Privacy policy

As of: 2026-10-26, own research, not legal advice

This policy applies to the Lossboard app for iPhone and Android, to the website lossboard.app and to taking part in the browser. It explains which data we process, why, on which legal basis and what rights you have.

In short:

• You do not need an account. We do not know your name or email address unless you choose to give it to us.
• Your weight is health data. We only process it for the challenge you take part in. By creating or joining a challenge you consent to this (section 5).
• Everyone in your challenge knows they are taking part in a weight loss challenge. That is why, by default, the other members see your change in percent and in kg, your starting weight and your weight on the weigh-in day. You can hide your kg at any time with "Hide my kg".
• Only you see your daily entries between weigh-in days.
• There are no ads, no tracking for advertising and no sale of data. To improve the app we use usage analytics in the EU without weights or names, which you can turn off under "Me" with "Share usage data" (section 11).
• Our server is hosted by Hetzner in the EU.
• If you withdraw your consent, you leave the challenge and your weight data is deleted.

1. Controller

Johannes Müller
Simone-Veil-Straße 30
53121 Bonn
Germany

Email: [email protected]

For any privacy question, contact us at the email address above.

2. Terms and principles

• Challenge: a closed group of 2 to 30 people that can only be joined via an invite link or code. There are no public challenges and no way to search for strangers.
• Organizer: the person who creates and manages a challenge.
• Member: every person who has joined a challenge, including the organizer.
• Health data: As a precaution, we treat your body weight, your weight change and photos of your scale display as health data within the meaning of Art. 9 GDPR. This also applies to values derived from them, such as your change in percent.

We only collect what the challenge needs. We do not ask for your real name, date of birth, height, gender or location.

3. Identity without an account

When you first open the app or the participation page in your browser, the server creates a random ID and a random access token. The token stays on your device (in the app's protected storage, or in the browser's local storage). On the server we only store a hash of the token, not the token itself.

We also store: when the ID was created, your language, your unit (kg, lb or st), when you first created or joined a challenge (by doing so you declare that you are at least 18, see section 17), and your consents under section 5.

We do not set cookies in the browser. The token in local storage is strictly necessary so that you can keep taking part after reloading the page (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). No consent is required for this.

Legal basis: Art. 6(1)(b) GDPR (providing the app you want to use).

Recovery code

Under "Me", the app shows a recovery code. You can use it to move your participation to a new device. On the server we only store a hash of the code. Keep the code safe: anyone who knows it can take over your participation. Without the code we cannot restore your participation, because we have no other way to identify you.

Optional email address (prepared)

This section applies once the email feature is switched on.

You can choose to give us an email address. We only use it for two purposes, each of which you switch on yourself:

1. Recovery: we send you a one-time code to restore your participation on a new device.
2. Weigh-in day reminders when you take part in the browser, because there are no push notifications there.

We do not send newsletters or ads. You can delete the address at any time under "Me". Emails are sent by an email service provider based in the EU, acting as our processor.

Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw under "Me" or by email.

4. Data in the challenge

4.1 When creating a challenge (organizer)

Challenge name, start date, duration, weigh-in day, visibility (percent only, or percent and kg), whether a scale photo is required, challenge language and, optionally, the agreement as free text.

4.2 When joining (all members)

• Nickname: your choice. Please do not use your full real name if you do not want to.
• Starting weight.
• Consents as described in section 5, with timestamp and text version. We do not ask for any health details (for example pregnancy or an eating disorder) and store nothing about them.
• Role (organizer or member), time of joining, status (active, paused, left, removed).

4.3 During the challenge

• Weigh-ins: weight, date of measurement, week, source (manual, health import or photo) and earlier versions if you correct a value. For corrected values the organizer sees the label "corrected", not the old value.
• Scale photos, if the challenge requires them (section 5.3).
• Your device's push token and which reminders we sent on which day, so that you get at most one notification per day.
• Reports made by you or others (section 8).
• Flag for unusual values: if a value changes by more than 3 % between two weigh-ins, the server flags it for the organizer so that typos are noticed. This flag has no automatic consequence for you.

4.4 Who sees what

Weight gains are never shown to others as a negative value, only as 0 %. Anyone who has not weighed in yet is shown as "open". By default a challenge is set to "percent and kg"; the organizer can set it to "percent only", then nobody sees kg. Independently of that, you can choose at any time:

• "Hide my kg": the others see no kg of yours, only percent.
• "Hide my values": in images, weekly reports and the organizer's export you also appear without a percentage. In the leaderboard in the app your change in percent stays visible, because the leaderboard is based on it.

