Privacy Policy. In plain English.

1. Controller (Art. 13(1)(a) GDPR)

Dr. Jan Philip Wahle
Siedlungsweg 24, 37124 Rosdorf, Germany
Email: [email protected]

A Data Protection Officer is not required under Art. 37 GDPR and Section 38 BDSG. Questions are routed to the contact email above.

2. Overview of data processing

Processing of personal data is limited to what is needed to run the website, provide the app, and respond to you when you write in. We do not sell your data. Pseudonymous analytics profiles can link a website offer, app activity and purchase when you allow analytics. For each activity below we name the purpose, the legal basis, and how long data is kept.

3. The OfficeSquats Mac app

Camera and squat counting

When a break starts, the app opens the camera you selected and runs Apple's on-device pose estimation over the live frames. Each frame is reduced to a set of body points — roughly, where your head, shoulders, hips, knees and ankles are — and the app watches how far those points drop to decide that a squat happened. The frame is then released. Nothing is written to disk, nothing is queued, and nothing is transmitted. There is no server-side component: we could not look at your camera if we wanted to, because no endpoint exists that receives images.

macOS asks for camera permission the first time a break runs. You can withdraw it at any time in System Settings → Privacy & Security → Camera; the app then simply cannot count, and breaks fall back to a manual finish.

Recorded clips

If you press the record button — or switch on "record every break" yourself — the app writes two .mov files of that session into a folder you choose using the standard macOS folder picker: the session clip, rep counter and skeleton overlay included, and the plain camera footage without any overlays. The files are yours. They are not uploaded, indexed, or reported on; the only thing analytics ever learns is the boolean fact that a break was recorded, never the files, their names, or their contents. Delete them like any other file.

Calendar

Calendar access is optional. If you grant it, the app reads the calendars you tick through Apple's EventKit framework, on your Mac, to decide whether a break should be skipped because you are in a meeting. Event titles, participants, notes, and locations are never transmitted, never logged, and never included in analytics events. Withdraw access at any time in System Settings → Privacy & Security → Calendars.

Spontaneous meeting detection

When "Wait for meetings" is on, OfficeSquats also checks, at the moment a scheduled break is due, whether a meeting app such as Zoom, Microsoft Teams, Webex, FaceTime, Skype or GoTo Meeting is running, and whether any app is currently using a microphone or camera. These checks read the names of running apps and the on/off state of your audio and video devices. They do not record audio or video, they run only on your Mac, and nothing about them is saved or sent anywhere.

Screen Recording permission (browser window titles)

What the permission is for. A video call in a browser tab (Google Meet, Zoom, Microsoft Teams, Webex, GoTo Meeting, Jitsi Meet, Whereby) shows no meeting app, and while you are muted with the camera off it shows no device activity either. To still recognise it, OfficeSquats can read the titles of open browser windows. macOS only hands window titles to apps that hold the Screen Recording permission, which is the only reason the app asks for it. OfficeSquats never captures, displays, records or saves any image of your screen, and it has no feature that does.

Optional and off by default. The title check exists only if you switch on “Detect meetings in browser tabs” (under “Wait for meetings” in the app's settings) and then allow Screen Recording in System Settings. That switch is the only place in the app that asks for the permission; while it is off, the app neither requests nor reads anything that needs it. Without the permission, meeting detection continues with your calendars, running meeting apps and device activity.

What is read. Only the title text of windows that belong to a web browser (Safari, Chrome, Edge, Firefox, Brave, Arc, Opera, Vivaldi, Chromium), and only while a scheduled break is due (at most once every 15 seconds while a break is waiting). No screen images, no page contents, no URLs, no keystrokes and no titles from other apps are read.

Purpose. Each title is compared, in memory, with a short list of meeting product names to decide whether a break should wait. That is the only use. Legal basis: Art. 6(1)(b) GDPR, providing the meeting-aware break feature you switched on.

Storage, retention and sharing. Window titles are never written to disk, never logged, never included in analytics events and never transmitted to us or to any third party — not to PostHog, AppsFlyer, RevenueCat or Apple. They are discarded as soon as the comparison finishes, within the same second. The only thing the app keeps, and only for as long as the break is waiting, is the detected product name (for example “Google Meet”), which is shown in the menu bar so you know why the break waits.

Withdrawing. Turn off “Detect meetings in browser tabs” or “Wait for meetings” in the app, or revoke the permission at any time in System Settings → Privacy & Security → Screen Recording. The app keeps working without it.

