Privacy Policy

ComniWell ("ComniWell", "we", "us") is a health & fitness app built by ComniWell, a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KVK) under number 42155849, based in the Netherlands. Contact: support@comniwell.com. We are the data controller for your personal data under the GDPR.

ComniWell is local-first. Your data is stored primarily on your device and synced to our backend (Supabase, hosted in the EU) so you can back it up and use it across devices. We do not sell your data, and we do not use it for advertising.

Only what the app actually needs to run the features you use:

• Account data: your email address, for sign-in and account emails.
• Health & fitness data you enter: workouts and training, nutrition and food logs, gut-health entries, supplements and compounds you log, biomarkers you record, habits, body measurements, sleep, resting heart rate, and related notes.
• Health Connect data (Android, only with your permission): where you connect it, we read data such as activity, heart rate, and sleep from Android Health Connect to show it alongside your other data. You control this permission and can revoke it at any time in Health Connect.
• Camera & meal photos (only when you use the AI meal-estimate feature): the photo is sent to our AI backend, which calls Anthropic's Claude API to estimate nutrients, then returns the estimate to your device. We do not store the photo anywhere; it exists only for the duration of that one request and is discarded once the estimate is returned.
• Recipe text you paste to import a recipe: sent to our AI backend to structure it into ingredients and quantities. The AI only extracts structure; it does not invent nutrition data.
• Free-text questions you type into "Ask your data": sent to our AI backend along with the relevant slice of your own logged data (the last ~90 days) needed to answer it, so Claude can generate a plain-language answer grounded in your real data.
• Basic technical data: app version and, when a request to our backend fails, a short error report (the endpoint called, the status code, and a truncated error message) so we can find and fix problems. This does not include your health data or any photo/image content.
• We do not currently use any third-party analytics or advertising SDK, and we do not track you across other apps or websites.
• We do not currently collect a push notification token. Reminders (workout, water, habit, etc.) are scheduled locally on your device and never touch our servers.
• Subscription data: not applicable yet. ComniWell is currently free to use. If we introduce a paid subscription in the future (planned via Google Play Billing, managed through RevenueCat), this section will be updated first, and Google Play — not us — will process your payment details.

To provide and sync the app's features; to generate AI estimates and answers from data you submit; to authenticate you and send account emails (sign-up confirmation, password reset); to send the local reminders you've enabled; to keep the service secure and fix problems. That's it — we don't use your data for advertising, and we don't sell it.

• Contract — to provide the app you signed up for.
• Explicit consent (special-category data) — we process your health data only with your explicit consent, given when you start using the app's health features, withdrawable at any time (Art. 9 GDPR).
• Consent — for optional features like Health Connect access and local notifications, withdrawable any time.
• Legitimate interests — to keep the service secure and functioning (e.g. the error reports described above).

Our AI features (meal-photo estimates, recipe import, ask-your-data answers, trend narration, program generation) are automated but informational only. They don't produce legal or similarly significant effects, and we don't use them to make automated decisions about you. Outputs are always framed as estimates or narration, never as exact figures or medical interpretation.

Health data is sensitive. We process it only to provide the app's features, only with your consent where required, and we never sell it, share it for advertising, or use Health Connect data for anything other than showing it back to you in the app. Revoking a permission stops that processing.

Supplements, peptides, and compounds you log are treated as neutral data — we record what you tell us without judgment, and we never use it to recommend, endorse, or provide dosing guidance.

A small number of service providers who process data only on our instructions, never as data they can use for their own purposes:

• Supabase — authentication, database, sync, and account emails. Hosted in the eu-west-1 (Ireland) region.
• Open Food Facts and USDA FoodData Central — public food-database lookups (barcode/text search terms only, no account-identifying data).
• ComniWell's own AI backend, which calls Anthropic's Claude API server-side — for meal-photo estimates, recipe import, ask-your-data answers, and trend narration, as described above.
• Google Health Connect — on-device, under your permission (Android only).
• RevenueCat + Google Play Billing — not in use yet; will be added when a paid subscription launches, and this section will be updated first.

We do not sell your data or share it with data brokers or advertisers.

Your Supabase-synced data is stored in the eu-west-1 (Ireland) region, within the EEA. Where a processor sits outside the EEA — for example, Anthropic's API infrastructure — the transfer is covered by appropriate safeguards (such as the EU Standard Contractual Clauses). [Open item for legal review: confirm the exact transfer mechanism currently in place with Anthropic and reference it here by name.]

We keep your data until you delete it or your account. When you delete your account, we delete your personal data from our systems within 30 days, except anything we must retain by law. Backups are purged on a rolling basis.

Meal photos: not retained at all — see "What we collect" above.

Local-first storage with sensitive values encrypted on-device; encryption in transit (HTTPS/TLS); access controls on our backend. No system is perfectly secure, but we take reasonable measures to protect your data.

You can access, correct, export, delete, restrict, or object to processing of your data, and withdraw consent at any time. Use the in-app tools below, or email support@comniwell.com. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

• In-app: Settings → Account → Delete account removes your account and associated data immediately.
• Export: a full personal-data export (JSON) is built into the app, in-app and instant.
• See our Account & Data Deletion page for full steps.

ComniWell is not directed at children and is intended for users 16 and older. We do not knowingly collect data from children; contact us if you believe a child has provided data.

We'll update this page and change the "Last updated" date when our practices change; significant changes will be announced in-app.