Privacy policy

01What this covers

This policy has three separate parts:

• using the iPhone app CED Buddy (sections 3 to 7),
• emails to apps@wullschleger.dev: support, feedback and contact requests through the website (section 8),
• visiting the website wullschleger.dev, meaning the start page, the app pages and all other pages under this address (section 9).

CED Buddy is a personal journal for people with Crohn's disease or ulcerative colitis. The app makes no diagnoses and gives no treatment recommendations.

02Controller and contact

The controller for the app and the website is:

Email for support and all privacy questions: apps@wullschleger.dev

I run the app and the website as a private individual. In this policy, “I” means this controller.

03Data in the app

In the app you record yourself:

• an optional nickname for the greeting,
• your daily wellbeing, symptoms and bowel movements,
• notes and marks “for the doctor's visit”,
• meals with a name and, if you like, a photo, plus saved meals to reuse,
• settings such as language, appearance and reminder time.

This information is health data and therefore particularly sensitive. The app asks for no account, no email address and no real name, and collects no device identifier.

The data is stored only on your device, in an encrypted database (SQLCipher); photos are encrypted individually (AES-256-GCM). The keys are kept in the iPhone keychain, tied to this device and do not move to another device. The app marks its data as “do not back up” for iCloud and computer backups of the device.

One exception while taking a photo: as long as you are editing a meal with a new photo, a resized copy is stored unencrypted in the app's cache. The app deletes it when you save or discard, at the latest at the next start.

The app uploads nothing to a server of mine; there is no such server and no sync. I therefore can neither see nor recover your entries.

Deleting: you delete meals, symptoms, bowel movements and notes one by one in the app; you can edit check-ins and remove the nickname at any time. If you delete the app, iOS removes the app and the entries stored in it from the device. Whether storage is physically overwritten is up to iOS.

Links to the website

In Settings, on the “Help & contact” and “Privacy” screens, “Help page on the web” and “Privacy policy” only open this website when you tap them, in your iPhone's default browser outside the app. The address contains only the page and the language, nothing from your journal and nothing about your purchase. Section 9 then applies to the visit.

04Permissions and reminders

Reminders are local iPhone notifications with fixed texts, without names or health information. There are no push notifications through a server.

05Backup file

A backup file is only created when you create it. It contains your entries and, if you choose, the photos, and is encrypted with a password you choose. Where you put it via the share sheet (for example Files, AirDrop or Mail) is up to you. The copy the app briefly creates for this is encrypted too and deleted afterwards.

Anyone with the file and the password can read your journal. A forgotten password cannot be reset, not even by me.

When restoring, the app opens the chosen file with your password, checks it and shows you what it contains. Only when you confirm does the content of the file replace all entries on the device. The app only imports CED Buddy backups.

06Report PDF

A PDF report for a doctor's visit is only created at your request. It contains the health information you select for the period and contents, is not password-protected and contains no meal photos. It only includes your nickname if you switch that on.

Whether and with whom you share the PDF is your decision, in the share sheet. Once shared, the PDF is readable without encryption; I am not responsible for further processing by recipients or by the app you choose. While the PDF view is open, the file is stored unencrypted in the app's cache; the app deletes it when you close the view, at the latest at the next start.

07Purchasing doctor reports through Apple

You unlock the PDF reports with a one-time in-app purchase; there is no subscription. The app uses Apple's StoreKit directly, without a third-party library and without a server of its own.

Apple handles the purchase, payment, Apple Account, Family Sharing and refunds under its own terms. The app sees neither payment methods nor account data. StoreKit connects to the App Store when the app loads the price, when you buy or restore purchases, and when the system syncs transactions.

Only while it runs does the app know whether a purchase confirmed by Apple exists, its transaction number (to complete the purchase) and the price text. The app stores, logs or sends none of this. Journal data is neither used nor transferred for the purchase.

How Apple processes data is described in Apple's privacy policy: www.apple.com/legal/privacy

08Emails to apps@wullschleger.dev

When you use “Contact support” or “Give feedback” in the app under Settings › Help & feedback, or open an email link on this website (support page or contact section of the start page), an email draft opens: for “Give feedback” in Apple's mail dialog inside the app, otherwise in your mail app. It is only sent if you send it. The message then goes from your sender address through your mail provider to apps@wullschleger.dev. Because of the sender address, it is not anonymous.

I receive what you write and attach, your sender address and the name your mail app sends along, and the usual technical information of an email such as the time and the mail servers involved. You see what the app prepares itself before sending:

• An email from “Contact support” has the app's name and version as its subject, for example “CED Buddy 1.0.0: help”. The app fills in nothing else.
• For feedback, the subject names the kind of feedback (for example “[CED Buddy][BUG] Feedback”), and the text contains the category and what you wrote. App version and build, operating system and version, app language and appearance are only added if you switch on “Add technical details”. If Apple's Mail app is not set up, you can copy the message or the address to the clipboard with a tap, or open your default mail app. The app does not store the feedback text; it only remains while the screen is open.

The app does not automatically add your nickname, journal entries, photos, health information, purchase data, device identifiers or location. Whatever you write or attach yourself does reach me, though. Please leave out personal health information, findings, doctor's reports, backup files and report PDFs. I do not need them for support and do not ask for them.

I use the messages to reply to you, fix bugs, evaluate factual suggestions for improvement and answer general requests. I handle support myself, do not automatically forward messages to other mailboxes and use contact details neither for a newsletter nor for advertising.

