission, we secure the level of data protection by appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses (SCCs).

Processing in our app

The following processing activities relate to the use of our app. Each describes the purpose, the legal basis, and the categories of personal data. Recipients and retention are set out in the "Recipients (App)" section and in the "Retention period" section.

AI calorie/nutrition estimation from meal photo

Purpose: Determine calories and nutritional values from a user-uploaded meal photo, for the food diary.
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: Meal photo

Apple Send Consumption Information API

Purpose: Send consumption information about an in-app purchase to the App Store after receiving a consumption request notification (e.g. refund decisioning).
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: In-app purchases (products acquired)

Authentication data storage

Purpose: Sign-in to the app
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: Account ID (Apple / Google SSO)

Campaign measurement (Google Analytics)

Purpose: Measuring advertising performance
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: IP address, Device data (model, OS, device ID), User interactions (registration date, first message, first match, purchases), Advertising IDs, In-app purchases (products acquired)

Campaign measurement (Singular)

Purpose: Measuring advertising performance and install attribution.
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: IP address, Device data (model, OS, device ID), User interactions (registration date, first message, first match, purchases), Advertising IDs, Gender, Age / age range

Campaign measurement (TikTok)

Purpose: Measuring advertising performance (Web2App conversion tracking via TikTok Pixel / Events API)
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: IP address, Device data (model, OS, device ID), User interactions (registration date, first message, first match, purchases), Advertising IDs

Chatbot

Purpose: Advising users on their questions
Legal basis: Art. 6(1)(a) GDPR — consent
Special categories of personal data (Art. 9 GDPR): Body weight
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Date of birth, Height, Message content (chat / support), Gender, Body weight

Consent management (Usercentrics CMP)

Purpose: Collect, store and document end-user consent decisions as proof of consent, via the Usercentrics Consent Management Platform.
Legal basis: Art. 6(1)(c) GDPR — legal obligation
Categories of personal data: IP address, Consent decisions / preferences, Consent ID (unique identifier), Consent metadata (timestamp, policy version, language)

Crash reports

Purpose: Product improvement through crash analysis
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: Crash report data (Sentry)

Data storage for reporting, monitoring and debugging

Purpose: Internal analysis and performance measurement
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Session, profile and interaction data (aggregated for reporting)

Food & activity diary

Purpose: Data required for the core function
Legal basis: Art. 6(1)(b) GDPR — contract
Special categories of personal data (Art. 9 GDPR): Body weight, Food diary (meals), Activity log, Steps
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Body weight, Food diary (meals), Activity log, Steps

Health platform sync (Apple Health / Google Health Connect)

Purpose: Import body weight, steps and workouts from the device's health platform at the user's active request.
Legal basis: Art. 6(1)(a) GDPR — consent
Special categories of personal data (Art. 9 GDPR): Body weight, Activity log, Steps
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Body weight, Activity log, Steps

In-app analytics

Purpose: Measuring in-app user interactions (e.g. registration funnel step, button/tab clicks) for product analysis
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: User interactions (registration date, first message, first match, purchases)

In-app purchases

Purpose: Unlocking extended paid features
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: IP address, Device data (model, OS, device ID), Advertising IDs, In-app purchases (products acquired)

Profile data storage

Purpose: Data required for the core function
Legal basis: Art. 6(1)(b) GDPR — contract
Special categories of personal data (Art. 9 GDPR): Diet (vegetarian, vegan, kosher, …), Body weight, Daily activity level, Fitness goals (weight, steps, activity, calories, fasting), Weight-loss blockers, Weight-loss motivation, Health condition, Eating disorders, Food intolerances & allergies, Eating behaviour
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Date of birth, Height, Diet (vegetarian, vegan, kosher, …), First name, Gender, Body weight, Daily activity level, Fitness goals (weight, steps, activity, calories, fasting), Weight-loss blockers, Weight-loss motivation, Health condition, Eating disorders, Food intolerances & allergies, Eating behaviour

Push notifications

Purpose: Send transactional/functional notifications. Per-channel opt-out in the app.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Device data (model, OS, device ID), Push token / device registration

Recommendation personalization

Purpose: Personalising recommendations
Legal basis: Art. 6(1)(b) GDPR — contract
Special categories of personal data (Art. 9 GDPR): Diet (vegetarian, vegan, kosher, …), Daily activity level, Fitness goals (weight, steps, activity, calories, fasting)
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Diet (vegetarian, vegan, kosher, …), Daily activity level, Fitness goals (weight, steps, activity, calories, fasting)

Session & version data

Purpose: Secure session and login management, and storing your operating system, platform and app version so the app runs reliably and stays compatible across updates and devices.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: IP address, Device data (model, OS, device ID)

Recipients (App)

In the context of our app we share your personal data only with carefully selected recipients, and only where this is necessary for the stated purposes or you have consented. Where we engage external service providers to process data on our behalf, we have entered into data processing agreements with them pursuant to Art. 28 GDPR.

