Feedbye
Get the app

Privacy Policy for Feedbye

Effective: October 14, 2026

This policy explains which personal data is processed when you use the iPhone app Feedbye: by whom, for what purpose, on which legal basis and for how long. The German version of this policy is available in the app. This policy covers the app and, in section 18, this website.

At a glance

  • No ads, no analytics or tracking tools, no advertising identifier (IDFA), no sale of data.
  • Most things stay on your iPhone: settings, daily counters, habits and your Screen Time selection.
  • Data leaves your device in these cases:
  1. You use Instagram, YouTube, TikTok, Threads, X or Facebook in the app. Your data then goes to those services, as in any browser (section 4).
  2. The app regularly downloads our rules file. Our service provider Supabase sees your IP address (section 5).
  3. You create an account during setup (required to use the app). For it we store your email address, details from your sign-in provider, your habit check-ins with Supabase; the database is in Frankfurt (section 6).
  4. You buy a subscription or redeem a code. Apple handles this (section 7).
  5. You email us (section 8).
  • You can delete your account in the app at any time.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Bohdan Bernatek
Am Kaiserblick 28, 83098 Brannenburg, Germany
Email: support@feedbye.app
Phone: +49 (0) 170 630 0387

Where this policy says "we" or "us", this means Bohdan Bernatek as the provider of the app.

2. Data protection officer

We are not required to appoint a data protection officer. For privacy questions, contact us at support@feedbye.app.

3. What stays on your iPhone

The app stores the following data only locally on your device: in the app's storage, in an app group shared by the app, the widget and the Screen Time extensions, and in the iOS keychain. We do not receive this data.

Data Purpose How long
Settings, e.g. daily limit, focus rules per network, free days in your weekly schedule, creator and Hardcore mode app features until you change them or delete the app
Daily counters per network, including the short IDs of posts or videos seen today (so nothing is counted twice), extensions used ("+5") daily limit current day only, reset at midnight
Habits: your chosen habits, daily check-ins and whether you kept your limit; calculated locally from this: clarity score, mascot stage, streak habits and motivation about 60 days; the app removes older days automatically
Your Screen Time selection (encrypted references from Apple, see 3.1) blocking the original apps until you change it or delete the app
Cached Pro status Pro features without a connection until the next check with Apple
Cached rules file see section 5 until a newer one is loaded
Sign-in session (in the keychain) staying signed in until you sign out or delete the account

When you delete the app, iOS removes the app's locally stored data. One item in the iOS keychain, the sign-in session, may remain on your device after the app is deleted. "Sign out" removes the sign-in session. "Delete account" deletes your data on our server (section 6.6).

Legal basis: To the extent this involves processing by us at all, it is necessary to provide the features you asked for (Art. 6(1)(b) GDPR). Storing and reading this information on your device is strictly necessary to provide the service you requested (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act), so no consent is needed. The app sets no tracking cookies of its own and uses no advertising identifier.

3.1 Screen Time

If you want, you can block the original Instagram, YouTube, TikTok, Threads, X or Facebook apps with Apple's Screen Time. You grant permission in Apple's own dialog and pick the apps in Apple's own picker. Apple gives the app only encrypted references (tokens). We cannot see which apps you picked. The selection, the block screens and Post Mode (a short unlock that locks again automatically) run entirely on your device. We receive none of it and do not use it for advertising.

Before you delete the app, tap "Unblock all apps" in Settings. Otherwise blocks may stay in place. If that happens, email us and we will help.

3.2 Notifications

The app only sends local notifications created on your device, for example when Post Mode ends, when you tap "Open in Feedbye" on the block screen, or when you asked to be reminded of your habits. There is no push server, and we receive no device tokens. The app asks for your permission first (consent, Art. 6(1)(a) GDPR, to the extent personal data is involved). You can withdraw it at any time in the iOS settings.

3.3 Widget

The widget shows today's limit and your networks. It only reads the app's locally stored data.

4. Instagram, YouTube, TikTok, Threads, X and Facebook in the app

4.1 Built-in browser, operators are responsible for their own processing

The app shows the official websites of Instagram, YouTube, TikTok, Threads, X and Facebook in a built-in browser (Apple WebKit). What you do there, such as signing in, watching, liking, messaging or uploading, happens directly between your device and the operator, just like in Safari. Each operator is responsible for that processing itself. Its own privacy policy applies:

We do not embed any plugins, tracking code or other services of these operators in the app, and we receive no data about you from them. You use their websites as in an ordinary browser. We do not decide on the purposes and means of their processing and are therefore not joint controllers with them.

