Privacy policy

Last updated 30 October 2026

Adenal is built so that your caffeine and sleep data stays on your iPhone unless you choose to sync it. This policy explains what we process, why, and what you can do about it. It covers the Adenal apps for Android, iPhone and Apple Watch, the Adenal account and this website.

1. Controller

Responsible for data processing under the General Data Protection Regulation (GDPR):

For any privacy question or request, write to support@aralel.com.

2. Data that stays on your device

Without an account, everything you enter is stored only on your iPhone and Apple Watch: drinks, sleep records, going-to-bed times, sleepiness, favourites, custom drinks and settings. We cannot see it.

Motion data. To suggest when you slept, Adenal reads your iPhone's motion activity (Core Motion). This is processed on the device only and never sent to us or anyone else.

Health data and consent. Caffeine intake and sleep are health data (Art. 9 GDPR). Before Adenal stores any, the app asks for your explicit consent (Art. 9 (2) (a) GDPR). You can withdraw it at any time in Settings → Privacy → Withdraw consent and delete all data; this deletes the data on your device and, if you have an account, on our server.

3. Account and sync (optional)

If you create an account, we process:

• Sign-in details: your email address, or with Sign in with Apple a user identifier from Apple and the email address Apple shares (which may be a private relay address).
• Your synced entries: drinks, sleep records, sleepiness logs, favourites, custom drinks and settings, with their timestamps.
• Signed-in devices: platform, device name, time of last use and a sign-in token, of which we store only a hash.
• The time you gave health consent.

Purpose: back up your data and sync it between your devices. Legal basis: performance of our agreement with you (Art. 6 (1) (b) GDPR) and, for health data, your explicit consent (Art. 9 (2) (a) GDPR). Insights are calculated on your device, not on our server.

We keep account data until you delete your account. Sign-in codes expire after 15 minutes and are deleted within a day.

4. Sign-in and account emails

When you sign in with your email address or ask to delete your account on this website, we send you a six-digit code. These emails are delivered by Resend (Resend, Inc., USA), which processes your email address and the message on our behalf under a data processing agreement. Transfers to the USA are covered by the EU Commission's standard contractual clauses (Art. 46 GDPR). Legal basis: Art. 6 (1) (b) GDPR.

5. Barcode lookups

When you scan a barcode, the app asks our server, which looks the product up in its own catalog or in Open Food Facts and caches the result. Only the barcode is sent to Open Food Facts, from our server, so Open Food Facts does not see your IP address or anything about you. Legal basis: Art. 6 (1) (b) GDPR.

6. Advertising

Adenal is free and shows banner ads from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the app starts, Google's consent dialog asks for your choice where the law requires it.

• By default, ads are not personalized. Google still processes technical data such as your IP address, device type and ad interactions to deliver ads, count views and prevent fraud.
• Only if you turn on Personalized ads in Settings → Privacy, and allow tracking when iOS asks, may Google use your device's advertising identifier to show ads based on your interests.
• Your caffeine, sleep and health data is never shared with Google or any advertiser.

Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) for personalized ads; otherwise our legitimate interest in funding a free app (Art. 6 (1) (f) GDPR). Change your choice at any time in Settings → Privacy → Ad privacy choices. Google may transfer data to the USA under the EU–US Data Privacy Framework. See Google's privacy policy.

7. Error reports

When the app or our server crashes or hits an error, a report is sent to our error tracking service (Sentry) so we can fix it. Reports contain technical details: the error, app and system version, device model and the steps that led to it. We send no names, email addresses, IP addresses, screenshots or caffeine, sleep and health data, and filter sign-in codes and synced data out of reports. Legal basis: our legitimate interest in a working app (Art. 6 (1) (f) GDPR). Reports are deleted after 90 days.

8. Hosting and this website

Our server and database run on servers in the European Union. When you visit this website or the app contacts our server, the server briefly logs technical data (IP address, time, requested address, browser or app version) to keep the service secure and fix problems (Art. 6 (1) (f) GDPR). Logs are deleted after a short time.

This website uses no tracking, no analytics and no third-party fonts or scripts. It sets one cookie only while you use the delete-account form, to remember your email address between the two steps; it is deleted when you close the browser.

9. Deleting your data

• In the app: Settings → Privacy → Withdraw consent and delete all data.
• On this website: delete your account with a code sent to your email address.
• By email: write to support@aralel.com from the address of your account.

Deletion removes your account and all synced data from our database right away. Copies in our encrypted backups disappear when those backups are overwritten.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Settings → Account → Export my data gives you a copy of everything in a machine-readable file.

You can also complain to a data protection supervisory authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

11. Children

Adenal is not meant for children under 16, and we do not knowingly process their data.

12. Changes

We update this policy when the app or the law changes. The date at the top shows the latest version; we tell you about important changes in the app.