Privacy Policy
1. Controller
The organization operating PureShape controls your data. Contact: kissszabolcs0211@gmail.com.
2. Data we process
Account
- Email and authentication data (registration, sign-in).
Profile & health data
- Name, date of birth, height, weight, goal weight, sex, activity level, goal.
- Special-category health data: dietary restrictions, allergens, intolerances, health conditions, pregnancy status, medications, eating-disorder history, only with your explicit consent, for recipe and content safety.
Usage data
- Food logs, body measurements, mood entries, cycle data (only if enabled).
- Photos: progress photos (private, only for you), avatar, community post images (if you share them).
- Generated recipes and AI conversations (Hűtő-Mágus, Lola).
- Subscription status; push notification token.
Health Connect (Android)
- If you explicitly enable it, the app only reads the following data types from Health Connect: steps, sleep, heart rate variability (HRV), and resting heart rate. The app does not write or modify any Health Connect data.
- Step and sleep data are used to show your daily activity and rest, and to personalize gentle feedback.
- HRV and resting heart rate are used to estimate a "load/stress" signal that adjusts the assistant's tone. This feature is opt-in and off by default.
- Raw HRV and heart-rate values are processed on your device and are not stored on our servers. At most, a derived qualitative load level (for example calm / neutral / strained) influences the assistant's tone.
- Health Connect data is not shared with third parties and not used for advertising.
- You can revoke Health Connect access at any time in the Health Connect app or system settings. We keep this data no longer than needed for the feature; deleting your account also deletes the related data.
3. How we use it
- To run the service: personalized recipes, logging, insights, community.
- Safety filtering: flagging allergen/diet conflicts in generated content.
- Subscription management and product support.
4. Processors
- Supabase - database and storage (EU region).
- Google (Gemini API) - for recipe/chat generation, your ingredients and relevant health context are processed (for safe output).
- RevenueCat and Google Play Billing - subscriptions (payment handled by Google; we never see card data).
- Firebase Cloud Messaging - push notifications (if enabled).
- PostHog (EU) - product telemetry, only with separate consent; off by default.
We do not sell your data or use it for advertising.
5. Legal bases (GDPR)
- Performance of a contract (providing the service).
- Consent (special-category health data, optional telemetry, push).
- Legitimate interest (security, abuse prevention).
6. Retention
We keep your data while your account exists. On deletion we remove data linked to you, except where law requires retention.
Account & data deletion
You can delete your account and all associated data at any time:
- In the app: Profile → Account → "Delete account". Deletion is immediate and permanent.
- By email: write to kissszabolcs0211@gmail.com from your registered email address and we will delete your account.
On deletion we permanently remove your profile, your food, weight, mood and cycle logs, recipes, AI conversations (Lola), uploaded photos (avatar and progress photos), and notification tokens. This cannot be undone. We retain only the data that law requires us to keep (for example billing records), for the legally mandated period.
7. Your rights
- Access, rectification, erasure, restriction, objection, portability.
- In-app data export and account deletion are available in settings; consents can be withdrawn anytime.
- Complaints: to your local data protection authority (in Hungary, the NAIH).
8. Security
Row-Level Security on stored data, encrypted transport (HTTPS), secure on-device storage for sensitive data.
9. Children
The app is not intended for users under 16.
10. Changes
We may update this policy from time to time; material changes are announced in the app.