Privacy notice

Last updated: 17 July 2026

This privacy notice applies to www.nouravo.app, the Nouravo app for Apple iOS and Google Android and the API at api.nouravo.app. This English version is provided for accessibility; the German notice is the original version.

1. Controller

Rene Dressel
Im Höfchen 2
53809 Ruppichteroth
Germany
Email: support@nouravo.app

2. Scope and privacy principles

Nouravo is an everyday nutrition coach for tracking, meal suggestions and guidance. Depending on how the product is used, data is processed locally on the device, through a pseudonymous installation identifier and, after optional sign-in, through a Nouravo account. The app works offline first: entries may initially be stored on the device and synchronised with the Nouravo API when a connection is available.

Nouravo does not sell personal data. Meals, body data, excluded foods, photos and free-form coach text are not transferred to external marketing services as advertising profiles. Nouravo does not use advertising SDKs and does not use data for cross-company advertising tracking. The public website uses no marketing or analytics cookies.

Nouravo is not a medical application, does not provide a diagnosis and does not replace medical, therapeutic or dietetic advice.

3. Website, hosting and server logs

The website, API and database run on infrastructure from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany and are managed through Coolify. Technical connection data may include:

• IP address and request time
• requested URL, HTTP method and HTTP status
• referrer, browser, operating system and device type
• technical error and security information

The purpose is secure, stable and reliable delivery. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are service operation, error analysis and protection against misuse. Logs are deleted or anonymised when no longer required for these purposes. They may be retained longer while a specific security incident is investigated.

More information: Hetzner privacy policy.

4. Website language selection

On the first visit, the language may be selected from the preferred language sent by the browser. If you switch language manually, the website stores the strictly necessary first-party cookie nouravo_locale for up to one year. It contains only de or en and is set as Secure, HttpOnly and SameSite=Lax. The legal basis is Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.

5. Contact and support

When you email us, we process the sender address, message, timestamp and any voluntary attachments in order to answer the request. The legal basis is Article 6(1)(b) GDPR for contract-related matters and otherwise Article 6(1)(f) GDPR.

Support information is retained while needed to resolve the request, document communication or establish, exercise or defend legal claims. It is deleted when no longer required unless statutory retention duties apply.

6. Website calculators

The calculators on the website run locally in your browser. Inputs are not sent to the Nouravo API and are not stored by Nouravo. Results are general estimates, not medical assessments.

7. Apple App Store and Google Play

The Nouravo app is distributed through the Apple App Store and Google Play. When you open a store link, download, install, update or review the app or use store billing, Apple or Google processes data under its own responsibility. This may include:

• store account, country or region and store identifier
• IP address, device, operating-system and diagnostic data
• installation, updates and store interactions
• purchases, subscriptions, transactions, cancellations and refunds

The extent depends on the store account, device settings and platform terms. See Apple's privacy policy and Google's privacy policy.

8. Installation, local storage and device permissions

On first use, Nouravo generates a random installation ID. It supports local use, synchronisation before sign-in, technical events, privacy actions and assignment of anonymously purchased Pro access. Profile data, settings, meals, pantry items, history, favourites, analysis results and authentication information may be stored on the device. Session data is placed in protected device storage where supported by the operating system.

The app requests device permissions only when the relevant feature is actively used:

• Camera: for barcode scans and voluntarily captured meal photos
• Photo library on iOS: for a meal photo explicitly selected by the user

Nouravo does not require access to contacts, location or microphone. Permissions can be withdrawn at any time in the iOS or Android settings. The related feature may then no longer be available.

9. Optional account, sign-in and security

A Nouravo account is optional. It is useful for synchronisation, easier device changes, cross-platform assignment, data export and support. A Nouravo account is not required to purchase or restore a store subscription.

Registration or sign-in may process:

• email address, username and optional display name
• password in hashed form only
• installation ID and session or refresh-token metadata
• registration, sign-in, sign-out and update timestamps
• versions and timestamps of consent or acknowledged notices

The purpose is to provide optional account functions, assign synchronised data, support device changes and prevent unauthorised access. The legal basis is Article 6(1)(b) GDPR and, for security checks, Article 6(1)(f) GDPR.

