Last updated: 4 September 2026
This privacy policy applies to the iOS app Shapey Coach: Fitness & Health (the “App”).
Dorent Azemi Hauptstraße 99 66851 Queidersbach Germany Email: dorentazemi@gmail.com
Shapey Coach is built around data minimisation. Your training, nutrition and health data is processed on your device wherever possible (Apple SwiftData). We show no advertising and use no analytics, tracking or advertising services; there are no user accounts.
The Premium AI features – the coach “Lara”, recognising meals from text or photo, and AI-supported insights – require cloud processing for technical reasons. In those cases, and only then, certain data leaves your device and is transmitted through our server provider to an AI service. Section 3 g) sets out exactly which data and to whom. This transmission only takes place after your explicit consent.
We access information on your device only where this is strictly necessary for the feature you have called up (§ 25(2) no. 2 TDDDG, the German implementation of the ePrivacy rules). We do not read advertising identifiers (IDFA); the App therefore does not need an App Tracking Transparency prompt. The connection to our server service is TLS-encrypted throughout.
Legal basis: Art. 6(1)(b) GDPR (barcode) and Art. 6(1)(b) in conjunction with Art. 9(2)(a) GDPR (photo AI recognition, explicit consent).
On devices running iOS 26 or later you can additionally set an alarm for supplement reminders (Apple AlarmKit). This too is scheduled exclusively on your device; no data is transmitted to us.
If you explicitly grant permission, the App adds your planned training sessions as events to your iOS calendar. The App deliberately requests write-only access (requestWriteOnlyAccessToEvents): it can create events but can neither read nor analyse your existing appointments. The entries remain on your device or in the calendar account you selected; nothing is transmitted to us. You can withdraw this permission at any time in the iOS settings under “Privacy & Security → Calendars”.
Legal basis: Art. 6(1)(a)/(b) GDPR.
Instead of typing you can speak your message to Coach Lara. Recording starts only when you tap the microphone icon and stops as soon as you end it.
If your device supports on-device recognition, no audio leaves your phone – the app explicitly requests that mode. If your device cannot do it for your language, Apple processes the recording on its servers to turn it into text; Apple's privacy policy applies to that.
We never receive an audio recording. The recognised text first appears only in the input field – you can review and edit it. Only when you send it is it treated like any typed message (see section h).
Legal basis: Art. 6(1)(b) GDPR. The recording is not stored; the recognised text stays in the input field until you send or discard it.
What is transmitted when you actively use one of these features: - your respective input (chat message, free text about a meal, where applicable a photo of the meal, training request) and the conversation history of that session; - a context record to improve the advice you receive, which may contain personal and health-related details: first name, age, height, weight, target weight, weight trend, calorie and macro goals, calories/macros logged today, readiness score, sleep duration, available equipment, training locations, dietary preference as well as notes you have stored in the coach; - a pseudonymous, random usage identifier (a random ID with no link to your name) to enforce a fair usage limit, and the signed purchase receipt for the Premium check (see 3 e).
Recipients and their role: - Cloudflare, Inc. provides the server service (“Worker”) as our processor, checks the Premium entitlement, runs an abuse/topic filter and counts fair usage. A monthly usage counter is stored against the pseudonymous identifier; your inputs and photos are not stored permanently by us. - Google (Google Cloud / Vertex AI, “Gemini” models) processes the inputs and the context as our processor in order to generate the answer or the nutrition estimate. Under the Google Cloud terms for Vertex AI, Google does not use this content to train its own AI models.
Legal basis: Art. 6(1)(b) GDPR (providing the Premium service you booked) and – since health data is transmitted in the process – Art. 9(2)(a) GDPR (your explicit consent). The App obtains this consent before the first use of an AI feature; without consent no transmission takes place and the features remain disabled. You can withdraw your consent at any time with effect for the future — in the App under Coach → Settings → AI processing; the AI features are then no longer usable. After a withdrawal the App aborts every AI request before any data leaves the device.
No medical advice: The AI coach gives no medical advice: no diagnoses, no assessment of illnesses, complaints, symptoms, injuries or medication, and no dosage recommendations for supplements. Training and nutrition suggestions as well as calorie and nutrient requirements – including for particular life stages such as pregnancy or breastfeeding – are purely calculated values based on generally accepted formulas and general sports and nutrition science, not a nutritional-medical recommendation. AI answers and nutrition estimates are generated automatically, may be wrong and do not replace medical, nutritional or therapeutic advice. This does not involve any automated decision within the meaning of Art. 22 GDPR.
When you use a Premium AI feature, our server provider Cloudflare processes technically necessary connection data (including IP address, time, requested resource, App version) in order to establish the connection and to protect the service against attacks and misuse. We ourselves do not keep permanent access logs containing IP addresses. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation). Retention: short-term, within Cloudflare’s operational and security logs.
If you write to us by email, we process your details (email address, content of your message) solely in order to deal with your enquiry. Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. Retention: until your enquiry has been dealt with conclusively, unless statutory retention periods require otherwise.
Beyond this we do not pass data to third parties and we do not sell data.
Open Food Facts is operated within the EU (France). Apple Inc., Cloudflare, Inc. and Google LLC are based in, or have their parent company in, the USA. Where personal data is transferred to the USA, the transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (the providers named are certified) and, in addition, on EU standard contractual clauses. For the AI processing we configure processing in EU data centres where possible; processing outside the EU cannot be technically excluded in every case.
Data stored locally remains on your device until you delete it or remove the App. Search queries to Open Food Facts as well as inputs and photos from the AI features are not stored permanently by us; only a monthly usage counter is kept against the pseudonymous identifier.
You have the following rights against the controller: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Because your app data is held locally, you can export or completely delete it yourself in the App at any time. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority here is, for example, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Germany (Hintere Bleiche 34, 55116 Mainz).
There is no automated decision-making, including profiling, within the meaning of Art. 22(1) GDPR. Providing your data is neither required by law nor by contract; without the respective permissions, however, individual features of the App are unavailable.
Access to Apple Health, the camera, the calendar and (on iOS 26+) the alarm function only happens after you grant permission; you can withdraw it at any time in the iOS settings. You enable the Premium AI features (Coach Lara, photo/text recognition, AI insights) through a separate, explicit consent before first use (Art. 9(2)(a) GDPR); you can withdraw this consent at any time in the app settings. After withdrawal no further data is transmitted to the server provider or the AI service.
The App is intended for persons aged 16 and over and is not directed at children. From the age of 16, the required consents – in particular to the Premium AI features (section 3 g) and to Apple Health access – can be given validly by the user themselves under Art. 8(1) GDPR.
We update this privacy policy when the App’s data processing changes (for example with new features). The current version stored in the App or in the App Store applies.