Deutsch

Privacy Policy

Last updated: 19 October 2026. In case of doubt, the German version prevails.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For any privacy questions or to exercise your rights, contact us at hello@qirise.app. We have not appointed a data protection officer as we are not legally required to.

2. Legal bases

• Contract (Art. 6(1)(b) GDPR): to provide the app and the features you use (account, training, progress, friends, league, dojo, chat, purchases).
• Consent (Art. 6(1)(a) GDPR, for health data also Art. 9(2)(a) GDPR): e.g. push notifications, Apple Health and, if enabled, usage analytics. You can withdraw consent at any time with effect for the future.
• Legitimate interests (Art. 6(1)(f) GDPR): secure and fair operation, e.g. preventing abuse and cheating, chat moderation and server logs.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. statutory retention duties.

We only store or access information on your device where this is strictly necessary for a feature you requested (Section 25(2) no. 2 TDDDG) or where you have consented (Section 25(1) TDDDG).

You are not legally or contractually required to provide data. Without an account you can use the app on your device; features with other users (friends, league, dojo, chat) and backing up your progress require an account.

3. This website

Hosting and server logs

The website qirise.app is hosted by Vercel Inc. (USA). When you visit, Vercel processes technically necessary data: IP address, date and time, requested URL (for invite links including the invite code), browser and operating system. This is needed to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR). Vercel keeps these logs only briefly. We use no cookies and no advertising on this website; usage statistics are only collected if you explicitly agree (see below). We have a data processing agreement with Vercel.

Fonts

The fonts (Zen Old Mincho and Zen Kaku Gothic New) are stored on our own web space and loaded from there. No connection is made to Google or any other font provider.

Horse stance test in the browser

On the horse stance test page you can choose to turn on your camera and measure how long you hold the horse stance (Ma Bu). The camera only starts once you tap “Start camera” and your browser grants access. Detection of your body posture (MediaPipe Pose Landmarker) runs entirely in your browser. Camera images are neither stored nor transmitted to us or third parties; your result also stays on your device until you share or download it yourself. To run the detection, your browser downloads the program library from the public jsDelivr network (delivered via providers such as Cloudflare and Fastly) and the detection model from Google servers (storage.googleapis.com, Google LLC, USA). As with any file request, your IP address and technical details such as browser and time are transmitted to these providers. The legal basis is your request to use the feature (Art. 6(1)(b) GDPR) and our legitimate interest in fast delivery (Art. 6(1)(f) GDPR).

Invite page

If you open an invite link without the app installed, the page shows the code from the link. “Copy” puts it on your clipboard. So you can see who invited you, the page uses the code to fetch the inviting person's username and avatar, or the dojo's name and member count, from our service provider Supabase (EU, Ireland). This transmits your IP address and the code; nothing is stored for this (Art. 6(1)(b) and (f) GDPR).

Website usage statistics (Mixpanel, only with consent)

On your first visit, a notice at the bottom of the page asks whether we may count which pages and buttons are used. Until you choose “Yes”, no statistics software is loaded, nothing is stored on your device and nothing is sent; we only remember your choice in your browser's storage so we don't ask again (Section 25(2) no. 2 TDDDG).

If you choose “Yes”, we use Mixpanel (Mixpanel, Inc., USA; data location: data centre in the EU), the same project as for the app's usage statistics. We then record: pages viewed with address, title and previous page (referrer), clicks on links and buttons including their label, how far you scroll, campaign details from the link (e.g. utm_source), clicks on the App Store button, a successful newsletter sign-up (without the email address), starting, length and sharing of the horse stance test, browser, operating system, screen size and language. For this, Mixpanel stores a random ID in your browser's storage (localStorage, not a cookie) so that several page views can be counted together. Form field input, your email address and camera images are never recorded. For invite links we do not send the address containing the invite code, only that an invite page was opened. Your IP address is technically processed during transmission but not used for location. The website ID is not linked to your app account. The library is hosted on our own web space.

The purpose is to improve the website and understand which content leads to the app. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the “Statistics” link at the bottom of every page or here; nothing more is sent and the ID is deleted from your browser. Mixpanel stores the data for up to 2 years.

