Panotxa is a meal-quality coaching app: you photograph or describe what you eat, an AI reads the plate, and the app turns that into scores and trends. This policy explains, in plain language, what personal data we handle to do that, why, who helps us process it, how long we keep it, and what your rights are. It applies to the Panotxa app (iOS, Android and web atapp.panotxa.com) and to this website.
1. Who is responsible
The data controller is Oriol Jiménez, NIF 47897286Q, postal address Montoeri 23, Girona, Spain. For anything about your data, write to [email protected]. There is no data protection officer, because none is required for a service of this size.
2. What data we process
- Account. Your email address, an optional display name and a password (stored only as a salted hash). If you sign in with Google or Apple we receive the email and name that provider releases and a provider user id — never your provider password. Apple's "hide my email" relay addresses are accepted.
- Profile. What you choose to tell us in the app: your focus (habits or weight), language and time zone, diet type and intolerances, and — only if you turn on weight tracking — date of birth, height, sex, activity level, target weight and pace, protein preferences, and notification settings.
- Meals. Meal photos, text descriptions, meal type and time, your answers to clarification questions (portion, "was this yours?"), corrections and notes; and the results the app derives from them (dish and meal scores, extracted food signals, calories and macros, recommendations, daily notes, weekly focus goals).
- Chat. The messages you exchange with the in-app nutritionist assistant and its replies. The assistant is an AI, not a person.
- Habits and body data. Water and movement entries you log; weight and body fat entries you type in or that we import from your health app.
- Health data (opt-in only). If you switch on health sync, with your permission we read from Apple Health or Health Connect: daily step counts, active energy (and on Android total and basal energy, to correct for wearables that exclude workouts), body weight and body fat percentage. If you switch on "write to Health" we write the day's calories consumed into the same apps. We read nothing else, and we never write back anything we read.
- Pro connections. If you connect a nutrition or training professional (by entering their invite code), the connection record, which categories you chose to share, and the comments and notes that professional leaves on your data.
- Devices and technical data. Push-notification tokens for the devices where you enable notifications; the client identifiers the app uses to avoid duplicate uploads; and standard server logs (IP address, user agent, timestamps, requested URLs).
- Installation record. Each installation of the app creates a random identifier of its own (not a hardware or advertising identifier) and reports it with the device model and manufacturer, the operating system and its version, the app version and build, and the web engine version (in a browser: the browser's user-agent string). It is sent when you open the app while signed in, at most once every five minutes, and we keep the 20 most recent installations per account so we can answer support questions ("which version are you on?") and know which app versions are still in use.
- Usage statistics. Page views in the app and on this website (the page address, the referring page, the browser, operating system, device type and screen size, and the country derived from the IP address), counted by an analytics tool we run on our own server (Umami). It sets no cookies, keeps no IP addresses and does not follow you across other sites.
- Purchases. If you subscribe or buy lifetime access: which plan, the price and currency, the dates of the purchase, renewals, cancellation or refund, the store or payment provider and its transaction reference, linked to your account id. We never see or store your card or bank details.
- Error reports. When the app or the server hits an error, a report is sent to our error-monitoring service with a stack trace, app version, device model/OS and the URL involved. The app's error reporting is configured not to send personal identifiers by default; a report may still contain fragments of the data being processed at the moment of the error.
