Your privacy in Fitnevo

1. Controller and contact

The controller is the owner of Fitnevo, identified in the legal notice. You can contact us about privacy at fitnevo.app@gmail.com or through the help form.

2. Service and the people it is aimed at

Fitnevo organises recipes, indicative quantities, a calendar and a shopping list, and allows optional tracking. This version is intended for people aged 19 to 78. That range reflects the scope of the product and its estimates, not a statement about the general age of legal consent.

Recommendations are produced using the product's rules and calculations. They do not constitute a medical diagnosis or treatment. We do not use the profile to make medical decisions or to determine the price of your subscription.

3. What information we process

Account. Account identifier, sign-in provider, email —which may be Apple's private address— and name/avatar when you provide them or the provider supplies them. Sign-in is handled by the chosen providers and Supabase. Fitnevo does not need your Google or Apple password.

Individual plan. Age for the calculation, height, current weight and declared activity; preferences you decide to provide; declared allergies and other optional onboarding data; recipes, quantities and derived estimates. Part of this information may reveal health. Not providing an allergy is not the same as declaring that you have no allergies. We do not request HealthKit, GPS or a body photograph for these functions.

Optional tracking. Weight progress, logged meals, streaks and other progress or household shopping histories, when you authorise that tracking. They are not to be confused with your subscription transactions.

Purchases. Products, transactions and Premium entitlement status. Payment is processed by Apple. Fitnevo does not collect your full card numbers in the account or planning form.

Operation and use. User/installation identifiers, technical events for loading and purchases, paywall interaction, errors and performance. Technical services may process IP and the approximate location derived from it, not your GPS position. The app disables Superwall's optional events and RevenueCat's automatic collection of attribution identifiers. The services keep the technical processing needed to serve the paywall and verify purchases; we do not use health data for advertising or cross-app tracking.

Support and privacy. Messages, enquiry category, technical identifiers to reply, and minimal evidence of requests and decisions. Avoid including medical reports, photographs of your national ID, passwords or third-party data in a support message unless a secure channel is expressly justified for a specific procedure.

4. For what purpose and on what legal basis

We use the data objectively necessary for the account, the synchronisation you request and purchases in order to provide the contracted service (art. 6.1.b GDPR). For the individual plan, that basis is combined with your explicit consent for the data that reveal health (art. 9.2.a). Optional preferences and history rely on your consent for the corresponding purpose (art. 6.1.a and, where applicable, 9.2.a).

We do not include advertising purposes with health data in that consent. We do not send measurements, allergies or diaries to the billing/paywall systems for advertising. Requests to exercise rights and legal obligations are handled on the corresponding legal basis, keeping only the information necessary to demonstrate them.

Before collecting the protected data we show the relevant explanation and choices. The commercial terms and the policy inform you about the service; accepting them, signing in or paying is not the same as consenting to health data. We do not require you to authorise history in order to use the individual plan.

5. Your choices and withdrawal

You can refuse the processing for the plan. In that case we cannot generate a personalised estimate with your measurements, but you will be able to access the legal information, support, subscription management and account deletion. Optional data can be omitted without blocking a plan that can be provided with the necessary data.

In Your profile → Privacy & consents you can review and withdraw the authorisation for each purpose. Before you confirm, the screen explains what will stop and what data will be erased. A confirmed withdrawal starts the erasure of the affected information with no basis to keep it; it does not require a separate request afterwards. Withdrawing history does not delete the account or the purchased access, and does not prevent you from continuing to use a plan whose purpose remains authorised.

Withdrawal does not by itself affect the lawfulness of processing that was validly carried out before. If you must withdraw the plan with an active subscription, you will have access to the management options and to the complaints contact. Withdrawing consent or deleting the account does not automatically cancel an Apple subscription. You do not have to cancel first in order to exercise withdrawal or deletion.

