Privacy policy

1. Controller

Kristan Dietrich, Enzianstr. 3, 86343 Königsbrunn, Deutschland. Email: hello@lightotter.com.

2. Principle

LightOtter keeps your history, settings and streak on your device. Only if you turn on sync across devices or Ollie’s Raft, or use Premium, is data also stored on our server (sections 7 and 8). We use no tracking cookies and no ad trackers.

The website sets no cookies. Your browser keeps your choice in the cookie notice in local storage (entry “lo-consent”: choice and time) so the notice does not appear on every visit. This is strictly necessary for that purpose (Section 25(2) no. 2 TDDDG); the entry never leaves your device. You can change your choice at any time under “Cookie settings” in the footer, or delete it by clearing this website’s data in your browser.

Time in Daylight from Apple Health (iPhone only, only if you turn it on in Settings): the app reads this one value your Apple Watch estimates and shows it. It stays on your device, is not stored, not synced and not sent to us; LightOtter writes nothing to Apple Health (Art. 6(1)(a), Art. 9(2)(a) GDPR).

Android: your device may include app data in your Google backup if you turned backup on in the Android settings. Google manages this backup, not us. Reminders and widgets are calculated on your device; no data leaves the device for them.

The web app stores its program files in your browser (service worker) so that it starts quickly and also offline. This is strictly necessary for us to provide the web app you open; no consent is needed for it (§ 25(2) no. 2 TDDDG). The website outside the web app stores nothing like this.

3. Hosting (Hostinger, Supabase)

The website and the web app are hosted by Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus. When you visit, Hostinger processes technically necessary data: IP address, time, page requested, amount of data transferred, referring page, browser and operating system (server log files). This is needed to deliver the site and protect it from abuse (Art. 6(1)(f) GDPR). Log files are deleted within 42 days at the latest. Hostinger processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Hostinger uses sub-processors, including providers based in the USA; transfers to third countries rely on the European Commission's standard contractual clauses and, where available, the EU-US Data Privacy Framework. The website sets no cookies.

Our server runs at Supabase. Our contract partner is Supabase Pte. Ltd. (Singapore), acting on our behalf (Art. 28 GDPR). The database is in Frankfurt (EU). The server functions run in the data centre closest to where a request comes from; for requests from outside the EU that can be outside the EU. Transfers to third countries rely on the European Commission’s standard contractual clauses.

4. Weather and place search (Supabase, Open-Meteo, GeoNames)

For the daily estimate, the app, the calculator and the light check request weather data from Open-Meteo (Switzerland) – not directly, but through a function on our server at Supabase (section 3). Your device first rounds the coordinates to about 10 km; only these rounded values reach Open-Meteo, never your IP address. The place search sends the name you type and your language the same way to Open-Meteo; place data is based on GeoNames. Our server technically sees your IP address. To prevent abuse we keep only a one-way hash of it and delete it after one day. We cache responses, with no link to you, for at most one hour (weather) or one day (place search) (Art. 6(1)(f) GDPR). This also applies when the calculator is embedded on another website; the embedding site receives no data from us. The chronotype quiz only uses the place search, and only if you enter a city; it does not request weather data.

5. Location in the app (BigDataCloud)

If you allow location access in the app, the app asks you in a separate notice whether it may look up the name of your place at BigDataCloud. Only if you expressly agree there does your device send your IP address and your coordinates, rounded to about 1 km, to BigDataCloud. Important (third country and own purposes): BigDataCloud processes this data in Australia and the USA and also uses the pairing of IP address and location for its own purposes, independent of us (to improve its own location services). There is no EU adequacy decision for Australia and there are no standard contractual clauses that protect your data to EU standards. The legal basis is your explicit consent to this transfer and to the use by BigDataCloud (Art. 6(1)(a), Art. 49(1)(a) GDPR). It is optional, and you can withdraw it any time in Settings under “Show place names”. Without it the app shows “Your location”; you can always search for a place by typing, and then no data goes to BigDataCloud.

6. Map during walks (CARTO)

The map in walk mode loads map tiles from CARTO (USA/Spain), which learns your IP address and the rough map area. The GPS route itself stays on your device. CARTO is certified under the EU-US Data Privacy Framework. The map is part of the Premium walk feature; the legal basis is the contract (Art. 6(1)(b) GDPR).

7. Account and Premium (Supabase, Brevo, RevenueCat)

If you create an account with your email address, the account and your Premium status are stored with Supabase (section 3); we send the sign-in codes through Brevo (section 9). The legal basis is the contract (Art. 6(1)(b) GDPR). “Delete account” in the app removes your account at once.

In the iOS and Android apps you buy Premium through Apple’s App Store or Google Play. You enter payment details only there; Apple and Google process the purchase under their own responsibility. To verify and restore purchases we use RevenueCat (RevenueCat, Inc., USA) as our processor (Art. 28 GDPR). The app only connects to RevenueCat once you open the Premium section (intent to buy), restore purchases or already have Premium through the store; from then on it checks the state of your purchases when it starts and when you return to it. RevenueCat then receives from your device the store’s purchase receipts (product, purchase and expiry date, store), technical details about the app and device (e.g. app version, operating system, language) and your IP address, plus a random identifier or, if you are signed in, an identifier derived from your account that is not your account ID – never your email address. If you are signed in and the app has already connected to RevenueCat, our server asks RevenueCat whether your Premium is active, so that it also applies on the web and to your own session types. The legal basis is steps taken at your request before a purchase, or the contract once you have bought or subscribed (Art. 6(1)(b) GDPR). Transfers to the USA rely on the European Commission’s standard contractual clauses and, where available, the EU-US Data Privacy Framework. “Delete account” for accounts with an email address also deletes the purchase data at RevenueCat; you cancel a running store subscription yourself in your App Store or Google Play account. If you bought without an account, we do not know your RevenueCat identifier; write to us and we will sort out the deletion with you.

