Privacy Policy

1. Controller

The controller for data processing on this website and in the Julio app is:

Flexen UG (haftungsbeschränkt)
Paul-Heidelbach-Straße 14
34134 Kassel, Germany
Managing directors: Leonard Hoppe, Marcel Schneider, Leon Schmelzle
Commercial register: HRB 20498, Amtsgericht Kassel
Email: info@flexen.co

2. Scope

This privacy policy covers two areas:

• Website (sections 3–5): visiting flexen.co and contacting us by email.
• Julio app (sections 6–14): using the Julio app for iOS and Android, including your account, health and nutrition data, AI features, beta Premium and purchases.

Sections 15–19 (recipients, retention, your rights) apply to both areas.

The beta of the Julio app is aimed at testers from Germany, Austria and Switzerland. For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies; see section 17.

3. Website: Hosting

This website is hosted by Google Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit the website, information (e.g. IP address, time of access, page requested, user agent) is automatically stored in server log files. This data is used solely for the purpose of stable website operation and cannot be attributed to specific individuals. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable website operation).

4. Website: Contact by Email

When you contact us by email (e.g. info@flexen.co), we process the data you submit (email address, content, name if provided) for the purpose of handling your request. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding). The data is deleted as soon as it is no longer required for our response and no statutory retention obligations apply.

5. Website: No Cookies, No Tracking, Local Fonts

This website sets no cookies and uses no tracking. No third-party scripts (e.g. Google Analytics, Facebook Pixel) are embedded.

This website uses locally hosted fonts (self-hosting). No connections to external font servers (e.g. Google Fonts) are established.

6. Julio App: Account, Registration & Minimum Age

Using the Julio app requires an account. We offer the following sign-up and sign-in methods:

• Email and password — we send you a verification email to confirm your address.
• Google Sign-In — sign in with your Google account.
• Sign in with Apple (on iPhone) — sign in with your Apple ID. Apple sends us a user identifier and, if you agree, your name and your email address or a relay address created by Apple (“Hide My Email”). When you delete your account, we revoke the app's sign-in authorisation with Apple.
• Phone number — sign in via one-time code (SMS); your phone number is only stored when you use this method.

Authentication is handled by Firebase Authentication (Google). Your account is assigned a pseudonymous user ID (Firebase UID), which your app data is linked to.

Verified identity: The AI features (section 8) and beta Premium (section 11) require a verified identity: signing in with Google, Apple or your phone number, or a confirmed email address. For this, our server checks which method you signed in with and whether your email address is confirmed.

Minimum age 18 – no data of minors: The Julio app is intended exclusively for people who are at least 18 years old. During registration we ask for your date of birth. Registration cannot be completed without a date of birth showing that you are at least 18 years old: the app does not accept a later date, and our server rejects any user profile under 18. We therefore do not knowingly process personal data of minors. If we nevertheless learn that an account was created by a minor, we delete the account and the data associated with it.

Profile data: During registration the app asks — to the extent you provide them — for your first and last name, date of birth, gender, height, weight, body fat percentage, target weight and time frame, up to three goals (including a goal of your own as free text), sports and training goals (e.g. running distance), your weekly training time and the plan duration, the training plan you choose, your activity level, devices you want to connect, your diet type (e.g. vegetarian), allergies and intolerances, favourite and disliked foods, medications, pre-existing conditions, injuries or physical limitations, your cycle, your preferences for the friends feature (section 14) and your unit system. From this the app calculates your starting plan and your goals (calories, macros, water, steps).

What is stored depends on the health consent (section 7) at the end of registration. With consent, we store these details, the starting plan and your goals in your profile. Without consent, we only store your email address, first name, display name, date of birth (age verification), unit system, diet type, your preferences for the friends feature, your time zone and your consent decisions; the app discards all other answers, and your starting plan is kept only in encrypted form on your device. You can set your username and display name later in your profile.

The Julio app collects no location data. No location permission is requested and no location is determined or stored.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract). Where profile data constitutes health data (e.g. allergies, pre-existing conditions), section 7 additionally applies.