We do not collect precise location, contacts or advertising identifiers, and we never receive card or bank details: payments are handled by Apple, Google or Stripe.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6 / 9) |
|---|---|---|
| Running your account and the service you asked for: analysing meals, computing scores and trends, syncing across your devices, sending service emails (sign-up confirmation, password reset, the digests you enable) | Account, profile, meals, chat, habits | Performance of a contract (art. 6.1.b) — the terms of use |
| Sending your meal photos, texts and relevant profile context to an AI model (Google Gemini) to analyse the plate and answer in the chat | Photos, texts, meal type, diet and intolerances, chat, a summary of your recent data for the chat's context | Your consent (art. 6.1.a), given when you take/upload the first photo or send the first message. Diet and intolerance data are health-related; we rely on your explicit consent (art. 9.2.a). Withdraw by deleting the data or your account. |
| Reading and writing health data via Apple Health / Health Connect | Steps, energy, weight, body fat (read); calories consumed (written) | Your explicit consent (art. 9.2.a), given in the OS permission dialog and the in-app toggle. Withdraw any time in the app or the OS. |
| Sharing your data with a professional you connect | The categories you toggle on (meals & photos, scores, habits, body data, history) | Your explicit consent (art. 6.1.a / 9.2.a). Withdraw by disconnecting. |
| Public meal share links you create | The shared meal: photo(s), dish titles, scores, plate breakdown | Your consent (art. 6.1.a) — you create and can revoke each link |
| Push notifications you enable (trend changes, gentle logging reminders, weekly focus review) | Device push token, notification settings | Contract (art. 6.1.b); you can switch them off in the app or the OS |
| Selling and managing your subscription or lifetime purchase: knowing which plan you have, renewals, refunds, and receipts | Purchases, account id and email | Performance of a contract (art. 6.1.b); keeping payment records, legal obligation (art. 6.1.c) |
| Understanding how the app and the website are used (anonymous page-view counts) and supporting the installed app versions | Usage statistics, installation record | Legitimate interest (art. 6.1.f) in improving the service and answering support questions. You may object (section 8). |
| Keeping the service secure and working: server logs, rate limiting, error monitoring, prompt/quality observability of the AI calls | Technical data, error reports, AI traces | Legitimate interest (art. 6.1.f) in a reliable, secure service. You may object (section 8). |
| Answering your requests and exercising your rights | Your email and the request | Legal obligation (art. 6.1.c) |
We do not sell your data, we do not use it for advertising, and we do not build profiles for any purpose other than the coaching you see in the app. Automated analysis (scores, recommendations, chat replies) is informational; no decision with legal or similarly significant effects on you is made automatically.
4. Who helps us process it (processors) and international transfers
We use a small number of service providers, each bound by a data-processing agreement (GDPR art. 28) and only receiving what they need:
| Provider | What for | Where |
|---|---|---|
| netcup GmbH | Hosting of the app's servers and database, the usage statistics (Umami) and our server logs | EU (Austria, Vienna data centre) |
| Hetzner Online GmbH | Hosting of our own error-monitoring server (GlitchTip), which receives the error reports | EU (Germany, Falkenstein data centre) |
| Cloudflare, Inc. | Hosting of this website, DNS, and storage of the daily database backups | United States / global — EU-US Data Privacy Framework |
| Backblaze, Inc. (B2 cloud storage) | Storage of meal photos and generated share images | United States (region us-west-004) — EU-US Data Privacy Framework. Provider privacy notice. |
| Google (Gemini API) | AI analysis of meal photos and texts, recommendations, daily notes, chat replies | United States / global — Google is certified under the EU-US Data Privacy Framework. Under the paid Gemini API terms Google does not use your prompts to train its models. |
| Langfuse GmbH | Observability of the AI calls (the prompt sent, the model's answer, timings and cost, keyed to your account id) so we can find and fix bad answers | EU (Germany, cloud.langfuse.com EU region) |
| Resend (Plus Five Five, Inc.) | Sending transactional emails (confirmations, password resets, digests, data exports) | United States — EU-US Data Privacy Framework and standard contractual clauses where applicable. Data processing addendum. |
| RevenueCat, Inc. | Receiving and checking App Store and Google Play purchases for us (your account id and the purchase records; no card details) | United States — standard contractual clauses for restricted transfers under its data processing addendum. |
| Stripe Payments Europe, Ltd. (and Stripe, Inc.) | Card payments on the web and for professionals, invoices and VAT (Stripe collects your card details directly; we never see them) | EU (Ireland), with transfers to the United States under the EU-US Data Privacy Framework |
| Google (Firebase Cloud Messaging) and Apple (APNs) | Delivering push notifications to your device | United States — EU-US Data Privacy Framework |
| Google Sign-In / Sign in with Apple | Optional social login; they tell us who you are, we tell them nothing about your use of the app | United States — EU-US Data Privacy Framework |
When you buy through the App Store or Google Play, Apple or Google process the payment as independent controllers under their own privacy policies; we receive only the purchase record described above.
Where a provider is outside the EEA, transfers rely on an adequacy decision (the EU-US Data Privacy Framework for certified US companies) or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards in place.
Other recipients. A professional you connect sees the categories you chose to share, and only from the date you chose. Anyone who has a share link you created can open that page. We disclose data to authorities only when the law obliges us to.
5. How long we keep it
- Account, profile, meals, chat, habits, body and health data: for as long as your account exists. When you delete your account (section 7) everything is deleted, including photos in storage.
- Public share links: until you unshare the meal, delete it, or delete your account.
