Privacy Policy

Privacy Policy

Last updated: 24 September 2026

1. Overview

This policy explains what personal data we collect when you visit our website or use our mobile applications (together the “Services”), why we collect it, how we use it and which choices you have. “Personal data” means any information that directly or indirectly identifies you.

This policy currently covers the following apps:

  • Brogress – Smart Strength Log (Android) – a workout and strength-training log.
  • Cullis (Android) – a privacy audit and app management / debloating tool.

Section 7 describes what applies to all of our apps and the differences between them.

2. Controller

Controller: Sebastian Schmitt, c/o Block Services,
Stuttgarter Str. 106, 70736 Fellbach, Germany
E-mail: [email protected]

2.1 Data-Protection Officer

According to § 38 BDSG we are not obliged to appoint a data-protection officer.

3. Data We Collect

3.1 Website

  • Hosting: Our website is hosted by Namecheap, which may process limited personal data, such as IP addresses, in server logs for security and operational purposes. According to their policy, they derive broad demographic information from this data to improve their services. We do not actively store these logs ourselves.
  • Cloudflare: Our website uses Cloudflare, which is essential for content delivery and protection against attacks. Cloudflare may process personal data (e.g., IP address) according to its Privacy Policy.
  • Google Fonts: We load Google Fonts only after you have given your consent via our cookie banner. Google may process personal data (e.g., IP address) according to its Privacy Policy.
  • Caching: This site uses caching via QUIC.cloud to improve load times. QUIC.cloud may process data (e.g., IP address, crash logs) for technical support according to its Privacy Policy.

3.2 Mobile Apps

  • Purchase metadata (Google Play Billing): purchase token, product ID, purchase time, price, currency and, for subscriptions, renewal status.
  • Usage and diagnostics (Google Firebase Analytics and Crashlytics): pseudonymous usage events, device information and crash reports, as described in section 7.1.
  • App content (your workouts in Brogress, the app inventory analysed by Cullis): processed and stored only on your device. We do not receive it.

Our apps do not require an account, and we do not operate our own servers that receive data from them.

4. Purposes and Legal Bases

  • Performance of a contract (Art. 6 (1)(b) GDPR) – providing and billing in-app purchases and subscriptions, delivering customer support.
  • Legitimate interests (Art. 6 (1)(f) GDPR) – safeguarding IT security, preventing fraud, keeping our apps stable (crash reporting) and understanding how our Services are used in order to improve them.
  • Consent (Art. 6 (1)(a) GDPR & § 25 (1) TDDDG) – loading non-essential website resources such as Google Fonts. Consent can be withdrawn at any time with effect for the future.
  • Legal obligations (Art. 6 (1)(c) GDPR, HGB, AO) – bookkeeping, tax and consumer-protection duties.

5. Cookies and Similar Technologies (§ 25 TDDDG)

We use essential cookies to operate the website and ensure its accessibility. All other cookies or comparable technologies (e.g., Google Fonts) are used only after you have given explicit consent via the cookie banner. You can withdraw or change this consent at any time using the buttons provided in the footer of this website.

6. Server Log Files

Our web hosting provider (Namecheap) automatically collects access logs that may include your IP address, browser type and timestamps. These logs are stored on Namecheap’s servers and retained for a period determined by their internal policies, typically for operational security and abuse prevention. We do not access or use this data except for technical troubleshooting or abuse detection.

7. Mobile Apps

7.1 What Applies to All Our Apps

Distribution and billing. Our apps are distributed via Google Play and use Google Play Billing for purchases. When you make a purchase, Google sends us a unique purchase token plus product ID, price, currency and purchase timestamp. We do not receive your name, address or payment details; payment is handled entirely by Google.

Analytics and crash reporting. We use Google Firebase Analytics and Firebase Crashlytics to understand how our apps are used and to keep them stable:

  • Firebase Analytics records usage events (e.g., app opens, screens viewed, session duration), device and app information (e.g., device model, Android version, app version, language, approximate country) and a randomly generated app-instance identifier.
  • Firebase Crashlytics records crash reports (stack trace, device state at the time of the crash) together with a randomly generated installation identifier.

These identifiers are pseudonymous: they do not contain your name or contact details, and we cannot use them to identify you. We do not use this data for advertising or cross-app tracking and do not sell or share it. Google processes this data on our behalf as a processor. Analytics data is retained for up to 14 months; crash reports are retained by Google for 90 days.

