Privacy Policy
1. Who is responsible
Your personal data is processed by Nutrition Pulse, the developer and operator of the Nutrition Pulse mobile app (the “App”, “we”), as data controller. You can reach us at support@nutritionpulseapp.com.
2. What we process
2.1 Account details
- Name and email address.
- Password: only an irreversible hash (BCrypt) is stored; we cannot see your password.
2.2 Health and body data (special category data)
- Date of birth, sex, height, weight, estimated body-fat percentage.
- Your answers about daily activity, training frequency and experience, sport background, recent weight change and highest past weight.
- Your goal (lose/maintain/gain, target weight, pace) and program preferences (eating style, protein level, calorie distribution and floor).
- Foods, portions and macros you log; your weigh-ins; your weekly check-in answers.
- Values calculated from these: estimated energy expenditure, weight trend, calorie and macro targets.
2.3 Photos
When you use food-photo analysis, the photo you take or pick is sent to our server and our AI provider to recognise the food. The photo itself is not stored on our servers. We keep the foods you confirm and log from the result and a summary of the analysis itself: the food names the AI recognised in the photo, its estimated portions and which food in our catalog we matched them to (to improve recognition and find wrong matches). We also keep a count of analyses to enforce the daily limit.
2.4 Cosmic Rhythm (optional)
Only if you turn this feature on: your birth time (if known), birth province, and — when a daily report is created — your device’s approximate location (rounded to about 11 km) and time zone. Location is used only to calculate sunrise and sunset times.
2.5 Barcodes
When you scan a barcode, only the barcode number is used to look up the product.
2.6 Technical data
- Server logs: IP address, request time, device/app version and account ID. Logs do not contain your email address.
- On your device: sign-in tokens in the device’s secure storage, and your language preference.
2.7 Your food searches
What you type when searching for food, the first results we showed you and which of them you logged are kept, linked to your account, to improve search and find foods missing from our catalog. These records are deleted automatically after 90 days.
3. App permissions
| Permission | Used for | Required? |
|---|---|---|
| Camera | Taking food photos and scanning barcodes | No, only asked when you use these features |
| Photos | Picking a food photo from your library | No |
| Approximate location | Sunrise/sunset in Cosmic Rhythm | No, only while Cosmic Rhythm is on |
You can revoke permissions at any time in your device settings; the rest of the App keeps working.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating your account and managing sign-in | Performance of our contract with you (KVKK Art. 5/2-c) |
| Calculating, updating and showing your personal calorie and macro targets, logs and trends from your health data | Your explicit consent (KVKK Art. 6/2) |
| AI analysis of food photos and food names you type | Your explicit consent and performance of contract |
| Creating Cosmic Rhythm reports | Your explicit consent; you switch the feature on yourself |
| Security, preventing abuse and errors, daily usage limits | Legitimate interest (KVKK Art. 5/2-f) |
| Legal obligations and lawful requests | Legal obligation (KVKK Art. 5/2-ç) |
5. Who we share data with (transfers abroad)
We share data only with the service providers needed to run the App, and only as far as needed:
| Provider | Location | Purpose / data |
|---|---|---|
| Google Cloud | Germany (Frankfurt) | Server infrastructure; all App data is processed here |
| Neon (on Amazon Web Services) | Germany (Frankfurt) | Database; your account and health data are stored here |
| Anthropic | USA | AI analysis: food photos, food names you type, and for Cosmic Rhythm sky data plus a summary of your recent logging habits (days logged and your logging streak, average calories and protein vs. your targets, and the usual time of your last meal), none of which identifies you. Under its own policy Anthropic does not use this data to train models and keeps it only for a limited time for safety purposes. |
| Open Food Facts | France | Product lookup by barcode number (no personal data) |
| Expo | USA | Delivering app updates; IP address and device/app version when checking for updates |
Because our servers and database are outside Turkey, your personal data is transferred abroad under KVKK Article 9 on the basis of the explicit consent you give at sign-up. We may also disclose data to public authorities where legally required.
6. How long we keep data
- Account and health data: for as long as your account exists.
- When you delete your account (More → Delete account), all data linked to it is permanently deleted. It may remain in database backups for up to 7 more days before it is removed from them too.
- Server logs: about 30 days, for security and debugging.
- Your food searches: 90 days.
- Data we are legally required to keep: for the period the law requires.
7. How we protect it
- All traffic between the App and our servers is encrypted (HTTPS/TLS).
- Passwords are stored as irreversible hashes; sign-in tokens are kept in your device’s secure storage and access tokens expire quickly.
- Access to the database and to secrets is restricted; secrets are kept in a separate secure vault.
- Each account can only access its own data.
8. Your rights
You have the right to learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to in Turkey or abroad; ask for incomplete or incorrect data to be corrected, and for data to be deleted; ask that such corrections or deletions be notified to those third parties; object to a result against you arising solely from automated processing; and claim compensation for damage caused by unlawful processing (KVKK Art. 11). If the EU GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection.
You can withdraw your consent at any time. The quickest way is to delete your account in the App; you can also email support@nutritionpulseapp.com. We answer requests free of charge within 30 days at the latest. If you are not satisfied, you may complain to the Turkish Personal Data Protection Authority (or your local data protection authority).
9. Age limit
The App is not intended for anyone under 18, and we do not knowingly collect data from people under 18.
10. Changes
We may update this notice and will let you know about significant changes. The current version is always published at this address.