Download App

Privacy Policy

Last updated: August 2026

1. Data Controller

The controller responsible for data processing in the Cravewatch app and on this website is:

Mert Agil (sole proprietor)
In der Tiefschley 2
41517 Grevenbroich
Germany

Email: support@cravewatch.de

2. Data We Process

When you use Cravewatch, we process the following data:

  • Account data: email address (provided by your Apple or Google account; with Apple optionally an anonymized relay address), username (freely chosen)
  • Usage data: your streak, saved difficult moments, flex moments used, instant-support sessions
  • Nutrition & weight data: your meal, workout, water, and weight entries are stored locally on your device and are not uploaded to our servers. Only if you keep crew sharing enabled, individual entries (dish name and nutritional values) are transmitted to your crew
  • Plan data: age, height, current weight, target weight, activity level, and the calorie and protein targets calculated from them. We store these in your account so your plan survives a device change or a reinstall — without that backup it would be lost on switching. They are retrievable by you alone and are never shared with your crew
  • Social data: your friends list, your support circle, and your crews (only if you use these features). If you share your daily summary with a crew, your calorie target, calories eaten so far, and protein status are transmitted as well — never your weight
  • Device data: push token (only if you allow notifications)
  • Technical data: anonymized crash reports on app errors (stack traces, device model, OS version)

3. Purpose of Processing

We process your data solely to provide the app's functionality — calorie and nutrition tracking, the streak, instant support, crews, and your circle of trusted people. We do not sell data and we do not use it for advertising or profiling.

4. Legal Basis

Processing of your data is based on the following legal grounds:

  • Art. 6(1)(b) GDPR (performance of a contract): for providing the app's functionality, account management, and processing your Pro subscription.
  • Art. 6(1)(a) GDPR (consent): for push notifications and optional features you actively consent to.
  • Art. 6(1)(f) GDPR (legitimate interest): for processing technical error data via Sentry, to ensure the stability and security of the app.

5. Content with Potential Health Relevance

You can record content in Cravewatch that may allow inferences about your eating habits or personal well-being — such as difficult moments, mood entries, or notes.

This data is processed solely to provide the features you use, stored in the EU region, and never used for advertising, profiling, or analytics purposes, nor sold to third parties. Content is only visible to you; we do not evaluate it automatically.

6. Apple Health & Health Connect (optional)

You can optionally connect Cravewatch to Apple Health (iOS) or Health Connect (Android). Only after your explicit approval in the system dialog does the app read your step count, your active energy, and your most recently saved weight; when you log a new weight in Cravewatch, the app can additionally save it to Apple Health or Health Connect.

This health data is processed and displayed exclusively locally on your device. It is never uploaded to our servers, never passed on to third parties, and never used for advertising, profiling, or analytics purposes. The legal basis is your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR); you can revoke it at any time — on iOS under Settings → Health → Data Access & Devices, on Android in the Health Connect app.

7. AI Meal Analysis and Recipe Suggestions (Google Gemini)

When you use the optional AI analysis to log a meal via photo or description, the photo or your text is transmitted through our backend to Google's Gemini API (Google LLC, USA) to estimate nutritional values. The same applies to recipe suggestions: for those we transmit your remaining calories, your remaining protein target, and the selected meal type — no names, no account ID, no personal details. The transfer to the USA takes place on the basis of the EU Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR. We do not store your photos on our servers — they are passed through for analysis only. Under the paid API tier we use, Google states that submitted content is not used to train its models. Gemini API Terms of Service

Using this feature is voluntary — you can always log meals manually or via the food search instead. The legal basis is the provision of the feature you actively request (Art. 6(1)(b) GDPR).

8. Storage Location & Data Processors

We use the following data processors:

  • Supabase (Supabase Inc., USA / EU region): backend for storing your account and usage data. A data processing agreement (DPA) under Art. 28 GDPR is in place. Data is stored in the EU region.
  • Apple (Apple Inc., USA) — "Sign in with Apple": when you sign in with your Apple ID, Apple handles authentication and provides us with a user ID and an email address. A transfer to the USA takes place on the basis of the EU Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR. Apple's Privacy Policy
  • Google (Google LLC, USA) — "Continue with Google": when you sign in with your Google account, Google handles authentication and provides us with a user ID, your name, and your email address. A transfer to the USA takes place on the basis of the EU Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR. Google's Privacy Policy
  • RevenueCat (RevenueCat Inc., USA): manages your Pro subscription. RevenueCat receives a pseudonymous user ID and processes purchase data. A DPA under Art. 28 GDPR is in place. Data transfer to the USA is based on the EU Standard Contractual Clauses.
  • Sentry (Functional Software, Inc., EU region Frankfurt): technical error logging. We use the EU region, so error data is processed exclusively in Germany. Only technical data is transmitted (stack traces, device model, OS version, anonymous user ID). No email addresses, names, or content are transmitted. Sentry's Privacy Policy
  • Expo Push Notification Service (Expo, USA): only when you allow push notifications. Only the push token and the notification text are transmitted. Data transfer to the USA is based on the EU Standard Contractual Clauses. Expo's Privacy Policy
  • Apple or Google (App Store / Play Store): process your payment data directly when you purchase a subscription — we do not receive your payment data.

9. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, or unauthorized access. These include in particular transport encryption (TLS/HTTPS), access controls to the backend, regular security updates, and processing exclusively in the EU region where technically possible.

10. Retention Period

We store your data for as long as your account exists. After deletion of your account, personal data will be erased within 30 days, unless statutory retention obligations apply.

11. Your Rights

Under GDPR you have the right to:

  • Access (Art. 15)
  • Rectification (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection (Art. 21)

To exercise these rights, simply write to us at support@cravewatch.de. We will respond to requests without undue delay and at the latest within one month of receipt.

12. Account Deletion

You can delete your account at any time — either directly in the app via "Profile → Delete account" or by emailing support@cravewatch.de.

13. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates GDPR. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).

14. Minors

Persons under 16 years of age require the consent of their legal guardians for the processing of their personal data in Cravewatch. We assume that this consent is in place when the account is set up.

15. Website

This website uses no tracking or analytics tools, no advertising cookies, and no non-essential cookies. Fonts are loaded locally from our own domain — there is no data transfer to third parties (e.g. Google Fonts). When the site is accessed, only the standard, technically necessary server log information (IP address, date/time, requested URL) is stored by our host to ensure operation of the website.

16. Changes to This Privacy Policy

We reserve the right to amend this privacy policy if the app's functionality or legal requirements change. The current version is always available at cravewatch.de/en/privacy.