7. Julio App: Health & Nutrition Data

Julio is an AI health coach. To make the app work, we process health data within the meaning of Art. 9 GDPR — but only with your explicit consent (Art. 9(2)(a) GDPR). You give it during registration, later in the app settings under “Health & Tracking”, or when the app asks you for it before saving your first health value. You can withdraw it at any time with effect for the future (in the app settings under “Health & Tracking” or by email to info@flexen.co). This consent also determines whether health information is included in AI requests (section 8).

Without health consent, neither the app nor Julio stores any health values (first list below). If you want to enter such a value, the app first asks for the consent and only saves the value once you have given it. You can use the features in the second list without health consent.

Health data — only with health consent, in each case only if you use the feature:

• Apple Health and Health Connect: We treat everything the app reads from Apple Health (iOS) or Health Connect (Android) as health data. The app therefore only imports steps, sleep (sleep stages; on iPhone also “In Bed”), workouts (type, duration, calories), active calories and weight, including values your watch, your scale or other apps store there, with your health consent and your permission in the system. The system permission alone is not consent: without health consent, the app imports nothing from Apple Health or Health Connect. On Android, reading workouts technically also requires the permissions for distance and total calories; the app does not store or use the distance, and uses total calories only as the calories of the respective workout. The app does not read heart rate, heart rate variability, oxygen saturation or cycle data. The app only reads; it does not write anything to Apple Health or Health Connect and does not read in the background.
  
  The app stores the values it reads as daily values, activities or in your weight history in your account, also retroactively for up to 7 days or nights, and uses them for display, progress, achievements and calorie balance and for Julio's answers (section 8). If you entered something yourself for the same day, your entry takes precedence. With health consent, a weight from Apple Health or Health Connect goes into your weight history; the app only changes your profile weight and your goals after you confirm it (“Scale reports … – use it?”).
  
  When you connect Apple Health or Health Connect, the app first tells you which data it takes over and what it uses it for; the app also shows this dialog during registration. You control this access at any time via your device's system settings; if you withdraw your health consent, the app no longer imports anything from Apple Health or Health Connect.
• Sleep: sleep entries you create yourself or that come from Apple Health or Health Connect, and sleep recording: on Android, you can record your sleep overnight with the motion sensor. The app analyses the movement data on your device, stores only the result (time you fell asleep and woke up, duration, sleep stages, quality) and then deletes the raw data from the device.
• Weight & body values: your weight history (entered yourself or from Apple Health/Health Connect) and body values such as your body fat percentage.
• Journal & mood: journal entries and your mood on a five-level scale. You can additionally protect journal entries with Face ID or your device lock.
• Medications: name, dosage, intake schedule and intake history. Only you add or change medications; Julio does not do this for you. What the AI learns about your medications is described in section 8.3. There is no separate consent for this; your health consent and your AI consent apply.
• Cycle: if you use cycle tracking: start of your last period, cycle length and your contraceptive method (e.g. pill) to calculate your cycle phases.

Without health consent — likewise only if you use the feature:

• Nutrition: meal logs, food photos, recipes and your fridge inventory.
• Water: your water tracking.
• Training: AI-generated training plans, exercises and the workouts and activities you log yourself.
• Your phone's step counter: if no source is connected, the app can count your steps using your phone's motion sensor.

Withdrawal and deletion: If you withdraw the health consent in the app, it first tells you what will be deleted and offers to export your data first (section 17). We then delete the health data stored in your account (Art. 17(1)(b) GDPR): weight history and body measurements, mood, sleep, journal entries including photos, medications including intake history, cycle data, allergies and intolerances, your details on pre-existing conditions and on injuries or physical limitations, workouts and active calories imported from Apple Health or Health Connect, Julio's health notes, and mood and sleep in your weekly summaries. What stays: food, water, activities you logged yourself and workouts from your plan, meditations, height, sex, date of birth, target weight, diet type, your plan and the rest of your weekly summaries. Step counts also stay, including steps from Apple Health or Health Connect, because the app does not store where a day's step count came from; we delete them on request (email info@flexen.co). The deletion cannot be undone; for backups see section 16. If you withdraw by email, we delete in the same way.

