Privacy Policy

1. Controller

Anton Melnychuk
Heppenheimer Strasse 39
64658 Furth im Odenwald
Deutschland
Email: contact@melnychuk-anton.de

No data protection officer has been appointed (not required under Art. 37 GDPR).

2. Principle: your data stays with you

FORMA works without an account. FORMA stores training, cardio, nutrition, body measurements and supplements only on your iPhone. The developer has no access to this data and never receives it.

3. iCloud sync (optional)

If you turn on iCloud sync, Apple stores your entries encrypted in your private iCloud space so that they are the same on all your devices. Only you have access, not the developer. Legal basis: Art. 6(1)(b) GDPR; for health data, your explicit consent by turning it on (Art. 9(2)(a) GDPR), which you can switch off at any time.

4. Apple Health

Only if you allow it, FORMA reads workouts and weight from Apple Health and writes strength training and weight there. The data stays on your iPhone. You change the permission in the Health app.

5. Food databases

When you scan a barcode or search, FORMA sends only the number or the search term to Open Food Facts (non-profit association, France). For technical reasons the server sees your IP address. Legal basis: Art. 6(1)(b) GDPR (the search you requested). If you add your own key for USDA FoodData Central, search terms go to the US Department of Agriculture (USA, Art. 49(1)(b) GDPR).

6. Location

Only during a run, walk or ride that you start, for the map, route and pace. The route stays on your iPhone.

7. Coach

The coach runs on the device (Apple Intelligence). Questions and answers do not leave your iPhone and are not stored.

8. Anonymous usage statistics (only with consent)

If you allow it, FORMA sends: app opened, setup completed, which features are used (e.g. “coach opened”), completed workouts with their origin (plan or free) and duration as a rough range (e.g. “30 to 60 minutes”), that the purchase screen was shown and why, and which subscription type was started (yearly, monthly, lifetime, without price), plus app and iOS version. Never included: weight, measurements, food, supplements, exercises, sets, name, location, free text. Instead of a person, the server only knows a random identifier that is created only once you consent. Times only to the full hour. Server: Supabase (Supabase Inc., data centre in Frankfurt) as processor under Art. 28 GDPR with EU standard contractual clauses. For technical reasons the provider briefly keeps access logs with IP addresses; FORMA does not analyse them. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Retention: 12 months. You can withdraw at any time under Profil und Einstellungen › Über FORMA › Datenschutz (Profile and settings › About FORMA › Privacy); FORMA then deletes the identifier and all related events on the server.

9. FORMA Pro

Purchases and subscriptions are handled entirely by Apple. On the device, FORMA only learns whether and which Pro is active, no payment data. With consent to statistics, FORMA also counts which subscription type was started (see 8). Apple’s privacy policy also applies.

10. Notifications

FORMA schedules reminders (rest, training, supplements, end of the free trial) locally on the iPhone. There are no promotional push notifications.

11. Retention

Data on the device until you delete it (individually or everything under Profil und Einstellungen › Über FORMA › Datenschutz, Profile and settings › About FORMA › Privacy). Statistics for at most 12 months, immediately upon withdrawal. Emails to support until the enquiry is dealt with, at most 12 months (see 15).

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20, export under Profil und Einstellungen › Daten › Export und Import, Profile and settings › Data › Export and import), objection (Art. 21) and to withdraw consent with effect for the future (Art. 7(3)). Because almost everything is stored only on your iPhone, you can exercise these rights directly in the app. Questions to: contact@melnychuk-anton.de. You can lodge a complaint with a supervisory authority (Art. 77), for example the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden.

13. Minors

FORMA asks about statistics only from the age of 16 (Art. 8 GDPR). Younger people use FORMA without statistics.

14. Security

Connections are encrypted (TLS). On the server there is no direct table access, only vetted functions; only the developer sees totals, not individual devices.

15. Contact by email

If you write to contact@melnychuk-anton.de, the developer processes your address and the content in order to reply. The mailbox is hosted by IONOS SE (Montabaur, Germany) as processor under Art. 28 GDPR. Legal basis: Art. 6(1)(b) GDPR for questions about the app, otherwise Art. 6(1)(f) (answering enquiries). You can object to processing based on Art. 6(1)(f) at any time on grounds relating to your particular situation (Art. 21 GDPR, see 12). The message is deleted once the enquiry has been dealt with, at the latest after 12 months, unless a statutory retention obligation applies.

16. Changes

Version: 27.10.2026. If anything material changes, FORMA will point it out once.

1. Hosting and server logs

This website consists of static pages without a database and without accounts; only the contact form uses a server function at Cloudflare (see 4). When you visit it, the hosting provider processes technically necessary data: IP address, time, requested address, browser identifier (user agent) and the previously visited page (referrer). This is necessary to deliver the pages and to protect them against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and reliable delivery).

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as processor under Art. 28 GDPR. Transfers to the USA are covered by the adequacy decision for the EU-US Data Privacy Framework, supplemented by standard contractual clauses; the data processing agreement is part of Cloudflare’s terms of service. Cloudflare does not state a fixed retention period for the logs; details are in Cloudflare’s privacy policy. FORMA itself does not receive or analyse any server logs.

2. No cookies, no tracking

This website sets no cookies and stores nothing on your device. There are no analytics or advertising tools and no embedded content from other providers; the website also serves its fonts itself. Therefore no consent under Section 25 TDDDG is required.

3. Contact by email

If you write to contact@melnychuk-anton.de, the provider processes your address and the content in order to reply. The mailbox is hosted by IONOS SE (Montabaur, Germany) as processor under Art. 28 GDPR. Legal basis: Art. 6(1)(b) GDPR for questions about the app, otherwise Art. 6(1)(f) (answering enquiries). The message is deleted once the enquiry has been dealt with, at the latest after 12 months, unless a statutory retention obligation applies.

4. Contact form

The contact form lets you write to the provider without opening an email app. Your email address (for the reply) and the message are required, your name is optional. When you submit the form, a server function at Cloudflare (see 1) checks the details and passes them on, without storing them, to the delivery service Brevo, which sends them as an email to the provider’s mailbox at IONOS (see 3). A field that is invisible to people keeps out automated submissions; there are no cookies and no captcha.

Delivery service: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, as processor under Art. 28 GDPR; the data processing agreement is part of Brevo’s terms of service. The servers are located in the EU (France and Belgium); where Brevo group companies outside the EU access data for support or maintenance, standard contractual clauses or the EU-US Data Privacy Framework apply. Brevo does not store a preview of the message. Brevo deletes the delivery log with sender, recipient, subject (containing your name or email address), time and delivery status after one month.

Legal basis: Art. 6(1)(b) GDPR for questions about the app, otherwise Art. 6(1)(f) (answering enquiries). In the mailbox, the message is deleted as described in 3.

5. Your rights

For the website, too, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To exercise them, write to contact@melnychuk-anton.de.

You can object at any time, on grounds relating to your particular situation, to the processing based on Art. 6(1)(f) GDPR (sections 1, 3 and 4) (Art. 21(1) GDPR).

You can lodge a complaint with a supervisory authority (Art. 77), for example the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden. The controller is the provider named in Part A, section 1. Version of this part: 27.10.2026.