Launch newsletter

On the home page you can choose to sign up with your email address to be informed about the launch of Qi Rise and occasional news. For this we process your email address, the time of sign-up and confirmation, your chosen language and your IP address at sign-up and confirmation, so we can prove your consent. After signing up you receive an email with a confirmation link; you are only added once you click it (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by writing to hello@qirise.app; we then delete your address, unless we need to keep it for a limited time to prove your earlier consent. We use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) as a processor to send the emails. For technical reasons Brevo counts whether an email was opened and a link in it was clicked (tracking pixel and redirect links). This count is anonymised and not linked to you or your email address; we do not analyse it or build profiles from it.

4. The Qi Rise app

4.1 Using the app without an account

You can start using the app without an account. The app then stores your avatar, goal, workouts and progress only on your device. We receive none of it.

4.2 Account with “Sign in with Apple”

Accounts use “Sign in with Apple”. Apple sends us a unique user identifier and, if you agree, an email address. You can choose to hide your real address at Apple; we then receive a relay address from Apple. We do not ask for your name. The account is created with our service provider Supabase (see section 5). Apple processes the sign-in itself under its own responsibility.

Purpose: creating your account, signing you in, backing up progress across devices. Legal basis: Art. 6(1)(b) GDPR.

Year of birth: Before you create an account, the app asks for your year of birth (only the year, not day or month). After you sign in, we store it with your account to enforce the minimum age of 16 (see section 9). It can only be changed through support. Legal basis: Art. 6(1)(b) and (c) GDPR.

4.3 Profile

We store your chosen username, your avatar and camp (Yin or Yang), your training goal, your starting level, the outfit you wear and a friend code. Please do not choose a username that contains your real name.

Username (publicly visible to other users): you choose your username yourself during onboarding (3 to 20 characters). Other users see it in the league, dojo, dojo chat, friends list, private chat, duels and notifications, and can add you as a friend by it. We store it together with the time of the last change (it can be changed at most every 30 days), check it against a block list (e.g. offensive names) and delete it with your account. Legal basis: Art. 6(1)(b) GDPR.

Profile photo (optional). Instead of your avatar you can choose your own photo as your profile picture. The app crops it on your device, adjusts the colours and checks it there with Apple's sensitive content detection; nothing is sent to Apple or third parties in the process. Only the finished image (512 × 512 pixels) is stored, in non-public storage at Supabase (EU, Ireland). Only you and people whose friend request has been accepted can see it; in the league, dojo, dojo chat and for everyone else your avatar is still shown. Friends can report a photo; we then review it and hide it until we have done so. If you block someone or the friendship ends, that person no longer sees your photo. You can remove the photo at any time under Settings → Profile Picture; it is deleted together with your account. Legal basis: Art. 6(1)(a) GDPR (your voluntary choice), withdrawn by removing the photo.

4.4 Training and progress

For each workout we store: the training unit, start time and duration, completed exercises and repetitions, whether an exercise was tracked by the camera (“verified”), your rating of the effort (easy, right, hard) and your time zone. From this, the server calculates experience points (XP), streak, rank, exams, league position, coins, jade and rewards. We also store learned techniques with their rating and your items. The server checks workouts for plausibility to keep leagues and challenges fair (Art. 6(1)(b) and (f) GDPR).

Returning after a break: if your last workout was four or more days ago, we record the length of the break, the outcome of your streak and any comeback reward with your next workout (so the reward is given at most every 14 days).

Fitness checks (voluntary): if you do a fitness check (about every four weeks), we store your results: push-ups in a row, horse stance hold time, squats in 60 seconds, your self-assessment of flexibility in centimetre steps and how each was measured (on-device camera, tapping, stopwatch, self-assessment). These results say something about your physical condition and are therefore specially protected: they are visible only to you (not in league, dojo, to friends or in notifications), are not used for advertising and are not shared. You can share them yourself as an image via the share menu. You can delete individual checks in the app under Profile, Your progress; all of them are deleted with your account. They are included in the data export. Legal basis: contract (Art. 6(1)(b) GDPR) as you use the feature voluntarily; insofar as this is health data, your explicit consent by voluntarily doing and saving the check (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting it.

Workouts completed offline are first stored encrypted on your device and uploaded once you are online again.

4.5 Camera

Using the camera is optional. It is only active when you use it in a workout or learning mode and have granted iOS access. Body pose detection (Apple Vision) runs entirely on your device. Camera images and videos are neither stored nor sent to us or anyone else. Only results are sent to the server, e.g. “20 reps, verified” or a technique's stars. You can revoke camera access at any time in iOS Settings.

