Privacy policy

Controller

• Develogix Agency e.U., [pending: address], Salzburg, Austria
• Data protection requests: [pending: contact address for data protection]
• No data protection officer has been appointed; there is no obligation to do so.

Which data

• Account: Apple identifier, email address forwarded by Apple (including a relay address), display name, time zone, language.
• Profile: sex, year of birth (no date of birth), height, activity level, diet type, allergies and intolerances as codes, health flags as yes/no.
• Tracking: meals with names, amounts and nutrients, weight and measurements, activity, wellbeing.
• Technical: device model and app version, push token, times of use, error logs without health data.
• Purchase: subscription status and transaction identifiers from Apple via RevenueCat. We never see payment details – payment runs through your Apple account.

Health data

Weight, measurements and health flags are health data within the meaning of Art. 9 GDPR. We process them only with your explicit consent, which you give during onboarding separately from the terms of use and can withdraw at any time. Free text about diagnoses or medication is not stored – the app does not ask for it.

Photos

A photo of a meal is processed for the analysis and deleted afterwards, at the latest after 24 hours. Only if you explicitly save a meal with its picture does a downscaled preview remain. Location data is removed from the image on upload.

Legal bases

• Contract (Art. 6(1)(b)): account, tracking, subscription.
• Explicit consent (Art. 9(2)(a)): health data.
• Legitimate interest (Art. 6(1)(f)): protection against abuse and cost, error analysis.
• Consent (Art. 6(1)(a)): push notifications.

Who processes the data

• Hetzner Online GmbH – servers and database, data centre in Germany.
• Anthropic – analysis of photo and text. Transferred are the image, text, goal and context data as well as allergy codes and health flags; never name, email, weight or measurements. [pending: data processing agreement and standard contractual clauses]
• Apple Inc. – sign-in and purchases.
• RevenueCat, Inc. – subscription management. [pending: data processing agreement]
• Google Ireland Ltd. (Firebase Cloud Messaging) – delivery of push notifications. Transferred are the push token and the message type, no content from your diary.
• Swiss Food Composition Database (FSVO) and Open Food Facts – sources for nutrient values only; none of your data goes there.

Retention

• Analysis photos: 24 hours.
• Logs of AI calls: 90 days, afterwards only totals without reference to a person.
• Account and diary: until you delete them. After deletion they are locked for 30 days – signing in again within that time brings everything back – and are removed for good afterwards.
• Credit entries remain for accounting, without a reference to you after final deletion.

Your rights

Access, rectification, erasure, restriction, data portability and objection. Export and deletion are right inside the app: the export delivers all data as JSON and CSV, the deletion starts the 30-day period. You can also complain to the Austrian Data Protection Authority.

No tracking

No advertising, no reselling, no third-party analytics SDKs, no cookies other than those required to operate this site. This page loads no external fonts and no external scripts.