Achievements and app streak: For achievements such as the app streak, a day only counts if you opened the app or entered something yourself. For this, we note on that day in your account that you used the app. Days that were only filled in from Apple Health or Health Connect do not count.

This data is stored in Cloud Firestore (Google, EU multi-region “eur3” with data centres in the EU) or Cloud Storage (Google, europe-west1 region in Belgium) and linked to your Firebase UID.

Important: Julio is not a medical device and does not replace medical advice, diagnosis or treatment.

8. Julio App: AI Features (AI Coach Julio)

The AI coach Julio and other features of the app use AI models of the Google Gemini family via Vertex AI (Google Cloud; contracting party Google Ireland Limited). The app does not call any AI model itself: every AI request goes through our server (Cloud Functions in the europe-west1 region). Before each request, the server checks your consents, your quota and our cost limit and composes the instructions to the model itself.

8.1 Consents and legal basis

• AI consent (“Personalise Julio with external AI”): required for every AI feature. It is voluntary and not pre-selected; you give it during registration or later in the settings. If it is missing or you have withdrawn it, our server rejects every AI request. We store your choice, together with the time, in your account. If you withdraw it, we delete your chat history with Julio and Julio is deactivated; the other features of the app remain available.
• Health consent (section 7): only with it does the app include health information from your account in AI requests, such as weight, pre-existing conditions, sleep, mood or cycle phase. For the weekly check-in note, the analysis tips and the meditation recommendation, our server checks this itself and leaves out health values without consent, even if the app sends them. Without it, the app and Julio also store no health values: if you want to enter one or confirm such an entry from Julio, the app asks for the consent before saving and only saves once you have given it.
• Verified identity (section 6) and, during the beta, activation of your account for AI (section 11).

The legal basis for AI processing is your consent (Art. 6(1)(a) GDPR), and for health data your explicit consent (Art. 9(2)(a) GDPR). Whatever you write in the chat yourself or send as a photo is processed by Julio, including health information; only share what you want to share. Withdrawal takes effect for the future; processing carried out until then remains lawful.

8.2 Provider, place of processing and no use for training

• Processing in the EU: Google processes all AI requests in the EU multi-region of Vertex AI (“eu”). The only exception is the web search: its search queries go to Google Search, also outside the EU, and Google stores them for up to 30 days (section 8.5).
• No training: Google does not use the content of our requests to train or fine-tune AI models (Google Cloud Service Specific Terms, section “Training Restriction”). We have a data processing agreement with Google pursuant to Art. 28 GDPR.
• Caching at Google: To speed up responses, Google keeps inputs and outputs in memory for up to 24 hours, isolated per project and at the selected place of processing; they are not stored permanently. In addition, we keep fixed instructions to the model, which contain no data about you, at Google for up to 30 minutes.
• Abuse monitoring: If Google detects a possible violation of its usage policies, Google may store and review the inputs concerned for up to 90 days at the selected place of processing; Google does not use this data for training either.

8.3 Which data goes to which feature

The AI only receives the data the respective feature needs:

• Chat with Julio: your messages and attachments (photos, PDF documents), the previous history of the chat (condensed, section 8.4), your display name, your body type (female, male or prefer not to say), date and time, the reply language and general notes from Julio's memory (section 8.6). Julio receives your body type with your AI consent even without health consent; it is used for how Julio addresses you and for evaluations such as your calorie needs. Likewise, even without health consent Julio receives your diet type (e.g. vegetarian), your favourite foods and your dislikes, so that his suggestions fit. With health consent also: age, height, weight, body fat percentage, goals and target weight, activity level, pre-existing conditions and injuries, allergies and intolerances, your coach plan, today's values (calories, macros, water, steps, calories burned), your fridge and health notes from memory.
• Data you ask Julio about: If you ask Julio about your entries, he retrieves them specifically, for example daily values (including sleep, mood and how many of your medications you have taken today), your weekly overview, training plans, recipes, your fridge or journal entries from the last few days. The app only releases health-related entries for this with health consent; Julio never reads protected journal entries. If you ask Julio to tick off a medication (only with health consent), he only receives the name of the matching medication from your list. If he finds none, he learns no names of your other medications and instead asks you to check the name in the app.
• Chat title: the beginning of the conversation, so that the AI suggests a short title.
• Meal by text: your description and your nutrition region (e.g. DACH), so that portions and dishes are estimated appropriately.
• Meal by photo: the photo. Before sending, we strip the EXIF metadata (e.g. capture location, device info).
• Fridge or shopping photo: the photo, so that the AI recognises the products.
• Recipe ideas from your fridge: your fridge items (name, quantity, unit, whether expired or expiring soon), the next meal, your diet type (e.g. vegetarian) as well as your calorie and macro targets and how much of them is still open today.
• Personal plan and weekly plan analysis: your details from registration and your profile (goals, training preferences, dietary preferences); health information only with health consent. Your medication details are never sent to the AI.
• Weekly check-in note: your goal, the week, planned and completed workouts; with health consent also current weight and target weight.
• Analysis tips: summarised averages and counts for the selected period on nutrition, water, steps and training; values on sleep, mood and journal only with health consent.
• Custom activity: only the name of the activity you create, so that the AI estimates the energy expenditure.
• Dictation and voice notes in the journal: your voice recording, to convert it into text. The audio file is not permanently stored — only the transcript is stored.
• Translation: If you tap “Translate” on an answer from Julio, the text of that answer is sent to the AI and comes back translated.
• Meditation recommendation and web search: see sections 8.7 and 8.5.

8.4 Julio's chat: storage and condensing

We store your chats with Julio in Cloud Firestore and attachments in Cloud Storage (both in the EU, see section 7). They remain stored until you delete a chat or all chats, withdraw your AI consent or delete your account; when we delete a chat, we also delete its attachments.

For every answer, Julio needs the previous history of the chat. Before our server sends it to the AI, it automatically condenses older parts: long results of earlier tasks become short summaries, older attachments become a short note, and very old sections of a long chat are dropped. This means less data goes to the AI. We do not store the condensed version; your chat history in the app remains unchanged.

8.5 Web search

Julio only searches the internet when needed: when he needs current information for an answer. For this we use Google Search in Vertex AI (“Grounding with Google Search”). Only the search query that Julio formulates goes to the search — not your profile and not your chat history. Julio is instructed never to put profile or health values (e.g. weight, age, conditions, medications, cycle, mood, sleep) into a search query, only general topic questions; the search therefore receives no health context.

Processing outside the EU: The AI model that triggers the search and writes the answer runs in the EU. The search queries themselves, however, go to Google Search, which Google does not limit to the EU; they may therefore also be processed outside the EU, for example at Google LLC in the USA. This is based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses (section 15).

Storage at Google: For the web search, Google stores logs containing the search queries and the context provided for up to 30 days in order to fix errors in this service. This storage cannot be switched off. Google expressly excludes these logs from its other commitments for Vertex AI, including the choice of the place of processing; they too may be stored outside the EU (same legal basis as above).

The number of web searches per day is limited. In a turn with a web search, Julio does not save anything to his memory without asking you first (section 8.6).

8.6 Julio's memory

So that Julio remembers important things beyond individual chats, he can create short notes (up to 200 characters each, with date and type, such as routine, preference, goal, event or health). He does this when you share something that matters beyond the chat. You immediately see every new note in the chat as “Remembered” and can undo it there. In a turn in which Julio searched the internet, he only saves a note if you confirm it.

• Health notes (e.g. injuries, complaints) are only created with your health consent, and only then are they used in his answers. If you withdraw the consent, we delete them.
• Medications are never stored in Julio's memory.
• Control in the chat: If you ask Julio “What do you know about me?”, he shows you his notes; with “Forget that” he deletes the note concerned.
• Control in the settings: Under “What Julio knows about you” you can see all notes, delete individual notes or all of them, and switch the memory off.
• Weekly tidy-up: At most once a week, our server sends your notes to the AI (in the EU) to merge duplicates and remove outdated entries. General and health notes are processed separately, health notes only with consent.

