Privacy Policy — Osir
Version: 2.3 Effective date: October 7, 2026 Last updated: October 7, 2026 Canonical URL: https://foretalestudio.com/legal/osir/privacy-policy/en/
1. In Short
Osir is built local-first. Your data lives on your phone. Once you have accepted the Terms, the App keeps an anonymous account on our server so you can find your purchases and, if you choose, your account on another device. Your health data does not leave your phone: health synchronisation is not offered in this version (§3.3). Recording it on the device rests on your explicit consent, asked through a tick of its own (§4). The App keeps on the device a dated record of what it asked you and what you answered, "My declarations" (§3.1). There is no advertising, no analytics SDK, no tracker, and we never sell or share your data. You can export and delete everything, including your account, from inside the App, and correct everything that is not that record (§7). If you agree, the App keeps a journal of how you use it on your device; it is not sent (§3.1).
This policy explains the details, as the EU General Data Protection Regulation (GDPR) and French law require.
2. Who Is Responsible
The data controller is FORETALE STUDIO (FTS), SASU, RCS Lyon 938 483 914, 21 rue Maurice Flandin, 69003 Lyon, France. Privacy questions: contact-us@foretalestudio.com. The Publisher has not appointed a Data Protection Officer: its processing is not, to date, carried out on a large scale within the meaning of Article 37 GDPR, and that analysis is written down and reviewed as the App changes. The address above is the privacy contact.
3. What Data the App Handles, and Where It Lives
3.1 On your device only, always
The App stores the following in a database inside its private, operating-system-protected storage on your device:
| Category | Examples |
|---|---|
| Profile | age, sex, height, activity level, goals, target weight, what you already know about the programme |
| Health measurements | weight, waist circumference, and body-composition values (water, muscle, bone, visceral fat) if you paste them from your own scale; the free notes you attach to a weigh-in |
| Contra-indications you declare | the medical situations you tick during onboarding, or later in Settings → Health → My situation has changed; your answer (no situation, or your doctor's written agreement); whether you declared an eating disorder, current or past (which switches on the calmer mode) |
| Programme data | the programme you chose, its phase, the day you started, your daily checklists, your weekly menus, your shopping lists and stock; if a programme was stopped because you declared a situation in which the App does not let you follow it, the date of that stop — it reveals that such a situation was declared, not which one |
| Food and product data | preferences (favourites, exclusions, never), products you add, their label values, the photographs you take of them, the libraries you switch on |
| Learning and progression | lessons read, achievements, weight-loss tiers, coaching progress |
| Settings | language, theme, wallpaper, reminder times, motion, the pace dial |
| Your declarations | a record, kept on the device, of what the App asked you and what you answered: the acceptance of the Terms and of this policy, the attestation of majority, your consent to the recording of your health data, your answer about the medical situations and each situation declared, the refusals to go on that the App gave you and their lifting, the calmer mode being switched on and off, the age given in the profile, the warnings shown to you, the start and the stop of a programme, a change of situation. Each line carries the date and time, the version of the text displayed and its fingerprint (SHA-256) — not the text itself —, the language, the App's version, the programme, the screen, its origin (this device, or a backup you restored) and a random identifier of the installation, distinct from the usage journal's. A line, once written, is never changed. You read this record and export it as a PDF in Settings → Health → My declarations. It is not transmitted: we have no access to it unless you send it to us yourself |
| Usage journal — only if you agree | the App being opened and how long a visit lasts, the screens seen (without the identifiers they contain), the steps of the onboarding, your choices of programme, mode and motivation, the boosts you take or like, the foods you like, the fact that a boost or a food was set aside (without saying which), the fact that a weigh-in or a goal was noted, the lessons read, your purchases and the state of your subscription, the language chosen and whether reminders are used, your consent choices. Never your weight, your waist, your goal, the list of foods and boosts you set aside, what you write (product names, notes, searches) or your identity. This journal is not transmitted: it stays on the device, and you can read it, share it yourself, stop it and erase it (Settings → Data → Usage statistics) |
Photographs you take of products are processed on the device to read the label (the text-recognition model is bundled in the App); they are never uploaded.
