Privacy Policy

This policy explains which personal data Hotaru processes, why it is processed and which services are involved. Health data is not used for advertising, marketing or tracking.

1. Controller

2. Data we process

• Account and profile: Email address, user ID, display name, optional profile image, login and account status. When signing in with Apple or Google, Hotaru receives a sign-in token, the email address and – from Apple, if shared – the name.
• Body and goals: Gender, age, height, weight, activity level, diet preference, training and nutrition targets.
• Training and nutrition: Plans, exercises, sets, repetitions, weights, meals, foods, barcodes, calories, macros, water and supplements.
• Health and fitness: Read from Apple Health (iOS) or Health Connect (Android): steps, sleep and sleep stages, heart rate, resting heart rate, heart rate variability, active energy, blood glucose, oxygen saturation, respiratory rate, weight and workouts. Written there: workouts, weight and blood glucose, plus nutrition on iOS. In addition, readiness and body metrics calculated in the app. Access starts only after system permission.
• Photos: Progress photos (photo check-in), meal photos, photos of nutrition labels and packaging, and photos sent to the AI coach (details below).
• Voice input: Messages dictated to the AI coach (details below).
• Reminders: Notification settings stored with the account.
• AI content: Messages to the AI coach, selected goals, training, nutrition and health context, and generated responses.
• Purchases: Product, subscription status, purchase status and pseudonymous RevenueCat user ID. Apple or Google processes payment information, not Hotaru.
• Technical and error data: App version, device type, operating system, timestamps, crash and performance data. Standard usage analytics with PostHog is currently disabled.
• Food searches without a match: When a search finds no verified food from our catalogue, we send the search term (lower-cased, cut to 40 characters), the selected category filter and the number of branded products found, pseudonymised, to our analytics service (PostHog), without any link to your diary entries. The purpose is to add missing foods to the catalogue (legitimate interest, Article 6(1)(f) GDPR). Please do not enter names or other personal details into the search.

3. Purposes and legal bases

• Account, synchronization, training, nutrition and subscription features: Article 6(1)(b) GDPR.
• Voluntary health data and transfer to AI services for personal insights: consent under Articles 6(1)(a) and 9(2)(a) GDPR.
• Error diagnosis, security and abuse prevention: Article 6(1)(f) GDPR.
• Legal obligations relating to purchases and requests: Article 6(1)(c) GDPR.

Consent may be withdrawn for the future. System permissions can be changed in iOS or Android. Users can stop using AI features at any time.

4. Recipients and processors

• Supabase: Authentication, database, Edge Functions and image storage.
• OpenRouter: Routes AI requests to the model providers. Only data needed for the requested response is sent.
• Anthropic (Claude models): AI request processing through OpenRouter – AI coach, analyses and recommendations, training planning, and analysis of photo check-ins, meal photos and nutrition labels.
• Google (Gemini models): AI request processing through OpenRouter for the same purposes, where a Gemini model is used.
• RevenueCat: Product offerings, purchase status, restoration and entitlements.
• Sentry: Crash, error and performance diagnostics.
• PostHog: Pseudonymised analysis of food searches without a match (see section 2).
• Open Food Facts: Search terms and barcodes used for product lookup (details below).
• Apple Health and Google Health Connect: Device interfaces for health data import and export authorized by the user.
• Apple: App Store, in-app purchases and subscription management under Apple's terms, Sign in with Apple, speech recognition on iOS.
• Google: Google Play, in-app purchases and subscription management under Google Play's terms, Sign in with Google, speech recognition on Android.

Service providers must protect personal data to at least the same standard described in this policy and required by applicable privacy law.

AI features and photos

For coach answers, analyses and recommendations, the input needed – such as the message and goal, training, nutrition and health context – is sent through OpenRouter to Anthropic or Google. Coach chat messages are stored with the account.

• Photo check-in: The progress photo is sent once to the AI model for analysis and is not stored on Hotaru's servers. The photo and the result (estimated body fat, feedback) stay on the device. Only if the estimated body fat is actively applied to the profile is that value stored with the account.
• Meal and label photos: A photo of a meal, a nutrition label or packaging is sent once to the AI model for recognition and is stored neither on Hotaru's servers nor by the app on the device. Only the entries added to the food diary are stored.
• Photos in the coach chat: An attached photo is sent once to the AI model and is not uploaded or stored on Hotaru's servers. A preview stays on the device.

Voice input

Messages to the AI coach can be dictated. Speech is turned into text by the operating system's speech recognition – Apple on iOS, Google on Android. Depending on the device and its settings, the audio may be sent to Apple or Google for this. Hotaru receives only the recognised text; Hotaru neither stores nor transmits the audio. Microphone and speech recognition are used only after system permission.

Reminders

Reminders (for example for supplements or training) are scheduled as local notifications on the device. Hotaru runs no push server and sends no push messages through Apple or Google. The related settings are stored with the account. Notifications can be turned off at any time in the app or in the system settings.

Open Food Facts (food database)

For food search and barcode scanning the app queries the open food database Open Food Facts directly (Open Food Facts, a non-profit association under French law ("Association loi 1901"), 21 rue des Iles, 94100 Saint-Maur-des-Fossés, France). For a search, the app sends your search term together with any category filter you selected and a fixed country filter (Germany) – this also applies to a product name the AI recognised on a label you photographed; the photo itself is not sent to Open Food Facts. For a barcode scan, or when opening a product that has a barcode, the barcode number is sent. As with any request over the internet, Open Food Facts technically receives your IP address and a generic app identifier (user agent) that is the same for all users. Your user ID, email address, diary entries or other account data are not sent, and the app does not upload photos or product data to Open Food Facts. The purpose is to retrieve product and nutrition information for your food log; the retrieved product data is cached locally on your device. The legal basis is performance of the contract (Article 6(1)(b) GDPR). Open Food Facts processes this data as an independent controller, not on our behalf. Details are in the Open Food Facts privacy policy: https://world.openfoodfacts.org/privacy.

5. International transfers

Some providers may process data in the United States or other countries outside the European Economic Area. This applies in particular to AI processing: OpenRouter, Anthropic and Google are based in the United States, and AI requests including photos may be processed there. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework or suitable safeguards such as EU Standard Contractual Clauses.

6. Retention

Account and content data is generally retained while the account exists. Error data and technical logs are retained only as needed for diagnostics, security and legal obligations. Deleting the account removes productive account and app data. Technical backups may remain for a limited period under the infrastructure provider's backup schedule.

7. Account deletion

Users can permanently delete their account in the app under Profile → Account & security → Delete account. A deletion request can also be sent to support@hotarucoach.com. A subscription must also be cancelled in the subscription settings of Apple or Google Play because Apple or Google manages billing. Step-by-step instructions are on the Delete account page.

8. Rights

Subject to applicable law, users have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Users may complain to a competent data protection authority.

9. Security and children

Data is transmitted over encrypted HTTPS connections. Accounts and database access are protected. Hotaru is not intended for children under 16.

10. Contact

Privacy requests: support@hotarucoach.com