- Data-export files: the zip we email you a link to is deleted 24 hours after it is created.
- Pro connections: disconnecting stops the professional's access immediately; the professional's own notes and comments about you are deleted with your account.
- Server logs: 90 days, then deleted.
- Error reports:30 days, then deleted.
- Database backups: a daily copy, kept for up to 60 days. Data you delete disappears from the backups when the last copy that contains it expires.
- Installation records: the 20 most recent per account, deleted with your account.
- Usage statistics: kept in aggregate; they are not linked to your account.
- Payment notifications from Stripe and RevenueCat: the full message (which can include your name, email and billing address) is kept for 90 days, then only its provider, id, type, status and timestamps remain. The full message is erased when you delete your account; the remaining ledger is detached from your account.
- Payment records: Subscription records stored in Panotxa are deleted with your account. Payment providers hold their own records under their respective privacy policies. The minimal webhook ledger described above remains to prevent duplicate processing; it has no automatic expiry.
- AI observability traces (Langfuse):Langfuse does not automatically delete traces under its default retention policy; they can remain until deleted. Its plan-based data access window is not a deletion deadline. To request deletion of traces linked to your account, contact [email protected].
- Emails you send us: for as long as needed to answer and, if relevant, to prove we did.
Deleting your account removes its active app data. Backups, diagnostics, AI traces and the minimal payment-event ledger have the separate retention rules described above; account deletion does not mean that every copy held by a processor is immediately erased.
6. Public share links and professionals — a closer look
Share links. When you tap "share" on a meal, we create a public page (and a preview image for messaging apps) showing that meal's photo(s), dish names, scores and plate breakdown — never your name or email. It is reachable by anyone who has the link, and it can be indexed if it is posted publicly. You can revoke it from the meal at any time; it also stops working if you delete the meal or your account.
Professionals (Panotxa Pro). A nutritionist or trainer only sees your data after you enter their invite code and pick what to share: meals and photos, scores and trends, water and movement, weight and body data (off by default), and whether they see history from before the connection. They can leave comments on meals and private notes. You can disconnect at any time from the app; access ends immediately. Professionals are separately responsible for how they use what they see under their own professional obligations.
7. Deleting your account and exporting your data
In the app, under Profile, you can download all your data(a zip of CSV files, one per dataset, sent to your email as a link valid for 24 hours) anddelete your account. Deletion removes your account and everything tied to it — meals, photos, chat, habits, body and health data, professional connections and notes, push tokens — and every share link you created stops working. Deletion is immediate on the account and completes in the background within a short time; it cannot be undone. If you can no longer use the app, thedelete-account page explains how to ask us by email. Data written into Apple Health or Health Connect stays on your phone under your control; you can delete it there.
8. Your rights
You can ask us at any time to access your data, rectifyit, erase it, restrict its processing, receive it in aportable format, and object to processing based on legitimate interest. Where processing relies on consent you can withdraw it at any time without affecting what was done before. Most of this you can do yourself in the app (edit your profile, delete meals, export, delete the account); for the rest write to[email protected]. We will answer within one month.
If you think we are not handling your data properly, you have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), or with the authority of the EU country where you live.
9. Cookies and local storage
Neither this website (panotxa.app) nor the app sets cookies for analytics or advertising. Both count page views with Umami, an analytics tool we host ourselves, which uses no cookies and stores no IP addresses (section 2, "Usage statistics"). The app uses the browser's or device's local storage only for what it needs to work — your session token, your language and preferences, a random installation identifier and a small offline queue of pending uploads — never for advertising or cross-site tracking. No cookie banner is shown because none is required.
10. Children
Panotxa is not intended for anyone under 14 (the age of digital consent in Spain; up to 16 in some EU countries). We do not knowingly create accounts for children; if you believe a child has given us data, write to us and we will delete it.
11. Security
All traffic is encrypted in transit (HTTPS). Passwords are hashed, access to production systems is limited to the controller, and the API rate-limits authentication endpoints. Meal photos are stored under long random addresses that are not listed or published anywhere, but they are not password-protected: anyone who obtained a photo's exact address could open it. Should a breach ever put your rights at risk we will notify the AEPD within 72 hours and you without undue delay, as the GDPR requires.
12. Changes to this policy
We will update this page when the service changes what it does with your data, and bump the date at the top. For material changes we will tell you in the app or by email before they take effect. Previous versions are available on request.