Privacy Policy
Last updated: 14 September 2026.
1. Data controller
Data controller: Simon Kjeldsen (Yosano) Email: support@yosano.app Phone: +45 20 81 40 04 Address: Mathildevej 2, 2000 Frederiksberg, Denmark Yosano is currently available on the App Store in: Australia, Austria, Belgium, Canada, Denmark, Finland, France, Germany, Iceland, Ireland, Luxembourg, Netherlands, New Zealand, Norway, Portugal, Sweden, Switzerland, the United Kingdom and the United States.
2. What data do we collect?
We process the data you provide in the app: account details (email, name, username or display name), answers and measurements from the onboarding flow (such as goals, height, weight, gender, date of birth, training experience and preferences), meal logs (calories, protein, and optionally fat and carbs), workout logs, AI chat history and settings (for example calorie and protein goals, theme). Technical data such as device type may also be processed. Camera and scanning: If you use meal photo scan or barcode scan, the app accesses your camera (with your permission). Meal photos may be sent to Google Gemini to estimate nutrition. Barcode scans are used to look up product nutrition information so you can log food faster. Health and fitness data: If you connect Apple Health, we may process aggregated daily activity metrics you select (currently steps, active energy and sleep). Meal and workout logs you create also relate to health and fitness. Some of this information may be treated as sensitive or special-category personal data under applicable laws (including GDPR Article 9 and similar rules outside the EU/EEA).
3. Purpose and legal basis
We use the data to provide the app's features (personal statistics, workouts, nutrition and AI chat), operate and secure the service, process subscriptions via Apple, provide support, and — only if you opt in — send product update emails. Legal bases under the EU/EEA GDPR and UK GDPR include: • Performance of our contract with you (Article 6(1)(b)) for core account, logging, nutrition targets and chat features needed to run Yosano. • Explicit consent (Articles 6(1)(a) and 9(2)(a) where health/special-category data applies) for optional AI profile personalisation, Apple Health connection, Strava sharing when available, camera access for meal scans, and marketing email. • Legitimate interests (Article 6(1)(f)) for security, fraud prevention and crash monitoring (Sentry), balanced against your rights. You may withdraw consent at any time under Profile → My data (and Profile → Integrations for Health/Strava) without affecting processing before withdrawal.
4. Retention
We keep account and profile data while your account is active. Chat history follows your in-app chat retention settings. Meal photos used for scanning are processed to produce nutrition estimates and are not kept longer than needed for that purpose and support/security. When you delete your account, associated personal data is deleted or anonymised from our active systems in accordance with our routines, except where we must retain limited records for legal, accounting, dispute or security reasons (for example App Store / RevenueCat transaction records). Backup copies may persist for a short period until overwritten. Crash logs in Sentry are retained according to Sentry's configured retention for our project.
5. Recipients and transfers
Data is stored with Supabase (hosting, database, authentication, file storage). We use the following processors where relevant: Google LLC (Gemini API for AI chat and meal photo scanning; Google Sign-In), Apple (Sign in with Apple, HealthKit, App Store billing), RevenueCat (subscription management), Strava (optional workout sharing when the integration is available), Resend (support email), RapidAPI/ExerciseDB (exercise media proxy), and Sentry (crash and error monitoring in production builds). When you use Yosano AI (chat), your messages are always sent to Google Gemini to generate replies. If you opt in to AI personalisation under Profile → My data, we also send a short profile summary and, when Apple Health is connected, optional daily health summaries (steps, active energy, sleep) to tailor answers. Meal photo scanning sends meal images to Gemini. Barcode scanning is used to retrieve product nutrition details for logging. Onboarding macro targets are calculated on your device from your profile using established formulas (not sent to Gemini). Some processors are located in or may process data in the United States or other countries outside your home country. Transfers from the EU/EEA/UK/Switzerland only take place with appropriate safeguards (for example Standard Contractual Clauses and, where applicable, supplementary measures). We do not sell your personal information for money.