Legal basis for all health data in this section: Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR (explicit consent under section 5). For nickname, role and status also Art. 6(1)(b) GDPR.

5. Your consent by creating or joining

There are no separate checkboxes. Next to the button for creating or joining it says: "By creating the challenge (or by joining) you accept the Terms of Use and the Privacy Policy", with links to both texts. By tapping the button you explicitly consent to the processing that this challenge requires (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). What the challenge shows (percent and kg or percent only, scale photo or not) is visible to you before you join.

For each challenge we store which of the following consents were given this way, with timestamp and text version. You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). Processing before the withdrawal remains lawful.

5.1 Storing your weight and the ranking in percent (all challenges)

Lossboard stores your weight as health data, calculates your change in percent from it and shows that change together with your nickname to the members of the challenge.

You cannot take part without this processing, because the leaderboard does not work without your weight. Withdrawing therefore means leaving: if you withdraw, you leave the challenge and we delete your weight data for that challenge immediately. Nothing about you remains on the leaderboard. The organizer only sees "left the challenge".

5.2 Visibility in kg

For challenges set to "percent and kg" (the default), the members also see your starting weight, your weight on the weigh-in day and how many kilograms your weight has changed. You can stop this at any time with "Hide my kg" without leaving. Withdrawing your consent as a whole means leaving this challenge, with deletion as in 5.1.

5.3 Scale photo

Only for challenges in which the organizer requires a photo of the scale display: Lossboard stores photos of your scale display and shows them to the organizer for checking.

• Only photograph the scale display. No feet, no body, no other people.
• We remove metadata (EXIF, for example location and device) on the server before storing the photo.
• Other members do not see the photo.
• We delete photos 30 days after the challenge ends, or immediately when you leave.

Withdrawing means leaving this challenge, with deletion as in 5.1.

5.4 Import from Apple Health or Health Connect (optional)

If you switch on the import in the app, your device (iOS or Android) asks for permission to read your weight from Apple Health or Health Connect to suggest it on the weigh-in screen. Lossboard does not ask separately.

• We only read weight and never write anything back.
• The value is only pre-filled. Only when you confirm it is it sent to our server, just like a manual entry. Other health values never leave your device.
• We never use data from Apple Health or Health Connect for advertising or marketing, never pass it on to third parties and never store it in iCloud.
• You can revoke access at any time in the iOS or Health Connect settings. Weigh-ins you already confirmed stay in the challenge as manual values until you leave or delete them.

The import is optional. You can take part just the same without it.

5.5 Sharing within the group and share images

Sharing the leaderboard within the group is part of using Lossboard. Members can also create images of the leaderboard or the result and share them, for example in an Instagram Story, in Photos or in a messenger.

• In these images, in the weekly report, in the recap and in the organizer's export, members appear with nicknames and values by default (percent and, depending on the challenge settings, kg). The person sharing can switch off "Show nicknames" and "Show values".
• With "Hide my kg" or "Hide my values" you decide that your kg or all of your values do not appear in such images and reports. Then only your nickname or your place is shown.
• The weekly image and the result image can also be reached through a link with the challenge code (preview image in messengers). They too show nicknames and values by default; the person sharing the link can switch names and values off. With "Hide my values" you appear there only as "Place n", without nickname and without values.
• Weight gains never appear as a negative value in share images either. Amounts of money and the agreement never appear in share images.
• Important: once an image has been shared, it is in the hands of the person who shared it and of the platform it was shared on. We cannot recall shared images.

Legal basis: your consent by creating or joining (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Withdrawing means leaving the challenge, with deletion as in 5.1; images shared before are not affected.

6. Push notifications

If you allow notifications, we store your device's push token. Notifications are sent via the Expo push service (650 Industries, Inc., USA) and from there via the Apple Push Notification service or Google's Firebase Cloud Messaging. Notifications contain the challenge name and sometimes a nickname (for example "Deniz joined the challenge"), but never weights or percentages.

You can switch off each type of notification separately under "Me". You can revoke the permission itself in your device's system settings.

Legal basis: Art. 6(1)(a) GDPR (system permission) and Art. 6(1)(b) GDPR.

