Privacy policy

Last updated: 11 October 2026

This policy explains what personal data the Daptly app and the website daptly.ai collect, why, who receives it, and the rights you have. It applies to the app on iOS and Android and to this website.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Abraham Imohiosen
Brehmstr. 25
40239 Düsseldorf
Germany
Email: [email protected]

2. What we collect

• Account data: email address, and your name if you sign in with Apple or Google. Passwords are handled by our sign-in provider; we never see them.
• Profile and plan inputs: answers from the setup questions, such as age, sex, height, body weight, activity level and training experience.
• Logs you enter: meals and their nutrients, training sessions with exercises, sets, weights and repetitions, and weigh-ins.
• Meal photos: if you use photo scan, the photo of the meal you take.
• Voice: if you use voice logging (Premium), the audio of your voice while a voice session is open, and the transcript of it.
• Coach messages: the messages you send to the in-app coach and its replies.
• Subscription data: your subscription status, plan, trial and renewal dates. Payment card details stay with Apple or Google; we never receive them.
• Usage and device data: app events (for example, "plan generated"), device model, operating system, app version and an app-specific identifier.
• Attribution data: which advertisement or campaign led to the install. On iOS this uses the advertising identifier only if you allow tracking.
• Waitlist: if you join the waitlist on this website, your email address.

3. Health-related data

Body weight, food intake and training data can reveal information about your health. We process this data only to provide the service you ask for — your daily plan, its adjustments and your history — and only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you create your plan. You can withdraw consent at any time by deleting your account; this stops the service.

4. Why we use it, and the legal basis

• To provide the app (account, plan, logs, coach, voice, photo scan): performance of our contract with you (Art. 6(1)(b) GDPR), and your explicit consent for health-related data (Art. 9(2)(a)).
• To manage subscriptions and free trials: contract (Art. 6(1)(b)).
• Product analytics to understand which features work: your consent (Art. 6(1)(a)) where the law requires it, otherwise our legitimate interest in improving the app (Art. 6(1)(f)).
• Install attribution to measure our advertising: your consent (Art. 6(1)(a)); on iOS through Apple's tracking prompt.
• Security and abuse prevention, such as rate limits: legitimate interest (Art. 6(1)(f)).
• Legal obligations, such as tax records for purchases: Art. 6(1)(c).

We do not sell your personal data. We do not use your logs, photos, voice or messages to train AI models, and our AI providers are contractually not allowed to either.

5. How the AI features work

Your calorie and macro targets come from a fixed set of rules, not from an AI model. AI is used for three features only: the coach writes text about the plan the rules produced; photo scan estimates the food in a meal photo; voice logging turns what you say into set entries. For these features, the content you send (message, photo or audio) goes to the AI provider named below for that request only.

6. Who receives data (processors)

We use these service providers, bound by data processing agreements:

• Clerk (USA) — sign-in and account management.
• Neon (database hosted in Frankfurt, Germany) — storage of your account, plan and logs.
• Hetzner (Germany) — servers that run the Daptly API.
• Cloudflare (global network) — website hosting, DNS and delivery of exercise images; waitlist storage.
• Anthropic (USA) — coach replies and meal photo analysis.
• OpenAI (USA) — real-time voice logging (Premium).
• RevenueCat (USA) — subscription status and receipts.
• Apple and Google — app stores, payments and, if you choose it, sign-in.
• PostHog (EU hosting) — product analytics.
• AppsFlyer (USA / EU) — install attribution.
• Resend (USA) — service emails.

Food searches are looked up in public food databases (Open Food Facts, USDA FoodData Central) without any personal data.

7. Transfers outside the EU

Some providers above process data in the USA. Where they do, the transfer rests on the EU–US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses (Art. 46 GDPR).

8. How long we keep data

• Account, plan and logs: until you delete your account.
• Meal photos: used for the estimate and not stored by us after it.
• Voice audio: not stored by us; we keep only the resulting set entries and the minutes used.
• Analytics events: up to 24 months.
• Purchase records: as long as tax law requires (in Germany up to 10 years).
• Waitlist emails: until launch or until you ask us to remove them.

9. Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15–21 GDPR). Where processing rests on consent, you can withdraw it at any time without affecting earlier processing. To use any of these rights, email [email protected]. You can delete your account in the app (Profile, then Delete account) or by the same email; see how to delete your account.

You also have the right to complain to a data protection authority, for example the authority for North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

10. Children

Daptly is for people aged 16 and older. We do not knowingly collect data from younger children.

11. Not medical advice

Daptly offers lifestyle guidance informed by publicly available nutrition and training research. It is not medical advice and does not replace a doctor or dietitian.

12. Changes

We will update this policy when our processing changes, and show the new date above. For important changes, we will tell you in the app.