Device backups. Depending on your device settings, Android may include app data in your personal Google backup. This backup is controlled by you and Google; we have no access to it.

Usage statistics (opt-in): Firebase Analytics is disabled by default in our apps. It is only activated if you turn on “Share usage statistics” under Settings (legal basis: your consent, Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). You can turn it off at any time; this stops collection and resets the analytics identifier on your device.

7.2 Brogress – Smart Strength Log

  • Workout data: Everything you log (e.g., exercises, sets, repetitions, weights, notes and any body measurements you choose to enter) is stored only on your device. It is not uploaded to us or any third party.
  • Purchases: Premium features and subscriptions are handled via Google Play Billing as described in section 7.1.
  • Analytics: Firebase Analytics and Crashlytics as described in section 7.1. Your workout content is not included in analytics or crash reports.

7.3 Cullis

  • Installed apps: To perform its privacy audit, Cullis reads the list of apps installed on your device together with related information (e.g., app name, package name, icon, requested permissions, whether an app is a system or user app). This requires the “Query all packages” permission. This information is analysed only on your device. It is never transmitted to us or any third party and is not included in analytics or crash reports.
  • Shizuku (optional): If you choose to connect Cullis to Shizuku, Cullis can perform actions such as disabling or uninstalling apps for the current user. These commands are executed locally on your device through the Shizuku service; no data is sent to us in the process. Shizuku is a separate app provided by a third party and is subject to its own terms.
  • Purchases: Cullis Premium is a one-time purchase handled via Google Play Billing as described in section 7.1.

8. Sharing of Data

  • Service providers (hosting, content delivery, analytics, payment processing) as described above.
  • Public authorities where required by law or to protect legal rights.
  • Other third parties only with your explicit consent.

Some recipients (e.g., Google, Cloudflare) may process data outside the EEA, in particular in the USA. Such transfers are based on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses.

9. Retention

Website: We do not actively collect or store personal data on this website. Our hosting provider may process limited personal data, such as IP addresses, in server logs for security and operational purposes. We do not use this data to identify visitors; however, under applicable data protection law, IP addresses may still qualify as personal data. The retention period of these logs is determined by Namecheap and has not been publicly disclosed; see their Privacy Policy.

Cache files are temporary copies of web pages that expire automatically. They may be accessed by QUIC.cloud for technical support; see their Privacy Policy. Other third-party services (e.g., Cloudflare, Google Fonts) retain data according to their own policies (Cloudflare, Google).

Mobile apps: App content stays on your device until you delete it (see section 11). Firebase Analytics data is retained for up to 14 months and Crashlytics crash reports for 90 days. Purchase records are kept by Google and, where required, by us for the statutory retention periods under German commercial and tax law.

10. Your Rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR and § 34 BDSG). You may withdraw any consent at any time with effect for the future. Because we cannot link pseudonymous analytics identifiers to you, we may need information from you (e.g., your app-instance identifier) to process requests relating to that data.

11. Data Deletion

App data is stored locally on your device. You are responsible for managing, backing up or deleting it.

  • Brogress: You can delete all locally stored data using the “Factory Reset” option in the app settings, by clearing the app’s storage in Android settings, or by uninstalling the app.
  • Cullis: Cullis only stores your settings locally. You can delete them by clearing the app’s storage in Android settings or by uninstalling the app. Changes you made to other apps via Shizuku (e.g., disabled apps) are not undone by uninstalling Cullis.

12. Right to Complain

You can lodge a complaint with any supervisory authority, in particular the one competent for your habitual residence. Our lead authority is:
Unabhängiges Datenschutzzentrum Saarland
Die Landesbeauftragte für Datenschutz und Informationsfreiheit
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Phone: +49 681 94781-0 · E-mail: [email protected]
A full list of German authorities is available at bfdi.bund.de/anschriften.

13. Security

We use TLS encryption for all data transfers and maintain technical and organisational measures to safeguard your data against unauthorised access, alteration or deletion.

14. Children’s Privacy

Our Services are not directed to children. If we become aware that a child has provided personal data, we will delete it immediately.

15. Changes to This Policy

We may update this policy from time to time, for example when we release a new app or change the services we use. The current version is always available on this page; material changes will be announced on our website.

16. Contact

For any questions about this policy, write to [email protected].