Last updated: 11 October 2026 · Effective date: 11 October 2026
This Privacy Policy explains how STNG Studios ("we," "us," "our") collects, uses, and protects your personal data when you use the Neomi mobile application ("the App") and our website at stng-studios.dk. It applies to all users of our products and services.
We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act (Databeskyttelsesloven), and Apple's App Store requirements.
The data controller responsible for your personal data is:
STNG Studios
CVR: 45819272
Ny Banegårdsgade 49, 8000 Aarhus C, Denmark
Email: support@stng-studios.dk
For all questions about this Privacy Policy, the processing of your personal data, or to exercise your rights under GDPR, contact us at support@stng-studios.dk.
We collect the following categories of personal data:
You can sign in with Apple or with your email address. Depending on the method you choose, we collect:
With email sign-in, we send a one-time login code to your email address instead of using a password. These emails are sent by our email provider, Resend (see Section 5).
With your permission via the Apple HealthKit framework, we read:
This data is used to display your daily progress and award activity points. You may revoke this access at any time in iOS Settings → Privacy & Security → Health → Neomi.
Step counts are converted into points that are stored on our servers as part of your activity history. We never write data into Apple Health on your behalf without explicit consent for that specific operation.
With your permission, we use your device's GPS during running and cycling activities solely to calculate distance traveled. We do not:
Only the calculated total distance (e.g., "5.2 km") is saved to your activity history.
When you subscribe, Apple processes the payment. We receive a confirmation that your subscription is active, but we never see or store your payment card information. Apple's privacy policy applies to the payment transaction.
If app usage analytics is turned on, similar technical information is also collected as part of the analytics described in Section 2.7.
To understand how the App is used and to find and fix problems, we collect product analytics through PostHog (see Section 5). Analytics is on by default, and you can turn it off at any time in the App under Settings → "Share Usage Analytics".
We collect:
Identifiers: When you first open the App, it generates a random identifier. This is not an advertising identifier or a device identifier. When you sign in, your analytics events — including onboarding events from before you signed in — are linked to your account's internal user ID. This means analytics data is personal data linked to your account.
What we do not collect through analytics: your name, email address, health or body values (such as weight or height), gender, age, any free text you write, your precise location, your location based on your IP address (IP addresses are discarded and location lookup is disabled), or advertising identifiers (IDFA). We do not record your sessions, do not track you across other companies' apps or websites, and do not use cookies.
| Purpose | Data used | Legal basis (GDPR Article 6) |
|---|---|---|
| Provide the App's core functionality (track habits, calculate points, sync across devices) | Account info, activity data | Contract performance — Art. 6(1)(b) |
| Display health and fitness progress | HealthKit data | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) for health data |
| Calculate distance during run/cycle activities | Location data | Explicit consent — Art. 6(1)(a) |
| Send local habit reminders and streak notifications | Account info | Contract performance — Art. 6(1)(b) |
| Verify and renew your subscription | Subscription status | Contract performance — Art. 6(1)(b) |
| Understand where people drop off in onboarding, the subscription screens, and sign-in, and detect problems (for example, subscription products failing to load), so we can improve the App | App usage analytics (Section 2.7) | Legitimate interest — Art. 6(1)(f). You can opt out at any time in Settings → "Share Usage Analytics" |
| Detect and prevent fraud, abuse, and security incidents | All categories | Legitimate interest — Art. 6(1)(f) |
| Comply with legal obligations | All categories | Legal obligation — Art. 6(1)(c) |
Our legitimate interest in app usage analytics is improving the App. We balance it against your interests by collecting only minimal, pseudonymous data, storing it in the EU, and making it easy to opt out. Analytics data is not used for advertising, is not sold, and is not shared with anyone other than our analytics provider, PostHog.
We do not use your data for marketing, advertising, profiling for advertising, or sale to third parties.
Health-related data (steps, calories, sleep) is classified as a "special category" of personal data under GDPR Article 9. We process this data only with your explicit consent, given through iOS HealthKit permission prompts.
You may withdraw this consent at any time without affecting your ability to use the rest of the App. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We share your data only with the following processors, who act on our behalf and under contractual data-processing agreements (DPAs):
We do not share, sell, rent, or trade your personal data with any other third parties for any purpose.
Your data is stored on servers located within the European Union, except for the emails we send through Resend, which are stored in the United States (see below). Apple may process limited authentication and payment data in other jurisdictions under Standard Contractual Clauses (SCCs) and other appropriate safeguards as detailed in Apple's privacy documentation.
App usage analytics is stored on PostHog's EU Cloud in Frankfurt, Germany. PostHog, Inc. is a US company, so analytics data may be accessed from or transferred to the United States. Any such transfer or access is covered by PostHog's Data Processing Agreement, which includes the EU Standard Contractual Clauses (SCCs).
Resend is operated by a US company, Plus Five Five, Inc., and stores the data it processes for us (the emails we send and their delivery logs) in the United States. This transfer is covered by Resend's Data Processing Addendum, which includes the SCCs.
