calmloop

Privacy Policy

This is a courtesy translation of the German version at /de/privacy. In case of discrepancies, the German version prevails.

1. Data Controller

Controller for data processing on this website:

Balane GmbH
Balanstraße 84
81541 München
Germany
Email: contact@balane.tech
Managing Director: Jonas David Höttler

2. Data Protection Officer

No DPO has been appointed, as the statutory requirements under Art. 37 GDPR and § 38 BDSG do not apply. For data protection matters please contact us directly at contact@balane.tech.

3. General Information

  • SSL/TLS encryption: This website uses transport encryption to protect data in transit.
  • Web fonts: We use Fraunces and Inter. These fonts are downloaded by Next.js via next/font/google at build time and served from our own domain. At runtime there is no connection to Google servers.
  • Automated decision-making under Art. 22 GDPR does not take place.

4. Hosting & Server Logs (Vercel)

Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

Processed data: IP address, access date and time, requested file names and URLs, referrer URL, browser and operating system information.

Purpose: Technical provision of the website, system security, service optimisation.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional operation).

Retention: Typically 7–30 days.

Third-country transfer: The provider is based in the USA. The transfer takes place on the basis of certification under the EU-US Data Privacy Framework (Art. 45(3) GDPR) and additionally on the basis of Standard Contractual Clauses. Official US surveillance access cannot be fully excluded.

5. The Calmloop app — local, no servers

Calmloop (the mobile app for iPhone, iPad, Android phones and tablets) is built so that your entries (moods, notes, plans, experiments) are stored only on your device. There are no Calmloop servers that receive this data.

If you enable device sync, your data travels through your own iCloud account (iOS/iPadOS) or Google Drive (Android). Calmloop itself never sees these entries.

The app uses no trackers, no analytics SDKs and no advertising identifiers. You are not required to provide personal data to use the app.

6. Reach Measurement (Umami)

For website analytics we use Umami, a privacy-focused open-source analytics tool that we host on our own instance.

Processed data: truncated/hashed IP address, anonymised device and browser info, page viewed, referrer URL, timestamp, approximate country-level location.

Cookies / device access: Umami sets no cookies and does not access information stored on your device within the meaning of § 25(1) TDDDG. The IP hash is regenerated server-side daily and then discarded.

Purpose: Reach measurement, aggregated analysis of usage behaviour, service optimisation.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest; no consent required as no device access takes place).

Hosting of the Umami instance: Railway Corp., 2261 Market Street #4059, San Francisco, CA 94114, USA, server location: Amsterdam, Netherlands. Standard Contractual Clauses are in place. US authorities' access cannot be fully excluded; the hashing mechanism provides supplementary protection.

Retention: Aggregated statistics 24 months; pseudonymous individual records maximum 30 days.

7. Contact by Email

We do not use contact forms. Communication happens via mailto: links that open your local email client. The data you send us (email address, name, subject, message) is used to process your request.

Legal basis: Art. 6(1)(b) GDPR (for contract-related inquiries) and Art. 6(1)(f) GDPR (legitimate interest in responding).

Provision: Providing your data is neither legally nor contractually required, but necessary for a response.

Email provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Processing takes place on servers in Germany; no third-country transfer occurs. A data processing agreement is in place.

Retention: Deleted after processing unless statutory retention obligations apply (§ 257 HGB, § 147 AO). Non-business inquiries are deleted within 12 months of last contact.

8. External Links to App Stores and Third Parties

We link to the Apple App Store and Google Play. When you follow such links, the privacy policies of the respective providers apply. We disclaim responsibility for their data processing.

9. Recipient Overview

Personal data is transferred only to the following processors pursuant to Art. 28 GDPR:

  • Vercel Inc. (USA) — hosting
  • Railway Corp. (USA, servers in EU) — Umami hosting
  • IONOS SE (Germany) — email services

No advertising or other third-party transfers take place.

10. Data Backups

Encrypted backups of our Umami instance are created regularly. Backups are overwritten on a rolling basis within 30 days at most.

Legal basis: Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR (security of processing).

11. Your Rights as a Data Subject

You may exercise the following rights informally via email to contact@balane.tech:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

12. Right to Object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing serves to establish, exercise or defend legal claims.

Objections by email to contact@balane.tech.

13. Competent Supervisory Authority

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de

14. Changes to This Privacy Policy

We reserve the right to adapt this policy to new legal or factual circumstances. The version in force at the time of your visit applies.

Last updated: April 17, 2026