Who is responsible
Arkadius Biernat, trading as Biernat Solutions
Dürerstr. 12
59368 Werne, Germany
Privacy and support: support@nod-app.de.
Information in the app
Nod does not require its own user account and does not run its own server for your sleep diary. The app stores entries locally and uses them to calculate sleep statistics, guidance and program progress.
Entries include sleep and wake times, sleep quality, daily wellbeing, habits, notes, sleep-check and safety answers, and settings. Optional profile details can include birth year, sex, height, weight, activity, diet, caffeine, alcohol, nicotine, work and daily schedule, stress, family circumstances, sleep environment, pain and sleep medication. Derived sleep patterns and guidance may also be health information. Please avoid entering identifying information about other people.
Local entries remain stored until you delete them in the app. Where we act as controller in providing requested app features, Article 6(1)(b) GDPR is the legal basis. Processing health information for which we are responsible additionally requires explicit consent under Article 9(2)(a) GDPR. Technical access permission alone does not replace that requirement.
Apple Health and local assistance
With your permission, Nod reads sleep information from Apple Health. Optional insights can also read steps, exercise time, active energy, workouts, resting heart rate, heart-rate variability, caffeine, alcohol, dietary energy, water and mindful minutes. For the optional sleep profile it can, at your request, take sex, date of birth, height and weight from Apple Health. If you share only part of your Health history under iOS 27, Nod uses that period only. You choose the categories to allow. Nod does not write information to Apple Health. You can revoke permissions in Health or system settings; this does not automatically delete previously imported entries.
On supported devices, Nod can use Apple’s local Foundation Models model for summaries and reframing thoughts you enter. Nod does not send these inputs to an AI service operated by us. Rule-based text is used when the local model is unavailable.
Devices, backups and exports
Enabled Watch features exchange the information they need with your paired Apple Watch. Widgets, notifications and Live Activities can display selected information on your device and lock screen. Consider who can see your screen.
Your device, Apple Health and backup settings affect whether information is backed up or synchronized outside the running app. Local storage is not a guarantee that device backups never occur. Nod offers CSV and PDF exports: you choose where to save them and whom to share them with. Those destinations and recipients have their own terms and privacy practices.
Visiting this website
The website serves its styling and fonts without embedded third-party services. It uses no analytics or advertising trackers, cookies or local browser storage for visitor profiling. When the homepage is opened without a language in its address, an available language is selected from the browser’s language preferences. An explicit language in the page address takes priority. This does not use location access or store a language preference in the browser. The contact form does not accept uploads. Only the form uses a necessary session cookie to protect against forged requests; it expires with the browser session. To limit abuse, we retain a keyed, non-readable fingerprint of the IP address and request counters without message contents. These values apply to a one-hour window and are overwritten on the first subsequent valid form request after that window expires.
To deliver a page, the server necessarily receives connection information such as IP address, time, requested address, browser details and response status. This serves page delivery, troubleshooting and abuse prevention, not the creation of health profiles. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning website.
Hosting: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Deutschland (Serverstandort Nürnberg). Routine access logs are deleted after 8 days. Relevant entries may be preserved to investigate a specific security incident.
Contacting support
An email link opens your email application. Only sending the message sends us your sender address, message and any voluntary attachments. When you submit the contact form, we receive your email address, message and optional name through our hosting and email provider netcup GmbH in Germany. We use these to handle your request. Article 6(1)(b) GDPR applies to contractual requests; Article 6(1)(f) applies to other correspondence and its secure administration. Legally required retention relies on Article 6(1)(c).
Start with your app version, iOS version and a technical description, without health information or full exports. If health information is exceptionally necessary, we first agree the scope and transmission method and obtain explicit consent under Article 9(2)(a) GDPR. Apple Health permission does not constitute consent to send health information to support.
Our intended retention policy is to delete routine support correspondence within six months of closing the request. A legal obligation or specific legal dispute may require longer retention, restricted to that purpose. Unneeded health details should be deleted sooner.
Recipients, purchases and processing countries
We use hosting and email service providers subject to appropriate obligations for the website and support, with access limited to necessary tasks. We do not sell personal or health information, use it for targeted advertising or operate health-related geofencing. Authorities receive information only where there is a lawful basis.
Apple handles purchases and subscriptions. StoreKit provides Nod with the necessary product, transaction and entitlement status; we do not receive full payment details. Apple’s own purchase processing, Health services and device accounts are subject to Apple’s privacy policy. Destinations you choose for an export may also process information in other countries.
Buying the app in the US or another country does not, by itself, send your local diary to us. Transfers we arrange outside the EEA require the safeguards specified in Articles 44 onwards GDPR, such as an applicable adequacy decision or appropriate safeguards. Contact support@nod-app.de for information about our providers and safeguards.
Control, deletion and your rights
You can manage local entries in the app and use “Delete all data” in Settings. This does not cancel an Apple subscription or remove separate exports, original Apple Health records or independently managed backups. Without our own diary cloud, we cannot remotely view, restore or delete local information.
For information we process, you have rights of access, correction, deletion, restriction and portability subject to applicable law. You can object to processing based on legitimate interests and withdraw consent for future processing. Contact support@nod-app.de; you do not need a new account or to upload a diary. If we have reasonable doubts about identity, we request only the information needed for verification.
We normally respond to GDPR requests within one month. Where a lawful extension is needed, we explain the reasons within that month; the extension cannot exceed two further months. You may complain to a data protection authority, including North Rhine-Westphalia’s LDI (German).
Additional US information
Our separate Washington Consumer Health Data Privacy Policy describes health data categories, purposes, recipients and rights under the Washington My Health My Data Act.
For consumers covered by Nevada’s consumer health law, the categories, sources, uses and recipients described above apply. There is no cross-service health tracking. You can request confirmation of processing, a recipient list, cessation of collection or sharing, deletion, or correction through support@nod-app.de. We respond without undue delay and within 45 days after authentication; we will explain any necessary extension of up to 45 days in time. To appeal a refusal, email the same address with “Privacy appeal” in the subject line. We provide a reasoned decision within 45 days. You can complain to the Nevada Attorney General. We do not discriminate against you for exercising privacy rights.
Other applicable state rights remain available. Using a health app does not automatically mean HIPAA applies. Nod does not make automated decisions about you with legal or similarly significant effects.
Audience and changes
Nod is intended for adults aged 18 or older. This intended audience is distinct from Apple’s technical age rating. Changes to data flows will be explained here with a revised date; we announce material changes beforehand on the website and, where required, in the app. When a new use requires consent, we obtain it before that use begins.