The notes are stored in your account (Cloud Firestore, EU) until you delete them or delete your account. They are part of your data export.

8.7 Meditation recommendation

In the “Mind” area, the app suggests a meditation from its fixed catalogue. For this, the time of day, your meditation level and the identifiers of the catalogue entries are sent to the AI; with health consent also your mood, your sleep duration, your cycle phase, your training load, your calorie balance and whether you have probably not eaten yet today. The AI only selects from the catalogue; it does not generate any meditation text. The voice recordings were produced in advance with a synthetic voice and are labelled as an AI voice in the app. The app remembers the recommendation for the day on your device. Without AI consent or in case of an error, the app selects the meditation using fixed rules on your device, without AI.

8.8 Shared store for nutrition estimates

So that the same meals do not have to be estimated again every time, we use a shared store. If the AI estimates a meal with high confidence, the app reports the normalised description (e.g. “haferflocken mit milch”) and the result to our server. Only when at least two accounts that are older than seven days have independently reported matching values do we add the result to the shared store. The shared entry contains the name of the dish, the estimated nutrition values and the AI's reasoning, but no user ID; it is found via a checksum of the description.

Your reports are pseudonymous: they carry your user ID, but no name and no email address. We only need the user ID so that the same account is not counted twice and new accounts cannot distort the result. We delete your report as soon as the result has been added, after 90 days at the latest, and in any case when your account is deleted.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR): recurring dishes are estimated faster and more consistently, and no new request goes to the AI for them, which saves data and costs. This is weighed against only a short, pseudonymous link between a meal description and your user ID; the shared entry itself is not personal. You can object to this processing at any time (Art. 21 GDPR), for example by email to support@flexen.co. We then delete your open reports and no longer accept new ones from you.

8.9 Quotas and cost log

For every AI request, we count your daily and monthly quota and log, without any content, which feature ran with which model, where, with how many tokens, for how long and with which result, together with your user ID. This serves billing, protection against abuse and troubleshooting. We delete the log after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and affordable operation).

Note: Julio is an AI assistant; the app shows this in the chat. AI output can contain errors and is not medical advice. For health concerns, please consult a medical professional.

9. Julio App: Permissions and Push Notifications

The app only requests device permissions when you use the corresponding feature:

• Camera: to photograph meals and scan barcodes.
• Photos/gallery: to select existing food photos.
• Microphone: for voice recordings that are transcribed (see section 8).
• Health data, motion & fitness / activity recognition: to read the data listed in section 7 from Apple Health or Health Connect (read only) and to count steps with the motion sensor.
• Face ID or device lock: to unlock protected journal entries; the check takes place only on your device.
• Notifications: for reminders you configure in the app and for push notifications (see below).

You can revoke any permission at any time in your device's system settings.

Push notifications: If notifications are allowed for Julio on your device, the app registers your device with Firebase Cloud Messaging (Google) after you sign in. For this, we store one entry per device in your account (Cloud Firestore) containing the device token, the platform (iOS or Android), the app language and the time of the last update. We use this entry to send you notifications about friend requests, accepted requests, challenge invitations and new messages. A notification only contains a general note (e.g. “New message”), no sender and no message content; for messages, a technical identifier of the conversation is also sent so that your device can group notes from the same conversation. On iOS devices, delivery takes place via the Apple Push Notification Service (Apple). Reminders you set in the app are scheduled locally on your device.

When you sign out, the app deletes the entry for this device and the device token. If Firebase reports a token as invalid (e.g. after the app has been reinstalled), we delete the entry at the next delivery. When you delete your account, all entries are deleted. Legal basis: Art. 6(1)(b) GDPR (provision of the notifications you switch on). The app only retrieves and stores the device token if you allow notifications in your system settings. This access to your device is strictly necessary for the notifications you requested (Section 25(2) no. 2 TDDDG).