If RevenueCat tells us that a store purchase was refunded, we store the store’s purchase identifier (transaction ID) and the product so that the refund ends Premium; we delete the entry after 5 years, because back-to-back annual passes can run that long (Art. 6(1)(b) GDPR). So that the founder price applies only once per email address, after a founder purchase we store a check value of your address (an HMAC with a secret key; the address itself cannot be read from it) together with the RevenueCat identifier derived from your account, also after the account is deleted, and delete both after 2 years (Art. 6(1)(f) GDPR; our legitimate interest is that the founder price applies only once, as announced). If a founder pass is bought without meeting the conditions in the terms (for example a second time), we note this under the identifier derived from your account in order to review the purchase, and delete the note after 400 days (Art. 6(1)(f) GDPR; our legitimate interest is that the founder price applies as announced).

8. Sync across devices and Ollie’s Raft (Supabase)

If you turn on sync or the raft, the app creates an account without email and stores with Supabase (section 3): your sessions (time, part of day, minutes, type, your own session type if any, walk distance in metres, whether added later), your daily goals, your collection, what Ollie wears, your display name and your language. The server calculates your sun coins from this. We keep this data until you delete the account; days older than 400 days are removed at the next sync. Your morning check never leaves the device. Because your movement (walk distance in metres) and your time outdoors can allow conclusions about your health or fitness (health data within the meaning of Art. 9 GDPR), syncing this data with our server is based solely on your explicit consent, which you give in the app before turning it on (Art. 6(1)(a), Art. 9(2)(a) GDPR). You can withdraw it at any time by turning off sync in Settings; we then delete your sync and raft data on the server at once (sessions, daily goals, collection, display name, raft connections, invites and notification subscriptions). Your account, your purchases and any block note on a name stay. You delete an account without email entirely with “Delete server data”, an account with email with “Delete account”.

On the raft your friends see your display name, what your otter looks like, your streak and your minutes this week. When you reach your morning goal, friends on your raft who turned on notifications also get a short message with your display name and this morning’s minutes; you can turn this off on the raft. We store invite codes only as one-way hashes; they are valid for 14 days. Whether a friend you invited has confirmed their email and had sessions on 3 days is used to credit rewards to the person who invited them; the inviter only sees the raft values above. For “one free month per email address” we keep a one-way check value (HMAC) of your address even after deletion, never the address itself.

If you report a name on the raft, we process the details from the report form in the app (the reported name, the account identifiers of both people, your reasons) or from your email (also your name and email address) to review the report and, where we know your email address, reply to you; we delete reports from the app one year after receipt; if we block a name, we keep the account identifier and the reason until the account is deleted (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act).

Accounts without email and without a web purchase are deleted after 90 days without use. “Delete account” removes all your data on the server at once except this check value and the purchase check data described under “Account and Premium” (refunds, founder price), including your raft connections.

Notifications “a friend is done” (only if you turn them on): we store your browser’s subscription address at the push service of the browser vendor (Google, Mozilla, Apple or Microsoft), its keys and your language. The message itself is encrypted; the push service only delivers it but sees its time and size. These services are mostly based in the USA; where available, the transfer relies on the EU-US Data Privacy Framework. So that each person gets at most one message a day per friend, we remember for two days whom we notified on which day. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw any time in the settings. We delete the subscription when you turn it off, when you delete your account or when the push service reports it as invalid.

The community counter on “Today” shows how many accounts with sync had a session of minimum length on the current day (UTC) – a total with no link to any person, shown from 25 on. For this the app asks Supabase when it starts, also without an account; to prevent abuse we keep a one-way hash of your IP address and delete it after one day (Art. 6(1)(f) GDPR).

9. Waitlist and emails (Brevo)

If you join the waitlist, we store your email address and your language with Supabase (section 3), and we send the confirmation email through Brevo (Germany/France), without open or click tracking. You are only on the list after you click “Confirm” (double opt-in). To prevent abuse we briefly keep one-way hashes of your email and IP address; they are deleted after one day. Unconfirmed entries are deleted 30 days after the last confirmation email. You can unsubscribe at any time with the link in every email, and we delete your entry at once (Art. 6(1)(a) GDPR).

If you sign in to the app with the same email address, we match it against the waitlist to offer you the founder price (Art. 6(1)(b) GDPR).

10. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and may withdraw consent at any time. You can complain to a data protection authority. In the app you can export your data as a file and delete everything.

You are not obliged to give us any data. Without an email address you cannot join the waitlist or create an account with email; the core features work without one.

11. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Just write to hello@lightotter.com.

12. Children

LightOtter is intended for people aged 16 and over. It is not directed to children under 13, and we do not knowingly collect their data. If we learn that a person under 16 has an account, we delete it.

13. Users outside the EU

United Kingdom: the UK GDPR applies; you can complain to the Information Commissioner’s Office (ico.org.uk). Switzerland: the Swiss Federal Act on Data Protection (FADP) applies; transfers to the USA rely on the Swiss-US Data Privacy Framework where the recipient is certified, otherwise on standard contractual clauses recognised by the FDPIC; you can complain to the FDPIC (edoeb.admin.ch). Canada and Québec: the person in charge of the protection of personal information is Kristan Dietrich, Enzianstr. 3, 86343 Königsbrunn, Deutschland, reachable at hello@lightotter.com. USA: we do not sell or share personal information and do not use it for targeted advertising. Do Not Track: we do not track you across other websites or apps, so there is nothing for a Do Not Track signal to switch off; we treat all visitors the same way. Australia: you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

14. Changes to this policy

The date under “Version” shows the current version. We announce material changes on this page before they take effect.

15. Version

Version: 14 October 2026.