Privacy Policy

Last updated: April 24, 2026

1. Controller

2. Data Protection Officer

No data protection officer has been appointed. We do not meet the requirements for mandatory appointment under Art. 37 GDPR.

3. Purposes and App Features

Zielfit is a health and fitness app. We process your data to provide the following features:

• Calorie, nutrient and meal tracking
• Weight, water, step, training, supplement and fasting tracking
• Body measurements and energy expenditure calculations
• AI-powered food photo analysis
• AI chat for nutrition and training questions
• Voice-based food entry (speech-to-text)
• Barcode scanner for packaged foods
• Apple Health / Health Connect integration
• Personalized push notifications (reminders, streaks)
• Premium subscription management
• Advertising (only outside Premium, personalized only with ATT consent)

4. Data We Collect

4.1 Account Data

• Email address, name, password (stored encrypted)
• When signing in with Apple or Google: provider user ID and email address
• Profile picture (optional)

4.2 Health and Fitness Data (Art. 9 GDPR)

This data belongs to special categories of personal data. Processing occurs only on the basis of your explicit consent under Art. 9(2)(a) GDPR, granted when you first use the respective tracking feature.

• Height, weight, target weight, age, gender
• Body measurements (chest, waist, hip, arms, thighs, calves, neck)
• BMI, body fat percentage, muscle mass
• Step count (via pedometer / CMPedometer)
• Training activities (type, duration, intensity, calories burned)
• Fasting sessions (start, end, target duration)
• Water intake
• Supplement intake
• Check-in events and streaks

4.3 Nutrition Data

• Entered meals, nutritional values, portions, meal type
• Self-created foods and favorite foods
• Barcode scans
• Photos of meals (not permanently stored, see section 5.2)

4.4 AI Usage

• Texts from the AI chat sent to OpenAI
• Meal photos sent to OpenAI Vision
• Voice recordings sent to OpenAI Whisper
• Chat history stored in our database for context continuity

4.5 Apple Health / Health Connect

With your consent, we read steps, weight, height, distance, active energy and water from the Health app (iOS) or Health Connect (Android), and write back steps, weight, water and active energy. You retain full control in your system settings.

4.6 Payment Data

Payments are processed exclusively via Apple (App Store) or Google (Play Store). We receive no credit card or bank details. Our subscription partner RevenueCat only provides us with subscription status and an internal user ID.

4.7 Advertising Data

• Advertising ID (IDFA on iOS, Advertising ID on Android)
• IP address (pseudonymized)
• Coarse location derived from IP
• Device model, OS version, language

Without consent we only show non-personalized advertising.

5. Third Parties

5.1 Supabase (Backend, Database, Authentication, Storage)

Provider: Supabase Inc., San Francisco, USA. Our instance is hosted in Europe. All personal data is stored at Supabase. Privacy: supabase.com/privacy

5.2 OpenAI (AI Services)

Provider: OpenAI, L.L.C., USA. Data sent: Chat messages, meal photos, voice recordings. OpenAI does not use this data to train models via our API. Privacy: openai.com/enterprise-privacy

5.3 Google AdMob (Advertising)

Provider: Google Ireland Ltd. Personalized advertising only with ATT or consent-form consent. Privacy: policies.google.com/privacy

5.4 RevenueCat (Subscription Management)

Provider: RevenueCat Inc., USA. Receives anonymized user ID and subscription status. Privacy: revenuecat.com/privacy

5.5 Apple Sign-In and Google Sign-In

Authentication tokens are processed via the respective providers: Apple Privacy / Google Privacy.

5.6 Apple In-App Purchase / Google Play Billing

Payments are processed exclusively by Apple or Google. We do not receive any payment data. For terms of service regarding purchases, see our Terms of Use.

5.7 Apple HealthKit / Google Health Connect

Health data integration is optional. We do not transfer HealthKit data to third parties for marketing. Data is processed only to provide app functionality and stored securely on our backend. We comply with Apple's restrictions on HealthKit data usage.

6. International Data Transfers

Transfers to the USA (e.g., OpenAI, RevenueCat) are based on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

7. Retention Periods

Personal data is stored until account deletion. AI inputs (photos/voice) are deleted at OpenAI within 30 days and are not permanently stored on our servers.

8. Account Deletion

Delete your account in the app under Settings → Delete Account. All data is irreversibly deleted within 30 days.

9. Your Rights

You have the right to information, rectification, erasure, and data portability under the GDPR. Contact: infozielfit@gmail.com.

10. Right to Complain

Competent authority: Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach, Germany.

11. Automated Decision-Making

Calculations (BMR, calories) are for informational purposes only and have no legal effect under Art. 22 GDPR.

12. Minors

Minimum age is 13 years. Users under 18 require parental supervision.

13. Security

We use TLS 1.3 encryption for transport and AES-256 for data at rest. Session tokens are stored in the secure system keychain.

14. Cookies and Local Storage

We do not use web cookies. Local storage is used for app settings and offline caching only.

15. Changes to This Policy

Changes will be announced via in-app notice. Continued use constitutes acceptance.

In case of discrepancies between versions, the German version at zielfit.com/datenschutz prevails for users in Germany.