Schliffit privacy policy

Schliffit is an iPhone app for training and food logging, made by Atomish (“we”). This page explains what the app keeps, what leaves your phone, and why.

The short version

• There is no account and no sign-in.
• Your diary stays on your phone. We cannot see it.
• No analytics, no advertising, no tracking.
• Barcode lookups, and food corrections if you leave sharing on, go to our food catalogue. They are not linked to you.

What stays on your phone

Your meals, workouts, GPS routes, weigh-ins, goals, training programme, period logs, Daily Challenge progress, custom exercises, profile, and the foods you have scanned or corrected with their photos. They are stored in the app on your device and are included in your phone’s normal backup to iCloud or a computer, which Apple or you control.

On an iPhone with Apple Intelligence, workouts and programmes are generated on the phone and nothing is sent anywhere to make them. On an older iPhone the app asks our server instead — see AI-generated plans below.

Delete everything in Profile › Privacy removes all of it from the phone. Deleting the app does too.

What leaves your phone

Barcode lookups

When you scan a barcode the phone has not seen before, the barcode number is sent to the Schliffit food catalogue at www.atomish.co.uk, a server we run. If the catalogue does not have the product, our server asks Open Food Facts and keeps a copy. If the catalogue cannot be reached, the app asks Open Food Facts directly.

Searching by name

A food name you search for is sent to the Schliffit food catalogue first, and then directly to Open Food Facts, a non-profit food database, for more results. Our server does not store your searches; its standard access logs (described below) record each request, including the words searched, for up to 14 days. Open Food Facts’ privacy policy applies to the request sent to them.

Food corrections

When you correct a food, the values you changed (for example the protein per 100 g) are sent to the catalogue with a random ID created on your phone. The ID is not connected to your name, your Apple ID or anything else in the app. Delete everything, or deleting the app, makes a new one.

The server stores a keyed hash of that ID with your values, never the ID itself. So that one person or one network cannot outvote everyone else, it also stores a keyed hash of the network part of your IP address for 30 days, then deletes it. It never stores your IP address or the ID in readable form.

Your values are used only to decide what the catalogue shows. A value is shown to other people only once enough of them agree. Unusual activity is held for us to check by hand.

You can turn this off with Share my food corrections in Profile › Privacy. Your corrections are then kept on the phone only, and any that were still waiting to be sent are dropped. Values already sent stay in the catalogue, because we cannot tell which are yours.

Photos you choose to share

A photo you add to a food stays on your phone. It is sent only if you tick Share this photo to help others?, which is off by default. The phone redraws the image without its location, date or camera details, and the server removes any remaining metadata. We look at every shared photo: if we approve it, it becomes the product photo others see; if not, it is not shown to anyone.

AI-generated plans on an older iPhone

An iPhone without Apple Intelligence cannot generate a plan on the phone. With your agreement, shown at onboarding, the app then sends a short, anonymised description of the request to the Schliffit server at www.atomish.co.uk: the goal, planned minutes, body areas, a capped summary of recent weights for the exercises involved, exercise and equipment lists, any note you typed, and your language. The server builds the actual question from only those fields and relays it to our AI provider, Mistral, then returns the plan.

Each request also carries a random ID created on your phone. It is not connected to your name, your Apple ID or anything else in the app, and the server stores only a keyed hash of it, used to limit each install to 20 requests a day. Requests are signed with a time-based code so a captured request cannot be replayed. The server does not keep the contents of AI requests; its logs record only the time, the type of request and the hashed ID. Your meals, routes, weigh-ins and the rest of your diary are never sent.

What every request carries

Like any web request, each one carries your device’s IP address and the app’s name and version. Our web server keeps standard access logs, which include IP addresses, for up to 14 days for security and to fix faults. The app sets no cookies and none of these requests includes your meal diary.

Purchases

Schliffit is unlocked with a purchase through Apple’s App Store. Apple handles the payment. We receive no payment details and not your Apple ID.

Permissions

• Apple Health: reads your step count and the energy your Apple Watch measured during a workout. Never writes anything back, and nothing is sent anywhere.
• Location: only while a run, ride or hike you started is in progress, to measure distance and pace. Your route stays on your phone.
• Camera: only to scan barcodes.
• Photos: adding a photo to a food uses Apple’s photo picker. The app sees only the photo you pick.
• Calendar: write-only, to add sessions you export. The app cannot read your calendar.
• Music: to play, pause and skip while you train. Your library is never read or shared.
• Motion: while the app is open, to shade the background as you tilt the phone. Never stored or sent.

You can change any permission in iOS Settings at any time.

Who else sees data

No one, apart from Open Food Facts as described above. When our server asks Open Food Facts for a product, it sends only the barcode, from the server’s own address, not yours. The name searches that go to Open Food Facts are sent by the app directly. We do not sell data and do not share it with advertisers.

Your rights

Under UK data protection law you can ask what we hold about you and ask us to delete it. Because nothing on our server is linked to you, we usually cannot find which records came from you, but we will help where we can. You can also complain to the Information Commissioner’s Office.

Changes

If what the app sends changes, we update this page and the date at the top.

Contact

Atomish · Atomish@outlook.com