Sub Zero Hero

Privacy Policy

Information about the processing of personal data under GDPR — for this website and for the iPhone app.

1. Controller

The controller responsible for processing is:
Stefan Siebel
Bartholomäus-Arnoldi-Str. 122
61250 Usingen
Germany
Email: app-contact@niftybits.app

2. The short version

Sub Zero Hero is an iPhone app that runs entirely on your device. There is no user account, no sign-in, and no server of ours holding your data. Your freezer inventory is stored locally on your iPhone and — if you are signed in to iCloud — synced across your devices through your own private iCloud database. We have no access to that data and never receive it. The app contains no analytics, tracking, or advertising components and no third-party SDKs.

3. Scope

This privacy policy applies to this website at subzerohero.niftybits.app and to the “Sub Zero Hero” iPhone app. The sections below indicate whether they relate to the website, the app, or both.

4. Website: hosting and connection data

This website is hosted with Amazon Web Services (AWS) in the eu-central-1 region (Frankfurt am Main, EU) and delivered through the Amazon CloudFront content delivery network. For a page to reach you at all, AWS necessarily processes technical connection data — in particular your IP address, the time of the request, the address requested, and browser and device information. We have not enabled access logging: no server log files are written for us, and we do not store this data. To protect against attacks such as denial-of-service (DDoS) floods, AWS also screens every request with the AWS WAF web application firewall: based on the IP address and the characteristics of the request, suspicious traffic is detected and, where necessary, blocked — for example when unusually many requests arrive from one IP address within a short time. We have not enabled firewall logging either. AWS shows us only aggregated counts and a small sample of individual requests, including their IP address, which expires automatically after at most three hours; we do not export or store it. Whatever AWS briefly retains beyond that to operate its own infrastructure securely is governed by AWS’s own statements. None of it is merged with other data sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website securely).

5. Website: cookies and local storage

This website sets no cookies. The only entry stored is a technically necessary item in your browser’s localStorage remembering your preferred colour theme (light/dark). It is used locally only and is not transmitted to us. We use no analytics or audience-measurement tools.

6. App: no accounts, no processing by us

Using the app requires no registration. We process neither your email address nor a password, neither your name nor your Apple Account. There is no user database on our side. The app contains no code that sends content to us; the only connections it makes are to Apple — for iCloud, for the silent push messages that drive syncing, and for the App Store — as described in sections 7 to 10.

7. App: storage on your device and in your iCloud

The content you create in the app — households, food items, quantities and units, storage locations, categories, purchase, freezing and best-before dates, and notes — is stored in a database on your iPhone. If you are signed in to iCloud and iCloud Drive is enabled for the app, that content is additionally mirrored into the private iCloud database of your own Apple Account (Apple CloudKit). That makes it available on your other devices and part of your iCloud backup.

This processing takes place between you and Apple: the data sits inside your iCloud account and counts towards its storage. CloudKit gives developers no access to users’ private databases — we can therefore neither view, nor export, nor delete your inventory. Apple’s processing is governed by Apple’s Privacy Policy. You can turn iCloud syncing off at any time in the iOS settings under Apple Account → iCloud; the app then carries on working purely locally.

For syncing, your device registers with Apple’s push service (APNs): CloudKit wakes the app with a silent push message as soon as something changes on another of your devices or in a shared household. These messages carry no content, produce no visible notification, and run entirely through Apple. The app requests no notification permission and sends you none.

Separately, the app stores two technical settings on the device only: your language choice and a flag recording that the household is unlocked (see section 10). Neither leaves the device.

Legal basis, to the extent any processing is attributable to us at all: Art. 6(1)(b) GDPR (providing the app functionality you asked for).

8. App: sharing a household

You can share your household with other people through Apple’s iCloud sharing by sending them a link. The shared content stays in the iCloud database of the person who owns the household; the people you invite get access to it through their own Apple Account. Apple shows you the name and — depending on how you invited them — the email address or phone number of the people involved, so that you know who has access. This processing too runs entirely through Apple; we receive neither the content nor the details of the participants. A share can be revoked in the app at any time.

9. App: distribution through the App Store

The app is distributed through the Apple App Store. When you download and update it, Apple processes data as its own controller; see Apple’s privacy policy for details. As the developer we receive only aggregated, non-personal statistics from Apple (such as number of downloads, device types, or regions) and — only if you have explicitly agreed to share them in the iOS settings under Privacy & Security → Analytics & Improvements — crash reports. Those reports contain technical information about the crash, not the contents of your inventory. Legal basis for crash reports: Art. 6(1)(a) GDPR (consent given to Apple, revocable there at any time).

10. App: unlocking the full version

The app is free and fully usable up to a fixed number of items. Beyond that you unlock it with a one-off in-app purchase. Apple is the seller and receives the payment: the purchase runs through your Apple Account, and we receive no payment data, no name, and no Apple Account identifier — only aggregated sales statistics from Apple. There is no subscription, and no receipt is validated on any server of ours; the unlock is confirmed by the operating system alone.

So that the unlock still applies offline and after a restart, the app stores a simple yes/no flag on the device and, in the household itself, the date it was unlocked. If the household is shared, that date syncs through the iCloud of the person who owns the household, like all other household data. The other participants can see that and when the household was unlocked, but not who paid for it. Legal basis: Art. 6(1)(b) GDPR (providing the functionality you purchased).

11. App: no tracking

Sub Zero Hero does not track you. The app uses no advertising identifiers, requests no tracking permission, and embeds no third-party analytics, advertising, or error-reporting services. Accordingly, its App Store listing declares Data Not Collected under “App Privacy”.

12. Contacting us

If you email us, we process your email address and the content of your message in order to deal with your request. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), and for app-related enquiries additionally Art. 6(1)(b) GDPR. We delete the correspondence once it is no longer needed and no statutory retention obligations apply.

13. Recipients and processors

To operate this website we use Amazon Web Services as a processor (hosting and delivery via Amazon S3 and Amazon CloudFront, eu-central-1 region, Frankfurt am Main, and protection against attacks via AWS WAF). With regard to iCloud and the App Store, Apple is not our processor but processes your data under your own contractual relationship with Apple. We do not pass data to third parties for advertising or analytics purposes.

14. Retention

You store your app content yourself: on your device and in your iCloud, for as long as you wish. It is deleted when you delete it in the app, remove the app from your device, or delete the associated iCloud data in the iOS settings. For this website we store nothing ourselves: we keep no access logs (see section 4), and your colour theme stays in your browser.

15. Your rights

Under GDPR you have, in particular, the following rights:

  • Access to data stored about you (Art. 15)
  • Rectification of inaccurate data (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection to processing based on Art. 6(1)(e) or (f) (Art. 21)
  • Lodge a complaint with a data protection authority (Art. 77)

In relation to the app:

  • Access and data portability (Art. 15, 20): you can export your entire inventory yourself at any time from the app’s settings as a structured JSON file. Conversely, you can read such a file back in there under “Import data”; that too happens entirely on your device. We cannot provide access ourselves, because we do not hold this data.
  • Erasure (Art. 17): you delete your data yourself — in the app, by removing the app, or via the iOS settings under Apple Account → iCloud → Manage Storage.
  • For any other request, reach us by email at app-contact@niftybits.app.

16. Last updated

Last updated: 5 October 2026.