Privacy Policy

Data Controller

Controller: René Kann, Erich-Nehlhans-Str. 19, 10247 Berlin, Germany,support@waffly.app.
Scope: This notice covers the Waffly app and this website.
Purpose: Information about every processing activity of the released production state, meaning the features that are actually available today.

Account, Sign-In and Consents

Purpose: Sign-in, account management, and evidence of your consents.
Data: Email address, password hash, the name from registration, and server-side consent and version records with their timestamps.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR); consents under Art. 6(1)(a) GDPR.
Retention: until your account is deleted. Signing out is not account deletion.

Profile and Health-Related Values

Purpose: Calorie goals, progress, and planning.
Data: Weight, height, birth year, sex, body fat percentage, and calorie goals, stored in Supabase.
Apple Health: HealthKit values stay separate under Apple's and your control. Waffly does not keep an additional copy of raw HealthKit data on its own servers.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR); for health-related data your explicit consent (Art. 9(2)(a) GDPR).
Retention: until the respective entry or your account is deleted.

Meals, Favorites, Cache, Quotas and Device Check

Purpose: Daily log, repeats, quota control, and abuse prevention.
Data: Meal entries with free text, nutrition values, and Apple Health links, favorites, frequency data, daily quotas, temporary reservation and rate-limit data, subscription and feature-access status, and technical deletion and synchronization evidence.
Device check: a one-time technical device check serves as a trial abuse lock and holds no health data.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in abuse prevention (Art. 6(1)(f) GDPR).
Retention: see the retention overview; core data until the entry or your account is deleted.

Voice Input

Purpose: Converting your voice input into text.
Audio data: Waffly stores no audio file. Transcription may run through Apple's cloud speech recognition; Apple may store and process audio as well as transcript and request data under its own terms, associated with rotating device identifiers.
Data reaching Waffly: only the transcript, not the recording.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR); for using cloud speech recognition your consent.
Retention: no audio at Waffly; the transcript only as part of your meal entry.

Photos

Purpose: Photo-based estimation of calories and macronutrients.
Storage: locally on the device or in Waffly storage in the EU (Cloudflare R2); Google Gemini performs the processing for the estimate.
Retention: at most 30 days at Waffly. We delete incomplete photo uploads after 7 days. The app removes local copies on the next start or foreground switch on a best-effort basis. After expiry, physical deletion may take up to about 24 hours.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
Retention details: see above and the retention overview.

Managed AI

Purpose: Normalizing your input and estimating nutrition values without your own key.
Involved parties: Cloudflare (running the Workers close to the request), Supabase (EU data storage), Google Gemini (normalization and estimation), and conditionally OpenAI only for normalizing text.
OpenAI fallback: text only, no photos, no profile data; the data is not used for model training by default; OpenAI retains abuse logs for up to 30 days.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR); for AI processing your consent (Art. 6(1)(a) GDPR).
Retention: results as part of your meal entry; provider logs under the provider's terms.

BYOK: Your Own AI Access

Purpose: Using your own AI access instead of the Waffly quota.
Flow: the request goes directly from the device to the provider you selected; your key stays in the iOS Keychain and is not sent to Waffly.
Responsibility: you are responsible for the processing, processing region, retention, and terms of the provider you selected.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and your own contract with the selected provider.
Retention: at your provider, not at Waffly.

Analytics with PostHog EU

Purpose: Optional product analytics to improve the app.
Provider: PostHog Cloud EU. Events are linked to your account ID and your email address and are therefore account-linked, not anonymous.
Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable in settings.
Retention: at most 1 year.
Withdrawal and erasure: withdrawal stops future events on updated clients. Account deletion places an asynchronous erasure order for the person and the events and repeats it for 30 days; we cannot prove provider-side completion. A device that is not updated may recreate provider data after this window. We therefore promise no immediate or permanently verified erasure.

Diagnostics with Bugsnag

Purpose: Detecting and fixing crashes and errors.
Provider: Bugsnag; processing in the USA based on a data processing agreement with standard contractual clauses.
Data: technical error data with your account ID and, when a sign-in fails, the email address typed during that attempt, which may belong to no account.
Retention: 7 days on the Free plan; we handle erasure requests for individual events manually and only within what is possible. Cloudflare retains Worker logs and traces for 3 days. An internal verbose logging mode is off by default and cannot be enabled by end users.
Legal basis: Legitimate interest in stability and abuse prevention (Art. 6(1)(f) GDPR).

Barcode with Open Food Facts

Purpose: Product data for a scanned barcode.
Transmission: the app queries the open Open Food Facts database directly. Open Food Facts then receives the barcode, your IP address, and the user agent with the Waffly version. No account ID, no email address, no health data, and no cookies are transmitted.
Retention: Open Food Facts publishes a 3 years period for visitor logs; we have no influence on it.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

Email and Support via Netcup

Purpose: Handling your request tosupport@waffly.app.
Provider: the mailbox is hosted at Netcup; Netcup processes the mailbox data as a data processor.
Retention: regularly closed support cases 12 months; sensitive attachments shorter; exceptional retention only where legally or for billing reasons unavoidable.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in handling your request (Art. 6(1)(f) GDPR).

Purchases via Apple StoreKit

Purpose: Handling subscriptions and one-time purchases and mapping your feature-access status.
Flow: Apple processes payment and the receipt; Waffly receives and stores subscription and feature-access status to unlock features.
Note: deleting your Waffly account does not cancel an Apple subscription and does not refund a purchase.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

Retention Overview

Your Rights, Withdrawal and Erasure

Rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21), plus the right to withdraw consents at any time with effect for the future.
Account deletion: you can delete your account and its data in the app settings. Deletion removes local domain data only on the device that performs it. Another installation without a connection keeps its own isolated local copy until deletion or a reset runs there, the applicable retention period prunes it, or the app data is removed. Signing out is likewise not account deletion: updated clients clear the telemetry identity and identified queues, while account-linked domain data and a scoped BYOK configuration may remain in the app sandbox.
Export: we provide a data export or a transferable copy on a manual request tosupport@waffly.app. There is no in-app export feature. We verify your identity securely before releasing any data.
Complaint: you may lodge a complaint with the competent supervisory authority.

International Transfers

USA: Google Gemini and Bugsnag process data in the USA, safeguarded by data processing agreements with standard contractual clauses.
Open points: we do not invent details we have not confirmed. For your BYOK provider you determine the region and the contract yourself.

Audience and Version

Audience: Waffly targets adults (18+).
Contact: support@waffly.app.
Version: effective 17.09.2026.