10. Profile, nutrition, history and usage data

Depending on the features you choose, the following data may be processed locally and through an installation ID or account:

• language, daily routine, goal, common eating difficulties and app settings
• height, weight, optional target weight, optional age or age group and activity level
• calorie guidance, macro targets and optional weight entries
• meals, foods, portions, times, calories and macronutrients
• preferences, excluded foods, favourites and accepted rescue meals
• pantry items, category, storage location, approximate amount, barcode and voluntary notes
• feedback about satiety, cravings and app functions
• premium status, feature limits and fair-use counters

This processing provides tracking, personalisation, history, suggestions, synchronisation and requested Pro functions under Article 6(1)(b) GDPR. Voluntary information may rely on Article 6(1)(a). Where information qualifies as health data in context, processing additionally relies on explicit consent under Article 9(2)(a) GDPR.

Consent can be withdrawn for future processing. This does not affect processing that was lawful before withdrawal. If consent is necessary for a requested feature, that feature cannot continue after consent is withdrawn.

11. Barcodes and Open Food Facts

For a barcode search, the Nouravo API sends the scanned barcode to Open Food Facts to retrieve product and nutrition information. The query is server-side; we do not intentionally send your name, email address, meal history or body data. Product data may be cached and corrected in the Nouravo database.

The legal basis is Article 6(1)(b) GDPR. See Open Food Facts privacy information.

12. AI coach and photo analysis with OpenAI

For limited coach questions and the analysis of voluntarily captured or selected meal photos, the Nouravo API uses the OpenAI API. The following content may be transmitted to OpenAI:

• the coach question and context required for the answer
• the meal photo voluntarily captured or selected from the photo library
• language and technical request or usage information

Free-form coach questions and answers are not stored as raw text in the current Nouravo data model. Usage metadata such as status, character and token counts, model and timestamp may be stored. Nouravo does not retain meal photos as images. A photo is temporarily transmitted to the API and OpenAI for the requested analysis. The result, uncertainty, model or provider information and, after confirmation, a meal entry may be stored.

The purpose is the coach answer or photo estimate requested by the user. The legal basis is Article 6(1)(b) and, for voluntary photo or health-related information, Article 6(1)(a) and where required Article 9(2)(a) GDPR.

The provider is OpenAI Ireland Limited. Processing may also occur outside the EEA. More information about applicable safeguards is available in the OpenAI Data Processing Addendum.

13. Subscriptions, Apple, Google and RevenueCat

Pro subscriptions are purchased and billed through the Apple App Store or Google Play. Nouravo does not receive full payment details such as card or bank information. Nouravo uses RevenueCat, Inc. for offers, purchase status, access, renewal, expiry and restoration.

A purchase can be made without a Nouravo account. In this case RevenueCat generates a random pseudonymous App User ID. Before purchase or restoration, Nouravo links this ID to the local installation ID so Pro access can be assigned technically. The following data may be processed:

• anonymous or, after optional sign-in, account-related RevenueCat App User IDs and alias information
• Apple transaction information, store receipts or Google purchase tokens
• product, offer, price or currency information, duration and entitlement status
• purchase, renewal, expiry, cancellation, refund and restoration
• platform, app version and technical timestamps

If a Nouravo account is connected later, the anonymous RevenueCat ID may be merged or linked as an alias with the Nouravo user ID. This makes assignment on additional devices and between iOS and Android easier. Without a Nouravo account, a purchase can be reassigned after reinstallation or a device change through “Restore purchases” using the same Apple or Google store account.

The purpose is to display offers, unlock Pro functions, restore purchases, provide support and synchronise subscription status under Article 6(1)(b) GDPR. RevenueCat acts as a service provider and may process data on infrastructure in the United States. See the RevenueCat Privacy Policy and Data Processing Addendum.

Subscriptions are managed and cancelled through the relevant Apple or Google store account. Deleting the Nouravo app, local data or a Nouravo account does not automatically cancel a store subscription.

14. Transactional email with Resend

Nouravo may use Resend for required emails, particularly password-reset links and account notices. The recipient address, message and delivery information are processed to perform the requested account action under Article 6(1)(b) and to prevent misuse under Article 6(1)(f) GDPR.