Storage on the device (Article 82 of the French Data Protection Act). Writing this data into the App's private storage — its database and the device's secure keychain — is strictly necessary for the service you ask for: on that ground it needs no separate consent. Two consents come on top of it, for two different reasons: your explicit consent to the recording of your health data, because it is health data (§4); and your consent to the usage journal, because it is not necessary for the service (§4).
If this journal were one day to be transmitted to our server, that would happen only after a new version of this policy and a separate request for your consent; health data would remain subject to the explicit consent of §4.
3.2 On our server (the "portal") — always, minimal
Once the Terms and this policy are accepted — never before —, the App creates an anonymous account on the portal: an account identifier assigned by the portal, a random identifier of the installation created by the App (it is derived from no characteristic of your device), the date of creation, and the tokens that authenticate the App. This account carries no name, no e-mail and no health data.
If you link an identity (Settings → Account, optional):
- by e-mail: the App sends the portal the address you type, then the one-time code you receive; the portal keeps that address;
- with Google: Google hands the App a signed identity token; the App passes it at once to the portal, which verifies it and keeps your Google e-mail address and your display name from it. The App does not keep that token, and neither the App nor the portal receives your Google password or any access to your Google account.
In both cases the App keeps, in the device's secure keychain, the sign-in tokens the portal gives it and, in its database, a copy of the account's identity (identifier, e-mail address, display name, sign-in method) to show it to you. Signing in sends none of your data: it stays on the device.
If you subscribe or make a purchase, the App passes the portal the purchase record the store hands it (which store, the product, the amount and currency, the transaction identifier and the purchase token); the portal verifies it to validate your entitlement. It never receives your payment details.
The portal's technical logs. Each time the App contacts the portal (account creation, sign-in, token renewal, purchase validation, sign-out, account deletion), the portal records, as any server does, the IP address the request comes from, the date and time, the address called and its result, and the technical identifier of the calling software ("user agent"). It also keeps the IP address and that technical identifier with the sign-in tokens it issues, in its security log and in the log of rights requests. These logs serve to run and protect the service (abuse detection, rate limiting) and to prove our answers to your requests; they contain no health data and serve neither advertising nor audience measurement. How long they are kept is stated in §6.
3.3 Health synchronisation is not offered in this version
Health synchronisation is not offered in this version of the App. No setting switches it on, the App sends the portal neither your profile, nor your weigh-ins, nor your measurements, nor your notes, nor your declarations, and signing in to an account changes none of that.
If it is offered one day, it will be in a new version of this policy, which the App will show you, and only after an explicit, separate consent, given in Settings → Account and withdrawable at the same place.
3.4 What we never collect
No location. No contacts. No advertising identifier. No usage analytics sent to us, no crash reporting, no telemetry: the optional usage journal described in §3.1 stays on your device and does not reach us. No payment data. No data from your device outside the App. No cookies: the only web page in the App is the bundled animation that goes with some lessons; it ships with the App, has no network access and stores nothing.
4. Why, and on Which Legal Basis
| Processing | Purpose | Legal basis (GDPR) |
|---|---|---|
| Running the App on your device | providing the features you use | performance of the contract (Art. 6(1)(b)) |
| Anonymous account, tokens | identifying the installation, restoring purchases, securing the service | performance of the contract (Art. 6(1)(b)); our legitimate interest in security (Art. 6(1)(f)) |
| E-mail or Google identity | letting you find your account on another device | performance of the contract, at your request (Art. 6(1)(b)) |
| Purchase validation | granting what you paid for; keeping the accounting records the law requires | contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Health data on the device (weight, waist, composition, declared medical situations, dietary restrictions that reveal a medical condition, the date a programme was stopped) | the App's tracking and safety features | your explicit consent (Art. 9(2)(a)), given during onboarding through a tick of its own, never pre-ticked: "I agree that my health data (weight, waist measurement, body composition, declared situations) are recorded on this device". This data is necessary for the service: without that agreement the App does not go on. Accepting this policy is not that consent |
| Your declarations (§3.1) | keeping the trace of what the App asked you, what you answered, what it refused and what it warned you about; letting you read it again and export it | performance of the contract (Art. 6(1)(b)) and our legitimate interest in being able to establish those facts in a dispute (Art. 6(1)(f)) — a record that stays on your device, that you read, export and erase, and that does not reach us; for the lines that reveal health data: your explicit consent above (Art. 9(2)(a)) and the establishment, exercise or defence of legal claims (Art. 9(2)(f)) |
| Health data synchronised to the portal | — | not applicable in this version: synchronisation is not offered (§3.3); it would require an explicit, separate consent (Art. 9(2)(a)) |
