Privacy Policy

1. Controller

The controller for data processing on this website and in the Flexen app is:

Flexen UG (haftungsbeschränkt)
Paul-Heidelbach-Straße 14
34134 Kassel, Germany
Managing directors: Marcel Schneider, Leon Schmelzle
Commercial register: HRB 20498, Amtsgericht Kassel
Email: info@flexen.co

2. Scope

This privacy policy covers two areas:

• Website (sections 3–5): visiting flexen.co and contacting us by email.
• Flexen app (sections 6–14): using the Flexen app for iOS and Android, including your account, health and nutrition data, AI features and purchases.

Sections 15–19 (recipients, retention, your rights) apply to both areas.

3. Website: Hosting

This website is hosted by Google Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit the website, information (e.g. IP address, time of access, page requested, user agent) is automatically stored in server log files. This data is used solely for the purpose of stable website operation and cannot be attributed to specific individuals. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable website operation).

4. Website: Contact by Email

When you contact us by email (e.g. info@flexen.co), we process the data you submit (email address, content, name if provided) for the purpose of handling your request. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding). The data is deleted as soon as it is no longer required for our response and no statutory retention obligations apply.

5. Website: No Cookies, No Tracking, Local Fonts

This website sets no cookies and uses no tracking. No third-party scripts (e.g. Google Analytics, Facebook Pixel) are embedded.

This website uses locally hosted fonts (self-hosting). No connections to external font servers (e.g. Google Fonts) are established.

6. Flexen App: Account & Registration

Using the Flexen app requires an account. We offer the following sign-up and sign-in methods:

• Email and password — we send you a verification email to confirm your address.
• Google Sign-In — sign in with your Google account.
• Phone number — sign in via one-time code (SMS); your phone number is only stored when you use this method.

Authentication is handled by Firebase Authentication (Google). Your account is assigned a pseudonymous user ID (Firebase UID), which your app data is linked to.

Profile data: During onboarding and in your profile we process — to the extent you provide them — email address, username, display name, date of birth, height, weight, body fat percentage, gender, fitness goal, activity level, dietary preferences, allergies and intolerances, an optional note on pre-existing conditions, your medication status, your goals (calories, macros, water, steps) and your time zone.

The Flexen app collects no location data. No location permission is requested and no location is determined or stored.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract). Where profile data constitutes health data (e.g. allergies, pre-existing conditions), section 7 additionally applies.

7. Flexen App: Health & Nutrition Data

Flexen is an AI health coach. To make the app work, we process health data within the meaning of Art. 9 GDPR — but only with your explicit consent (Art. 9(2)(a) GDPR), which you give during onboarding and can withdraw at any time with effect for the future (in the app settings or by email to info@flexen.co).

This includes — in each case only if you use the feature:

• Steps and sleep: With your permission, the app reads step count and sleep data from Apple HealthKit (iOS) or Android Health Connect. Sleep you log manually in Flexen can be written back to HealthKit/Health Connect. You control this access at any time via your device's system settings.
• Nutrition: meal logs, food photos, recipes and your fridge inventory.
• Medications: name, dosage, intake schedule and intake history. The AI accesses your medication data only with a separate, additional consent, which you can give in the app and withdraw at any time.
• Journal & mood: journal entries and your mood on a scale of 0–10.
• Cycle: if you use cycle tracking: start of your last period, cycle length and your contraceptive method (e.g. pill) to calculate your cycle phases.
• Weight & water: weight history and water tracking.
• Training: AI-generated training plans and exercises.

All of this data is stored in Cloud Firestore or Cloud Storage (Google, processed in the europe-west1 region) and linked to your Firebase UID.

Important: Flexen is not a medical device and does not replace medical advice, diagnosis or treatment.

8. Flexen App: AI Features (Julio)

The AI coach Julio and other AI features of the app use the Google Gemini AI model (Google Ireland Limited / Google LLC) via Firebase AI / Vertex AI. The following content is transmitted to Google:

Depending on the Gemini version used, AI processing may also take place in Google regions outside the EU, currently in particular in the USA (e.g. us-central1). Details on third-country transfers can be found in section 15.

• Chat messages you send to Julio, together with the profile context required to generate a response.
• Food photos for automatic nutrition analysis. Before upload, we strip the EXIF metadata (e.g. capture location, device info) from the image.
• Voice recordings (e.g. for journal entries) for transcription. The audio file is not permanently stored — only the transcript is stored.

The AI accesses your medication data only with your separate consent (see section 7).

Legal basis: Art. 6(1)(b) GDPR (provision of the AI features as the core of the app); for health data, your explicit consent under Art. 9(2)(a) GDPR.

Note: AI output can contain errors and is not medical advice. For health concerns, please consult a medical professional.

9. Flexen App: Camera, Photo and Microphone Permissions

The app only requests device permissions when you use the corresponding feature:

• Camera: to photograph meals and scan barcodes.
• Photos/gallery: to select existing food photos.
• Microphone: for voice recordings that are transcribed (see section 8).
• Health data / activity recognition: to read steps and sleep (see section 7).
• Notifications: for reminders you configure in the app.

You can revoke any permission at any time in your device's system settings.

