Health Data Widgets

Privacy Policy

Effective: 20 May 2026 · Last updated: 16 October 2026

Controller

Daniel Bühner
Kolbergstr. 6b
83109 Großkarolinenfeld
Germany
Email: hdw@fn11.net

About this website

This website (hdw.fn11.net) is a simple, static information page for the iOS app "Health Data Widgets". It sets no cookies and stores nothing on your device. Beyond the server logs and the cookieless audience measurement described below, we collect no personal data.

Hosting

This website is hosted on a virtual server provided by DigitalOcean, LLC (101 Avenue of the Americas, 10th Floor, New York, NY 10013, USA). The server is located in Frankfurt am Main (EU region). Management is handled through Laravel Forge (Laravel Holdings, Inc., USA).

Data-processing agreements under Art. 28 GDPR are in place with both providers. Transfers to the USA rely on the European Commission's adequacy decision under the EU–US Data Privacy Framework and, supplementarily, on the EU Commission's Standard Contractual Clauses.

Server logs

When you visit this website, the following data is automatically recorded in server logs:

Logs are stored to operate the site and for troubleshooting, on the basis of our legitimate interest under Art. 6(1)(f) GDPR. They are automatically deleted after at most 7 days.

Audience measurement

We measure visits to this website with Xstrm, an analytics service operated by the controller named above. A small script loaded from in.xstrm.net records, for every page view, the path (never the query string), the referring website's domain, the country and city, the browser, the operating system, the device category, and page-load performance (Core Web Vitals). To count unique visitors, a hash of your IP address and User-Agent is formed with a salt that changes daily; the previous day's salt is destroyed, so visits on different days cannot be linked. The IP address is used only at the moment of the request to derive country, city, and this hash, and is then discarded — it is never stored.

Xstrm sets no cookies, uses no local storage, and builds no profiles. The legal basis is our legitimate interest in anonymous usage statistics under Art. 6(1)(f) GDPR. Raw data is deleted after 30 days (in individual cases up to 60 days, since deletion runs monthly).

Xstrm runs on Laravel Cloud (Laravel Holdings, Inc., USA) in an Amazon Web Services data centre in Frankfurt am Main. Requests are routed through the network of Cloudflare, Inc. (USA), which processes your IP address to secure the connection. A data-processing agreement is in place with Laravel; where access from the USA is possible, it relies on the EU Commission's Standard Contractual Clauses.

Email contact

Email sent to hdw@fn11.net is processed by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The mail servers are located in Germany. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages and their contents are deleted as soon as they are no longer needed to handle your request.

The app and Apple Health

The iOS app "Health Data Widgets" reads selected values from Apple Health via Apple's HealthKit framework with your explicit permission — currently step count and walking + running distance. These values remain solely on your device and are cached locally in an App Group container so the Home Screen widget can display current values even when the app isn't running.

The companion Apple Watch app reads the same values directly from Apple Health on your watch, with a separate permission you grant on the watch. The daily goals you set in the iPhone app (two numbers: a step goal and a distance goal) are passed to the watch through Apple's WatchConnectivity framework, between your own paired devices. No health values are transferred, and nothing reaches us.

The app does not write to Apple Health. You can revoke access at any time in iOS Settings → Privacy & Security → Health → Health Data Widgets, and on Apple Watch in the watch's Settings app under Health.

No network requests from the app

The app makes no network requests, neither to our servers nor to third parties. It contains no analytics SDKs, no tracking frameworks, no advertising libraries, and no crash-reporting services other than Apple's built-in anonymized reports, which are handled directly between Apple and your device.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object under Art. 21 GDPR

You may object at any time to processing of your data carried out on the basis of Art. 6(1)(f) GDPR — in particular server logs and audience measurement — for reasons arising from your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. Competent authorities are listed by the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

Children

The app is rated 4+ and is suitable for users of any age. We do not knowingly collect data from children.

Changes to this policy

Material changes will be marked with an updated date at the top of the page. The current version is always available at hdw.fn11.net/privacy.html.