Privacy notice

Last updated: 15 July 2026

This notice covers www.nouravo.app, the Nouravo Android app and the API at api.nouravo.app. The iOS app will be included when it is publicly available. This English version is provided for accessibility; the German notice is the original version.

1. Controller

Rene Dressel
Im Höfchen 2
53809 Ruppichteroth
Germany
Email: support@nouravo.app

2. Scope and principles

Nouravo is an everyday nutrition coach. Depending on how the product is used, data is processed locally on the device and, after sign-in, through the Nouravo API. The app works offline first: entries may be stored on the device and synchronised with the account when a connection is available.

Nouravo does not sell personal data. Meals, body data, excluded foods or free-form coach text are not transferred to external marketing services as advertising profiles. The public website currently uses no marketing or analytics cookies. A first-party language preference cookie is used only to remember the selected website language.

3. Website access and hosting

The website, API and database run on infrastructure from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany and are managed through Coolify. Technical connection data may include IP address, request time, URL, HTTP status, referrer, browser, operating system, device type and security or error information.

The purpose is secure, stable delivery, error analysis and protection against misuse. The legal basis is Article 6(1)(f) GDPR. Logs are deleted or anonymised when no longer needed, unless a specific security incident requires longer retention. See Hetzner's privacy policy.

4. Contact and support

When you email us, we process the sender address, message, timestamp and any voluntary attachments in order to answer the request. The legal basis is Article 6(1)(b) GDPR for contract-related matters and otherwise Article 6(1)(f) GDPR. Support information is retained only as long as needed for the request, evidence, legal claims or statutory retention.

5. Website calculators

The website calculators run locally in your browser. Inputs are not sent to the Nouravo API and are not stored by Nouravo. Results are general estimates, not medical assessments.

6. Store links

When you follow the Google Play link, you leave the Nouravo website. Google is responsible for subsequent processing, which may include your store account, device data, IP address, downloads, purchases and store interactions. See Google's privacy policy.

7. Account, sign-in and security

Account functions may process your email address, username, optional display name, password in hashed form only, installation ID, session and refresh-token metadata, registration and sign-in timestamps, and consent versions. These data provide the account, synchronisation and protection against unauthorised access under Article 6(1)(b) and, for security checks, Article 6(1)(f) GDPR.

8. Profile, nutrition and usage data

Depending on the features you choose, Nouravo may process language, daily routine, goals, common eating difficulties, height, weight, optional target weight, age group, activity level, calorie and macro guidance, weight entries, meals, foods, portions, preferences, excluded foods, favourites, pantry items, barcode information and voluntary feedback.

This processing supports tracking, personalisation, history, suggestions and synchronisation under Article 6(1)(b) GDPR. Voluntary data may rely on Article 6(1)(a). Where information qualifies as health data in context, processing additionally relies on explicit consent under Article 9(2)(a). Consent can be withdrawn for future processing.

9. Barcodes and Open Food Facts

For barcode searches, the Nouravo API sends the scanned barcode to Open Food Facts to retrieve product and nutrition information. The query is server-side; we do not intentionally send your name, email, meal history or body data. Product data may be cached and corrected in the Nouravo database. The legal basis is Article 6(1)(b) GDPR. See Open Food Facts privacy information.

10. AI coach and photo analysis with OpenAI

For limited coach questions and voluntarily selected meal photos, the Nouravo API uses the OpenAI API. The coach question, context needed for the answer, selected image, language and technical request data may be transmitted.

Free-form coach questions and answers are not stored as raw text in the current Nouravo data model. Usage metadata such as status, character and token counts, model and timestamp may be stored. Nouravo does not retain meal photos as images; analysis results, uncertainty and provider metadata may be stored where required for the requested feature.

The legal basis is Article 6(1)(b) and, for voluntary photo or health-related information, Article 6(1)(a) and where required Article 9(2)(a) GDPR. The provider is OpenAI Ireland Limited; processing may also occur outside the EEA using the transfer mechanisms described in the OpenAI Data Processing Addendum.

11. Subscriptions, Google Play and RevenueCat

Purchases and subscriptions are handled through Google Play. Nouravo uses RevenueCat, Inc. to associate subscription access across the app. A pseudonymous app user ID, purchase receipts or Google purchase token, product, duration, entitlement status, platform information and technical timestamps may be processed. Nouravo does not receive full payment details.

The purpose is to display offers, unlock paid features, restore purchases and synchronise subscription status under Article 6(1)(b) GDPR. RevenueCat states that customer data is stored on AWS infrastructure in the United States. See its privacy policy and data processing addendum.

12. Transactional email with Resend

Nouravo may use Resend for required account emails such as password reset links. The recipient address, message and delivery information are processed to perform the requested account action under Article 6(1)(b) and to prevent misuse under Article 6(1)(f) GDPR. Processing may occur in the United States. See the Resend privacy policy and DPA.

13. Technical product analytics

Nouravo stores data-minimised technical events in its own database, for example coach starts, displayed suggestions, barcode searches, pantry changes, paywall views, premium restrictions, feedback or privacy exports. This shows whether core features work and are used. Barcodes, meal names, body data, excluded foods and free coach text are not stored as content in these events. No external marketing analytics service is currently used. The legal basis is Article 6(1)(f) GDPR.

14. Retention

• Local app data: until deletion in the app, reset of app data or uninstallation, subject to operating-system backups.
• Account and synchronised data: while the account exists or the feature is used, then until deletion is completed unless legal retention applies.
• Session and reset data: until expiry, use or revocation, and afterwards only where security evidence is required.
• Technical events: while needed for stability and product analysis, with regular review, reduction or deletion.
• Support communication: until the matter is complete and thereafter only for evidence, limitation periods or retention duties.
• Backups: until overwritten through the rolling backup schedule. Deleted data is not intentionally restored into production.

15. Recipients and international transfers

Access is limited to people and service providers who need data for operations, support, email, AI functions, product information or subscription management. Processing agreements under Article 28 GDPR are concluded where required. For processing outside the EEA, providers may rely on adequacy decisions, standard contractual clauses or other safeguards. Different government-access and legal-protection standards may still apply.

16. Automated decisions

Coach answers, photo estimates and meal suggestions may be generated partly automatically. They do not produce legal or similarly significant effects under Article 22 GDPR. Users must review, accept or reject suggestions, and they do not replace medical decisions.

17. Your rights

Subject to the legal requirements, you may request access, correction, deletion, restriction, portability and object to processing. Consent can be withdrawn for future processing at any time. Email support@nouravo.app. We may ask for reasonable proof that the request belongs to the relevant account.

You can also complain to a data protection authority. The authority responsible for the controller's location is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

18. Data export and deletion

Export and deletion functions are available in the app's privacy section. You may also email us. The step-by-step explanation and prepared email are available under request data deletion.

Depending on use, deletion includes account, profile and session data; body, goal and routine settings; meal, calorie, macro and history data; preferences, exclusions, favourites and feedback; pantry and barcode data linked to you; AI and photo-analysis metadata linked to the account; technical events; and personal support communication unless further retention is required.

We act without undue delay and respond within one month. For complex or numerous requests, Article 12(3) GDPR allows an extension of up to two further months; we will explain any extension within the first month. Data may be retained where legal duties, open matters or legal claims prevent immediate deletion. Backup copies disappear through scheduled overwriting.

19. Changes to this notice

This notice is updated when app features, data categories, providers or legal requirements materially change. The date above identifies the published version.