7. Invite links, link previews and the clipboard

• Invite links look like lossboard.app/c/CODE, result links like lossboard.app/r/CODE. For these links the server creates a preview image that messengers show. It contains the challenge name, the organizer's nickname, start and duration, and for result links the podium with percentages but without nicknames, plus the "Together" total. It never contains kg values or other members' nicknames. Weekly reports have a preview image with places and percentages, also without nicknames and without kg. Anyone who chose "Hide my values" appears there without a percentage.
• Anyone who knows an invite link can see the preview. So only share links with people you want to invite.
• When you first open the app, it asks "Do you have an invite code?". It only reads the clipboard when you explicitly tap "Paste".

8. Reporting and moderation

You can report nicknames, agreements and scale photos. We store who reported, what was reported, the reason and the status. Reported content is hidden from the group immediately and we usually review it within 48 hours. For nicknames and agreements we also use an automatic word filter that blocks offensive terms. The reported person is not told who reported them.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in respectful behaviour in groups and in meeting app store requirements), for photos Art. 9(2)(a) GDPR based on your consent under 5.3.

9. Purchases

A challenge is free for up to 3 people. For larger groups, the organizer makes a one-time purchase of a challenge or an organizer year pass. Participants never pay.

Current status: the purchase options below are prepared. As long as they are not switched on, no real payment takes place and no payment data is processed.

For each purchase we store on our server: challenge, buyer (random ID), payment method, the provider's transaction number, product, amount, currency, status (paid or refunded) and time. We never see or store card or bank details.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (retention under tax and commercial law).

9.1 In-app purchase via Apple and Google (prepared)

This section applies once in-app purchases are switched on.

In the app you buy through Apple's App Store or Google Play. Apple or Google process the payment under their own responsibility, and their privacy policies apply. We only receive the purchase confirmation.

To verify and assign purchase confirmations we use RevenueCat (RevenueCat, Inc., USA) as our processor. RevenueCat receives the store's purchase confirmation, a random ID and technical device data (for example operating system, app version, store country). RevenueCat never receives weight data.

9.2 Web purchase via Stripe (prepared)

This section applies once purchases on the website are switched on.

On the website you pay via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe receives the details you enter in the checkout (for example email address, payment details, country) and technical data such as your IP address. Stripe processes some of this data under its own responsibility for payment processing and fraud prevention. Stripe may transfer data to Stripe, Inc. in the USA. We receive the purchase confirmation, the email address for the receipt and the invoice from Stripe. Stripe never receives weight data.

10. Server, hosting and security

• Hosting: our server runs at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in the EU. The database and scale photos are stored there.
• Protection and delivery: requests to lossboard.app pass through Cloudflare (Cloudflare, Inc., USA) for protection against attacks and for quick delivery. Cloudflare technically sees your IP address and the requested address.
• Backups: we store database backups at Cloudflare R2 with storage location in the EU. They are overwritten after 30 days at most. Deleted data therefore also disappears from backups within 30 days.
• IP addresses: our server only keeps your IP address briefly in memory to limit excessive requests. We do not write it to logs.
• Further measures: encrypted transfer (TLS), hashed tokens and codes, server access only for the operator.

Legal basis for hosting, protection and backups: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation) and for health data Art. 9(2)(a) GDPR (your consent covers storage with our processors).

11. Usage analytics with PostHog, no ads

• Lossboard shows no ads and passes no data to advertising networks. We do not sell data.
• Usage analytics: To understand which features are used and where people get stuck, we use PostHog (PostHog Inc., USA) in the app, on the website and in the web app, with storage in the EU (data centre in Frankfurt, eu.i.posthog.com). PostHog is our processor.
• What is collected: pages and screens viewed, buttons tapped (autocapture, in the web app without texts), events such as "challenge created", "joined", "weighed in", "invite shared" or "purchase completed", technical details (device type, browser, operating system, app version, approximate region derived from the IP address, which PostHog does not store), loading times (Web Vitals), error messages and a random ID. After creating or joining a challenge this is your random Lossboard ID, never your nickname.
• What is never collected: weights, percentages, photos, nicknames, challenge names, agreement texts and invite codes. For weigh-ins only a rough band is sent (for example "0.5 to 1% less than the last entry" or "gained"). IDs and codes in addresses are removed before sending.
• Session replay: On the website and in the web app we record the course of a session (movements, clicks, page layout) to find usability problems. All input fields are masked. In the web app all digits, nicknames and challenge names are masked as well, on the website the calculator results. In the app text input and images are masked.
• Storage on your device: PostHog stores a random ID in your browser's local storage or a cookie and in the app so that views from the same session belong together.
• Turning it off: In the app under Me → Settings, in the browser under "Me" with the switch "Share usage data" (on by default). After that neither your device nor our server sends analytics events about you, and session replay stops. In the browser the switch applies to the website and the web app.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working and improving app). You can object at any time (Art. 21 GDPR), most easily with the switch. We do not process health data for this.
• Retention: PostHog deletes session recordings after 30 days and events after 24 months at the latest. If you delete all your data, there is no longer any link on our side between the random ID and you.
• There is no automated decision-making within the meaning of Art. 22 GDPR. The leaderboard is a calculation by fixed rules and has no legal effect on you.