Awareness of what is running

So that a break does not steal the keyboard from a coding agent mid-task, the app asks macOS for a list of running processes and their CPU time, and matches executable names against a list you can edit. This happens entirely on your Mac. No process list, window title, file name, or document content is transmitted or stored anywhere by us.

What the app stores on your Mac

Your schedule, work hours, rep target, camera choice, streak and rep history, and your analytics preference live in the app's own preferences on your Mac. We have no copy. Deleting the app may leave preferences behind; you can remove its container and preferences separately. The app remembers your recording folder so future recordings save there. Locally recorded clips remain in that folder until you delete them.

Optional usage and attribution analytics

If you choose “Allow analytics”, the app sends usage and pricing events to PostHog EU Cloud and uses AppsFlyer to measure which website or campaign led to an install and purchase. This processing uses consent (Art. 6(1)(a) GDPR). Change “Usage & attribution analytics” in the app settings to stop future optional collection. Declining does not prevent you from trying the app, buying it or restoring it.

Events include completed, skipped and snoozed breaks; rep counts and targets; onboarding and paywall steps; pricing variant and storefront; purchase attempts, outcomes and restores; and campaign attribution. Technical information includes random app/device identifiers, app and operating-system versions, language, timestamps, and network information such as IP address and approximate location. We do not send your name, email address, Apple Account, camera frames, pose data, calendar contents or quiz answers. The data is pseudonymous, not anonymous: a random identifier can join multiple events and purchases into a profile.

When a website price assignment reaches the app automatically, its random ID joins consented website and app events. AppsFlyer attribution may include the campaign, source, clicks, install and purchase events. Our app does not request the advertising identifier. Turning analytics off stops new app events and removes the identifiers used to send future purchases to AppsFlyer; it does not automatically erase events already received by a provider.

Provider information: PostHog privacy, AppsFlyer services privacy. Request deletion through the contact address below.

Local pricing

OfficeSquats tests three prices for the same lifetime unlock. The website requests Cloudflare’s country detection endpoint on this domain and uses only the country code to show local pricing. The response, IP address and detected country are not saved by the pricing feature. We do not request precise device location. Your current location may differ from your Apple Account storefront; Apple determines the final in-app currency and price. When a verified AppsFlyer OneLink is enabled, a random price assignment can reach the app automatically. Otherwise the website shows the lowest local price with “From”, and the app selects its price automatically. No country selection or offer code is needed. A saved assignment and, when automatic handoff is enabled, a price-configuration request to PostHog keep pricing consistent (Art. 6(1)(f) GDPR, our interest in providing consistent pricing). These configuration requests include a random ID and network information; optional behavior events require your analytics choice.

Purchases and financial reporting

All new purchases are one-time in-app purchases through Apple's App Store. RevenueCat receives transaction information and a random app user ID to verify the purchase, restore access and process refunds or revocations. Information includes product and transaction identifiers, purchase date, storefront, currency, amount and entitlement status. We do not receive your card details or Apple Account credentials.

RevenueCat sends verified purchase and refund events to PostHog for financial reporting. This continues when optional usage analytics is off, using the purchase-system ID without optional pricing or attribution attributes. The purpose is to provide the purchased features and maintain sales records (Art. 6(1)(b) and, where applicable, Art. 6(1)(c) GDPR); basic sales analysis uses Art. 6(1)(f). Purchase records are retained as needed to provide lifetime access, handle disputes and satisfy applicable accounting obligations. Other analytics records are retained only as needed for the purposes above and applicable provider retention settings.

Provider information: RevenueCat privacy and Apple privacy. Refund requests are handled by Apple at Report a Problem.

Crash reports

If you have opted in to sharing diagnostics with developers in your macOS privacy settings, Apple may forward anonymised crash reports to us through App Store Connect. We use them only to fix bugs. Opt out at any time in System Settings → Privacy & Security → Analytics & Improvements. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fixing crashes).

4. Hosting and server log files

The origin server for officesquats.app is operated for us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a German data centre. Traffic is delivered through Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, and Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), which acts as a content delivery network and reverse proxy and terminates the encrypted connection. Both act as our processors under Art. 28 GDPR.

Every request produces a temporary log entry containing:

• IP address
• Request date and time
• URL requested and HTTP method
• HTTP status code and response size
• Browser type, version, and operating system
• Referrer URL, if your browser sends one

Purpose: keeping the site online, defending it against attack and abuse, and investigating faults. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service). Retention: log entries are deleted after 14 days unless we need them to investigate a security incident. Transfers to Cloudflare, Inc. in the United States are covered by the EU–US Data Privacy Framework adequacy decision (C(2023) 4745) and by standard contractual clauses.

