Last updated: July 24, 2026
1. Data controller
Edo Galizia (TriFinger Dreams)
Email: info@trifingerdreams.app
To exercise your rights or for any question about your data, write to: info@trifingerdreams.app
2. Data we collect
2.1 Account and profile
- Email address (for authentication)
- Nickname, date of birth, height, current weight, sex, activity level, goal (weight loss/maintenance/muscle gain)
2.2 App usage data
- Food logs: foods, quantities, macronutrients (calories, protein, carbs, fat)
- Daily water intake
- Body weight measurements over time
- Logged physical activity (type, duration, calories burned)
2.3 AI analysis
When you use the AI analysis features:
- Text mode: your meal's text description is sent to Anthropic's servers (USA) for processing
- Photo mode: your meal's photo is sent to Anthropic's servers (USA) for processing
Anthropic does not retain this data beyond the time strictly necessary to process the response. More information: anthropic.com/privacy
2.4 Anonymized analytics
We collect aggregated, anonymized usage data via PostHog (e.g. which feature was used, how many foods were logged). Free-text input, photos, or individual nutritional data are never recorded.
This also applies to this website (nutrikata.app): PostHog uses cookies/local storage to distinguish anonymous visits and record aggregate interactions such as page views, language selection, and link clicks. No personal data is collected through the website.
2.5 Advertising (Free users only)
Users who have not subscribed to the Premium plan see ads via Google AdMob. Depending on the consent given through the Google User Messaging Platform (UMP) form, ads shown may be personalized or non-personalized. Users in the European Union, United Kingdom, and Switzerland are asked for this consent before every ad request, in compliance with GDPR/ePrivacy regulations. Consent can be reviewed at any time from Profile → Ad preferences.
2.6 Health data (Health Connect / HealthKit)
If you enable health data import, the app reads the following data from your device (Android Health Connect or Apple HealthKit) for the last 365 days:
- Workouts/exercise sessions (type, duration, calories burned)
- Body weight
- Daily steps
- Heart rate
- Total calories burned
This data is imported into your NutriKata diary and stored on Supabase in the same way as other usage data (section 2.2). The app never writes to or modifies data on Health Connect or HealthKit in any way: access is read-only. Import requires explicit authorization granted through the operating system's permission system (Android/iOS) and can be revoked at any time from device settings.
Since this is health-related data (a special category of data under GDPR Art. 9), processing only happens with the user's explicit consent, requested the first time the import feature is used.
3. Purposes and legal basis (GDPR)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Authentication and account management | Performance of a contract (Art. 6.1.b) |
| Calorie need calculation (TDEE) and nutrition tracking | Performance of a contract (Art. 6.1.b) |
| AI meal analysis (text and photo) | Explicit consent (Art. 6.1.a) |
| Health data import from Health Connect/HealthKit | Explicit consent (Art. 9.2.a — special category of data) |
| Anonymized analytics for service improvement | Legitimate interest (Art. 6.1.f) |
| Ad requests (AdMob) for EEA/UK/Switzerland users | Consent (Art. 6.1.a) |
4. Third-party services
| Service | Purpose | Privacy policy |
|---|---|---|
| Supabase (USA/EU) | Database, authentication, edge functions | supabase.com/privacy |
| Anthropic — Claude API (USA) | AI meal analysis | anthropic.com/privacy |
| Google AdMob | Advertising for Free users | policies.google.com/privacy |
| PostHog | Anonymized analytics | posthog.com/privacy |
| Google Health Connect (Android) | Health data import (read-only) | health.google |
| Apple HealthKit (iOS) | Health data import (read-only) | apple.com/legal/privacy |
All providers are bound by GDPR-compliant Data Processing Agreements (DPAs). Data transfers to the USA comply with GDPR safeguards (Standard Contractual Clauses).
5. Data retention
Data is retained for the duration of the active account. You can delete your account at any time from Profile → Delete account within the app. All associated personal data is permanently deleted within 30 days of the deletion request.
Anonymized analytics data, not traceable to individual users, may be retained indefinitely.
6. Your rights
As a user in the European Union, you have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate or incomplete data
- Erasure: delete your account and all associated data (available directly in the app)
- Portability: export your data in CSV format (available in the app: Profile → Export data)
- Objection: object to processing for marketing purposes or legitimate interest
- Restriction: request restriction of processing in certain cases
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing
To exercise your rights: info@trifingerdreams.app
You also have the right to lodge a complaint with the competent supervisory authority:
🇮🇹 Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) —
garanteprivacy.it
7. Data security
Data is transmitted over an encrypted connection (TLS/HTTPS). Database access is protected by Row Level Security (RLS): every user can only access their own data.
8. Minors
NutriKata is not intended for users under 13 years old. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us for immediate removal.
9. Changes to this policy
Any material changes will be communicated by updating the date at the top of this document. Continued use of the app after changes are published constitutes acceptance of the new policy.
10. Contact
Edo Galizia — TriFinger Dreams
info@trifingerdreams.app