Effective 2 October 2026
The short version. Your training, check-ins, body data and health data stay on your phone. We don't run ads, we don't sell data, and we don't track you across other apps or websites. The only things that leave your phone are what's needed to run your subscription and to understand, in aggregate, how people use the app.
Ossa ("the app") is made by Andrej Gazi, an independent developer based in the United Kingdom. Andrej Gazi is the data controller for the personal data described here. You can contact us at andrejgazi25@gmail.com.
Ossa does not need an account. The following is stored only on your device and is never sent to us:
Deleting the app deletes this data. If you use your phone's own backup (such as iCloud backup), that backup is handled by Apple or Google under their privacy terms, not by us.
Ossa only reads health data if you give permission, and only to adjust your Body Score and plan inside the app. Ossa never writes to Apple Health or Health Connect, never sends health data off your device, and never uses it for advertising or shares it with anyone. You can withdraw permission at any time in your phone's settings.
| What | Who receives it | Why |
|---|---|---|
| A random app user ID, your purchase and subscription history, and basic device details (country, operating system, app version) | Apple, and RevenueCat Inc. (our subscription service, USA) | To sell, verify and restore your Ossa Pro subscription. Legal basis: performance of a contract. |
| A random app user ID and how you use the app (for example: which onboarding screens you saw, when you viewed the subscription screen, started a trial or finished a workout), plus basic device details | Mixpanel (our analytics service), with data stored in the EU | To understand which parts of Ossa help people and fix what doesn't. Legal basis: our legitimate interest in improving the app. You can turn this off in Settings. |
| Your email and what you write, if you contact us | Us | To answer you. |
The random app user ID is created on your device and is not linked to your name, email or Apple Account by us. We do not collect your precise location, contacts, photos or advertising identifier.
Payments are handled entirely by Apple (or Google on Android). We never see your card details.
Subscription records are kept for as long as you have, or had, a subscription and then as long as needed for tax and accounting rules (normally up to 6 years). Analytics events are kept for up to 24 months. Emails are kept for as long as needed to help you, then deleted.
RevenueCat processes data in the United States. Where data leaves the UK or EU, it is protected by appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
Under UK and EU data protection law you can ask to access, correct or delete your personal data, object to or restrict how we use it, and ask for a copy in a portable format. Because Ossa has no accounts, the easiest way to delete your on-device data is to delete the app. To ask us to delete subscription or analytics records, email us from the Settings screen so we can find your app user ID. We'll reply within one month.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or to your local data protection authority.
Ossa is not intended for children under 13 and we don't knowingly collect data from them.
If we change this policy we'll update this page and the date at the top. Significant changes will also be shown in the app.