6. Providers and access

Supabase provides account and storage services; the project's database is configured in Ireland. RevenueCat verifies purchases and entitlements; Superwall serves the paywall and the associated technical data. Apple and Google are involved when you choose their sign-in, and Apple processes purchases under its own terms. Expo/EAS distributes updates and technical services. The help centre is hosted on Cloudflare Pages; its requests are stored in Supabase. We also use the Gmail contact email to handle communications.

Not all of these services or their support access are exclusively in the European Economic Area. The agreements with Supabase, RevenueCat, Superwall and Cloudflare provide for transfer mechanisms, including standard contractual clauses depending on the service and adequacy decisions where applicable. The actual configuration and access must correspond to those agreements. You can request information about recipients, transfers and a copy of the applicable safeguards through the privacy contact.

We do not send the plan's measurements, allergies, nutritional answers or diaries to RevenueCat or Superwall. You can consult the policies of Supabase, RevenueCat, Superwall, Expo, Cloudflare, Apple and Google. The contact email account is Gmail; we do not claim that it is a Google Workspace account.

7. Retention and erasure

We keep profile and plan data to provide the authorised functions during the active relationship. Withdrawing a purpose or closing the account starts its operational erasure, except for data that must remain blocked because of a specific legal obligation. Histories are kept only for their authorised purpose, not as a requirement of the plan.

Help form enquiries expire after 90 days; the form's anti-abuse fingerprints are deleted after two days. Technical deletion receipts, without nutritional data, are deleted 90 days after the verified closure of the provider handling. While a handling process remains pending, the minimum evidence needed to resolve it is kept and its processing is monitored; it is not considered finished merely because the provider has accepted the request.

Legal communications, proof of consent and data that must be reserved for liabilities are kept blocked and restricted for the period that corresponds to the identified obligation or liability, not to provide the withdrawn function again. They are destroyed afterwards. The support retention periods do not replace those obligations nor justify keeping complete profiles.

Account deletion covers the identified local copies of that account and its remote state; the corresponding data at providers is also processed. External copies that you export remain under your control. A disconnected device may need to reconnect to complete the clean-up. The server's authorisation epochs reject writes made before a withdrawal. The Supabase project currently uses the Free plan, with no scheduled backups or PITR recovery enabled. Operational restores require checking the independent erasure log; instantaneous disappearance of every third-party copy is not promised.

Earlier plans and technical data

Plans prior to this consent record are not reused merely because you sign in, pay or accept terms. To recover the data of the same account, a current authorisation for the plan and an express confirmation of recovery are required. No history is imported without its independent authorisation, and no data is recovered from a purpose that has been withdrawn. Recovery keeps the originals and does not grant Premium. Earlier unauthorised data remains separated from active use while its retention, return or erasure is resolved; you can request these actions without authorising its reuse.

Technical provider logs are kept in accordance with their purpose of security, operation, billing and applicable obligations, for as long as necessary for them. We do not apply the help form's 90 days to those logs, nor do we promise a uniform period from all providers. Apple transactions and the information that Apple or Google must keep under their own responsibility are also governed by their policies. On receiving a request we verify its scope, carry out the erasure that applies and communicate the limits and any specific legal retention.

8. Rights and handling

You can request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consents. Write to the contact above; we will verify your identity in a proportionate way. The iOS JSON export is an additional facility, not the only way to exercise rights.

We respond to requests within the GDPR deadlines, normally within one month, informing you of any justified legal extension. That response period does not authorise unnecessarily delaying an erasure. You can lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency).

The help form provides a private link to view the reply. Keep that link: no automatic email notices are sent from that form. Do not publish the link or share it with third parties.

9. Security and changes

We apply access controls, protected connections and account separation. The native session uses secure storage; we do not claim that all local data is end-to-end encrypted or that there is zero risk. We restrict diagnostics and do not include health information in ordinary technical logs.

We will report relevant changes to purposes or practices before applying them when necessary. A new purpose that requires consent is not authorised by publishing a new policy. The effective version and date will be identified on the current page.