Voice control (optional, off by default): if you turn it on and allow microphone and speech recognition in iOS, Qi Rise listens only during a running workout for the commands “next”, “pause”, “again”, “back” and “done”. Recognition runs entirely on your device (Apple's on-device speech recognition). Audio is neither recorded nor stored nor sent to us or anyone else. You can revoke access at any time in iOS Settings.

4.6 Apple Health and Apple Watch (optional)

If you explicitly allow it in iOS, Qi Rise uses Apple Health (HealthKit):

• Read: your date of birth, to calculate your heart rate zone, and your body weight, to estimate calories without an Apple Watch. Both are used only on your device and are not sent to us.
• Apple Watch: during a workout, the Qi Rise watch app measures heart rate and active energy and shows them live.
• Write: Qi Rise saves every counted workout to Apple Health as a workout (martial arts) with duration and calories, and with an Apple Watch also the heart rate readings.

Only a per-workout summary is sent to our server: average and maximum heart rate, time in the target zone and calories. The server uses it to check the “effort measured” bonus.

This is health data. We only process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give through the iOS Health permission. It is never visible to other users; others can at most see the “effort measured” badge. We do not use it for advertising, do not sell it and do not share it with third parties other than our hosting provider Supabase. You can withdraw access at any time in the Health app or iOS Settings; we delete stored summaries on request or with your account.

4.7 Friends, league, dojo and challenges

• League and dojo: other members see your username, avatar, weekly XP and position.
• Friends: friends also see your streak, rank and whether you trained today. Friendships only exist if both agree. You can remove friends at any time.
• Cheers and challenges: we store who cheered or challenged whom, and a challenge's stake and result.
• Invites: others can add you with your friend code or a dojo code. Once an invited person completes three workouts, you both get a reward; for this we store who invited whom.

Legal basis: Art. 6(1)(b) GDPR.

4.8 Dojo chat

We store your messages, reactions and their time. Members of your dojo see your messages together with your username and avatar. Automatic posts (e.g. “joined”, “completed a master workout”) also appear in the chat.

To protect the community there is a word filter, a message rate limit, reporting and blocking. If you report a message, we store the message, the reporter and the time in order to review the case. The app hides blocked people for you. Legal basis: Art. 6(1)(b) and (f) GDPR (safe chat, preventing abuse).

4.9 Notifications

• Daily reminder: scheduled locally on your device. No data is sent to us.
• Push notifications (e.g. friend request, cheer, rank-up): only if you allow them in iOS do we store the device token and send notifications via the Apple Push Notification service (APNs). The content includes usernames and short texts. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw in iOS Settings. We delete the token when you sign out or when Apple reports it as invalid.

4.10 Widget, Live Activity, calendar and photos

For the widget and the Live Activity on the lock screen, the app stores your streak, today's workout and images of your avatar in a protected area on your device. This data does not leave the device.

Only when you trigger it and iOS allows it, Qi Rise adds planned workouts to your calendar (write-only access) and saves share cards or courtyard photos to your photo library (add-only). Qi Rise cannot read your calendar or your photos, and nothing from them is sent to us.

4.11 Purchases and subscription

Purchases and the “Meisterweg” subscription are handled by Apple (in-app purchase). Only Apple receives payment details, not us. Apple confirms to us what you bought and whether your subscription is active, so we can unlock content (Art. 6(1)(b) GDPR).

RevenueCat: to manage and validate purchases we use RevenueCat, Inc. (USA) as a processor. RevenueCat receives your pseudonymous user ID (a random ID, after sign-in your account ID without a name), Apple receipts, purchased products and subscription status, country or currency, app version and device type. RevenueCat reports purchases and renewals to our server so your subscription applies on all your devices. Legal basis: Art. 6(1)(b) GDPR.

Gifts: if you gift Meisterweg to a friend or redeem a gift, we store who gave what to whom and when it was redeemed (Art. 6(1)(b) GDPR).

