Privacy policy

This translation is provided for convenience; the German version is legally binding.

Controller

webhead GmbH, Kärntner Ring 10/13, 1010 Wien, Österreich, contact form

What data we process

• Account: email address, password (only as a hash), the times you gave your consents. Purpose: providing the account (Art. 6(1)(b) GDPR).
• Diary: profile details (year of birth, height, sex, goal), weight, meals, activity, favourites. This is health data. We only process it with your explicit consent (Art. 9(2)(a) GDPR) in order to provide the diary on your devices. It is stored encrypted and is not analysed, passed on or used for advertising.
• On your device: a copy of the diary is kept in the browser’s storage so that the app works offline. It is removed when you log out.
• Shared foods: if you share one of your own foods with everyone, others only see its name, brand, barcode and nutritional values. Internally we store which account the entry came from in order to prevent misuse; this link is removed when you delete your account. We store reports about entries together with your account so that each person can only report once.
• Google reCAPTCHA: Only if you click "Load reCAPTCHA" in the contact form do we load Google reCAPTCHA (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address, browser and device information and your behaviour on the page are sent to Google, possibly also to the USA (EU-US Data Privacy Framework), and Google sets the cookie "_GRECAPTCHA" (up to 6 months). The purpose is spam protection. The legal basis is your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021); you can withdraw it at any time by deleting the cookies for google.com. Without reCAPTCHA you can reach us by post. Google's privacy policy: policies.google.com/privacy.
• Contact form: name (optional), email address, topic and message, used solely to answer your enquiry (Art. 6(1)(b) and (f) GDPR). The message is forwarded to us by email and not stored in the app; we delete it once the matter is settled, unless statutory retention obligations apply.
• Food search: search terms and barcodes are sent to our server and, where applicable, to Open Food Facts (France), without any reference to you as a person.
• Premium and payment: payment is handled by Stripe Payments Europe Ltd. (Ireland). We do not receive any card details, only the subscription status. Legal basis: contract (Art. 6(1)(b)) and statutory retention obligations (Art. 6(1)(c), 7 years for accounting records).
• AI logging (Premium): when you take a photo or describe a meal, the content is sent to OpenAI (USA) and analysed there. This only happens after you have given separate consent in the app. Photos are scaled down beforehand, location data is removed, and they are stored neither by us nor by OpenAI (storage switched off). The transfer to the USA is based on the EU-US Data Privacy Framework or standard contractual clauses. We only store when and how often you used the AI (for the daily allowance).
• Technical: server logs (IP address, time, page requested) for a maximum of 14 days for security purposes (Art. 6(1)(f)). We only use technically necessary cookies (session, protection against cross-site request forgery), no analytics or advertising cookies.

Cookies and browser storage

We only use strictly necessary cookies and storage – no analytics, advertising or tracking services and no content from third-party servers. The only exception is Google reCAPTCHA in the contact form, which loads only after you click it (see above). No consent is required for this (section 165(3) Austrian TKG 2021, section 25(2) German TDDDG). If you only read the information pages, no cookies are set at all.

Storage period and deletion

You can delete just the diary or your entire account at any time in your account. Deletion takes effect immediately. Server backups are overwritten after 30 days at the latest. We retain invoice data as required by law.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability (the backup in the app is a file containing all your diary data) and objection, as well as the right to withdraw consent at any time with effect for the future. You can lodge complaints with the Austrian Data Protection Authority (dsb.gv.at).