NutriLens — Privacy Policy
Effective date: June 22, 2026 Data controller: Bahri Bulut (FitnessAI) Contact: bahri9954@gmail.com
This policy explains what personal data NutriLens (“the App”) processes, why, and what rights you have.
1. Data We Collect
1.1. Account information
- The App works with an anonymous account by default (no email/password required).
- You may optionally create a permanent account with an email and password to keep your data across devices. In that case we store your email address.
1.2. Health & nutrition data (sensitive data)
- Meal photos and the nutrition values derived from them (calories, protein, carbs, fat, fiber, sugar, sodium, health score).
- Profile / goal data: age, gender, height, weight, activity level, workout frequency, diet preference, allergies, target weight and motivation.
- Weight history and daily meal logs.
- With your permission, data read from your device’s health platform (Android Health Connect / Apple Health): steps, active calories, distance, sleep, weight, heart rate. You can revoke this permission anytime in device settings.
1.3. AI processing data
- Your meal photos and coach chat messages are sent to Google Gemini (via our server-side proxy) to generate nutrition analysis and advice.
- AI calls are counted server-side for daily quota enforcement.
1.4. Subscription information
- If you purchase a premium subscription, purchase validation is handled by RevenueCat and the relevant app store (Google Play / App Store). We do not see or store your card/payment details; the store processes them.
1.5. Technical data
- Session/authentication tokens needed to run the App are stored in your device’s secure storage (Keystore/Keychain).
2. Why We Process Data (Legal Basis)
| Purpose | Basis |
|---|---|
| Provide nutrition analysis, tracking and personal advice | Consent / performance of contract |
| Create your account and maintain your session | Performance of contract |
| Display health-platform data | Consent (with permission) |
| Manage subscriptions and premium access | Performance of contract |
| Prevent abuse, enforce quotas | Legitimate interest |
Health data is special-category personal data; we process it only with your explicit consent and to provide the service to you.
3. Who We Share Data With
We do not sell your data. We share it only with processors needed to run the service:
- Supabase — authentication, database and file storage (hosting).
- Google Gemini (Google) — meal photo and text analysis (AI processing).
- RevenueCat + Google Play / Apple App Store — subscription validation and payment.
- Google Health Connect / Apple Health — only on your device, subject to your permission.
Some of these providers may process your data on servers outside your country, with appropriate safeguards in place.
4. Retention
We keep your data while your account is active. When you delete your account, your meal logs, photos, weight history, profile and identity record are permanently deleted (in-app: Settings → Privacy & Data → Delete Account).
5. Your Rights (GDPR / KVKK)
You have the right to:
- Access and export your data (in-app: Privacy & Data → Export).
- Rectify your data.
- Erase your data (“right to be forgotten”) — Delete Account.
- Object to processing and withdraw consent.
To exercise these rights: bahri9954@gmail.com.
6. Children’s Privacy
The App is not intended for anyone under 18. We do not knowingly collect data from children.
7. Security
We protect your data with encrypted transport (HTTPS), server-side authorization, row-level security (RLS) and secure on-device storage. No system is 100% secure, but we take reasonable measures to protect your data.
8. Changes
We may update this policy from time to time. We will notify you in the App of material changes. The current version is always published at this address.
9. Contact
Questions: bahri9954@gmail.com Bahri Bulut (FitnessAI) — Şanlıurfa, Türkiye