If health information arrives anyway

Health information, findings, doctor's reports, backup files or reports that are not needed for your request are not used for anything else: not to develop the app, not in notes or tickets and not in AI tools. I do not quote them in my reply. As soon as I notice them, I answer the request without this information and delete the message with its attachments as soon as possible, including from the trash and from my own copies. I do not keep them until the six-month limit. If I need more details about a bug, I ask you for a new description with made-up data.

Mail provider

The mailbox apps@wullschleger.dev is hosted by Infomaniak Network SA, Geneva, Switzerland. Infomaniak processes the messages on my behalf. According to Infomaniak's terms for its Mail Service (version of 27 May 2026), data is stored exclusively in data centres in Switzerland owned by Infomaniak. Infomaniak backs up mailbox content daily and keeps these backups for seven days.

How long I keep messages

• While a request is open, I keep the messages I need to handle it.
• I delete completed requests (support, feedback and contact) as soon as I no longer need them, no later than six months after they are closed. This applies to your messages and to my replies. Health information sent unnecessarily falls under the shorter rule above.
• I only keep individual messages longer if a statutory retention obligation applies or I need them for a specific legal claim, and only as long as necessary for that.
• I may keep factual bug descriptions and ideas separately, in my own words and without personal reference (no names, addresses or health information), to develop the app further.

I check the mailbox for this manually at regular intervals; there is no automatic deletion in place. After deletion, messages may remain in Infomaniak's technical backups for up to seven days.

09Visiting the website

This section applies to all pages under wullschleger.dev. The website is a static website: it has no contact form, no account and no comments.

Delivery and security by Cloudflare

The website is hosted on Cloudflare Pages and delivered through Cloudflare's network (Cloudflare, Inc., USA). With every request, Cloudflare receives the technically necessary information: IP address, time, requested address, referring page (referrer), browser and system details and other connection data. Cloudflare needs it to deliver the pages, defend against attacks and abuse and detect faults. From it, Cloudflare creates aggregated statistics, such as number of requests, countries and status codes, which I see in the Cloudflare account.

How long Cloudflare keeps this connection data is set by Cloudflare; Cloudflare does not state a fixed period for it. More: www.cloudflare.com/privacypolicy

The pages themselves set no cookies and store nothing in your browser; the language is part of the address (/en for English). If Cloudflare considers a request automated, it may show a security check and set a security cookie for it (for example “cf_clearance”). Such cookies protect the website; they are not used for analytics.

No web analytics

The website uses no web analytics: no analytics or statistics script, no measurement in your browser. The aggregated figures I see in the Cloudflare account come only from the connection data Cloudflare receives anyway when delivering the pages (see above).

Error reports (Network Error Logging)

With every page, Cloudflare sends the instructions “NEL” and “Report-To”. They let your browser report to Cloudflare when a connection to wullschleger.dev fails, for example because of a DNS or connection error. Successful requests are not reported. Such a report contains, among other things, the affected address, referring page, type of error, duration, protocol and the server's IP address. According to Cloudflare, it uses your browser's IP address only briefly to derive country and network provider and does not store it. Your browser follows the instruction for up to seven days; this is not a retention period at Cloudflare.

Links and downloads

Fonts, images and the CV as a PDF come from wullschleger.dev itself. Links to GitHub, LinkedIn, g.dev, Apple or authorities only open those sites when you click them; their privacy policies apply there. “Copy address” only puts the address on your device's clipboard. The website's addresses contain no journal content, email addresses or purchase data.

10Purposes and legal bases

I process personal data under the Swiss Federal Act on Data Protection (FADP) and only for the purposes named in this policy. I do not ask for consent: neither using the app, nor visiting the website, nor sending an email counts as consent. I make no automated individual decisions and build no profiles of you.

I do not process your journal data. It is only on your device and only reaches me if you send it to me yourself.

Where the EU General Data Protection Regulation (GDPR) applies to processing, for example when you live in the EU and write to me, I rely on these legal bases:

I do not process health information you write into an email unasked for any purpose of my own. I rely neither on consent nor on any other exception under Art. 9 GDPR for it; instead I end the processing by deleting it as described in section 8.

11Recipients and processing abroad

For transfers to the USA, Cloudflare states that it is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework and additionally uses standard contractual clauses. Since 15 September 2024, the Swiss Federal Council recognises an adequate level of data protection for US companies certified under the Swiss-U.S. Data Privacy Framework. Cloudflare describes its role as follows: for content passing through its services and for customer logs, Cloudflare processes data on behalf of its customers; for certain other data, Cloudflare is itself responsible.

I do not sell personal data and do not pass it on for advertising. There are no other recipients, unless I were legally obliged to disclose data.

12Your rights

Under the FADP you can request information about your personal data, have your data handed over or transferred, have incorrect data corrected and have data deleted. You can also object to processing. You can file a report with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch/en

Where the GDPR applies, you also have the right to restriction of processing and to data portability, and the right to object at any time to processing based on legitimate interests. You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

For all of these requests, including if you want your emails deleted, write to apps@wullschleger.dev. If I am not sure that a request comes from you, I may ask for confirmation, for example a reply from the address you wrote from.

Your journal entries are only on your device. You manage and delete them yourself in the app; I cannot provide information about them because I do not have them.

13Changes

If the app or the website changes in a way that other data is processed, I will update this policy. The version with the latest date applies.