Privacy Policy
Effective 26 June 2026
Attunora (“we”, “us”, the “app”) is a personal health, nutrition and training assistant. This policy explains what data we process, why, and the rights you have over it. Because the app handles information about your body and health, that data is treated as a special category of personal data under Article 9 of the EU General Data Protection Regulation (GDPR) and is processed only with your explicit consent.
Who is responsible
The data controller is the operator of Attunora. For any privacy request — access, export, correction, deletion, or to withdraw consent — contact panchalishit@gmail.com.
What we collect
- Account: an anonymous account identifier created on first launch. We do not require your name or email. You may later choose to link an email or sign-in to recover your account.
- Profile: the details you enter during onboarding — sex, height, birth year, dietary pattern and restrictions, goals, country, language, and units.
- Health & fitness data (special category): body weight, body-fat and measurement logs, body-composition scan numbers, food and meal logs, and workout/training logs that you record.
- Coaching messages: the text of conversations you have with the in-app coach.
- Technical: minimal request and error information needed to operate and debug the service.
How your data is used
- All numerical calculations — energy targets, TDEE, macro and micronutrient totals, training progression — are performed by a deterministic engine, not by an AI model.
- An AI language model (provided by OpenRouter) is used only to read your typed meal descriptions and to phrase coaching text. It receives the minimum text needed for that task. It is never used to do health calculations and never receives your photos.
- We do not sell your data, use it for advertising, or share it for any purpose unrelated to running the app.
Legal basis
We rely on your explicit consent(GDPR Art. 9(2)(a)) to process your health and fitness data, and on performance of our agreement with you (Art. 6(1)(b)) to provide the app’s features. You can withdraw consent at any time by deleting your account in the app; this does not affect processing already carried out.
Who processes data on our behalf
- Supabase — database and authentication. Your data is stored in the European Union (region
eu-central-1). - Vercel — application hosting and API delivery.
- OpenRouter — routes meal-parsing and coaching text to an AI model.
- Open Food Facts — public food/barcode catalog we query for product nutrition. Barcode lookups are not linked to your identity.
Each processor is bound to protect your data to the standard described here.
Security
Data is transmitted over encrypted connections. Each user’s rows are isolated at the database level by row-level security, so one account can never read another’s data.
Retention
We keep your data for as long as your account exists. When you delete your account, all of your data is permanently and immediately erased from our database — there is no recovery period.
Your rights
Under the GDPR you have the right to:
- Access & portability— export a full copy of your data as a JSON file from the app at any time (Body → Privacy & data → Export my data).
- Erasure— delete your account and all associated data from the app (Body → Privacy & data → Delete account).
- Rectification — correct your profile and logs directly in the app.
- Withdraw consent — by deleting your account.
- Complain — to your local data protection authority.
Children
Attunora is not intended for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
If we make a material change to how we handle your data, we will update this policy and ask you to review and accept it again before continuing to use the app.
Contact
Questions or requests: panchalishit@gmail.com.