Privacy Policy

Last updated: 2026-07-29

1. What we collect

We collect the minimum data needed to operate Trunex Health:

• Account: email address (account creation and authentication).
• Health & fitness data (special category): food logs, calorie counts, macro breakdowns, workout records, body weight — all linked to your account and protected with AES-GCM encryption at rest.
• Menstrual / cycle data (special category, optional): if you use the female health feature, the cycle dates and settings you enter are collected to power that feature. This data is encrypted at rest, is never shared with any third party, is never used for advertising, and is permanently deleted when you delete your account.
• Photos (AI scan only): sent transiently to Anthropic for calorie estimation; not stored by us or by Anthropic after the estimate is returned.
• Push notification token (optional): if you enable notifications, a device push token is generated and sent to Google (Firebase Cloud Messaging) so we can deliver notifications to your device. It is an identifier, not health data.
• Advertising identifier (IDFA/GAID): used for contextual advertising only when you grant consent via the App Tracking Transparency or UMP prompt. Never combined with health data.
• Approximate location (city level, from your IP address): the App does not use GPS and never asks for a location permission. When you log a cardio session, our server derives approximate coordinates from your IP address and asks a weather service for the current outdoor temperature, so the calorie estimate can be adjusted. The coordinates are used for that single request and are never stored.

Legal basis. Health & fitness data and menstrual / cycle data are special-category data under Article 9 GDPR. We process them only with your explicit consent (Article 9(2)(a)), obtained when you create your account and opt into each feature, in combination with the performance of our contract with you (Article 6(1)(b)). You can withdraw your consent at any time in Settings → Privacy & Consent, or by deleting your account; withdrawal does not affect processing already carried out before it.

2. How we use your data

• To provide and improve the App (food logging, goal tracking, AI estimates).
• To show advertising that helps us offer a free tier. Health/fitness data is never used for advertising targeting.

3. Third-party processors

• Anthropic — receives meal photos for AI analysis (with your consent). Processes data under Anthropic's privacy policy; photos are not retained.
• Google AdMob — serves contextual ads. Receives advertising identifiers (with your consent); never receives health data. Subject to Google's privacy policy.
• Cloudflare — hosts our backend infrastructure. Data processed in the EU and US under Cloudflare's Data Processing Addendum.
• Open Food Facts — barcode lookups use the public Open Food Facts API. No personal data is sent to Open Food Facts.
• Open-Meteo — receives approximate coordinates (derived from your IP, city level) to return the current outdoor temperature. No account data, no identifier and no health data is sent; nothing is stored.
• Resend — sends transactional email (account-recovery and account-deletion confirmation links) on our behalf. Receives your email address only; no health data.
• Google Firebase Cloud Messaging — if you enable notifications, delivers push messages to your device. Receives a device push token (identifier); never receives health data.
• YouTube (Google) — some exercise/guidance videos are embedded from YouTube using its privacy-enhanced mode. If you play a video, your IP address and device information are sent to Google to stream it, subject to Google's privacy policy. No account or health data is sent.

4. Data retention

We retain your data while your account is active. Sessions expire after 90 days of inactivity. You can delete your account (and all data) at any time — see §5.

5. Your rights (GDPR / deletion)

• Access & portability: Settings → Export my data (JSON download).
• Deletion: Settings → Delete account, or health.trunex.app/delete-account (no login required).
• Consent withdrawal: Settings → Privacy & Consent.
• EEA/UK users may also lodge a complaint with their national data protection authority.

6. Security & breach notification

Health data is encrypted at rest (AES-GCM) and in transit (HTTPS/TLS). Passwords are hashed with PBKDF2-SHA256 (100,000 iterations) and are never stored in plaintext.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (in Romania, the ANSPDCP) within 72 hours of becoming aware of it, and will inform affected users without undue delay where the breach is likely to result in a high risk to them.

7. Children

The App is not directed at children under 16. We do not knowingly collect data from minors.

8. Changes

We will notify you of material changes to this policy via in-app notice before they take effect.

9. Contact

Data controller: SC Trunex SRL, Strada Hagi Ghita 35, Sector 1, Bucharest, Romania · privacy@trunex.app. You may lodge a complaint with the Romanian supervisory authority (ANSPDCP) or with your local EEA/UK data protection authority.