Privacy policy

Last updated: 2 October 2026

This is a non-binding courtesy translation. Only the German version is legally binding: read the German original.

1. Data protection at a glance

General information

The following notes give you a simple overview of what happens to your personal data when you visit this website or use the PainTrack app. Personal data is any data by which you can be identified personally.

Key points about the app

Your health data (pain types, entries, notes, medications, body locations) stays encrypted on your device and is never transferred to us. The app has no user account. We use RevenueCat for purchases and PostHog, with servers in the EU, for usage statistics without any health data and for crash reports. You can switch off the usage statistics in the app at any time. You can find the details in section 7.

Data collection on this website

Data on this website is processed by the website operator. You can find their contact details in the legal notice.

2. Hosting

This website is hosted by Hetzner Online GmbH. Please refer to that provider's privacy policy for details.

We use this host on the basis of Art. 6 (1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.

3. General information and mandatory disclosures

Data protection

The operators of this site take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Controller

The controller responsible for data processing on this website and in the PainTrack app is:

Johannes Müller
Simone-Veil-Straße 30
53121 Bonn
Germany
Email: [email protected]

4. Data collection on this website

Cookies

Our website uses cookies. Some of these are technically necessary, others are only set once you have given your consent (analytics cookies).

You can adjust your cookie settings at any time via the cookie banner. Technically necessary cookies are stored on the basis of Art. 6 (1)(f) GDPR. Analytics cookies are only set with your consent (Art. 6 (1)(a) GDPR).

Language selection (the “st_lang” cookie)

This website is offered in ten languages. If you open the home page without specifying a language, we redirect you to the matching language version based on the language setting your browser sends (the Accept-Language header). This is evaluated only while serving the request; the header itself is not stored.

If you actively choose a language using the language selector in the navigation, we store that choice in a cookie named st_lang. It contains nothing but the code of the chosen language (for example “de” or “en”), has a lifetime of one year and does not allow any conclusions to be drawn about you personally. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest is to serve you the website in the language you selected on every visit. You can delete the cookie at any time in your browser settings.

Server log files

The provider of these pages automatically collects and stores information in what are known as server log files, which your browser transmits to us automatically. These are:

Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources. It is collected on the basis of Art. 6 (1)(f) GDPR.

If you open the address schmerztrack.app/app, we evaluate your browser identifier (User-Agent) once in order to redirect you to the right app store (App Store or Google Play). Nothing is stored in the process.

Contact form

If you send us a message via the support form, we forward your message and, if provided, your email address via the messaging service Telegram (Telegram Messenger Inc.) to our own inbox in order to handle your request. In the process, data may be transferred to countries outside the EU. The legal basis is Art. 6 (1)(b) GDPR where your request relates to the use of the app, and otherwise Art. 6 (1)(f) GDPR (responding to enquiries). We delete your request once it has been dealt with, unless statutory retention obligations prevent this. Please do not include any health data in the form.

5. Analytics tools and advertising

Google Analytics 4

This website uses features of the web analytics service Google Analytics 4, a service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses so-called “cookies”. These are text files stored on your computer that allow an analysis of how you use the website.

Purpose of processing: We use Google Analytics to analyse how our website is used, so that we can improve it and make it more user-friendly. Specifically, we record:

Page views and time on page
Clicks on the download buttons for the App Store and Google Play (as the event app_download_click)
Interest in the premium subscription (as the event premium_interest)
Interaction with FAQ elements (as the event faq_expand)
Scroll depth (as the event scroll_depth)

Legal basis: Google Analytics is used exclusively with your consent under Art. 6 (1)(a) GDPR. You can withdraw your consent at any time via the cookie banner.

Google Consent Mode v2: We use Google Consent Mode v2. This means Google Analytics only starts collecting data once you have actively agreed via the cookie banner. Without your consent, no analytics data is transferred to Google.

IP anonymisation: We have enabled IP anonymisation. Your IP address is truncated by Google within member states of the European Union.

