Version 2026-11-09.
Marla is provided by Hammerschmied Sp. z o.o. (the "Operator"), a company registered in Poland. Registered office, court register (KRS), tax number (NIP) and contact details are listed in the Imprint. The Operator is the data controller under the General Data Protection Regulation (GDPR). Contact for privacy matters: privacy@marla.fit.
Marla is a personal health application for iPhone, Apple Watch and Mac. It records what you eat and drink, your nutrition targets, recipes, meal plans, shopping lists and training plans, and lets software agents you authorise (for example Claude or ChatGPT) read and write that data on your behalf through a connector. Marla stores your data on servers operated for the Operator in the European Union.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | e-mail address, name, password (stored as a salted hash), time zone, Sign in with Apple identifier | Sign-in, security, contacting you | Contract (Art. 6(1)(b)) |
| Health data | meals and drinks logged, macronutrients, hydration, nutrition targets, day types, training plans and planned sessions, logged workouts (sets, weights, heart rate, calories), cardio workouts and daily summaries from Apple Health (weight, body fat, resting heart rate, HRV, VO2 max, steps, active energy, exercise minutes, sleep), athlete profile including limitations you describe, goals, events, notes and coaching reviews | Providing the service you asked for: tracking, targets, reminders, planning | Explicit consent (Art. 9(2)(a)), see Health Data Consent |
| Household data | recipes, meal plans, shopping lists, store preferences shared with the other members of your household | Shared planning and shopping | Contract (Art. 6(1)(b)) |
| Preferences | country, grocery stores, unit system | Ranking food suggestions, display | Contract (Art. 6(1)(b)) |
| Connector access | which agent clients you authorised, their scopes, token validity, API keys you created | Letting agents act for you, revoking access | Contract (Art. 6(1)(b)) |
| Technical | IP address and request metadata in short-lived server logs | Security, abuse prevention, debugging | Legitimate interest (Art. 6(1)(f)) |
Marla does not process payment details itself; subscriptions are handled by Apple. Marla does not show advertising and does not sell or share data for advertising.
The iPhone app reads data from Apple Health only with your permission in iOS and only for the types you allow: workouts, heart rate, active energy, distances, body weight, body fat, resting heart rate, heart-rate variability, VO2 max, steps, exercise minutes and sleep. Raw samples stay on your device; Marla receives per-workout summaries and one summary per day. Workouts you record with Marla on Apple Watch are saved to Apple Health, with your permission. Marla never uses HealthKit data for advertising, never sells it and never shares it with third parties other than the agents you connect yourself, in line with Apple's App Store guideline 5.1.3.
When you search for a food, the search text and, optionally, your country and preferred stores are sent to Open Food Facts (Open Food Facts, France), a public database, to find products. No account data is sent with the query.
You can connect AI assistants and other software ("agents") to Marla through an OAuth 2.1 connector. Each connection is authorised by you, limited to the scopes you grant, and can be revoked at any time in the app (Settings → Assistants) or with the agent provider. What an agent does with the data it reads is governed by that provider's terms (for example Anthropic for Claude, OpenAI for ChatGPT). Marla itself never places orders, sends messages or buys anything.
Recipes, meal plans, shopping lists and store settings belong to your household and are visible to every household member. Your nutrition logs, targets, training data and notes are personal and are not visible to other members.
Servers are rented from Hetzner Online GmbH (Germany) in EU data centres. Container images are stored with GitHub (Microsoft). Push notifications, if enabled, are delivered by Apple. Processors act on the Operator's instructions under data-processing agreements.
Your data is kept for as long as your account exists. When you delete your account, personal data is erased immediately; households in which you were the only member are deleted with it. Server logs are kept for at most 30 days. Backups are overwritten within 30 days.
You can access, export, correct and delete your data yourself:
You have the right to lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
Marla is not intended for people under 16. We do not knowingly process data of children.
When this policy changes materially, the version date changes and the app asks you to accept the new version before continuing to use features that depend on it.