Last updated: 6 July 2026
This Privacy Policy explains how Sloth (“the App”, package name
com.sloth.app) handles information when you use our mobile application.
Sloth is an alarm app for climbers that uses your device camera to verify physical
wake-up challenges (such as hangboard holds, push-ups, pull-ups, or sit-ups) before
an alarm can be silenced.
1. Who is responsible
2. Summary
- Camera video is processed on your device. We do not upload, store, or transmit camera recordings or images to our servers.
- Most app data stays on your phone (alarms, settings, local stats).
- Optional sign-in uses Firebase Authentication (Google, Apple, or email).
- Subscriptions are handled by Apple/Google and RevenueCat.
- We do not sell your personal data.
3. Data we process
3.1 Data stored locally on your device
When you use Sloth, the following information is stored on your device using local app storage (Capacitor Preferences):
- Alarm settings (time, label, repeat days, enabled state)
- Selected wake-up mission (e.g. hangboard, push-ups)
- Onboarding preferences and climbing-related settings you enter
- Local statistics and achievement progress (e.g. streaks, completed challenges)
- Premium status cached for app functionality
This data remains on your device unless you delete the app or reset your profile in the app.
3.2 Camera and on-device AI
Sloth requests camera access only to run wake-up challenges. Video frames are analysed on your device using an on-device pose estimation model (MediaPipe). The App checks whether you are performing the required exercise posture for a sustained period.
- No video recordings are saved by the App
- No images or video are sent to our servers
- Processing happens in real time on your phone
On first use, the pose model may be downloaded to your device. After that, detection can run offline.
3.3 Account data (optional)
You can use Sloth without creating an account. If you choose to sign in, we use Firebase Authentication provided by Google. Depending on the sign-in method you choose, this may include:
- Email address (email sign-in)
- Display name and profile photo URL (if provided by Google or Apple)
- A unique user identifier (UID)
Firebase processes this data as our processor. See Google’s privacy documentation: firebase.google.com/support/privacy.
3.4 Subscriptions and purchases
If you purchase Sloth Pro or another subscription, payment is processed by Apple App Store or Google Play. We use RevenueCat to manage subscriptions and entitlements. RevenueCat may receive information such as:
- App user ID (linked to your Firebase UID if you are signed in)
- Subscription status, product identifiers, and purchase history
- Device and store-related transaction metadata
We do not receive your full payment card details. Those are handled by Apple or Google. RevenueCat’s privacy policy: revenuecat.com/privacy.
3.5 Device permissions
Sloth may request the following permissions to function:
- Camera — exercise verification during alarms
- Notifications — alarm alerts and lock-screen presentation
- Exact alarms / alarms — firing alarms at the scheduled time
- Full-screen intent (Android) — showing the challenge over the lock screen
- Battery optimisation exemption (Android, optional) — improving alarm reliability
You can revoke permissions in your device settings, but some features may stop working.
4. Why we use your data (legal bases under GDPR)
If you are in the European Economic Area or UK, we rely on the following legal bases:
- Contract performance — to provide alarms, challenges, and subscriptions you request
- Legitimate interests — to keep the App secure, reliable, and to improve features
- Consent — for optional sign-in, camera access, and notifications where required by your device
- Legal obligation — where we must retain or disclose data to comply with law
5. Sharing with third parties
We share data only with service providers needed to operate the App:
- Google Firebase — authentication
- RevenueCat — subscription management
- Apple / Google — app distribution and in-app purchases
We may also disclose information if required by law or to protect our rights, users, or safety.
6. International transfers
Firebase and RevenueCat may process data in countries outside your own, including the United States. Where required, such providers use appropriate safeguards (such as Standard Contractual Clauses).
7. Retention
- Local app data — kept on your device until you delete it or uninstall the App
- Account data — kept while your account exists; you may request deletion
- Purchase records — retained as needed for billing, tax, and fraud prevention
8. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Request correction or deletion
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
- Data portability
- Lodge a complaint with your local data protection authority
In Germany, the supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de).
To exercise your rights, contact lucamgudermann@gmail.com.
9. Children
Sloth is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it.
10. Security
We take reasonable technical and organisational measures to protect your information. No method of transmission or storage is completely secure. Because camera processing happens on-device, your challenge video does not pass through our servers.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the “Last updated” date. Continued use of the App after changes means you accept the updated policy.