We retain your personal data only for as long as necessary to provide the App's services:
As a data subject, you have the following rights:
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate or incomplete data |
| Erasure / "Right to be forgotten" (Art. 17) | Have your data deleted (also available in-app via Settings → Delete My Account) |
| Restriction (Art. 18) | Limit how we process your data |
| Portability (Art. 20) | Receive your data in a machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest. For app usage analytics, you can do this at any time in the App under Settings → "Share Usage Analytics" — turning it off immediately stops all analytics collection on that device, and your choice is kept after you sign out. You can also object by contacting us. |
| Withdraw consent (Art. 7) | Withdraw consent for HealthKit, location, or any other consent-based processing |
| Not be subject to automated decision-making (Art. 22) | We do not perform automated decision-making with legal effects |
The in-app "Export My Data" feature gives you a copy of your account data. It does not include app usage analytics data (Section 2.7) — to receive that, email support@stng-studios.dk.
To exercise any of these rights, email support@stng-studios.dk. We will respond within 30 days as required by GDPR.
If you believe we have violated your data protection rights, you have the right to lodge a complaint with the Danish Data Protection Authority:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Phone: +45 33 19 32 00
Website: https://www.datatilsynet.dk
Neomi is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@stng-studios.dk and we will delete it.
For users between 13 and 16 in EU jurisdictions where the digital consent age is higher than 13, parental consent is required for the processing of personal data.
We implement technical and organizational measures to protect your personal data, including:
No method of transmission or storage is 100% secure, but we follow industry best practices to protect your data.
The Neomi mobile application does not use cookies or advertising identifiers (IDFA). We do not track you across other companies' apps or websites — the App does no "tracking" in the sense of Apple's App Tracking Transparency framework. The App does use first-party product analytics via PostHog, as described in Section 2.7, which you can turn off at any time in Settings → "Share Usage Analytics".
The stng-studios.dk website may use minimal first-party cookies necessary for site operation. No third-party advertising or analytics cookies are used.
Apple may collect anonymized, aggregated usage statistics about the App through App Store Connect. We see only aggregate, non-identifying metrics (e.g., total downloads, crash counts). This data is governed by Apple's privacy policy.
This section describes how we handle personal data when you use Neomi's optional social features. It supplements the rest of this Privacy Policy, which continues to apply.
Social features are optional. If you choose to use them, we process:
Social features are, by their nature, shared with other people. Please only add people you know and only share what you're comfortable with.
Some activity metrics you can share through social features (for example the duration or distance of a workout, run, or walk) may be considered health or fitness information. We only share these metrics with friends and challenge participants that you have chosen, and only where you have opted into social features. You can stop sharing at any time by removing a friend, leaving a challenge, or disabling social features.
Social features require a minimum age of 13. Where local law sets a higher age for these services, that higher age applies — currently 15 in France and 16 in Germany and Ireland. We verify eligibility by self-declaration and, as noted above, do not store your birth year. If you indicate that you are under the required age, social features remain disabled; if you believe this was a mistake, you can contact us at the address below.
We have no tolerance for objectionable content or abusive behavior.
If you enable them, we send push notifications about social activity (such as friend requests and challenge updates) to your device via Apple's Push Notification service. You can turn social notifications on or off by category in the app's settings, and disable them entirely in your device settings.
Social features rely on processors described in Section 5 — Supabase (hosting, database, authentication, and delivery of notifications on our behalf), Apple (Sign in with Apple and the Apple Push Notification service), and Resend (internal moderation alerts to our team when a user reports content). These providers process your data on our instructions, and a current list of our sub-processors is available on request. As set out in Section 6, your social data is stored within the European Economic Area (EEA), except for moderation alert emails, which Resend stores in the United States. Any access or transfer from outside the EEA is covered by the safeguards described in Section 6. As described in Section 7, we keep your social information for as long as your account is active; when you delete your account we delete your profile, display name, friend code, connections, and challenge participation within 30 days. Information relating to reports and blocks may be retained for longer where necessary to keep the community safe and to prevent repeat abuse.
At any time you can remove a friend, leave a challenge, block a user, disable social features, or delete your account. Deleting your account also removes you from the friend and challenge data described above. These choices are in addition to your rights (including access, correction, erasure, portability, and objection) described in Section 8. If you have questions about how we handle your social data, contact us at support@stng-studios.dk — STNG Studios ApS, Ny Banegårdsgade 49, 8000 Aarhus C, Denmark.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Continued use of the App after the effective date constitutes acceptance of the updated policy.
For any questions, concerns, or requests regarding your personal data or this Privacy Policy:
STNG Studios
CVR: 45819272
Ny Banegårdsgade 49, 8000 Aarhus C, Denmark
Email: support@stng-studios.dk
We aim to respond to all inquiries within 7 business days, and to formal GDPR rights requests within 30 days as required by law.