| The portal's technical logs (§3.2) | running and protecting the service; proving our answers to your requests | our legitimate interest in security (Art. 6(1)(f)); legal obligation for the log of rights requests (Art. 6(1)(c)) |
| Local reminders | the reminders you set | your consent, through the App's and the system's notification settings |
| Usage journal on the device | understanding how the App is used in order to improve it; showing you your own figures | your consent (Art. 6(1)(a) GDPR; Art. 5(3) of Directive 2002/58/EC and Art. 82 of the French Data Protection Act: this journal is not necessary for the service), given during onboarding or in Settings, which you may withdraw at any time |
| Answering your requests | support, rights requests | legitimate interest (Art. 6(1)(f)); legal obligation for rights requests |
Weight, waist, body composition, the declared medical situations, food exclusions that reveal a medical condition and the date a programme was stopped are special-category data (health data) under Article 9 GDPR. We only process them with your explicit consent, and you can withdraw that consent at any time (§7). Withdrawal does not affect the lawfulness of what was done before.
5. Who Receives Data
We do not sell your data and do not share it for advertising. Your data is only accessible to:
- FORETALE STUDIO, the controller;
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which hosts the portal on servers located in the European Union, as our processor;
- Apple Inc. or Google LLC, which process your download and your purchases under their own privacy policies and act as independent controllers for those; the portal receives from them only the purchase record described in §3.2;
- Google LLC, only if you choose to sign in with Google, for the sign-in itself;
- the recipients you choose yourself when you use the share sheet (an export, a PDF, a photograph);
- authorities, when the law compels us.
Your data is stored in the European Union and is not transferred outside it by us. If you sign in with Google or buy through a store, those companies may process data outside the EU under their own safeguards (standard contractual clauses or an adequacy decision).
6. How Long We Keep Data
| Data | Kept |
|---|---|
| Everything on your device | until you delete it, reset the App, or uninstall it |
| Your declarations (§3.1) | for as long as the App stays installed and you do not erase the device's data; erased by the reset, by signing out, by switching account and by deleting the account — the App first offers to export them; nothing of them is kept on our servers. They are part of the backup you create yourself (Settings → Data → Export); restored, they carry the mention of their origin |
| Usage journal (if you agreed to it) | at most 13 months on the device, then erased as it ages (each time the App is opened, even if you have stopped the journal); erased at once on request — together with the local backup copies of the database —, on reset or on uninstall |
| Anonymous account never linked to an identity | deleted after at most 90 days without any connection |
| Linked account | until you delete your account (§8), plus a short technical delay of at most 30 days for backups |
| Purchase records | anonymised on account deletion; the accounting record is kept at most 7 years, to meet French accounting and tax obligations, without your identity |
| Privacy-request logs (access, deletion) | at most 25 months, as recommended by the CNIL, so we can prove we answered |
| Authentication tokens | the access token is short-lived and renewed automatically; a renewal token that is no longer used expires after at most 180 days; both are revoked on sign-out or account deletion |
| The portal's technical logs (§3.2) | for as long as the security and the proper running of the service require, and for no other purpose; the traces attached to a sign-in token follow that token's lifetime; the log of rights requests follows the line above (at most 25 months) |
7. Your Rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on our legitimate interest, to withdraw consent at any time, and to set directives on what happens to your data after your death (Article 85 of the French Data Protection Act). You can exercise most of them directly in the App:
| Right | How |
|---|---|
| Access, rectification | everything is visible and editable in the App, with one exception: a line of "My declarations" is never changed — that is what makes it a reliable trace. An inaccurate or outdated answer is corrected by a supplementary statement, which is added (Settings → Health → My situation has changed; a new age in the profile): the earlier line stays, dated — the history of the age given, for instance. Only erasing the device's data removes it |
| Portability | Settings → Data → Export: a JSON file with all your data, your declarations included, shared through your device; Settings → Health → My declarations → Export as PDF for the record alone |
| Erasure of health data | delete an entry, or Settings → Reset, which wipes everything on the device, your declarations included (the App first offers to export them) |
| Erasure of your account | Settings → Account → Delete my account: deletes the portal account, then wipes the device |
| Withdraw consent to the recording of your health data | Settings → Reset, or uninstall the App: the data and the record of your declarations are erased together (export first what you want to keep). The App cannot work without this data; Settings → Health recalls this route |
| Withdraw health-sync consent | not applicable in this version: synchronisation is not offered (§3.3) |
| Withdraw consent to the usage journal, and erase it | Settings → Data → Usage statistics → switch it off, then "Erase the journal" |
| Withdraw all consent | reset the App or uninstall it |
| Anything else, or if you no longer have the App | write to contact-us@foretalestudio.com; we answer within one month; we may ask you to prove you own the account |
You may also lodge a complaint with a supervisory authority: in France, the CNIL (www.cnil.fr); elsewhere in the EU, your national authority; in the UK, the ICO (ico.org.uk).
