Last updated: June 12, 2026 · Version 1.2

Privacy Policy

This policy explains what personal data nærwert processes, why, on which legal basis, and what rights you have. It supplements the mandatory information in the Imprint. nærwert is operated from Germany and complies with the EU General Data Protection Regulation (GDPR).

1. Controller

The controller within the meaning of the GDPR is the person identified in the Imprint. Privacy requests reach us at privacy@naerwert.com.

2. Data we process

We only process the data needed to operate the app:

  • Account: email address, password (hashed), confirmation status, optional Apple Sign-in identifier.
  • Profile: date of birth (used to derive your age), biological sex (required by the BMR formula), height, current weight, activity level, target weight, weekly rate of change, units, language, country, optional dietary preferences.
  • Food diary: the foods you log with quantity, time and snapshot nutrition values (calories, protein, carbs, fat).
  • Weight history: weight entries you record, with timestamps.
  • Photo uploads: when you trigger a meal photo or nutrition-label scan, the image is sent to our AI processor (see §6) for analysis only. Images are not stored persistently on our servers.
  • Subscription status: whether you have an active subscription. All payments are processed by Apple — we never receive card or bank details.
  • Device & log data: truncated IP, timestamp, app version, device model, OS version, error logs. Used for technical operation and debugging; retained 30 days.

3. Legal bases

  • Art. 6(1)(b) GDPR (performance of contract) for account, profile, diary, photo analysis and subscription status — required to deliver the tracking service.
  • Art. 9(2)(a) GDPR (explicit consent) for processing health-related data — see §4.
  • Art. 6(1)(f) GDPR (legitimate interest) for truncated logs needed for security and abuse prevention.
  • Art. 6(1)(c) GDPR (legal obligation) for retention of purchase records under tax and commercial law.

4. Health-related data (Art. 9 GDPR)

Weight, body measurements and food diary entries can qualify as health-related data under Art. 9(1) GDPR. We process this data only on the basis of your explicit consent, granted during sign-up. You can withdraw consent at any time for the future by emailing privacy@naerwert.com or deleting your account inside the app. Health-related data is stored encrypted on EU-based servers and is accessible only to you and to the processors strictly required to deliver the service.

5. Apple HealthKit (optional)

If you grant the app access to Apple Health, we read steps, active calories and weight values strictly on-device. HealthKit data is never transmitted to our servers or to any third party and is not stored persistently. You can revoke access at any time in the iOS system settings.

6. Processors and international transfers

We use carefully selected service providers. We have data processing agreements (Art. 28 GDPR) with all processors. Transfers to third countries (in particular the United States) rely on EU Standard Contractual Clauses (SCCs) and additional safeguards where required.

  • Supabase Inc. — hosting, database, authentication, edge functions. Data is processed in the EU region (Frankfurt). Provider is US-based. Basis: DPA + SCCs.
  • Requesty — our AI processing vendor for photo analysis. Requesty routes each request, over its EU endpoint (Frankfurt, AWS eu-central-1), to a suitable AI model selected from its catalog at the time of the request; the underlying model may vary and is chosen by Requesty, not by us. Requesty does not store image or request contents (zero body retention) and receives a pseudonymised user identifier (SHA-256 hash) for cost attribution and abuse prevention. Basis: DPA (Art. 28 GDPR), with Requesty's own sub-processors bound by equivalent safeguards including SCCs where a transfer outside the EU occurs.
  • Apple Inc. (Ireland/USA) — app distribution, in-app purchases, and optional HealthKit (strictly on-device). Apple is the contracting party for all purchases.
  • Cloudflare, Inc. (USA) — hosting and delivery of the website (CDN). Processes technically necessary connection data (including IP addresses) of website visitors. Basis: DPA + SCCs / EU-US Data Privacy Framework.

7. Artificial intelligence (AI)

We use AI to identify foods and nutrition values from photos you choose to upload. When you trigger a scan, the image is sent over an encrypted connection to our AI processing vendor, Requesty, which routes it via its EU gateway (see §6) to a suitable AI model from its catalog for analysis; the structured result (name, calories, macros) is then returned to us. We do not send directly identifying profile attributes (such as your email) to Requesty or the model it routes to; Requesty only receives a pseudonymised user identifier for cost attribution. AI results are estimates — please verify them before saving.

8. Cookies, tracking, analytics

The mobile app sets no cookies. The website uses only strictly necessary local storage (e.g. for language selection). We do not use third-party tracking, advertising pixels, or personalised advertising. If we ever introduce reach-measurement analytics, we will obtain your separate consent in advance.

9. Retention

  • Account, profile and diary data: until you delete your account.
  • After deletion request: full removal from active systems within 30 days.
  • Encrypted backups: rotating retention up to 90 days, then automatic deletion.
  • Log data: 30 days.
  • Purchase-related records: statutory retention (typically 8 years for accounting records, up to 10 years per §§ 147 AO, 257 HGB).

10. Your rights

Under the GDPR you have the right to:

  • Access (Art. 15) — what data do we hold about you?
  • Rectification (Art. 16) — correction of inaccurate data.
  • Erasure (Art. 17) — "right to be forgotten".
  • Restriction (Art. 18) of processing.
  • Data portability (Art. 20) — export in a machine-readable format.
  • Object (Art. 21) to processing based on legitimate interest.
  • Withdraw consent (Art. 7(3)) — effective for the future.
  • Lodge a complaint (Art. 77) with a supervisory authority — typically the authority responsible for your place of residence or for our establishment.

Send requests informally to privacy@naerwert.com. We respond within the statutory one-month period.

11. Data security

Transmission is TLS-encrypted. Databases are encrypted at rest (AES-256). Passwords are stored as salted hashes only. Access to production data is restricted to the technically necessary minimum and is logged.

12. Minimum age

Use of the app is restricted to persons aged 16 or older. We do not knowingly process data from children under 16. Parents who suspect that their child has created an account can reach us at privacy@naerwert.com for immediate deletion.

13. Changes to this policy

We update this policy when features, processors or legal requirements change. For material changes we notify you by email or in-app and obtain renewed consent where required.

14. Contact

Privacy: privacy@naerwert.com
Controller: see Imprint.