6. Your rights (EU/EEA, UK and Switzerland)
Depending on where you live, you may have rights to access, rectification, erasure, restriction, objection, and data portability, and not to be subject to solely automated decisions with legal or similarly significant effects. You may also withdraw consent where processing is consent-based. • EU/EEA: You may complain to your local supervisory authority or the Danish Data Protection Agency (Datatilsynet). • United Kingdom (UK GDPR): You may complain to the Information Commissioner's Office (ICO). • Switzerland (FADP): You may contact the Federal Data Protection and Information Commissioner (FDPIC). To exercise rights, email support@yosano.app. We will respond within the timelines required by applicable law (typically within one month under GDPR/UK GDPR).
7. United States privacy notice
If you are a US resident (including California), this section applies in addition to the rest of this policy. Categories of personal information we may collect: identifiers (such as email, user ID, name); commercial information (subscription/purchase status via Apple/RevenueCat); internet or device information (device type, crash logs); health and fitness information you provide or sync (meals, workouts, optional Apple Health aggregates); user content (chat messages, meal photos for scanning); and inferences used to personalise the service if you opt in. We use this information to provide and improve Yosano, process purchases, communicate with you, and secure the service. We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than providing the app features you request or as otherwise permitted by law. California (CCPA/CPRA) and similar US state laws may give you rights to know/access, delete, correct, and opt out of sale/sharing, and to limit use of sensitive personal information. To exercise these rights, email support@yosano.app. We will not discriminate against you for exercising privacy rights. You may use an authorised agent where the law allows; we may need to verify your identity and the agent's authority. We aim to respond within 45 days (or the period required by your state's law).
8. Canada, Australia and New Zealand
Canada: We process personal information for the purposes described in this policy, consistent with PIPEDA and applicable provincial laws. You may request access or correction and withdraw consent to optional processing (such as marketing or AI personalisation) by contacting support@yosano.app. You may complain to the Office of the Privacy Commissioner of Canada (OPC) or your provincial commissioner. Australia: We handle personal information in line with the Australian Privacy Principles. Overseas disclosure may include processors in the EU/EEA and the United States as listed above. You may request access or correction via support@yosano.app and may complain to the Office of the Australian Information Commissioner (OAIC). New Zealand: We handle personal information in accordance with the Privacy Act 2020. You may request access or correction via support@yosano.app and may complain to the Office of the Privacy Commissioner.
9. Security
We apply appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and authenticated accounts. No method of transmission or storage is completely secure; please use a strong password and protect your device.
10. Children
Yosano is not directed to children under 16. You must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided data, contact support@yosano.app and we will delete it.
11. Integrations (Apple Health, Strava)
Integrations are strictly optional. We only process data from Apple Health or Strava after you explicitly accept the integration consent (during onboarding or under Profile → Integrations) and grant the necessary permissions. You can revoke consent at any time; data will no longer be read or written, and stored health summaries can be deleted under Profile → My data. Apple Health: When enabled we may read aggregated daily values you select (currently steps, active energy and sleep in the app) and we may write your logged meals and workouts back to Apple Health. Only daily aggregates — not raw samples — are stored in our database. Strava: When the Strava integration is available and enabled, you can share individual workouts from Yosano to your Strava profile. Yosano only writes to Strava when you actively tap "Share to Strava". We do not read data from Strava. Availability may be limited while we expand API access. Your consent and changes are logged with a timestamp (GDPR art. 7).
12. Yosano AI, onboarding data and Google Gemini
Profile personalisation (optional). If you enable AI chat personalisation (during onboarding or under Profile → My data), we attach a concise summary of relevant profile fields — and, when Apple Health is connected, optional daily health summaries — to Yosano AI requests so answers can be tailored. Without this opt-in, chat still uses Gemini for your messages but without profile or health context. Onboarding macro targets. Calorie and macro goals are estimated on your device from your profile (age, sex, height, weight and fitness goal) using established formulas. Legal basis: performance of our agreement with you (GDPR art. 6(1)(b)). Processor. Google LLC provides the Gemini API as data processor for chat and meal photo scanning (GDPR art. 28). Marketing email. If you opt in during onboarding, we may send product updates by email. Legal basis: consent (art. 6(1)(a)); you can withdraw by contacting support@yosano.app or using any unsubscribe link we provide. You may withdraw AI personalisation consent at any time under Profile → My data.
13. Changes
We may update this privacy policy. For material changes we will inform you via the app or email when appropriate. The current version is always available in the app under Profile → Privacy Policy and on our website.