8. Deleting Your Account
In the App: Settings → Account → Delete my account (offered when you are signed in to an account). The App asks the portal to delete your account, then wipes your device — it first offers to export your declarations — and signs you out. The deletion is immediate on the portal, and purchase records are anonymised as described in §6. An anonymous account you never linked to an identity is deleted by the portal at the time stated in §6, or on request by e-mail.
Without the App: write to contact-us@foretalestudio.com from the e-mail address linked to your account, with the subject "Delete my Osir account". We confirm within one month.
Deleting the account does not cancel a subscription: cancel it in your app-store account settings, or it will renew.
9. Security
Your data on the device is protected by the operating system's sandbox and, on iOS, by complete file protection while the device is locked. The App excludes its database from system backups so a copy does not leave the device without you. Authentication tokens are stored in the device's secure keychain, never in plain storage. Every connection to the portal uses HTTPS. Exports and PDFs are written to a temporary folder and deleted after they have been shared. The App contains no cipher of its own: it relies on the system's.
No system is perfectly secure. A rooted or jailbroken device, or a computer backup you make yourself, may expose the database; keep your exports safe.
10. Children
The App is for adults only (18 or older). Onboarding asks for the age, has it attested, and does not let a minor continue. We do not knowingly process the data of anyone under 18. If you believe we hold a minor's data, write to us and we will delete it.
11. Notifications, Camera, Photos
The App only sends local reminders that you schedule yourself; there is no push server. It asks for camera access only when you choose to photograph a product, and for photo library access only when you choose to attach an existing picture. Both are optional; the App works without them. The reading of a label happens on your device.
12. Users Outside the European Union
United Kingdom: the UK GDPR gives you the same rights; the ICO is your authority. United States: we do not sell or share personal information within the meaning of California law and do not process it for targeted advertising; you may exercise the rights above by e-mail. Canada: we apply PIPEDA principles; your data is under your control on your device. Elsewhere: the rights above are available to you on request.
13. Changes to This Policy
When we change this policy in a way that matters, the App shows you the new version and asks you to accept it before you continue. The version number and dates at the top change accordingly. Past versions are available on request.
14. Contact
- Controller: FORETALE STUDIO (FTS), 21 rue Maurice Flandin, 69003 Lyon, France
- E-mail: contact-us@foretalestudio.com
Version history: 1.0 (March 29, 2026) — offline-only draft. 2.0 (September 18, 2026) — portal account, opt-in health synchronisation, recipients, retention, account deletion, camera and on-device label reading, notifications. 2.1 (October 2, 2026) — optional usage journal, kept on the device and not transmitted: content, legal basis, retention, withdrawal. 2.2 (October 7, 2026) — §13 clarified: the age is asked and attested during onboarding; no other change. 2.3 (October 7, 2026) — the record "My declarations" (content, legal basis, retention, exception to the right of rectification); a tick of its own for the explicit consent to health data recorded on the device, and how to withdraw it; the date a programme was stopped; the portal's technical logs; storage on the device under Article 82 of the French Data Protection Act; health synchronisation is not offered in this version; what signing in by e-mail or with Google transmits; the anonymous account is created after the Terms are accepted, with a random identifier.