We share data with the following recipients or categories of recipients:

Adapty (United States)
Apple (United States)
Firebase (Ireland)
Google Ads (Ireland)
Google Analytics (Ireland)
Google Cloud BigQuery (Ireland)
Google Cloud Gemini (Ireland)
Singular (United States)
TikTok (Ireland)
Usercentrics (Germany)
Zurkuhl (Germany)

International data transfers (App)

Where we transfer personal data in the context of our app to countries outside the scope of the GDPR ("third countries"), we do so in accordance with Art. 44 et seq. GDPR. In the absence of an adequacy decision of the EU Commission, we secure the level of data protection by appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses (SCCs).

The following safeguards apply:

EU–US Data Privacy Framework
Standard Contractual Clauses (SCC)

App permissions

To use certain functions of our app, it is necessary to grant the app specific device permissions. If you do not grant a permission, you cannot use the corresponding function.

Health data (Apple Health): reading and writing health and fitness data (workouts, steps, body metrics) to track your daily activity and progress.
Camera: taking food photos for calorie estimation.
Photo library: selecting existing images to analyze meals.
Microphone: voice entry of meal, weight, and activity logs.
Notifications: sending functional notices (e.g. reminders).
Tracking (App Tracking Transparency): solely to measure which campaign you found the app through.

Legal basis: for function-necessary processing, Art. 6(1)(b) GDPR (contract); for the subsequent access to and storage of information on your end device, § 25(2) No. 2 TDDDG. Health data are special categories of personal data under Art. 9 GDPR and are processed solely on the basis of your explicit consent (Art. 9(2)(a) GDPR). The tracking permission is based on your consent (Art. 6(1)(a) GDPR).

You can grant and revoke the permissions at any time in your device settings.

Processing on our campaign landing pages (Web2App)

The following processing activities relate to the use of our campaign landing pages (the Web2App funnel through which we advertise app installs). Each describes the purpose, the legal basis, and the categories of personal data. Recipients and retention are set out in the "Recipients (campaign landing pages)" section below and in the "Retention period" section.

Authentication data storage

Purpose: Sign-in to the app
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: Account ID (Apple / Google SSO)

Campaign attribution (traffic source)

Purpose: Determine and store the first-touch traffic source of a funnel visit for campaign attribution and marketing controlling.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Campaign / traffic-source attribution data

Campaign measurement (Google Ads)

Purpose: Measuring advertising performance (Web2App conversion tracking and Enhanced Conversions via Google Ads).
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: Email address, User interactions (registration date, first message, first match, purchases), Advertising IDs

Campaign measurement (Singular)

Campaign measurement (TikTok)

Consent management (Usercentrics CMP)

Crash reports

Purpose: Product improvement through crash analysis
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: Crash report data (Sentry)

Profile data storage

Web payment (Paddle)

Purpose: Process payments for paid features/subscriptions purchased in the web (Web2App) funnel.
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: In-app purchases (products acquired)

Recipients (campaign landing pages)

In the context of our campaign landing pages we share your personal data only with carefully selected recipients, and only where this is necessary for the stated purposes or you have consented. We share data with the following recipients or categories of recipients:

Adapty (United States)
Google Ads (Ireland)
Google Cloud BigQuery (Ireland)
Paddle (United Kingdom)
Singular (United States)
TikTok (Ireland)
Usercentrics (Germany)
Zurkuhl (Germany)

International data transfers (campaign landing pages)

Where we transfer personal data in the context of our campaign landing pages to countries outside the scope of the GDPR ("third countries"), we do so in accordance with Art. 44 et seq. GDPR. In the absence of an adequacy decision of the EU Commission, we secure the level of data protection by appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses (SCCs). Where third-country transfers occur, the following safeguards apply:

adequacy decision (Art. 45)
EU–US Data Privacy Framework
Standard Contractual Clauses (SCC)

Retention period

We retain your personal data only for as long as necessary to fulfil the respective processing purpose. Thereafter the data is deleted, unless we still need it to comply with statutory retention obligations (in particular under commercial and tax law) or to establish, exercise or defend legal claims. The specific retention period is determined by these criteria and by the legal basis of the respective processing; data we process on the basis of your consent is deleted once you withdraw it, unless another legal basis applies.

Your rights

You have the following rights regarding the personal data we process about you:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR), in particular against processing for direct-marketing purposes
Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
Complaint to a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us at privacy@weightbuddy.com or our data protection officer at f.klytta@wecomply.de.

Obligation to provide data

Where we ask you to provide personal data, this is either required by law or contract, or necessary for entering into a contract. Without such data, the corresponding functions of our Services are generally not available.

Profiling and automated decision-making

We do not engage in automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or significantly affects you in a similar way.

Profiling within the meaning of Art. 4 No. 4 GDPR is used for the purposes flagged in the processing sections above, in particular to display relevant content and advertising. You have the right to object to such processing at any time pursuant to Art. 21 GDPR.

Changes to this privacy policy

We reserve the right to amend this privacy policy where this is necessary due to changes in the law, case law, or our Services. The most recent version is always available at https://www.weightbuddy.com/privacy.

Contact

For any questions relating to data protection and the processing of your personal data, please contact us at privacy@weightbuddy.com. General inquiries should be directed to help@weightbuddy.com.