Privacy Policy

This privacy policy explains how transfem.fit processes personal data under the EU General Data Protection Regulation (GDPR/DSGVO) and German data protection law. It is written for the current hosted app and should be reviewed by a qualified lawyer before commercial use.

1. Controller

2. What Data We Process

Account data: full name, email address, password hash, email verification status, chosen language, signup and update timestamps, and login/session identifiers.

Support data: contact-form messages, sender name, sender email address, subject, message content, submission time, and technical metadata needed to handle abuse or troubleshooting.

Profile and body context: gender selection, age, height, current weight, goals, settings, and progress preferences.

Tracking data: food entries, nutrition estimates, meal descriptions, confidence notes, assumptions, image notes entered by the user, daily targets, workout entries, fasting or timing context, reusable templates, shopping-list items, household inventory, and imported product links.

Technical data: session cookies, remember-login cookies, language cookies, CSRF tokens, API-token hashes, activation-token hashes, request metadata that may appear in normal server logs, and security records needed to operate the service.

3. Sensitive Data

Some profile and tracking data can reveal health, body, gender, nutrition, fitness, or lifestyle information. Where this data is considered special-category data under GDPR Article 9, transfem.fit relies on your explicit consent to process it for the app features you request. You can withdraw consent at any time by contacting us, but the app may no longer be usable if the data needed for the service must be deleted.

4. Purposes and Legal Bases

Account creation, login, email activation, security, API tokens, and core tracker features are processed to provide the service requested by the user and to perform the user agreement.

Body, nutrition, workout, fasting, and goal data are processed to provide private tracking, estimates, progress views, templates, imports, and user-controlled AI prompt workflows. The legal basis is performance of the service, and for sensitive body or health-related data, explicit consent.

Security, abuse prevention, troubleshooting, and legal compliance are processed based on legitimate interests and legal obligations where applicable.

5. AI and Third-Party Tools

The website can generate prompts and can import AI output that you paste or send through the API. If you copy data into ChatGPT, Claude, Gemini, or another third-party AI tool, that third party processes the data under its own terms and privacy policy. transfem.fit does not control those external tools. Do not send sensitive data to third-party AI services unless you are comfortable with their privacy practices.

6. Cookies and Local Storage

The app uses necessary cookies for sessions, login persistence, language selection, and CSRF/security behavior. These are required for the service and are not used for advertising. The signup form may use browser local storage to keep a draft on your own device; this draft is not sent to the server until you submit the form.

7. Recipients and Processors

Data is stored on the hosting provider and database provider used for transfem.fit. Email activation uses the hosting mail system. Data is not sold and there is no public feed, leaderboard, or advertising profile. Public nutrition/product data can be stored separately from private user logs. A Lab supporter can intentionally create a secret household shopping link; anyone who receives that link can view and change that shopping list until the owner disables or replaces the link.

Data may be disclosed if required by law, to protect the service, or to respond to valid legal requests.

8. International Transfers

The service is intended to be hosted in Germany or the EU/EEA. If you use external AI tools or other third-party services yourself, your data may be transferred according to those providers' policies.

9. Retention

Account and tracking data are kept while your account exists because the app needs the history to provide progress tracking. Activation tokens expire after 48 hours and expired activation tokens are cleaned up. Session cookies expire when the browser session ends; remember-login cookies are set for up to 30 days. API tokens are stored only as password hashes. Data may be retained longer if required for legal claims, security, backups, or statutory obligations.

10. Your GDPR Rights

Subject to legal conditions, you can request access, correction, deletion, restriction of processing, data portability, and objection to certain processing. Where processing is based on consent, you can withdraw consent at any time without affecting processing that happened before withdrawal.

To exercise these rights, email info@rel.pink.

11. Complaint to a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The likely competent authority for Bergisch Gladbach, North Rhine-Westphalia, is the Landesbeauftragte fuer Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW): www.ldi.nrw.de.

12. Security

The app uses password hashing, hashed API tokens, hashed activation tokens, signed household links, CSRF protection, private account scoping, HTTPS on the public site, and HTTP-only/SameSite session cookies. No internet service can be guaranteed perfectly secure, so users should choose a strong password and keep API tokens and household links private.

13. Children

Signup requires users to be at least 13 years old. Depending on your country, parental consent may be required for younger users of online services. The service is not intended for children below the applicable minimum age.

14. Changes

This policy may be updated when the app, hosting, processors, or legal requirements change. The update date at the top shows the current version.