← Nahria

Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how Nahria ("we", "us") processes personal data when you use the Nahria mobile application and related services (the "Service") and this website (nahria.app).

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is Johann Christian Gebhardt, Ludwig-Wucherer-Straße 27, 06108 Halle (Saale), Germany, email: contact@nahria.app.

This English version is provided for convenience; the German version is authoritative.

Overview

Nahria is built to collect as little data as possible: we only collect what is needed to run the app, we show no ads, we use no analytics or advertising trackers, and we do not sell data. Your account and app data are stored in the European Union (Frankfurt am Main, Germany).

Visiting this website

This website is a static site with no cookies, no analytics, and no advertising tracking. It is served via GitHub Pages (GitHub, Inc., USA). When you visit, GitHub processes technically necessary connection data (in particular your IP address) in server logs to deliver the site and protect it against attacks.

The legal basis is our legitimate interest in providing the website securely and efficiently (Art. 6(1)(f) GDPR). For transfers to the USA, see "International data transfers" below.

Account and sign-in

To use the app you create an account with your email address. Sign-in works via one-time codes sent to your email address; we do not store a password. We process this data to provide and secure your account and to prevent abuse. To prevent repeated sign-ups for the free tier, your email address is also checked at sign-up against existing accounts and against a list of disposable email providers; disposable email addresses cannot be used.

Legal bases: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (account security, abuse prevention).

Profile, goal and nutrition data (health data)

During onboarding and while using the app, you provide information such as an optional name, age, gender, height, weight, activity level, and nutrition goals, and you log your meals, foods, and quantities — including text descriptions and photos you submit for estimation. We use this data solely to calculate your calorie and nutrition targets, keep your food diary, and show you insights.

This information may constitute health data within the meaning of Art. 9 GDPR. We process it only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give in the app. You can withdraw this consent at any time with effect for the future by deleting your account in the app or by contacting us. Without this data, however, the app cannot provide its core features.

AI-assisted estimation

When you use AI estimation, your food description or photo is sent to an AI provider — solely to generate a nutrition estimate and return it to you. We currently use Google (Gemini) for this; in the future we may also use other providers such as OpenAI or Anthropic (Claude) for the same purpose. The submission does not include your name or email address.

Please avoid including people or sensitive information in photos that is not needed for the estimate. Legal bases: Art. 6(1)(b) GDPR and your consent under Art. 9(2)(a) GDPR.

Each AI request is also recorded in our backend together with technical usage data (feature used, model, processing volume and estimated cost), the IP address of the request and the creation date of your account. We use these records solely to enforce usage limits and to detect and prevent abuse of the free tier (for example repeated account creation). The IP address is deleted as soon as you delete your account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and fraud).

Barcode scanning (Open Food Facts)

When you scan a barcode, the product number is sent to the open food database Open Food Facts (a non-profit association under French law, France) to retrieve product information. No account data is transmitted; as with any internet request, your IP address is technically visible. Legal basis: Art. 6(1)(b) GDPR.

The product data comes from Open Food Facts and is available under the Open Database License (ODbL).

Subscriptions and payments

You purchase the Nahria Pro subscription through the Apple App Store or Google Play. Payment processing is handled entirely by Apple or Google as independent controllers; we never receive your payment details (such as credit card numbers). The privacy policies of Apple and Google apply in addition.

To manage subscription status we use RevenueCat (RevenueCat, Inc., USA). For this purpose RevenueCat processes a pseudonymous user identifier, purchase receipts, and the subscription status — not your name or email address. If you redeem a promo or referral code, we store the redemption linked to your account. Legal basis: Art. 6(1)(b) GDPR.

Crash, diagnostic and performance data (Sentry)

To detect and fix crashes and errors and to keep the app fast, we use Sentry (Functional Software, Inc., USA); our Sentry organization is hosted in Sentry's EU region, so this data is stored within the European Union. When an error occurs, technical details are transmitted, such as device model, operating system and app version, and the technical error trace (stack trace). We also measure performance on a share of sessions when nothing has gone wrong: how long screens take to open, and how long requests to our own backend take, including the address of the endpoint called (for example the one that saves an entry), the response status and the duration — never the contents of a request or a response, and never what you ate. A pseudonymous user identifier (your account's random ID) and the country set in the app are attached as well, so that we can tell how many users an error affects and whether the app is slower in some regions; within Sentry, neither is linked to your name or email address. Independently of that, Sentry's servers derive the country from the internet connection over which the report is sent and store it alongside the report; more precise location data and the IP address itself are not stored. We use this data solely for stability, troubleshooting and performance, not for advertising or profiling. The data is automatically deleted after 90 days at the latest.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable and secure Service).

Storage, processors and recipients

Your account and app data are stored with Supabase (Supabase, Inc., USA); our project's database is hosted in Frankfurt am Main (EU). Data is encrypted in transit (TLS) and at rest (disk-level encryption). We have data processing agreements under Art. 28 GDPR with our service providers. We share personal data only with the following recipients and do not sell it:

International data transfers

Some of the providers listed above are based in the USA. Where personal data is transferred to the USA, we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Data retention and deletion

We keep your data for as long as your account exists. You can delete your account and all associated data at any time directly in the app (Profile → Delete account) or request deletion by emailing contact@nahria.app. After deletion, your data is removed unless statutory retention obligations require otherwise. Crash reports are deleted after 90 days at the latest regardless.

Usage records of our AI features are kept after account deletion for cost statistics, but in de-identified form: the link to your account and the IP address are removed, so the records can no longer be associated with you.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), as well as the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To exercise these rights, contact contact@nahria.app.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example the State Commissioner for Data Protection of Saxony-Anhalt, or the authority where you live.

You are not legally or contractually required to provide your data; without account data and your consent, however, the app cannot be used. There is no automated decision-making with legal effect (Art. 22 GDPR) — the AI estimates are content suggestions only, which you can edit or discard at any time.

Users in Brazil (LGPD)

If you use the Service from Brazil, we also observe the Brazilian data protection law, the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018). The legal bases described above correspond to Art. 7 and — for health data — Art. 11 LGPD (consent, performance of a contract, legitimate interest). You have the rights set out in Art. 18 LGPD, including confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and revocation of consent; to exercise them, email contact@nahria.app. The Brazilian supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD). Your data is processed in the European Union as described above.

Children's privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

Changes to this policy

We may update this Privacy Policy from time to time, for example when the Service or the legal situation changes. Changes are reflected in the "Last updated" date above; we will inform you of material changes in the app.

Contact

Questions about this policy or about privacy? Email us at contact@nahria.app.