Squatoll Privacy Policy

Effective date: July 28, 2026

Squatoll ("Squatoll", "we", "us") is an iOS app that lets you earn screen time for selected apps by doing squats. This policy explains what information the app handles, what little of it ever leaves your iPhone, and the choices you have. It also covers our website, squatoll.com. The short version: Squatoll has no user accounts, your fitness and screen-time data stays on your device, your camera video never leaves your iPhone, and the only data the app sends us is anonymous usage analytics and crash reports. Our website counts visits without cookies and without storing anything on your device, which is why you see no cookie banner — see section 4.

1. Data that stays on your device

The following is stored only on your iPhone (in the app's private storage) and is never transmitted to us or anyone else:

• Camera video and body-pose data. Squat counting runs entirely on-device using Apple's on-device vision frameworks. Video is processed frame-by-frame in memory to detect your squat movement. It is never recorded, saved, or uploaded — by us or by Apple on our behalf.
• Your screen-time choices. The apps you choose to block are represented by opaque tokens provided by Apple's Screen Time (Family Controls) framework. By Apple's design, Squatoll cannot read which apps these are — we only receive anonymous tokens, and they never leave your device.
• Your activity history. Squat sessions, minutes earned and spent, your wallet balance, streaks, and awards.
• Your first name, if you optionally enter one in Settings. It is used only to personalize greetings and notifications on your device and is never sent anywhere.

Deleting the app deletes all of this data.

2. Data we receive

From the app, we receive the following, all tied to a random app-generated identifier — not to your name, email, phone number, or Apple ID. (The website waitlist is separate and is covered in section 4.)

Usage analytics (PostHog)

To understand which features work and improve the app, we collect anonymous product events — for example: onboarding steps completed, a squat session finished (with rep count), a screen viewed, a pass started or paused, a subscription screen shown. Events include basic technical context: device model, iOS version, app version, and language. Analytics events never include your name, your camera data, or the identity of the apps you block.

Feedback you send

If you use "Send feedback" in Settings, the text you write is transmitted to us together with the anonymous identifier and app version. Please don't include personal information in feedback unless you want us to have it (for example, an email address if you'd like a reply).

Crash and error reports (Sentry)

If the app crashes or encounters an error, a technical report is sent to Sentry, our error-monitoring provider. It contains stack traces, device model, iOS version, and app state at the time of the crash — no fitness data, no camera data, no blocked-app identity.

3. Payments

Subscriptions are purchased through Apple. Apple processes the payment; we never see your payment details, billing address, or Apple ID. We receive only an anonymous confirmation of subscription status from Apple's StoreKit on your device.

4. The website (squatoll.com)

This section is about squatoll.com, not the app.

Website analytics (PostHog)

We count visits to squatoll.com so we can see how many people find the site and how many of them go on to the App Store. This runs on PostHog — the same provider, and the same EU-hosted project, we use for the app.

We run it without cookies. PostHog stores nothing on your device: no cookies, no local storage. Visits are counted using a hash that PostHog computes on its own servers from your IP address and browser user agent together with a random value that is thrown away every day. The hash cannot be reversed, and once that day's random value is gone the visit cannot be tied back to you. That is also why this site shows no cookie banner — there are no cookies to consent to.

• What we collect. Which page was viewed and when, the site that referred you, your browser and device type, and a click event when you press a "Get the app" button. Your IP address is used only to compute the hash described above and is then discarded — it is never stored alongside the event.
• What we don't collect. No name, no email address, no account, no advertising or cross-site tracking, no session recording, and no profile that follows you from one visit to the next.
• Legal basis. Our legitimate interest (Art. 6(1)(f) GDPR) in understanding whether the site does its job. The interest is a narrow one because the measurement is anonymous and stores nothing on your device.
• Where it is stored. PostHog's EU cloud.

Alongside this we use Vercel Web Analytics, run by the company that also hosts squatoll.com. It works the same way — no cookies, no storage on your device, visitors distinguished by a hash of the incoming request that is discarded after 24 hours — and it exists to tell us roughly which countries our visitors come from, which the PostHog setup above deliberately cannot. It records the page, the referring site, browser, device type, and an approximate location derived from your IP address; the IP address itself is not stored. Legal basis is the same legitimate interest. Vercel is a US company, so unlike our PostHog data this may be processed outside the EEA.

