Privacy policy

Last updated: 12 October 2026

This is a translation for convenience. In case of doubt, the German version is legally binding: German version.

1. Data protection at a glance

General information

The following notes give you a simple overview of what happens to your personal data when you visit this website or use the Lean is law app. Personal data is any data that can be used to identify you personally.

The Lean is law app (iPhone and Android) and this website should be considered separately. The app stores your health data (weight, body measurements, body fat, nutrition, supplements and photos) only on your device and, only if you switch on the backup on iPhone, in your own iCloud account. There is no Lean is law server, no user account and no advertising. Details are in section 7.

Data collection on this website

Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice.

2. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For details please refer to the provider's privacy policy.

This hosting provider is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.

We serve the Barlow Condensed typeface from our own server. Visiting the website does not open a connection to any third party font service.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Controller

The controller responsible for data processing on this website and in the app is:

Johannes Müller
Simone-Veil-Strasse 30
53121 Bonn
Germany
Email: [email protected]

4. Data collection on this website

Cookies and local storage

Our website uses one technically necessary cookie for the language choice. If Google Analytics is enabled, we store your choice in the cookie banner in your browser's local storage; analytics cookies are only set after you consent.

Technically necessary cookies are stored on the basis of Art. 6 (1) (f) GDPR and section 25 (2) TDDDG. Analytics cookies are only set with your consent (Art. 6 (1) (a) GDPR, section 25 (1) TDDDG).

Language choice (cookie "lil_lang")

This website is available in ten languages: German, English, French, Spanish, Italian, Portuguese, Dutch, Swedish, Norwegian and Danish. If you open the home page without a language in the address, we redirect you to the matching language version based on the language setting sent by your browser (the Accept-Language header). This happens only when the page is requested; the header is not stored.

If you actively choose a language in the navigation, we store this choice in a cookie named lil_lang. It contains only the code of the chosen language (for example "en" or "fr"), expires after one year and does not allow any conclusions about you as a person. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to show you the website in the language you chose on every visit. You can delete the cookie at any time in your browser settings.

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

This data is not combined with other data sources. It is collected on the basis of Art. 6 (1) (f) GDPR.

Support form

If you send us a message using the form on the support page, your message and, if you provide it, your email address are transmitted to our inbox via the messenger service Telegram (Telegram FZ-LLC, Dubai) and stored there to handle your request. Providing an email address is voluntary and only needed if you want a reply. To prevent abuse we keep, for at most five minutes and only in memory, a count of how many messages were received from your IP address. The legal basis is Art. 6 (1) (b) and (f) GDPR (handling your request). Please do not send us health data through the form.

5. Analytics tools

Google Analytics 4

If enabled, this website uses features of the web analytics service Google Analytics 4, a service of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded once you consent in the cookie banner.

Google Analytics uses so-called "cookies". These are text files that are stored on your computer and allow an analysis of how you use the website.

Purpose of processing: We use Google Analytics to analyse how our website is used in order to improve it and make it more user friendly. In particular we record:

  • Page views and time spent on the page
  • Clicks on app download buttons (as the event app_download_click)
  • Interest in Lean is law Pro (as the event premium_interest)
  • Interaction with FAQ items (as the event faq_expand)
  • Clicks on the download prompt in blog posts (as the event blog_cta_click)
  • Scroll depth (as the event scroll_depth)

Legal basis: Google Analytics is used exclusively with your consent under Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. You can withdraw your consent at any time by deleting the site data in your browser and choosing "Decline" in the cookie banner.

Google Consent Mode v2: We use Google Consent Mode v2. This means that Google Analytics only collects data once you have actively agreed in the cookie banner. Without your consent, no analytics data is sent to Google.

IP anonymisation: We have enabled IP anonymisation. Google shortens your IP address within member states of the European Union.

Opt-out: You can prevent collection by Google Analytics by:

You can find more information on how Google Analytics handles user data in Google's privacy policy.

