Privacy Policy

Controller under Art. 4(7) GDPR:

[YOUR FULL NAME]

[STREET AND HOUSE NUMBER]

[POSTCODE] Weimar, Germany

Email: iffywurst@gmail.com

• Account data: email address used to register (via Supabase Auth)
• Meal data: photos you upload, food labels, and nutrition values we calculate
• Usage data: anonymous analytics events (via PostHog, EU region) to understand how the app is used — no personal identifiers
• Water logs and fasting session timestamps stored locally and in your account

• To provide the core app functionality (meal tracking, calorie history, goals)
• To analyse food photos using Groq AI (images are processed and not stored by Groq)
• To send optional local push notifications you configure
• To improve the app through anonymous usage analytics

• Access your data (Art. 15)
• Correct inaccurate data (Art. 16)
• Delete your account and all associated data (Art. 17)
• Export your data in a portable format (Art. 20)
• Object to (Art. 21) or restrict (Art. 18) processing
• Withdraw consent at any time (Art. 7(3)) — this does not affect the lawfulness of processing carried out before withdrawal

You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI), Häßlerstraße 8, 99096 Erfurt. You may also contact the supervisory authority of your own place of residence.

• Account + core health data (weight, goals, food logs): processed on your explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) and to perform the contract (Art. 6(1)(b)). This data is required to use the app — without it the service cannot be provided.
• Payment data: required to take out a paid subscription (Art. 6(1)(b)).
• Security / sign-in logs: our legitimate interest in security and fraud prevention (Art. 6(1)(f)).
• Analytics (PostHog): optional, only with your consent (Art. 6(1)(a)); declining has no effect on your use of the app.

• Account, health data and food logs: kept until you delete your account, plus a short grace/backup window of about 30 days.
• Food photos: deleted after analysis or, where linked to a meal entry, for the lifetime of that entry / account.
• Server and sign-in logs: 7–30 days.
• Payment, invoice and tax records: retained for 8 years as required by German law (§ 147 AO, § 257 HGB).
• Backups: overwritten on a limited rotation.

• Supabase — database and auth (EU servers). Privacy policy
• Groq Cloud (USA) — AI food analysis (image sent, not stored). Transfer to the USA is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); a copy of the safeguards is available on request. Privacy policy
• PostHog — anonymous analytics (EU region, no PII). Privacy policy