Last updated: August 2026 — this policy applies to the iOS app Nadir only. The website has its own privacy policy; so do the other apps, Interim, Pensum and Aquifer.
Shiwani Goswami, Stover Str. 24b, 21423 Drage, Germany. Email: app@goswami.de. Where this policy says "we", it means the controller.
Nadir reads health data from Apple Health and computes an assessment of recovery, sleep and strain from it, on the device. There is no user account and no registration.
The app contains no networking code, no analytics or tracking libraries, no ad networks and no third-party libraries. There is no server of ours for data to be sent to.
It follows that we receive no personal data from your use of Nadir — no health data either. To that extent no processing by us takes place; the data stays in your hands and under your control.
Nadir requests read permissions only. It writes nothing back to Apple Health and does not request write permissions. What it reads:
No other health data is requested. You can see which permissions are granted in the app under Settings → Health permissions, and at any time in the Health app under Data Access & Devices → Nadir.
Access only takes effect once you confirm it explicitly in the iOS dialog. The legal basis is your consent under Art. 6(1)(a) GDPR, and for the health data additionally Art. 9(2)(a) GDPR.
You may withdraw consent at any time with effect for the future — in the iOS settings under Privacy & Security → Health, or directly in the Health app. This does not affect the lawfulness of processing carried out beforehand. Without access to heartbeat series, sleep analysis and heart rate, Nadir cannot compute its metrics; wrist temperature and workouts are optional.
For its comparison values Nadir reads a window of 60 days of history. Full heart-rate series are only fetched for the last 30 days; older days take their strain from workouts alone. The journal (section 7) looks at a 90-day window.
Nadir keeps no copy of your Health data. The values it reads are fetched afresh from Apple Health on each run, condensed into daily figures in memory, and then discarded.
The raw beat-to-beat intervals are not retained. They are folded into a single figure per night (RMSSD) as they are processed; the individual heartbeats themselves are never stored.
What is kept on the device is only your own input and settings: chosen language, units and display, your maximum heart rate and weighting from calibration, and your journal entries. They live in the app's own settings store on the same device and do not leave it.
In the journal you can note per night what happened the evening before: alcohol, a late meal, screen time before bed, afternoon caffeine, travel, illness, sauna, stress. You enter these voluntarily.
Some of them — illness or alcohol, for instance — are health data within the meaning of Art. 9 GDPR. They too stay on the device only; we never see them. The legal basis is your consent given by making the entry (Art. 6(1)(a), Art. 9(2)(a) GDPR). Any entry can be removed again at any time.
You can export your daily values as CSV and the underlying series as JSON. The file is produced on the device and handed to the iOS share sheet — where it goes from there is entirely your decision. No upload takes place, and there is nowhere for it to be uploaded to. The raw beat-to-beat intervals are not part of the export, because the app never retains them in the first place.
Under Settings → Delete derived data you remove calibration, weighting and journal from the device. Apple Health is never touched — the health data stored there is yours and stays untouched. If you remove Nadir from your device, the app data goes with it; since Nadir writes nothing to Health, nothing from the app is left behind there.
Apple is responsible for downloads and billing in the App Store. If you use your device's iCloud backup, it may include app data; Apple's privacy policy applies to that. We have access to neither.
You are reading this page over the internet. It is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, which produces server log files (IP address, time, page requested, volume transferred, referrer, browser, operating system). The legal basis is Art. 6(1)(f) GDPR. A data processing agreement under Art. 28 GDPR is in place with Vercel; transfers to the USA rely on the Standard Contractual Clauses and Vercel's certification under the EU-US Data Privacy Framework. The website privacy policy covers this in full.
No automated decision-making including profiling with legal effect (Art. 22 GDPR) takes place: Nadir computes figures for your information, and no decisions about you are derived from them. The figures are not a medical finding and do not replace medical advice. You are under no statutory or contractual obligation to provide us with personal data. The only recipients of data are our hosting provider Vercel as a processor and — for downloads — Apple as a separate controller.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent you have given — in particular for Health access — can be withdrawn at any time with effect for the future in the iOS settings. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de.
Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
For requests concerning your rights, please write to app@goswami.de.
We update this policy when the app or the legal situation changes. The version published here is the one that applies.
This English text is a translation of the German original, which is the legally binding version. We have translated it carefully rather than mechanically — if you spot a passage where the two differ in substance, please tell us at app@goswami.de and we will correct it.