12. Contact by email

If you write to us, we process your email address and the content of your message to handle your request. Our mailbox is operated by Google (Gmail). Please do not send weight values or health details by email unless your request needs them.

Legal basis: Art. 6(1)(b) or (f) GDPR. We delete the message once your request is resolved, at the latest after 2 years, unless a legal retention obligation applies.

13. Recipients and processors

We have concluded, or will conclude before use, a data processing agreement under Art. 28 GDPR with all processors. Apple and Google act under their own responsibility for store purchases. We only pass data to authorities where we are legally required to.

14. Transfers to third countries

Some service providers are based in the USA or may transfer data there (Cloudflare, Expo, Apple, Google, RevenueCat, Stripe, PostHog; PostHog stores data in the EU). The basis for this is the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not transfer weight values, percentages or scale photos to service providers in the USA. They stay on our server in the EU.

15. Retention and deletion

Under "Me → Data" you can at any time:

• export your data as a file,
• leave individual challenges,
• delete all your data. We then delete your ID, all memberships, weigh-ins, photos, push tokens and your email address. If you are the organizer of a running challenge, the role passes to the member who has been in it the longest. Purchases stay stored for tax reasons, without any link to weight data.

In the browser this works the same way under "Me".

16. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR). You can correct weights yourself until the late entry window closes,
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), directly via the export in the app,
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw your consent with effect for the future (Art. 7(3) GDPR). Withdrawing means leaving and deletion (section 5),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 bis 4, 40213 Düsseldorf, Germany. You can also contact the authority where you live. In the UK this is the Information Commissioner's Office (ico.org.uk).

Because we only recognise you by your device and there is no account, requests are easiest to handle directly in the app. By email we need proof that the data belongs to you, for example your recovery code. Please only send it when we ask you to.

17. Minimum age

Lossboard is only for adults aged 18 and over (see the Terms of Use). We do not ask for your age separately. If we learn that a younger person is taking part, we remove them and delete their data.

18. US residents: Consumer Health Data Privacy Policy

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act (RCW 19.373) and comparable laws in other US states, such as Nevada SB 370. The English version of this section is binding.

• Consumer health data we collect: body weight, weight change in percent and kg, weigh-in dates, photos of the scale display and weight values imported from Apple Health or Health Connect.
• Sources: you, and for health import Apple Health or Health Connect on your device.
• Purposes: running the challenge, leaderboard, reminders, moderation.
• Sharing: with the members of your challenge according to sections 4.4 and 5, and with the processors listed in section 13. We do not sell consumer health data and do not use it for advertising. We do not use geofencing.
• Consent: we only collect and share consumer health data with your consent, which you give by creating or joining a challenge (section 5).
• Your rights: to confirm whether we process your consumer health data and to access it, including a list of all third parties and affiliates we shared it with, to withdraw your consent and to have it deleted. Use "Me → Data" or email [email protected]. We respond within 45 days.
• Appeal: if we decline your request, you can appeal by email. We decide within 45 days. If we still decline, you can contact the Washington State Attorney General (atg.wa.gov).
• We do not sell or share personal information for cross-context behavioural advertising.

19. Changes to this policy

We update this policy when the app or the law changes. If a change requires new consent, we ask for it in the app before applying it. The current version is always available in the app under "Me → Privacy" and at lossboard.app/en/privacy.

This policy is available in German and English. In case of differences, the German version prevails, except for section 18, where the English version prevails.