Privacy Policy
Last updated: 2026-07-29
1. What we collect
We collect the minimum data needed to operate Trunex Health:
- Account: email address (account creation and authentication).
- Health & fitness data (special category): food logs, calorie counts,
macro breakdowns, workout records, body weight — all linked to your account and
protected with AES-GCM encryption at rest.
- Menstrual / cycle data (special category, optional): if you use the
female health feature, the cycle dates and settings you enter are collected to power
that feature. This data is encrypted at rest, is never shared with any
third party, is never used for advertising, and is permanently deleted
when you delete your account.
- Photos (AI scan only): sent transiently to Anthropic for calorie
estimation; not stored by us or by Anthropic after the estimate is returned.
- Push notification token (optional): if you enable notifications, a
device push token is generated and sent to Google (Firebase Cloud Messaging) so we can
deliver notifications to your device. It is an identifier, not health data.
- Advertising identifier (IDFA/GAID): used for contextual advertising
only when you grant consent via the App Tracking Transparency or UMP prompt.
Never combined with health data.
- Approximate location (city level, from your IP address): the App does
not use GPS and never asks for a location permission. When you log a cardio
session, our server derives approximate coordinates from your IP address and asks a
weather service for the current outdoor temperature, so the calorie estimate can be
adjusted. The coordinates are used for that single request and are never stored.
2. How we use your data
- To provide and improve the App (food logging, goal tracking, AI estimates).
- To show advertising that helps us offer a free tier. Health/fitness data is
never used for advertising targeting.
3. Third-party processors
- Anthropic — receives meal photos for AI analysis (with your consent).
Processes data under Anthropic's privacy policy; photos are not retained.
- Google AdMob — serves contextual ads. Receives advertising identifiers
(with your consent); never receives health data. Subject to Google's privacy policy.
- Cloudflare — hosts our backend infrastructure. Data processed in the EU
and US under Cloudflare's Data Processing Addendum.
- Open Food Facts — barcode lookups use the public Open Food Facts API.
No personal data is sent to Open Food Facts.
- Open-Meteo — receives approximate coordinates (derived from your IP,
city level) to return the current outdoor temperature. No account data, no identifier
and no health data is sent; nothing is stored.
- Resend — sends transactional email (account-recovery and
account-deletion confirmation links) on our behalf. Receives your email address only;
no health data.
- Google Firebase Cloud Messaging — if you enable notifications, delivers
push messages to your device. Receives a device push token (identifier); never receives
health data.
- YouTube (Google) — some exercise/guidance videos are embedded from
YouTube using its privacy-enhanced mode. If you play a video, your IP address and device
information are sent to Google to stream it, subject to Google's privacy policy. No
account or health data is sent.
4. Data retention
We retain your data while your account is active. Sessions expire after 90 days of inactivity.
You can delete your account (and all data) at any time — see §5.
5. Your rights (GDPR / deletion)
- Access & portability: Settings → Export my data (JSON download).
- Deletion: Settings → Delete account, or
health.trunex.app/delete-account (no login required).
- Consent withdrawal: Settings → Privacy & Consent.
- EEA/UK users may also lodge a complaint with their national data protection authority.
6. Security
Health data is encrypted at rest (AES-GCM) and in transit (HTTPS/TLS). Passwords are
hashed with PBKDF2-SHA256 (100,000 iterations) and are never stored in plaintext.
7. Children
The App is not directed at children under 16. We do not knowingly collect data from minors.
8. Changes
We will notify you of material changes to this policy via in-app notice before they take effect.
9. Contact
Data controller: Trunex Health · privacy@trunex.app