TuFit
← TuFit 
TUFIT - PRIVACY POLICY
═══════════════════════════════════════════════

1. DATA CONTROLLER

Ali Dogru
Lorenz-Sandler-Str. 11
95326 Kulmbach
Germany
Email: info@tufitnutrition.com


2. WHAT DATA WE COLLECT

a) When you register
We collect your email address (for email registration) or your Apple ID identifier (for Sign in with Apple), your encrypted password, and the time of registration. Passwords are never stored in plain text.

b) During onboarding
To create your personal nutrition plan, we collect voluntarily provided information about gender, year of birth, height, weight, activity level, nutrition goal, and desired pace. This data is used solely to calculate your daily calorie needs (Mifflin-St Jeor formula).

c) When you use the app
We store the foods, meals, and calorie entries you log. Photos of nutrition labels used for AI scanning are transmitted in encrypted form to commissioned service providers for automated analysis and are not permanently stored by us - providers process the photos only for the duration of the analysis. Barcode scan events are processed locally only and are not uploaded.

d) Apple HealthKit (only with your explicit consent)
If you connect Apple Health, we read and write: active calories burned, dietary calories consumed, protein, carbohydrates, fat, and body weight. HealthKit data does not leave your device and is not stored on our servers.

e) Payment data (RevenueCat)
Payments are processed via Apple In-App Purchase and managed by RevenueCat. We do not store credit card data. RevenueCat receives an anonymized user ID and transaction information to manage your subscription. For more information, see: https://www.revenuecat.com/privacy


3. THIRD-PARTY SERVICES

We use the following third-party providers to deliver our services:

Supabase Inc. (USA) - backend, authentication, and database. Data shared: email address and nutrition data. Legal basis: Standard Contractual Clauses (SCCs), GDPR-compliant.

External processors for AI-based image analysis - automated recognition of nutrition information from photos of nutrition labels. Data shared: photo of the nutrition label. Processing is carried out solely to evaluate the scan; we do not permanently store the photos. Where processing takes place in third countries (in particular the USA), we rely on Standard Contractual Clauses (SCCs).

RevenueCat Inc. (USA) - management of subscriptions and in-app purchases. Data shared: anonymized user ID and transaction data.

Apple Inc. (USA) - In-App Purchase, HealthKit, Sign in with Apple. Data shared: transaction data in accordance with Apple's Privacy Policy.


4. TRANSFERS TO THIRD COUNTRIES

Some of our service providers are located in the USA. Personal data is transferred to the USA only where necessary for the performance of the contract.

We rely on the **Standard Contractual Clauses (SCCs)** of the European Commission pursuant to Art. 46 GDPR. In addition, we have conducted transfer impact assessments and implemented supplementary technical and organizational measures (in particular encryption) to ensure an adequate level of protection.

Affected US-based providers include:
- Supabase Inc.
- RevenueCat Inc.
- External processors for AI-based image analysis (where processing takes place in the USA)


5. LEGAL BASES FOR PROCESSING

We process your data on the following legal bases under the GDPR:

- Art. 6(1)(b) GDPR: performance of a contract - to provide app features.
- Art. 6(1)(a) GDPR: consent - for Apple HealthKit and optional features.
- Art. 6(1)(f) GDPR: legitimate interests - for security and error analysis.


6. DATA RETENTION AND DELETION

Your data is stored for as long as your account exists. You can request complete deletion of all your data at any time in the app under Profile → Delete data. After confirmation, all personal data is permanently deleted within 30 days. Photos used for AI scanning are deleted immediately after analysis and are not stored. For deletion requests, contact: info@tufitnutrition.com


7. YOUR RIGHTS (GDPR ART. 15-22)

You have the following rights regarding your personal data:

- Right of access (Art. 15): You may request information about stored data at any time.
- Right to rectification (Art. 16): You may have inaccurate data corrected.
- Right to erasure (Art. 17): You may request deletion of your data.
- Right to restriction (Art. 18): You may request restriction of processing.
- Right to object (Art. 21): You may object to processing.
- Right to data portability (Art. 20): You may receive your data in a machine-readable format.

To exercise your rights, contact us by email at: info@tufitnutrition.com

You also have the right to lodge a complaint with the competent data protection supervisory authority. For Bavaria, this is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.


8. DATA SECURITY

All data is transmitted in encrypted form (TLS/HTTPS). Passwords are hashed with bcrypt and are never stored in plain text. We use Supabase Row Level Security (RLS) so that users can only access their own data.


9. MINORS

TuFit is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If we become aware that a user is under 16, the relevant data will be deleted without delay.