10. Flexen App: External Food & Medication Databases

To look up nutrition values and medications, the app queries external reference databases. Depending on the feature you use, only the respective search terms or barcode numbers are transmitted — not your profile:

• OpenFoodFacts (Open Food Facts, France) — When you scan a food barcode, only the product's barcode number is transmitted — no personal data and no information from your account. Processing takes place in the EU; no third-country transfer.
• FatSecret Platform API (FatSecret, USA) — food and nutrition database. The request is routed through our server (Cloud Function in the EU, europe-west1 region); only the food search term is passed to FatSecret, not your user ID. Where a transfer to the USA occurs, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• USDA FoodData Central (U.S. Department of Agriculture, USA) — government food and nutrition database. The request is likewise routed through our server (Cloud Function in the EU); only the food search term is transmitted, not your user ID.
• NLM RxTerms / RxNav (U.S. National Library of Medicine, USA) — medication database for searching medication names. The request is routed through our server proxy (Cloud Function in the EU); only the medication search term is passed to NLM, not your user ID or device IP address. A third-country transfer to the USA may take place.

The legal basis for these lookup features is Art. 6(1)(b) GDPR (provision of the respective feature); where medication search terms constitute health data, your explicit consent under Art. 9(2)(a) GDPR.

11. Flexen App: Purchases

Subscriptions and one-time purchases (Flexen Monthly, Flexen Yearly with a 7-day trial, Flexen Lifetime) are handled entirely by the Apple App Store or Google Play. Payment processing is carried out exclusively by Apple or Google — we receive no payment data (no credit card or bank details), only the information about your subscription status. Legal basis is Art. 6(1)(b) GDPR (performance of contract). The privacy policies of Apple and Google apply to their data processing.

12. Flexen App: Crash Reports (Crashlytics)

To detect and fix app crashes, we use Firebase Crashlytics (Google). This processes diagnostic data (e.g. time of crash, device model, OS version, app version, stack trace). We do not enrich crash reports with personal content. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free app).

13. Flexen App: Analytics (PostHog)

Currently, no usage analytics are active in the Flexen app. No analytics data leaves your device.

Should we activate usage analytics in the future, the following applies: we will use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA) — exclusively with your explicit consent and with data processing on EU servers in Frankfurt, Germany. Where third-country transfers or access from the USA occur, we rely on appropriate safeguards, in particular the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(a) GDPR (consent). The feature is disabled by default (opt-in) and can be enabled or withdrawn at any time in the app settings under “Anonymous usage statistics”.

Purpose (if activated): improving the app, detecting errors, understanding which features are used, measuring user retention.

Data processed (if activated):

• Event metadata (e.g. “meal logged”, “workout completed”), without meal or workout content
• Screen views and tab switches
• Device and operating system information (model, OS version, language)
• A pseudonymous user ID (Firebase UID) to associate events

What we explicitly do NOT collect: the contents of your meals, chat messages with Julio, weight values, steps, sleep data or any other health parameters.

Data processing agreement: Before activation, we will enter into a Data Processing Agreement (DPA) with PostHog pursuant to Art. 28 GDPR. PostHog privacy policy: posthog.com/privacy.

14. Flexen App: Friends Feature

The friends feature is opt-in: it only becomes active when you send or accept a friend request. Confirmed friends see an activity snapshot of you: streak, daily steps, daily calories, water, mood index, workout status and when you were last active. Detailed data (e.g. individual meals, journal entries, medications) is not shared.

Legal basis: your consent (Art. 6(1)(a) GDPR; for the health values included, Art. 9(2)(a) GDPR). You can end friendships at any time — sharing of your activity data ends with them.

15. Recipients & Third-Country Transfers

We use the following service providers (processors or independent controllers):

• Google Ireland Limited / Google LLC — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions (europe-west1 region), Firebase AppCheck, Crashlytics and Firebase AI / Vertex AI (Gemini) for the AI features.
• OpenFoodFacts (France) — product data for barcode scans (barcode number only, see section 10).
• FatSecret (USA) and USDA FoodData Central (USA) — food/nutrition databases, each via our server proxy in the EU and with the search term only (see section 10).
• U.S. National Library of Medicine (NLM RxTerms / RxNav) (USA) — medication search; queried via our EU server proxy with the search term only, without your user ID or device IP address (see section 10).
• Apple / Google — handling of purchases and subscriptions (see section 11).
• PostHog Inc. — only if usage analytics are activated (see section 13).

Processing primarily takes place in the EU (europe-west1 region). Where Google services transfer data to the USA, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and on the EU-US Data Privacy Framework, under which Google is certified (as of 12 June 2026). We have a Data Processing Agreement with Google pursuant to Art. 28 GDPR.

For the food and medication databases named in section 10 (FatSecret, USDA FoodData Central, NLM RxTerms / RxNav), data may be transferred to the USA. We minimise these transfers by routing search requests through our EU server proxy without transmitting your user ID.

16. Retention & Deletion

We store your app data for as long as your account exists. When you delete your account, your personal data is deleted or anonymised in our active systems unless statutory retention obligations require longer storage. This includes profile, meal and daily logs, journal entries, AI chats, training plans, medications, cycle data, recipes, fridge inventory, weight history, achievements, weekly summaries, activity logs and snapshots, friendship data (on both sides), data exports, uploaded images and your sign-in account. Backups are overwritten within 30 days at the latest.

How to delete your account:

• In the app: Settings → Account → “Delete account” (with confirmation dialog) — deletion is started immediately.
• By email: to info@flexen.co — we delete your account within 30 days.

A step-by-step guide is available at flexen.co/en/delete-account.

17. Your Rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a data protection authority (Art. 77 GDPR), in particular the Hessian Commissioner for Data Protection and Freedom of Information

You can withdraw any consent you have given (e.g. for health data or AI access to your medication data) at any time with effect for the future (Art. 7(3) GDPR).

Contact us at: info@flexen.co

18. External Links

This website links to the Apple App Store and Google Play Store. The respective privacy policies of Apple and Google apply to data processing by these services.

19. Changes

We reserve the right to update this privacy policy to reflect changes in the legal landscape or in our services. The current version is always available on this page.

Last updated: 12 June 2026 (version 2.0)