Svalk Privacy Policy ==================== Effective date: 30 September 2026 Svalk ("the app") is an iPhone app for outdoor bathing, winter and summer, made by Skretteberg AS (org.nr. 937 577 648) ("we", "us"), who is the data controller. It shows the water temperature at bathing spots, keeps a log of your dips and offers a safety check-in with a buddy. This policy explains what data the app processes, why, who helps us, and the choices you have. Contact: mikkel@mskre.no The short version ----------------- • You do not need an account. Svalk creates an anonymous account for you on first launch. • Your dip log and your own water readings stay on your phone. • We store your onboarding answers so the app can plan your season. • If you use the safety check-in, we store your name and your buddy's name and phone number for that check-in, and send your buddy one text message if you do not check out in time. • We do not track your location, show ads, sell your data or use analytics tools. • You can delete everything at any time in Settings → Delete account. • If you join a group, your display name and your season numbers are shown to its members. What we process and why ----------------------- • Onboarding answers: your bathing spot, experience, goal for the season, dip days, who you bathe with, how long you usually stay in and whether you use a sauna. Used to plan your season and personalise the app. Stored in your profile on our server. • App language and time zone: to show the app and messages in your language and at the right time. • Your consent: the time you agreed to the statement "I agree that Svalk stores my dips and my answers", and the time you withdraw it. • Anonymous user id: to keep your data together and link your subscription. • Dip log and water readings (time in the water, water temperature, spot, sauna, readings you add): stored only on your phone. We do not receive them. • Safety check-in (Svalk+, only when you start one): your name as your buddy knows you, your buddy's name and mobile number, the spot name, the start time, the deadline and the app language. Used only to send your buddy one text message if the deadline passes before you check out. • Email address and Apple user id, only if you choose Sign in with Apple: to restore your account on a new phone. Apple may give us a private relay address instead of your real one. • Subscription status and purchase history: to unlock Svalk+ and restore purchases. Location: if you allow it, the app uses your position on this phone to show the bathing spots near you. It is used once, only while the app is open, and it is never sent to us or stored. You can say no and search or use the map instead. Bathing spots come from OpenStreetMap (© OpenStreetMap contributors, ODbL); spots you add yourself stay on your phone. Your buddy's data ----------------- When you add a buddy, you give us their name and mobile number. Please tell them first. We use the number only for the check-ins you start, never for anything else, and erase it from our server 7 days after each check-in ends. Your buddy can ask us to delete it at any time: mikkel@mskre.no. Groups and leaderboards ----------------------- Groups are optional. If you create or join one, we store the group's name, its members and the name you choose to show there. While you are in at least one group, the app also sends us four season numbers: dips this season, your weekly streak, days with a dip and the time of day of your earliest dip. Members of your groups see your name and these numbers. Your time in the water, water temperatures, spots and dip log are never shared. When you leave your last group, we delete your numbers. Public groups can be found and joined by anyone; private groups only with the invite code. You can report a group or member; reports are stored so we can review them. Health data and your consent ---------------------------- Your dips can say something about your health. The app therefore asks for your explicit consent before it stores anything, and it saves nothing to Apple Health without it. This consent is the legal basis under Article 9(2)(a) of the GDPR. You can withdraw it at any time in Settings → Withdraw consent, or delete your account. Withdrawal does not affect processing that happened before it. Apple Health ------------ If you allow it, Svalk writes each dip you log to Apple Health as a workout, with the time in the water and the water temperature. Svalk does not read anything from Apple Health. You can turn this off at any time in the Health app. Health data is never used for advertising or marketing, never sold and never shared with data brokers. Water temperatures ------------------ Water and weather data come from MET Norway (the Norwegian Meteorological Institute), licensed under CC BY 4.0. The app asks MET for the forecast at the spot's coordinates, not your position. Like any web request, MET receives your phone's IP address. Legal bases ----------- • Providing the service you asked for (contract): your account, profile, check-ins, subscription and support. • Your explicit consent: storing your dips and answers, and Apple Health. • Our legitimate interest: keeping the service secure and preventing abuse (for example a daily limit on check-ins, so nobody can use it to send messages to strangers). Service providers ----------------- • Supabase: database, anonymous accounts, Sign in with Apple and server functions. EU (Stockholm, Sweden). • 46elks: sends the check-in text message to your buddy. Sweden. • RevenueCat: manages subscriptions and purchase history. United States. • MET Norway: water temperature and weather forecasts. Norway. • Apple: payments, Sign in with Apple, Apple Health on your device, and Apple Maps for the spot map. RevenueCat is in the United States. That transfer relies on the safeguards the law requires, such as standard contractual clauses. How long we keep data --------------------- • Profile and answers: until you delete your account. • Check-ins: your buddy's number is erased 7 days after the check-in ends; the rest of the record is deleted with your account. • Groups: your season numbers are deleted when you leave your last group; memberships and reports are deleted with your account. • Dip log and readings: on your phone until you delete them, delete your account or delete the app. • Settings → Delete account removes your profile, check-ins and all related records from our database immediately, and erases the dip log on your phone. • RevenueCat keeps the purchase history of the deleted anonymous id, because Apple billing records require it. Your App Store subscription belongs to your Apple ID: deleting the account does not cancel it. Cancel it in your App Store account settings. Your rights ----------- Under the GDPR you can ask to access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Most of this is available in the app: change your goal in Settings and delete everything with Delete account. For anything else, write to mikkel@mskre.no. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live. Children -------- Svalk is not meant for anyone under 16, and we do not knowingly collect data from children. If you believe a child has used the app, contact us and we will delete the data. Changes ------- If this policy changes, we will update the effective date above and, for important changes, tell you in the app. Contact ------- Skretteberg AS (org.nr. 937 577 648), mikkel@mskre.no ---- nb: https://cmwdjuemspmqboldmlzt.supabase.co/functions/v1/legal/privacy?lang=nb sv: https://cmwdjuemspmqboldmlzt.supabase.co/functions/v1/legal/privacy?lang=sv da: https://cmwdjuemspmqboldmlzt.supabase.co/functions/v1/legal/privacy?lang=da