10. Julio App: External Food & Medication Databases

To look up nutrition values and medications, the app queries external reference databases. Depending on the feature you use, only the respective search terms or barcode numbers are transmitted — not your profile:

• OpenFoodFacts (Open Food Facts, France) — When you scan a food barcode or type into the food search, the app queries Open Food Facts directly from your device. Only the barcode number or your search term is transmitted — no information from your account. As with any request on the internet, Open Food Facts sees your device's IP address. Processing takes place in the EU; no third-country transfer.
• FatSecret Platform API (Secret Industries Pty Ltd, Australia; servers in the EU and the USA) — food and nutrition database. The request is routed through our server (Cloud Function in the EU, europe-west1 region); only the food search term is passed to FatSecret, not your user ID and not your IP address. For FatSecret, this search term cannot be linked to a person; no personal data is transferred.
• USDA FoodData Central (U.S. Department of Agriculture, USA) — government food and nutrition database. The request is likewise routed through our server (Cloud Function in the EU); only the food search term is transmitted, not your user ID and not your IP address. For the USDA it cannot be linked to a person; no personal data is transferred.
• NLM RxTerms (U.S. National Library of Medicine, USA) — medication database for searching medication names. This request is also routed through our server (Cloud Function in the EU): only the medication search term you enter (at most 80 characters) goes to the NLM, not your user ID and not your IP address; for the NLM it cannot be linked to a person. To prevent abuse, we count the number of your searches per day.

The legal basis for these lookup features is Art. 6(1)(b) GDPR (provision of the respective feature); where medication search terms constitute health data, your explicit consent under Art. 9(2)(a) GDPR (section 7).

11. Julio App: Beta Premium and Purchases

Beta Premium: During the beta (which ends on 30 November 2026 at the latest), every account with a verified identity (section 6) automatically receives Premium and, as long as places are available, is activated for the AI features — once per account, free of charge and without a subscription. As a thank-you, this Premium remains active until 30 November 2027; after that it ends automatically without a paid subscription being created. We will let you know about 14 days in advance.

For this, we store your Premium status, the source “beta” and the expiry date on your account, a note on our server that your account has received the grant (so that it does not happen a second time), and your user ID in the list of accounts activated for AI. Only our server can read this list. The note is part of your data export; when you delete your account, we delete the note and the list entry. The legal basis is Art. 6(1)(b) GDPR (provision of the beta service).

Purchases: After the beta, subscriptions (Premium as a monthly subscription, see the Terms of Use) are handled entirely by the Apple App Store or Google Play. Purchasing is hidden during the beta. Payment processing is carried out exclusively by Apple or Google — we receive no payment data (no credit card or bank details), only the information about your subscription status. Legal basis is Art. 6(1)(b) GDPR (performance of contract). The privacy policies of Apple and Google apply to their data processing.

12. Julio App: Crash Reports (Crashlytics) and Diagnostics

Crash reports only with consent: To detect and fix app crashes, we use Firebase Crashlytics (Google), but only if you consent. The “Send crash reports” switch under Settings › Privacy & Data is switched off by default; without your consent, the app does not collect or send crash reports. Your choice applies to your account on this device; if you sign in with another account or on another device, the switch is off there at first. With your consent, diagnostic data is processed (e.g. time of crash, device model, OS version, app version, system language, stack trace), and while you are signed in we attach your pseudonymous user ID (Firebase UID) so that crashes can be assigned to an account; the identifier is removed when you sign out.

Content and retention: The app does not write health values (e.g. water, steps, mood) into crash reports or the app log; in case of errors, it only records the error code and the field concerned. Crash reports do, however, contain technical error messages, which in individual cases may contain content from the app. This is why the app only sends them with your consent. Crash reports are deleted in Crashlytics after 90 days.

Legal basis and withdrawal: your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, Section 25(1) TDDDG). You can withdraw it at any time with the same switch. The app then no longer sends reports, removes the identifier and deletes reports on your device that have not yet been sent.