6. Your rights

You have the right at any time to:

  • Obtain access to the personal data we hold about you (Art. 15 GDPR)
  • Request rectification of inaccurate data (Art. 16 GDPR)
  • Request erasure of your data (Art. 17 GDPR)
  • Request restriction of processing (Art. 18 GDPR)
  • Request data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Withdraw consent you have given (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

7. The Lean is law app (iPhone and Android)

Lean is law is an app for iPhone (iOS) and Android that lets you run bulk, cut and maintenance phases and diet breaks by trend weight, calories and macros. It has no server of its own, no user account and no advertising. Where the two versions differ, this is stated in the relevant section.

What data the app processes

The app processes health data within the meaning of Art. 9 GDPR. This happens exclusively on your device, because you use the app for this purpose and enter or share the data yourself:

  • Weight measurements you enter manually or import from a file (weight, date, time, optional note), and weight measurements from Apple Health or Health Connect if you enable the import.
  • Optional body measurements (e.g. waist, hips, body fat), your height and, to estimate your maintenance calories, year of birth, sex and activity level, if you provide them.
  • Your phases (bulk, cut, maintain or diet break with start, planned end, weekly rate and optional goal weight, and in maintain the width of the corridor), milestones reached, and experiments and markers (type, name, period, optional note).
  • Optional nutrition entries (calories, protein, carbs, fat, meal, time, optional name) that you enter manually or that are read from Apple Health or Health Connect, and your calorie and macro settings.
  • Optional supplements (name, amount, reminder times, weekdays) and the days you ticked them off.
  • Optional progress and posing photos with date and pose (front, back, side, lat spread) and your weekly check-in (day, reminder, notes).
  • Your onboarding answers and settings (reminders, appearance, language, units, visible cards, Health and backup options).

This data is stored locally on your device and used only for the app's features, for example to calculate trend, weekly rate, forecast, phases, maintenance calories (TDEE), calorie and macro targets, milestones, balance, monthly reports, experiments, corridor and, if switched on, BMI. It is not transmitted to us or to third parties. Photos are never uploaded. The names and amounts of your supplements only appear in reminders on your own device. Lean is law does not give medical advice and is not a medical device.

Apple Health (HealthKit, iPhone)

If you enable the import, Lean is law reads the data types body mass, body fat percentage and waist circumference from Apple Health, for calories and macros dietary energy, protein, carbohydrates and total fat, and optionally active energy to estimate your maintenance calories. If you switch on writing back, Lean is law writes your manually entered values for weight, body fat and waist and your nutrition entries (calories, protein, carbs, fat) to Apple Health; calculated values such as the trend weight or maintenance calories are never written. Both are voluntary and can be switched off individually. Health data is used solely for the app's features, never for advertising, marketing or data mining, and is never passed on to third parties. It stays on your device only and is not included in the iCloud backup. You can revoke access at any time in the Health app under "Data Access & Devices" and remove imported entries in Lean is law.

Health Connect (Android)

If you enable the import, Lean is law reads the data types weight, body fat and nutrition (calories, protein, carbs, fat) from Health Connect and optionally active calories burned. With the permission for older data, Lean is law reads your full history once, without it only the last 30 days; with the permission for reading in the background, the app keeps the data up to date even when it is not open. If you switch on writing back, Lean is law writes your manually entered values for weight and body fat and your nutrition entries to Health Connect; calculated values are never written. Both are voluntary and can be switched off individually. Data from Health Connect is used solely for the app's features, never for advertising, marketing or data mining, never sold and never passed on to third parties. It stays on your device only. You can revoke access at any time in Health Connect under app permissions. Lean is law's use of information received from Health Connect adheres to the Health Connect Permissions Policy, including the Limited Use requirements.

Camera and photos

For progress and posing photos the app asks for access to the camera or your photo library. Photos are resized and stored only in the app's storage on your device. They are part of the file export you start yourself, not of the iCloud backup, and are never transmitted to us or to third parties.

iCloud backup (optional, iPhone only)

If you switch on the iCloud backup, Lean is law stores a copy of your data (measurements, body measurements, phases and corridor, manually entered nutrition entries, supplements, check-in, experiments and markers, settings) in the key-value store of your personal iCloud account. Photos and values read from Apple Health are excluded. Apple handles the transfer and storage under the iCloud privacy terms; we have no access to it. The backup only serves to restore your data on your own devices. You can switch it off and delete it at any time under "Export, backup & import".