5. Browser storage and optional website analytics

The website uses local storage to remember your random price assignment and analytics choice. These values stay until you clear them in your browser. Previously saved country selections are no longer used. If storage is unavailable, local pricing and the App Store link still work. Functional storage is used to provide a consistent price assignment and remember your settings (Section 25(2) TDDDG).

If you allow analytics, the website sends pricing-view and App Store click events to PostHog, including the detected storefront, currency and displayed price when available. When a verified AppsFlyer OneLink is enabled, its App Store link includes the random assignment ID and campaign. Otherwise, and when you decline, the website uses a direct App Store link. Reopen “Analytics settings” in the footer to change your choice. Optional website analytics and the associated device access use your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG).

6. Fonts and external connections

Fonts, images and demonstration videos are served by the website itself. Retrieving a price assignment contacts PostHog. Consented analytics contacts PostHog, and following an attributed App Store link contacts AppsFlyer before Apple. Each connection necessarily discloses network information such as your IP address to that service. Other external links open the named provider's website.

Affiliate applications, referrals, and payouts

If you apply to the partner program, we store your contact, channel, audience, address, optional tax, terms acceptance, and PayPal details in a dedicated OfficeSquats backend to review your application and administer the program. Approval is a human decision. Transactional emails, including application updates, sign-in links, private access passes, and monthly reports, are delivered through Amazon SES.

Following a partner link records the partner, a random click ID, time, referring hostname, and salted hashes of the IP address and browser agent. The link passes the click ID into the Mac app, where it is associated with the purchase-system ID. Valid clicks have a 60-day attribution window. No optional referral cookie is required. When enabled, AppsFlyer OneLink also carries the click through installation. Optional usage analytics remains controlled by the app’s analytics setting.

Private creator passes are single-use credentials. The backend stores their digest and redemption status; queued delivery emails are encrypted and their contents are deleted after delivery. The Mac keeps its purchase identity in Keychain so creator access can survive a reinstall on the same Mac. Verified purchases and refunds determine commissions; free creator access does not create commission. Partner operations and commission totals are reported to PostHog using partner IDs without contact, tax, postal, PayPal, or access-code details.

Old click metadata is anonymized after 24 months; rejected applications are deleted after 12 months, and expired sign-in and rate-limit records are periodically removed. Financial records remain for applicable accounting requirements. We use this information to administer the requested program, prevent abuse, and maintain payment records. Contact [email protected] about access, correction, or deletion.

7. Contact by email

When you email [email protected], we process your email address, your name if you give one, and the content of your message in order to answer you. Legal basis: Art. 6(1)(b) GDPR for pre-contractual and support matters, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to correspondence). Retention: we keep the thread until the matter is resolved and then delete it, unless we are required by law to retain it, for example for accounting purposes.

8. Recipients and third countries

Personal data is disclosed only to the processors named above — Hetzner, Cloudflare, PostHog, RevenueCat, AppsFlyer, Amazon SES, our email provider, PayPal for partner payouts, and Apple — and only to the extent needed for the purpose described. Some providers operate internationally, including in the United States and Israel. Processing outside the EEA uses applicable adequacy decisions or contractual safeguards, as described by the providers linked above. Beyond that, data is passed on only where we are legally required to do so. We do not sell or rent personal data, and we do not use it to train machine-learning models.

9. Your rights under the GDPR

You can reach us about any of these at [email protected]:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object, in particular to processing based on legitimate interests (Art. 21)
• Right to withdraw consent with effect for the future (Art. 7(3))

Because OfficeSquats has no account registration, we may need a random offer or purchase identifier to locate records for your request. Opting out stops future optional collection; it is not a deletion request. Send a deletion request to the address above without sending Apple Account passwords or payment-card details.

10. Right to lodge a complaint

You may file a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. Our competent authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: [email protected]
Web: lfd.niedersachsen.de

11. Data security

Connections to this site and to our processors are TLS-encrypted. Access to our infrastructure is restricted and kept patched. No system is perfectly secure, which is exactly why the app is built so that the sensitive part — the video of you — never travels in the first place.

12. Automated decision-making

The app uses on-device machine learning to recognise a squat, and a randomised assignment to pick which price it shows you. Neither produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Every break can be skipped or snoozed by you, and no purchase happens without your action.

13. Children

OfficeSquats is aimed at adults with desk jobs and is not directed at children. We do not knowingly process data from anyone under 16.

14. Changes to this policy

We update this policy when the law, our tools, or our practices change. The current version is always at this URL, and the date at the top says when it last moved.