“Send diagnostics”: Only when you trigger it yourself (in the settings under “About” or under “Help & Support”) does the app send us a diagnostics report. It contains your pseudonymous user ID, app version and build number, platform, operating system version, device model, system language, your optional note and the app log (up to the 500 most recent entries). The log records technical events and error messages (time, area, message, where applicable error text and stack trace). The app does not write content such as meals, messages or health values into it; however, we take over error texts from the system and libraries unfiltered, and they may in individual cases contain information relating to you. Until it is sent, the log stays on your device; it is deleted when you sign out.

The report is stored in Cloud Firestore (Google, EU); only our team can read it. We delete it 90 days after it was sent (technically usually within 24 hours after the deadline), immediately when your account is deleted and earlier on request. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing errors and handling your request).

13. Julio App: Analytics (PostHog)

If you consent, we use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA) to analyse how the Julio app is used. Usage analytics are switched off by default (opt-in). Without your consent, the analytics component is not started and no analytics data is sent to PostHog.

Consent and withdrawal: You give your consent in the app under Settings › Privacy & Data with the “Pseudonymous usage analytics” switch. You can withdraw it there at any time with effect for the future by switching it off. On withdrawal, the app stops collection immediately and removes the link to your pseudonymous identifier on your device. Consent applies to your account: we store your choice, together with the time, in your account so that it applies on all your devices. Consent given in earlier app versions does not carry over: usage analytics stay switched off until you consent again. After a withdrawal, we no longer collect analytics data; data already collected is deleted on request (info@flexen.co) and at the latest when your account is deleted.

Legal basis: Art. 6(1)(a) GDPR (consent).

Purpose: improving the app, understanding which features are used, measuring user retention, and detecting errors and delays in the AI features.

Data processed:

• Pseudonymous identifier: your Firebase UID (see section 6), used to associate events with your account. We do not send your email address, name or phone number to PostHog.
• Account attributes: sign-up date, premium status, date of last activity and app language.
• Usage events with time: sign-up and sign-in (with sign-in method), sign-out, the fact that a meal was logged via Julio or a workout was completed (without any further details), message sent to Julio (message length and whether it belongs to an existing chat), purchase completed (product, price, currency, new purchase or restore) and technical values of the AI nutrition estimate, such as response time, cache use, model used, success or type of error, estimate confidence and the length and kind of input – never the text you entered.
• App installed, updated, opened or moved to the background, and views of individual, predefined screens.
• Standard device and app properties sent automatically by the PostHog SDK (e.g. device model, operating system and version, app version, language setting). Your IP address is transmitted to PostHog as a technical necessity of the transfer.

What we explicitly do NOT send to PostHog: details of your meals (descriptions, photos, calorie and nutrition values, meal type), workout details (e.g. duration, exercises, training plan), the contents of your chat messages with Julio, weight, step and sleep values, medications, journal entries and cycle data. Screen recording (session replay), surveys and PostHog’s automatic error capture are switched off.

Storage location and third-country reference: We use PostHog's EU cloud; the data is stored on servers in Frankfurt, Germany. PostHog Inc. is based in the USA and may also process data outside the EU to provide its services, for example through sub-processors. Where data is transferred to the USA in this context, the transfer is based on the EU-US Data Privacy Framework, under which PostHog is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the data processing agreement (as of 27 September 2026).

Retention: Events are deleted at PostHog after 12 months. The account attributes (see above) remain stored until your account is deleted. When you delete your account, we immediately request the deletion of your analytics data at PostHog (see section 16).

Data processing agreement: We have a Data Processing Agreement (DPA) with PostHog pursuant to Art. 28 GDPR. PostHog privacy policy: posthog.com/privacy.

14. Julio App: Social Features

The social features are optional. We only process the following data to the extent that you use the respective feature. Our community guidelines apply to messages and profiles.

Discoverability, username and friend code: When you register, you decide whether others can find you by your username; this is switched off by default, and you can change it in the app at any time with the “Findable by username” switch. Only when it is switched on can others find you in the user search, by your exact username or by your friend code, and only then can they send you a friend request. We reserve your username and friend code uniquely for your account.