In-app purchases (Lean is law Pro)

Purchases and subscriptions are handled by Apple's App Store on iPhone and by Google Play on Android. To verify and manage your purchase entitlement, Lean is law uses the service RevenueCat (RevenueCat, Inc., USA). This involves a randomly generated, anonymous user ID, the App Store receipts or Google Play purchase tokens, the app version, the language and the device type.

In addition, Lean is law stores anonymous usage attributes there to see which features are used and how regularly the app is used: whether onboarding and a phase are set up, which features are switched on (for example reminders, Apple Health or Health Connect, body measurements, photos, nutrition, supplements, check-in, BMI, iCloud backup, maintain corridor), the chosen unit, language and trend method, and counts such as the number of entries, days with weigh-ins, supplements, experiments and markers and shared images, the length of your streak and the days since the last entry. Only numbers and on/off values are transmitted. Weight values, body measurements, height, year of birth, notes, photos, nutrition values, names and amounts of your supplements and the names of experiments and markers are not transmitted, not even in derived form.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) for handling purchases and Art. 6 (1) (f) GDPR (legitimate interest in improving the app) for the usage attributes. The transfer to the USA is based on the EU-US Data Privacy Framework or standard contractual clauses. More information: revenuecat.com/privacy.

Usage analytics

To keep Lean is law stable and improve it, the app uses the analytics service PostHog (PostHog Inc., USA; processing on servers in the EU). The following is transmitted: which screens you open and which features you use (e.g. entry saved, phase started, reminder turned on, Pro offer shown or closed, purchase started), the onboarding steps with your answers there (phase, obstacles, pace), the same anonymous usage attributes as at RevenueCat, app version, operating system, device type and language, as well as crash and error reports (technical error message and affected code location). All of this is linked only to your random, anonymous user ID from RevenueCat. Weight values, body measurements, height, year of birth, notes, photos, nutrition values, names of foods and supplements, and labels of experiments and markers are not transmitted. There is no screen recording and no advertising ID.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable and improved app). Where data reaches the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. You can object at any time: under "Settings & more → Privacy" you can turn off usage analytics, after which the app sends nothing more to PostHog. More information: posthog.com/privacy.

Apple and Google may also provide us with anonymised statistics via App Store Connect or the Google Play Console, if you have agreed to this in your device settings.

Export, import and sharing

Exports (CSV, JSON) and images for sharing (trend, milestone, experiment result, photo comparison, check-in) are only created when you explicitly ask for them and are handed over through the system share sheet to the app or storage location you choose. Lean is law itself transmits nothing. Imported files are read locally.

Widgets (iPhone only)

For home and lock screen widgets, Lean is law keeps a small summary (trend, change, streak, phase) in a protected area that only the app and its widget can read. This data does not leave your device.

Background refresh

If background import is enabled, iOS or Android may briefly start the app in the background at regular intervals to fetch new entries from Apple Health or Health Connect. No data leaves your device in this case either.

Notifications

Reminders to weigh in, supplement and check-in reminders, import notifications, the notification at the end of an experiment and corridor alerts are local notifications scheduled entirely on your device. There is no push service and nothing is sent to a server.

Feedback from the app

If you send feedback from the app, your message, the selected type, the app version and, if provided, your email address are transmitted to us via the messenger service Telegram. No other data, in particular no health data, is transmitted. The legal basis is Art. 6 (1) (b) GDPR (handling your request).

Storage and deletion

Your data is kept as long as the app is installed. You can remove it completely at any time under "Settings & more → Export, backup & import → Delete all data" or by uninstalling the app. You can delete an iCloud backup there as well.

Your rights regarding the app

Your health data belongs to you alone. Purchase data and usage attributes at RevenueCat and PostHog are only linked to a random ID that we cannot connect to a person. If you would like access to or deletion of this data, send us your anonymous ID, which you can find in the app under "Settings & more → Privacy", by email to [email protected]. The current version of the app privacy policy is also available in the app under "Settings & more".