4.12 Crash reports (Sentry)

If the app crashes or a serious error occurs, it sends a report to Sentry (Functional Software, Inc., USA; data location: data centre in the EU, Frankfurt am Main). The report contains only technical details: device type, operating system, app version, the error with its stack trace, and whether a session ended without a crash. We send no user ID, no names, no screenshots, no network addresses and no content. The purpose is finding and fixing bugs. The legal basis is our legitimate interest in a stable app (Art. 6(1)(f) GDPR); where information is stored on your device for this, it is necessary for secure operation (Section 25(2) no. 2 TDDDG). You can turn crash reports off at any time in the app's settings. Sentry deletes reports after 90 days at the latest.

4.13 Usage statistics (Mixpanel, only with consent)

After onboarding, the app asks you once whether you want to share pseudonymous usage statistics. Only if you choose “Yes” do we use Mixpanel (Mixpanel, Inc., USA; data location: data centre in the EU) to record which areas are used and how, e.g. “workout completed”, “onboarding step reached”, app start and session length, together with a pseudonymous ID (before sign-in a random installation ID, afterwards your account ID without a name), app version, device type and language. Events before your answer stay in memory only and are discarded if you choose “No”.

We send no names, no usernames, no email address, no health data and no chat content. Your IP address is technically processed during transmission but not used for location. There is no tracking across other apps or websites and no advertising ID. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the app's settings; the app then sends nothing more and deletes events not yet sent. Mixpanel stores the data for up to 2 years.

4.14 Images and content of the app

Avatars, outfits and manga images are created with AI tools (including Higgsfield) before they are added to the app. No user data is processed in the process.

4.15 Contact and support

If you email us, we process your address and message to handle your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is hosted by AgentMail, Inc. (USA). We delete messages once your request is resolved and no retention obligation applies.

4.16 No automated individual decisions

League promotion and relegation, rewards and plausibility checks run automatically according to fixed game rules. They have no legal or similarly significant effect within the meaning of Art. 22 GDPR. We do not create advertising profiles.

5. Service providers and recipients

We only share data with service providers that we have carefully selected and contractually bound (data processing agreements under Art. 28 GDPR), or with services you use yourself:

We do not sell data or share it for advertising. Authorities only receive data where we are legally required to provide it.

6. Transfers to third countries

Some service providers are based in the USA. Where data is transferred there, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework if the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For Supabase, Sentry and Mixpanel the data is stored in EU data centres; access from the USA, for example for support or maintenance, cannot be ruled out and is safeguarded in the same way. You can request a copy of the Standard Contractual Clauses.

7. Retention and deletion

• Account, profile, workouts, progress, friendships, chat messages: until you delete your account. Deleting it in the app removes all related data from the database immediately; backups are purged after at most 7 days.
• Reported chat messages: until the case is resolved, at most 6 months, unless the account is deleted earlier or longer retention is needed to pursue legal claims.
• Push device tokens: until you sign out, Apple reports them as invalid, or the account is deleted.
• Website server logs: after a few days, according to Vercel's settings.
• Data without an account and in the widget: only on your device; deleted together with the app.
• Support requests: until resolved, then within statutory retention periods.
• Purchase records: where we receive them, up to 10 years (tax retention duty).

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)).

Directly in the app under Settings → Your data:

• Export data: profile, progress, workouts, techniques, exams and items as a JSON file.
• Delete account: permanently deletes your account and all related data.

For anything else, write to hello@qirise.app. We reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live. The authority responsible for us is: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

9. Age and minors

Minimum age 16

Qi Rise is intended for people aged 16 and over. Reason: several features are based on your consent (e.g. Apple Health, usage analytics), and in Germany you can only consent to the processing of your data yourself from age 16 (Art. 8 GDPR). On top of that come the chat with other people and in-app purchases.

Before an account is created, the app asks for your year of birth. We count from the year in which you turn 16. We rely on your honest answer and do not check IDs. Anyone younger cannot create an account; in that case we store nothing. Existing accounts without a year of birth are asked once at the next launch; if the age is under 16, you can delete the account in the app. If we learn that a person under 16 has an account, we will delete it.

10. Security

All connections between app, website and servers are encrypted (TLS). In the database, everyone can only read their own data; changes to progress only go through validated server functions. Sign-in credentials are stored in the iOS keychain, and local data is protected by iOS data protection.

11. Changes

We update this privacy policy when the app or the law changes. The current version is always available here and in the app under Settings → Legal. We will inform you about material changes in the app.