Schliffit for Android — privacy policy

Schliffit is an Android app for training and food logging, made by Atomish (“we”). This page explains what the app keeps, what leaves your phone, and why. It covers the same data practices as the iOS privacy policy.

The short version

• There is no account and no sign-in.
• Your diary stays on your phone. We cannot see it.
• No analytics, no advertising, no tracking.
• Barcode lookups, and food corrections if you leave sharing on, go to our food catalogue. They are not linked to you.

What stays on your phone

Your meals, workouts, GPS routes, weigh-ins, goals, training programme, period logs, Daily Challenge progress, custom exercises, profile, and the foods you have scanned or corrected with their photos. They are stored in the app on your device and are included in your phone’s normal backup, which Google or you control.

On a Pixel with the on-device model available, workouts and plans are generated on the phone and nothing is sent anywhere to make them. On other phones the app asks our server instead — see AI-generated plans on other phones below.

Delete everything in the app’s privacy settings removes all of it from the phone. Deleting the app does too.

What leaves your phone

Barcode lookups

When you scan a barcode the phone has not seen before, the barcode number is sent to the Schliffit food catalogue at www.atomish.co.uk, a server we run. If the catalogue does not have the product, our server asks Open Food Facts and keeps a copy. If the catalogue cannot be reached, the app asks Open Food Facts directly.

Searching by name

A food name you search for is sent to the Schliffit food catalogue first, and then directly to Open Food Facts, a non-profit food database, for more results. Our server does not store your searches; its standard access logs record each request, including the words searched, for up to 14 days. Open Food Facts’ privacy policy applies to the request sent to them.

Food corrections

When you correct a food, the values you changed are sent to the catalogue with a random ID created on your phone. The ID is not connected to your name, your Google account or anything else in the app. Deleting the app makes a new one.

The server stores a keyed hash of that ID with your values, never the ID itself, and a keyed hash of the network part of your IP address for 30 days. It never stores your IP address or the ID in readable form.

You can turn this off in the app’s privacy settings. Your corrections are then kept on the phone only.

Photos you choose to share

A photo you add to a food stays on your phone. It is sent only if you tick Share this photo to help others?, which is off by default. The phone redraws the image without its location, date or camera details, and the server removes any remaining metadata.

AI-generated plans on other phones

A phone without an on-device model cannot generate a plan on the phone. With your agreement, shown at onboarding, the app then sends a short, anonymised description of the request to the Schliffit server at www.atomish.co.uk: the goal, planned minutes, body areas, a capped summary of recent weights for the exercises involved, exercise and equipment lists, any note you typed, and your language. The server builds the actual question from only those fields and relays it to our AI provider, Mistral, then returns the plan.

Each request also carries a random ID created on your phone, not connected to you; the server stores only a keyed hash of it, used to limit each install to 20 requests a day. Requests are signed with a time-based code so a captured request cannot be replayed. The server does not keep the contents of AI requests. Your meals, routes, weigh-ins and the rest of your diary are never sent.

What every request carries

Like any web request, each one carries your device’s IP address and the app’s name and version. Our web server keeps standard access logs, which include IP addresses, for up to 14 days. The app sets no cookies and none of these requests includes your meal diary.

Purchases

Schliffit is unlocked with a purchase through the Google Play Store. Google handles the payment. We receive no payment details and not your Google account details.

Permissions

• Health Connect: if you connect it, reads your step count and workout energy. Never writes anything back.
• Location: only while a run, ride or hike you started is in progress. Your route stays on your phone.
• Camera: only to scan barcodes.
• Photos: only the photo you pick.
• Calendar: write-only, to add sessions you export.
• Music: to play, pause and skip while you train.
• Motion: while the app is open, for the tilt effect. Never stored or sent.
• Notifications: to remind you of planned sessions. No advertising.

You can change any permission in Android Settings at any time.

Who else sees data

No one, apart from Open Food Facts as described above. We do not sell data and do not share it with advertisers.

Your rights

Under UK data protection law you can ask what we hold about you and ask us to delete it. Because nothing on our server is linked to you, we usually cannot find which records came from you, but we will help where we can. You can also complain to the Information Commissioner’s Office.

Changes

If what the app sends changes, we update this page and the date at the top.

Contact

Atomish · Atomish@outlook.com