Processing may occur in the United States. See the Resend Privacy Policy and Data Processing Addendum.

15. Technical product analytics and diagnostics

Nouravo stores data-minimised technical events in its own database, for example app starts, coach use, displayed suggestions, barcode searches, pantry changes, paywall views, purchase status, premium restrictions, feedback, errors or privacy exports. Events may be assigned to an installation ID or account. This shows whether core functions work and are used, helps limit misuse and supports product improvement.

Barcodes, meal names, body data, excluded foods, photos and free coach text are not stored as content in these analytics events. No external marketing analytics service is currently used. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are stability, misuse prevention and data-minimised product improvement.

16. Retention

• Local app data: until deletion in the app, reset of app data or uninstallation, subject to operating-system backups.
• Installation-related API data: until deletion through the app or until the assignment is no longer required, unless further retention is necessary.
• Account and synchronised data: while the optional account exists or the feature is used, then until deletion is completed unless legal retention applies.
• Session and reset data: until expiry, use or revocation, and afterwards only where security evidence is required.
• Coach and photo content: only for the requested processing; only the metadata and confirmed results described above may be retained.
• Technical events: while needed for stability, misuse prevention and product analysis, with regular review, reduction or deletion.
• Subscription and transaction assignment: while required for Pro access, restoration, support, evidence or legal duties. Separate retention by Apple, Google and RevenueCat remains unaffected.
• Support communication: until the matter is complete and thereafter only for evidence, limitation periods or retention duties.
• Backups: until overwritten through the rolling backup schedule. Deleted data is not intentionally restored into production.

Statutory retention requirements and the establishment, exercise or defence of legal claims may require longer, purpose-limited retention of individual records.

17. Recipients and international transfers

Access is limited to people and service providers who need data for operations, support, email, AI functions, product information or subscription management. Depending on the feature, these include Hetzner, Open Food Facts, OpenAI, RevenueCat and Resend. Apple and Google process store data under their own responsibility. Processing agreements under Article 28 GDPR are concluded where required.

For processing outside the EEA, providers may rely on an adequacy decision, standard contractual clauses or other safeguards permitted by law. Different government-access and legal-protection standards may still apply in third countries.

18. Automated decisions

Coach answers, photo estimates and meal suggestions may be generated partly automatically. They do not produce legal or similarly significant effects under Article 22 GDPR. Users must review, accept or reject suggestions, and they do not replace medical decisions.

19. Your rights

Subject to the legal requirements, you may request access, correction, deletion, restriction, portability and object to processing. Consent can be withdrawn for future processing at any time.

Email support@nouravo.app to exercise these rights. To prevent unauthorised access, we may request reasonable evidence that the request belongs to the relevant installation or account.

You can also complain to a data protection authority. The authority responsible for the controller's location is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

20. Data export and deletion

Export and deletion functions are available in the app's privacy section. The deletion function removes local data and, where a connection is available, submits a deletion request for associated API data. You may also email us. The step-by-step explanation and prepared email are available under request data deletion.

Depending on use, deletion includes:

• installation, account, profile and session data
• body, goal, weight and routine settings
• meal, calorie, macro and history data
• preferences, exclusions, favourites and feedback
• pantry, barcode and stored product data linked to you
• photo-analysis metadata, AI usage metadata and technical events linked to an installation or account
• RevenueCat and subscription-assignment data where Nouravo is permitted to delete it and no retention is required
• personal support communication unless further retention is required

Store purchase and transaction data is controlled by Apple or Google and cannot be deleted directly by Nouravo. Deleting Nouravo data does not cancel an active store subscription. The subscription must be cancelled in the relevant store account.

We act without undue delay and provide information about the action taken within one month. For complex or numerous requests, Article 12(3) GDPR allows an extension of up to two further months; we will explain any extension within the first month.

Data may be retained where legal duties, open matters or legal claims prevent immediate deletion. Processing is restricted where possible and the data is deleted when the reason no longer applies. Backup copies disappear through scheduled overwriting.

21. Changes to this notice

This notice is updated when app functions, data categories, service providers or legal requirements materially change. The date above identifies the published version.