Your account
Your data and your buyers' data
We keep as little as we can: a scrambled form of each watch's ID, what was bought, and when. Card details never reach us: buyers pay on the processor's own checkout.
Who is responsible
- Your buyers' data: you are the controller, and we are your processor. The data processing agreement you accept before going live sets out the terms.
- Your own account: we are the controller of your account data.
- Payment data: your processor isn't our sub-processor. You contract with Stripe, PayPal, Polar, Razorpay or Paystack yourself, and each acts as its own controller for payment data.
- Our sub-processor: Cloudflare, for hosting, storage and email.
What the watch sends
Each check is one small request to your app's address. The body carries:
| Field | What it is |
|---|---|
d | Garmin's device ID for your app on that watch. It goes in the request's body, never its address, since addresses get logged. |
l | The watch's language, so the screens come back in it. |
h, v | Only while the buy screen is open: how long we may hold the ask, and the version of the screen it shows. |
f | Only from watch faces and data fields. |
Nothing else: no name, no location, no activity data.
What we store
| Data | Why | How long |
|---|---|---|
| A keyed hash of each watch's device ID, never the ID itself | To know a watch again: its purchase, its trial | Unpaid: 400 days after it was last seen. Paid: while the app exists |
| Purchase records: amounts, processor IDs, status, times | Unlocks, refunds, your statements | As long as tax law requires, then cut to totals |
| A buyer's email, only when a processor sends it with a payment | Support, and your Customers list | While your account exists, sealed; deleted with it |
| Your account: email, name, country, business details | Your account, notices, statements | The life of your account, and tax records as the law requires |
| Passkey public keys and session records | Signing in, your session list | Until removed; sessions 30 days after they end |
| Payment connection secrets | To create checkouts | Encrypted; deleted at once when you disconnect |
| Error logs | Fixing faults | 30 days |
| Test log lines | Your Test tab | 7 days |
- A hashed watch ID is still personal data in law. It's pseudonymous, not anonymous, and we treat it that way.
- Logs never hold a device ID or an email. A watch's code appears only as a short hash.
- IP addresses live only in short-lived counters, for rate limits, never with purchases.
- Statistics are counts only. No buyer is ever named.
What we never do
- Make buyers sign up, or ask them for anything.
- Set cookies on payment pages beyond the processor's own, and the one that lets the phone that paid unlock that watch again.
- Track buyers on payment pages or in email.
- See card numbers, hold your money, or sell or share data.
Exporting your data
In Settings, Data, choose Export. You get everything we keep about your account, apps and sales, as files you can open. A link arrives by email within an hour, and the file is deleted 24 hours after it is made. Exporting asks you to confirm it's you again if you signed in more than 10 minutes ago. Monthly statements are also in Billing, as CSV.
Deleting
- A studio: Settings, Data, Delete studio, then type the studio's name to confirm. Only its owner can. Its apps stop selling at once. Payment connections are removed and their secrets deleted at once. The rest is deleted after 30 days, except purchase and fee records, which are kept only as long as tax law requires, cut to amounts and IDs. We confirm by email. Watches that paid stay unlocked.
- Your sign-in: Your account, Profile, Delete my sign-in, then type your email to confirm. You leave every studio you're in. If you own a studio, hand it over to one of its admins (Team, Hand over) or delete it first.
- One app: from its Settings tab. Take a live app off sale first.
When a buyer asks about their data
Buyers who contact us are sent to you, since you are the controller. We help you find their records by the watch's code or the processor's payment ID, and delete what the law allows.
Your app's privacy policy
Garmin asks an app that collects user data for a privacy policy saying the data goes to you, not to Garmin. Say that the watch sends its device ID to the payment service for Premium, and name your payment processor.
If something goes wrong
If a breach affects your data, we tell you without undue delay, aiming for 72 hours, with what happened and what to change.