The websites may use their own cookies, analytics and advertising. The app does not block ads, sponsored posts or the websites' tracking. You manage your settings for this with each service.

4.2 Cookies and website data

To keep you signed in, iOS (WebKit) stores the networks' cookies and other website data persistently on your device. This data is only sent to the respective service. We do not transmit it to us. For some networks (currently Facebook) the app only checks on your device whether a sign-in cookie with a certain name exists, to tell whether you are signed in. It does not read the cookie's content, and the result never leaves your device. "Sign out" in a network deletes that network's website data in the app. Deleting the app deletes it as well.

4.3 What our code does on the websites

  • None of our code runs on sign-in and security pages (for example login, confirmation codes, linking via Facebook). We do not see your passwords or confirmation codes.
  • The app checks on your device which address is about to open and decides, based on the rules, whether the page opens. For example, the Reels feed does not open. We keep no browsing history and do not send addresses to us.
  • A script only observes which feed posts become visible and passes their short ID to the app so it can count them. It does not change the page. It does not read message contents, passwords or form input. The IDs stay on your device (section 3).

Legal basis: Art. 6(1)(b) GDPR; for access to your device, Section 25(2) no. 2 TDDDG.

4.4 Camera and microphone

The camera and microphone are only used when a website requests them, for example to record a story or a voice message. iOS asks for your permission first. Recordings and files you capture or select there go directly to the respective website. We do not record, store or receive any of it. You give permission through the iOS dialog (Art. 6(1)(a) GDPR) and can withdraw it in the iOS settings at any time.

5. Downloading the rules file

Websites change often. To keep the rules current, the app regularly (currently every few hours) downloads a public rules file that defines which addresses are blocked or redirected and which networks the app currently offers. Our service provider Supabase delivers the file (section 6.5). The request is answered by a data centre near you; for users in Europe, a location in Europe.

The request is a plain download without cookies, without account or device identifiers and without usage data. As with any request on the internet, the server technically receives your IP address, the time, the requested file and the technical details iOS sends automatically (user agent: app name, app version and system version).

  • Purpose: provide current rules, secure delivery, troubleshooting.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a working and secure app. We do not analyse the logs to identify people.
  • Recipient: Supabase as our processor (Art. 28 GDPR, section 6.5).
  • Retention: Supabase keeps the server logs only briefly for troubleshooting and security and then deletes them automatically; on our plan after 7 days at most.

If the download fails, the app uses the last downloaded or the built-in rules file.

6. Account

6.1 Why there is an account

To use the app, you create an account during setup. It moves your habits and streak to other devices, such as a new iPhone and lets us inform you about important changes. You can't use the app without an account.

6.2 What we store

  • your email address (with "Sign in with Apple", possibly an anonymous relay address from Apple),
  • the sign-in provider (Apple or email code) and the user identifier it sends us,
  • an internal account ID and the time of creation and of the last sign-in,
  • with "Sign in with Apple", a token from Apple (refresh token). It is kept in an area the app cannot read. We use it only to revoke the link with Apple when you delete your account, as Apple requires,
  • your habit check-ins: the IDs of your chosen habits and, per day, which ones you completed and whether you kept your limit (yes or no), for about the last 60 days, plus the time of the last sync.

Not stored: which websites or posts you view, your daily counters, which apps you block, Screen Time data and payment data.

6.3 Signing in

  • Sign in with Apple: Apple confirms your identity and sends us your email address (or a relay address) and an Apple user identifier. We do not ask for your name. Apple is responsible for this itself: https://www.apple.com/legal/privacy/
  • Email code: We send a one-time code to your email address. It is delivered by an email delivery provider based in the EU that we use as our processor. The provider keeps delivery logs only as long as needed for delivery and troubleshooting.
  • Providing the account and syncing habits: Art. 6(1)(b) GDPR (contract of use).
  • Informing you by email about important changes to the app or these terms: Art. 6(1)(b) and (c) GDPR. We don't send you advertising.
  • Storing the Apple token and revoking it on deletion: Art. 6(1)(b) GDPR (providing your account and deleting it completely).
  • Security and abuse prevention: Supabase technically logs IP address, time and type of request for sign-ins and requests. Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure operation. Supabase deletes these logs automatically; on our plan after 7 days at most.

6.5 Supabase as processor

The account and the rules file are run for us by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, as our processor (Art. 28 GDPR). We have concluded a data processing agreement with Supabase. The database is located in the EU (Frankfurt am Main, Amazon Web Services "eu-central-1").

