Privacy Policy

Data Controller

TODO: Name
TODO: Adresse
Email: TODO: E-Mail-Adresse

1. HealthKit Data

Purpose: Syncing your nutrition data with your daily log.
Legal basis: Consent (Art. 6(1)(a) GDPR).
Retention: until your account is deleted.
Processing location: exclusively on your device (on-device) — weight, height, birth year, sex, and workout history are only read locally, and nutrition values from your meal log are only written back to HealthKit locally.
Recipients: none — this data is never transmitted to our backend, Supabase, or any LLM provider.
Third-country transfer: none.

2. Supabase (Account & Meal Log Data)

Purpose: Storing your account and your meal entries.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
Retention: until your account is deleted.
Tables processed: user profile (weight, height, birth year, sex, body fat percentage, calorie goals), meal entries (free-text description, nutrition values, HealthKit reference ID), frequency cache (normalized food names with nutrition values), account and subscription status.
Recipients: Supabase as data processor.
Storage location/region: TODO: Supabase-Region bestätigen
Data processing agreement (DPA): TODO: confirm DPA status (Supabase + active LLM providers)
Third-country transfer: depends on the confirmed Supabase region (see above).

3. LLM Provider

Purpose: Converting your voice/text entry into a normalized food item and estimating calories and macronutrients.
Provider depending on mode:
— Standard (Free, Trial, and paid tiers) and High Reasoning where available: currentlyGoogle Gemini (2.5 Flash-Lite for normalization, 3.1 Flash-Lite for estimation, planning, and High Reasoning), connected server-side through our backend's OpenAI-compatible interface.
— BYOK mode (your own API key): your device sends the request directly to the compatible provider and endpoint you configured — your API key and this request never pass through our backend; our backend explicitly rejects BYOK requests.
Legal basis: Performance of a contract or consent (Art. 6(1)(b) or (a) GDPR) — in BYOK mode, additionally your own contract with the selected provider.
Data transmitted: free-text transcript, normalized item name, quantity, an optional recipe context (max. 500 characters), and in Plan mode your calorie budget.No photos or images, no API keys, no Supabase auth token.
Retention: held by the respective provider, not by Waffly — in BYOK mode exclusively in your own provider account.
Third-country transfer: to the USA for the currently used Google Gemini; in BYOK mode, this depends on the selected provider.

4. Cloudflare Pages (Website Hosting)

Purpose: Delivering this website.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
Retention: standard server logs per Cloudflare's retention periods.
Recipients: Cloudflare, Inc. as data processor.

5. Contact / Feedback via Email

Purpose: Handling your request.
Legal basis: Consent by actively sending the email (Art. 6(1)(a) GDPR).
Retention: none — this website itself stores no data from the feedback link; it opens your email client directly.
Recipients: exclusively Waffly directly (no third party, no form backend on this website).

Your Rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) regarding your personal data. You can exercise account deletion and data export directly in the app under Settings; for all other requests, use the contact method above.

Dispute Resolution

The European Commission previously provided a platform for online dispute resolution (ODR) at ec.europa.eu/consumers/odr; this platform was discontinued as of July 20, 2025. We are neither obligated nor willing to participate in dispute resolution proceedings before a consumer arbitration board.