GentleGet it on the App Store

Privacy

Stand: 4 September 2026

1. Controller

The controller for the processing of personal data within the meaning of Art. 4(7) GDPR is:

Provider
Marvin Kicha
Address
Hueskenboerde 34
45136 Essen
Deutschland
Email
hello@deckle.io

No data protection officer has been appointed, and none is required: fewer than twenty people are permanently engaged in automated processing (§ 38(1) of the German Federal Data Protection Act), and there is neither large-scale regular monitoring nor large-scale processing of special categories of data within the meaning of Art. 37(1) GDPR.

2. What stays on your device

Gentle stores the following only locally on your iPhone. It is never transmitted to us or to anyone else, and we cannot see it:

  • the first name you may choose to give
  • which sessions you have completed, which days you practised, and how many minutes on each day
  • your favourites and where you last stopped in a session
  • settings such as voice, background sound, accent colour, appearance and reminder time
  • how often you have already heard a particular session (so the opening varies)
  • the text you type during a tapping practice. It does not leave the device. The spoken guidance only refers to it (“what you just wrote down”) rather than reading it back.

In legal terms this is the storing of information on your terminal equipment under § 25 of the German Telecommunications Digital Services Data Protection Act. No consent is required, because the storage is strictly necessary to provide the service you have expressly requested (§ 25(2) no. 2). No processing by us takes place, because this data never reaches us.

You can remove all of it at any time in the app under You → Delete local data. Deleting the app removes it as well.

3. Loading the content

The course texts, course artwork and the spoken audio files are held in object storage at Cloudflare (Cloudflare R2, served from audio.meditation.deckle.io). When your app loads a session, your IP address is transmitted to Cloudflare — unavoidably, as with any request on the internet — so that the file can reach your device at all.

We keep no access logs for this. Logging requests is not switched on by default in Cloudflare R2; it would have to be set up deliberately. We have not done that. No record is created on our side of who loaded which session and when.

Cloudflare processes the IP address in order to deliver the file and to defend against attacks and abuse. What Cloudflare itself stores, and for how long, is governed by Cloudflare's own statements: cloudflare.com/privacypolicy .

The files that are loaded are identical for everyone and are named after a checksum of their content. They contain nothing that points to you.

Purpose is delivering the content you requested in the app. Legal basis is Art. 6(1)(b) GDPR, because the request is necessary to provide the service you asked for, and additionally Art. 6(1)(f) GDPR for defending against abuse.

Processing on our behalf and transfers outside the EU: Cloudflare acts as our processor under Art. 28 GDPR. A transfer to the United States cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision under Art. 45 GDPR. Standard contractual clauses apply in addition.

4. The spoken voice

The spoken sessions are fully pre-produced. We generate them once before publication, after which they sit as finished audio files in the storage named in section 3.

The app generates no speech itself and sends no data to third parties for that purpose. Neither your name nor your progress nor your tapping text is transmitted to any speech provider.

5. Purchases and subscriptions

Gentle Plus is handled entirely through the App Store. Purchase, payment, renewal and cancellation all run through Apple. We receive no payment details, no address and no Apple Account; our app only learns whether a valid entitlement exists for this device.

Apple is independently responsible for processing within the App Store. Apple's privacy policy applies: apple.com/legal/privacy .

6. Feedback

When you use Feedback & requests in the app, exactly the following is sent to us:

  • the category you chose (problem, request or general) and the topics you tapped
  • the text you wrote
  • the app's version and build and your device's language setting, so a reported bug can be placed
  • an email address — but only if you fill that field in. It is optional; leave it blank and nothing is sent.

Without contact details, feedback reaches us anonymously. We receive neither a device identifier nor a user identifier and cannot attribute it to you. A link to your person arises only where you create one yourself — through the email field, or through what you write.

Legal basis for handling feedback is Art. 6(1)(f) GDPR; our legitimate interest lies in fixing bugs and improving the app. If you give an email address, we process it solely in order to reply to you — the legal basis for that is Art. 6(1)(a) GDPR, the consent you give by filling the field in voluntarily and can withdraw at any time.

Sending also transmits your IP address to our server, unavoidably. It is processed only transiently, to limit for a short time how many messages arrive from one address, and is neither combined with the feedback nor stored permanently.

To deliver it as email we use Mailgun (Mailgun Technologies, Inc., part of Sinch Email) as a processor under Art. 28 GDPR; a data processing agreement is in place. Sending runs through the provider's EU region, so the data is processed within the European Union. As the contracting party is a US company, access from outside the EU cannot be entirely ruled out; Mailgun Technologies, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), with standard contractual clauses in addition.

Feedback that includes contact details is deleted once the matter is settled, and after 12 months at the latest. Feedback without contact details contains no personal data and may be kept for evaluation.

7. This website

The website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Deutschland. When you visit, the server processes the usual access data (IP address, time, page requested, volume transferred, referrer, user agent) in server logs. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure and uninterrupted operation. These logs are kept only as long as that requires and are then deleted automatically.

Hetzner Online GmbH acts as our processor under Art. 28 GDPR; an agreement to that effect is in place. The servers are located in Germany, and no transfer outside the EU takes place in this respect.

  • This website sets no cookies and uses no local storage.
  • There is no audience measurement and no analytics.
  • Fonts are served from our own server. There is no connection to Google Fonts or any other third party.
  • No maps, videos, social media elements or other third-party content are embedded.

8. What does not happen

  • no advertising and no advertising identifiers
  • no tracking, no analytics tools, no third-party SDKs for analytics
  • no automated decision-making and no profiling within the meaning of Art. 22 GDPR
  • we do not sell your personal information, and we do not share it for cross-context behavioural advertising
  • no access to contacts, photos, location, microphone or camera
  • no health data within the meaning of Art. 9 GDPR: Gentle makes no diagnosis, records no symptoms and stores nothing about your state of health. The mood you pick serves only to choose a practice and stays on the device.

9. How long data is kept

Local data stays on the device until you delete it in the app or remove the app. We keep no access logs for content delivery, so nothing arises there that could be deleted (section 3). This website's logs are deleted automatically once they are no longer needed for secure operation (section 7). For feedback, the period named in section 6 applies.

10. Your rights

You have the following rights in relation to us:

  • access to the data processed about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Because we cannot identify you and keep no accounts, we are usually not in a position to connect you to a particular processing operation (Art. 11 GDPR). If you wish to exercise a right, please tell us what your request relates to — the time you sent feedback, for instance.

Independently of that, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Authority
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Address
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Email
poststelle@ldi.nrw.de
Website
ldi.nrw.de

You may equally turn to the supervisory authority where you habitually reside or work.

11. Children

Gentle is made for adults and is rated 9+ in the App Store. We do not knowingly collect data from children. As the app needs no account and works locally, no processing by us arises in any case.

12. Changes

We update this statement when the app or the law changes. The version published here at the time applies; the date above gives its state.