Opt-out: You can prevent collection by Google Analytics by:

Choosing “Decline” in the cookie banner
Installing the browser add-on that disables Google Analytics: https://tools.google.com/dlpage/gaoptout

You can find more information on how Google Analytics handles user data in Google's privacy policy.

6. Your rights

You have the right at any time:

To obtain information about the personal data we hold about you (Art. 15 GDPR)
To request the rectification of incorrect data (Art. 16 GDPR)
To request the erasure of your data (Art. 17 GDPR)
To request the restriction of processing (Art. 18 GDPR)
To request data portability (Art. 20 GDPR)
To object to the processing (Art. 21 GDPR)
To withdraw consent you have given (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

7. PainTrack app (iOS and Android)

Health data stays on your device

The PainTrack app stores all health data (pain definitions, entries, intensities, body locations, notes, tags, events, medications and doses taken) encrypted and exclusively on your own device. The app requires no user account and has no server of its own; no health data is transferred to us or to any third party. Reminders are scheduled locally on the device. You can optionally lock the app with Face ID, Touch ID or, on Android, biometrics; the biometric data is processed by the operating system alone.

iCloud backup (iOS only)

If you switch on iCloud backup, the app stores an encrypted backup of your entries in the private iCloud storage of your Apple Account. This data is processed by Apple as the provider of iCloud; we have no access to it. You can delete the backup in the app at any time.

Download, purchases and subscriptions (App Store, Google Play, RevenueCat)

You download the app from the Apple App Store or Google Play. Purchases and subscriptions of PainTrack Pro are processed by Apple or Google respectively; their privacy policies apply there. We do not receive any payment details, names or email addresses from the stores.

We use RevenueCat (RevenueCat, Inc., USA) to manage purchases. RevenueCat processes a randomly generated app user ID, the stores' purchase receipts, information on device, app version, country and language, as well as a few aggregated usage characteristics (such as progress in the onboarding, a rough number of entries in tiers, whether reminders are switched on). Pain values, pain names, notes or medication names are not transferred. The legal basis is Art. 6 (1)(b) GDPR for processing your purchases and Art. 6 (1)(f) GDPR for evaluating the usage characteristics; our legitimate interest is to improve our offering and the purchase flows. The transfer to the USA takes place on the basis of the EU Standard Contractual Clauses. More information: RevenueCat's privacy policy.

Usage statistics and crash reports (PostHog)

To improve the app and fix errors, it sends usage statistics and crash reports to PostHog (PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA). We use PostHog's EU cloud; the data is processed on servers in Frankfurt am Main, Germany.

Which data:

Usage events: which screens are opened, steps in the onboarding, that an entry was saved (only the scale type and count, not the value), purchase offers shown and their outcome, exports, reminders switched on or off, medications added (only type, form and schedule type, not the name or dose)
App events such as installing, updating, opening and closing the app
Technical information: app version, device model, operating system and its version, language, Pro status
Crash reports: the error message and the technical sequence at the time of the error
A randomly generated identifier (RevenueCat's app user ID) so that events from the same device belong together

What is not transferred: pain values, pain names, notes, tags, body locations, medication names and doses, or your answers in the onboarding. There are no screen recordings (session replays), no ads and no cross-app tracking. Your IP address is technically processed during transmission but is not stored in PostHog (IP anonymisation is enabled).

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is to detect errors, keep the app stable and understand which features are used. The transfer to PostHog, Inc. as a company based in the USA takes place on the basis of the EU Standard Contractual Clauses. The data is deleted as soon as it is no longer needed for these purposes.

Switching it off (objection): Under “Settings & more” → “Your data” → “Privacy” you can switch off “Share usage statistics” at any time. After that, the app sends neither usage events nor crash reports. More information: PostHog's privacy policy.

Privacy in the stores

You can also find the app's privacy details in the app itself and on its product page on the App Store and on Google Play.