The launch waitlist

If you enter your email address into the waitlist form on our website, we store that address so we can tell you when Squatoll reaches the App Store.

• What we collect. Your email address, and nothing else. We don't ask for your name and we don't record which pages you looked at before signing up.
• What we use it for. One welcome email confirming you're on the list, and one email on the day the app launches. That is the entire purpose — no newsletter, no other mailings.
• Legal basis. Your consent (Art. 6(1)(a) GDPR), given when you submit the form. The form tells you the purpose before you submit it.
• Withdrawing consent. Every email we send includes a one-click unsubscribe link, and using it removes you from the list immediately. You can also write to hello@squatoll.com and we will delete your address.
• Who processes it. Resend, our email provider (see section 7). Your address is stored on Resend's infrastructure in the United States.
• How long we keep it. Until you unsubscribe, or until six months after the launch email goes out, whichever comes first. The list is then deleted.

The waitlist is not an account, and it is not connected to any app data. If you later install Squatoll, we have no way to link your email address to anything you do in the app.

5. What we don't do

• We do not sell your data, ever.
• We do not use your data for third-party advertising and we do not track you across other companies' apps or websites.
• We have no user accounts and no server-side profile of you.
• We do not knowingly collect data from children. Squatoll is intended for users aged 13 and over.

6. Legal bases (EU/EEA/UK users)

Where the GDPR applies, we process personal data on these bases:

• Legitimate interests (Art. 6(1)(f) GDPR): anonymous usage analytics and crash reporting, to maintain, secure, and improve the App. We chose the least intrusive setup we could: no accounts, a random identifier, EU-hosted processing, and no advertising or cross-app tracking.
• Performance of a contract (Art. 6(1)(b) GDPR): providing the App and your subscription.
• Consent (Art. 6(1)(a) GDPR): feedback you choose to send us, and your email address if you join the launch waitlist on our website. You provide both voluntarily, and you can withdraw consent or request deletion at any time — for the waitlist, the unsubscribe link in every email does this immediately.

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

7. Service providers and international transfers

We use four processors, each bound by their own data-processing agreement:

Apple (App Store, StoreKit, Screen Time framework) processes purchases and enforces app blocking as part of iOS itself, under Apple's own privacy policy.

Where your data is stored. Our PostHog project is hosted on PostHog's EU cloud, and our Sentry project is hosted in Sentry's EU (Germany) data region — so analytics and crash data, from both the app and the website, are stored within the EU.

Two things sit outside the EU. Our Resend region is US East (North Virginia), so if you joined the waitlist, your email address is stored in the United States. Vercel, our host, is a US company, so the anonymous website statistics described in section 4 may also be processed there.

Where a provider's parent company is located outside the EEA, or where data is stored outside the EEA as with Resend, transfers are safeguarded by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as reflected in each provider's data-processing agreement.

8. Retention

Analytics and crash data are retained by our providers for a limited period (no longer than 24 months) and then deleted or aggregated. Data on your device stays until you delete the app.

Waitlist email addresses are kept until you unsubscribe, or until six months after the launch email is sent, whichever comes first.

9. Your rights

Your rights depend on where you live; rights granted by one region's law do not extend to residents of other regions.

If you live in the EU/EEA or UK (GDPR): you have the right to access your personal data, rectify it, erase it, restrict or object to its processing, withdraw consent (for consent-based processing, without affecting prior processing), and receive a copy in a portable format (data portability). You also have the right to lodge a complaint with your local data-protection authority.

If you live in California or another US state with a privacy law (CCPA/CPRA and similar): you have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, so no opt-out is needed.

Everywhere: because the data we hold is keyed to an anonymous identifier, the most effective controls are in your hands — deleting the app removes all on-device data and stops all collection. For anything else, including deletion of analytics or feedback data, contact us and we will honor your request within 30 days.

10. Security

Data on your device is protected by iOS's sandboxing and encryption. Data in transit to our providers is encrypted with TLS.

11. Changes to this policy

If we change this policy, we will update this page and the effective date. If a change meaningfully expands what we collect, we will inform you in the app before it takes effect.

12. Controller and contact

The data controller responsible for the processing described in this policy is:

Rashem Pandit Vorbergstr. 10A 10823 Berlin, Germany hello@squatoll.com

This policy is provided in several languages for convenience; in case of discrepancies, the English version prevails.