Supabase uses affiliates and sub-processors, among them Supabase, Inc. (USA) for support and Amazon Web Services and Cloudflare for hosting and networking. Access from Singapore or the USA, for example for maintenance, security or support, therefore cannot be ruled out. Such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of our contract with Supabase, including the supplement for Switzerland. You can request a copy from us.

Data is transmitted encrypted (TLS). Each account can only access its own data.

6.6 Retention and deletion

We keep your account data as long as your account exists. "Delete account" in the app immediately deletes your account, your profile including check-ins and, if there is one, the Apple token on the server; we also revoke the link with Apple. Backups, to the extent our plan includes them, are kept by Supabase for 7 days at most. After that, nothing remains there either.

Important: deleting the app does not delete your account. Delete it in the app first or email us. Deleting the account does not cancel a subscription; you manage that with Apple.

7. Purchases, subscriptions and codes through Apple

  • Purchases: You buy Pro through Apple's in-app purchase. Apple (in the EU: Apple Distribution International Ltd., Ireland) sells the subscription in its own name and processes your payment data under its own responsibility: https://www.apple.com/legal/privacy/. We receive neither your name nor payment data.
  • Pro status: On your device, the app learns from Apple (StoreKit) whether you have an active subscription and unlocks Pro (Art. 6(1)(b) GDPR).
  • Codes: You redeem codes in Apple's redemption sheet or through an Apple link. Apple checks whether you are eligible. We do not learn who redeemed a code.
  • Friend gift: You share the link through the iOS share sheet. We do not access your contacts, do not send invitations and do not learn whom you share with.
  • Reports from Apple: In App Store Connect, Apple gives us sales and subscription reports without names or contact details, for example with a subscriber ID assigned by Apple, country, product, offer, price, proceeds and refunds, plus the number of redemptions per code. For us, the subscriber ID is a pseudonym. We cannot identify you with it and do not try to. We use the reports for our accounting and to calculate creator commissions. Legal bases are Art. 6(1)(f) GDPR (correct accounting, creator program) and Art. 6(1)(c) GDPR (retention under tax and commercial law). We keep them as long as the law requires: accounting vouchers 8 years, books and records 10 years (Section 147 AO and, where applicable, Section 257 HGB).
  • Statistics and crash reports: We do not integrate any analytics or crash-reporting tools of our own. If you agreed in iOS to share analytics with app developers, Apple collects this data under its own responsibility and gives us only aggregated usage statistics and crash reports without details that would let us identify you. You can change your choice under Settings › Privacy & Security › Analytics & Improvements.

8. Contacting us by email

When you email us, for example via "Help" in the app, we process your email address, the content and anything else you tell us, in order to reply. The legal basis is Art. 6(1)(b) GDPR when it concerns your use of the app or your subscription, otherwise Art. 6(1)(f) GDPR (interest in answering requests). Our mailbox is run by an email provider based in the EU that we use as our processor. We delete messages once the request is resolved, within 2 years at the latest, unless statutory retention duties apply (6 years for business correspondence, Section 147 AO and, where applicable, Section 257 HGB).

Feedback in the app: Under Profile › Feedback you can send us a message. We then store the kind you chose (idea, bug, praise, other), your text, optionally your email address for a reply, the app version and your language setting together with your account ID at Supabase (see 6.5), to read and answer it and to improve the app. The legal basis is Art. 6(1)(f) GDPR (our interest in handling feedback), or Art. 6(1)(b) GDPR for questions about your subscription. We delete the message once it is handled, at the latest after 2 years, and in any case together with your account.

The reason you choose in the app's cancellation dialog is not stored by the app and not sent to us.

9. Recipients at a glance

Recipient Role When
Supabase Pte. Ltd. with sub-processors (database in Frankfurt) processor account, rules file download
Email delivery provider based in the EU processor sending sign-in codes
Email provider based in the EU processor when you email us
Apple independent controller purchases, codes, Sign in with Apple, optional analytics
Meta (Instagram, Threads, Facebook), Google (YouTube), TikTok, X independent controllers when you use their websites in the app
Tax advisor bound by professional secrecy accounting (only Apple reports without names)
Authorities, courts independent controllers only where we are legally required

We do not sell data and do not share data for advertising.

10. Do you have to provide data?

You have no legal obligation to give us data. Using the app requires an account with an e-mail address; without an account you can't use the app. Without the technical transmission of your IP address the app cannot download a new rules file and uses the one it has. Purchases require an Apple ID.

11. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and build no advertising profiles. The app calculates the clarity score, mascot and streak on your device only as a motivational aid; they have no legal or similarly significant effects on you.

12. Children and teenagers

Feedbye is meant for people aged 13 and over. If you are under 16, you may only use the app with the consent of your parents or legal guardians. This also applies to permissions you give in the app, for example for notifications or access to the camera and microphone (Art. 8 GDPR). The networks also have their own age limits. We do not knowingly process data of children under 13. If you are a parent or legal guardian and learn that your child under 13 has created an account, or that your child aged 13 to 15 uses the app without your consent, email us and we will delete the account and the related data.

13. Security

We transmit data encrypted (TLS), store as little as possible and limit access to the people who need it. No transmission over the internet is completely secure.

14. Your rights

You have the right to:

  • access your data (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Email us at support@feedbye.app. So that we do not hand data to the wrong person, we may ask you to send the request from your account's email address. We have no access to data that exists only on your iPhone. You can view, change and delete it in the app, or delete the app.

15. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Information for users in Switzerland

For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. Personal data may be disclosed to these countries: states of the EU and the EEA, the United Kingdom, Singapore and the USA. Data reaches Singapore and the USA through Supabase and its sub-processors, safeguarded by Standard Contractual Clauses with the supplement for Switzerland, and also reaches the USA through Apple when you use its services. The competent authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

17. Changes

We update this policy when the app or the law changes, for example when a new feature processes data. The current version is in the app and at the privacy policy link in the App Store. We will tell you about material changes in the app in advance.

18. This website

For our website feedbye.app, the following also applies:

18.1 Hosting

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, our processor (Art. 28 GDPR). When you open a page, Vercel processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the page you came from (referrer) and the details your browser sends automatically (user agent). This is needed to deliver the page and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure, working website. Vercel keeps these server logs only as long as needed for operation and security. We do not analyse them to identify people.

Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so an adequacy decision of the European Commission applies (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses in our data processing agreement with Vercel apply (Art. 46(2)(c) GDPR). Vercel delivers the pages through a worldwide server network, usually from a location near you.

On your first visit we ask whether you agree to optional services: "Accept all", "Only necessary", or one by one under "Settings". Nothing is preselected.

  • What is stored: your choice (necessary, statistics, marketing), a version number and the time. We keep it in your browser's local storage (localStorage, entry "feedbye-consent"), not as a cookie and not on our server.
  • Legal basis: storing it is strictly necessary so we can respect your decision (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). The processing is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstrating consent).
  • Retention: until you change your choice or delete this website's data in your browser. If the categories change, we ask again.
  • Withdrawal: with "Cookie settings" at the bottom of every page you can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR). We then stop loading the services concerned and delete the cookies they set on our domain.

Without your consent this website loads no analytics or marketing services and no third-party content. The "Statistics" category is prepared, but we do not use any service for it at the moment. Without consent the website sets a cookie in one case only:

  • Language: if you pick a language at the top of the page, we store it in the cookie "feedbye-lang" (value "de" or "en", kept for 1 year), so the home page opens in your language next time. Without that choice we do not set it. Storing it is strictly necessary for the function you asked for (Section 25(2) No. 2 TDDDG); the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being to show you the site in the language you chose. You can delete it in your browser at any time.

This section applies only if we use the Meta Pixel; the consent banner shows whether it is active. It loads only after you have agreed to the "Marketing" category.

  • Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
  • Purpose: measuring whether our ads on Instagram and Facebook lead people to visit our website or download the app, and showing our ads to visitors of this website.
  • Data: your IP address, browser and device details, the page you open and the page you came from, the time, and identifiers in cookies on our domain (_fbp and, where applicable, _fbc, kept for up to 90 days). If you are logged in to Meta, Meta can link the visit to your account.
  • Joint controllership: we and Meta are joint controllers for collecting this data on our website and transmitting it to Meta (Art. 26 GDPR), based on Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum). Under it, Meta is responsible for handling your rights regarding the further processing, but you can also contact us. Meta alone is responsible for the further processing: https://www.facebook.com/privacy/policy
  • Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
  • Transfers to third countries: Meta also transfers data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Standard Contractual Clauses also apply.
  • Withdrawal: at any time via "Cookie settings", see 18.2.

We serve the fonts ourselves from our own server; your browser does not connect to Google or other font providers for them. Links to the App Store or other websites take you to their providers, whose privacy notices apply there. Until you tap such a link, this website loads nothing from them. If you email us through a link on this website, section 8 applies.

Your rights under sections 14 to 16 also apply to this website.