Profile: Your display name and your username appear wherever others interact with you: in friend requests, in challenges, in messages and in friend lists. Together with your visibility setting and your number of friends, they can be retrieved by all signed-in users; however, you only appear in the user search with the “Findable by username” switch. Your profile photo is not part of this; friends only see it if you share it (see “Activity overview for friends”). Your bio as well as your level and up to 12 achievements are only shown to people your visibility level allows (friends only, followers or all signed-in users; friends only by default); you decide separately whether they see none of this, only the level, or level and achievements. Age, weight, height, health and cycle data are never part of your profile for others. Before you make your profile visible beyond “friends only”, you agree to our community guidelines once; how we store this agreement is described under “Direct messages”.

Friendships: Friend requests are handled by our server. We store the sender, recipient, status and time; the person you send a request to receives a notification with your display name. If they decline, we delete the request, and you cannot send them a new one for 24 hours. If they accept, we store the friendship (both of your user IDs and the time). You can end friendships at any time. Friends can “nudge” each other at most once a day; for this we store the sender, the recipient, the sender's display name and whether the nudge has been seen. The app no longer offers a follow feature; follow connections from earlier versions are deleted when you block someone and when you delete your account.

Activity overview for friends: Your friends see your display name and, to the extent you share it, your profile photo, your level, when you were last active, your streak and, via the “activity” setting, today's steps, calories eaten and burned, your protein and your water (each can be switched off individually). Profile photo and level are shared by default; activity, streak and “last active” are not. Individual meals, journal entries, medications and your weight are not shared. Only you and your friends can read the overview.

Direct messages: You can only exchange messages with friends, as long as neither of you has blocked the other. For each message we store the sender, the time and the text (up to 2,000 characters) or a challenge invitation; for each conversation the two participants, a preview of the last message (up to 140 characters), the number of unread messages, when it was read and when someone deleted the conversation for themselves. Messages are stored on our servers (Cloud Firestore) and are not end-to-end encrypted. Only the two participants can read them; after a friendship ends the history remains readable, while a block is in place it is not visible to either of you. Push notifications and the notification overview do not contain message text. Before your first direct message, you agree to our community guidelines once. We store this agreement with the time and the version of the guidelines in your account; it cannot be changed afterwards, and we ask again when there is a new version. It is included in your data export and deleted with your account.

Deleting messages: “Delete for me” only hides a message for you; once both of you have hidden it, we delete it permanently. “Delete conversation” hides all previous messages for you, while the other person keeps their history; you will see new messages again. Whatever both of you have deleted for yourselves is deleted permanently, and if no message remains, so is the conversation. Independently of this, we delete every message 12 months after it was sent and a conversation, including its preview, 12 months and 7 days after its most recent message, so that it never disappears before its messages (technically usually within 24 hours after the deadline). If someone deletes their account, we delete their conversations completely, including for the other person. Your data export contains all messages of your conversations that are still stored, including those you have hidden for yourself, but not when the other person deleted something.

Challenges: You can invite friends to challenges (steps, calories eaten, water in glasses, calories actively burned or protein over 1, 3 or 7 days). When you create or accept a challenge, you expressly consent to us evaluating your value for this metric during the challenge period; we store the metric and the time of your consent in the challenge. You can withdraw this consent at any time via “Leave challenge” as long as the challenge has not ended (see below). We also store the participants, invitation status, target and period. To evaluate a challenge, our server only reads the daily values of participants who have consented. All participants see names, status, ranking and winner; only you see your final value. Friends only see your value for today if you share it in the activity overview. For a step challenge, the dialog shown when you start or join it states explicitly that your steps, including those from Apple Health or Health Connect, are evaluated for the challenge and shared with the participants as a ranking; by starting or joining you agree to this.

Leaving a challenge: As long as a challenge has not yet started or its period has not yet ended, you can leave it at any time. We then remove your consent, do not evaluate you and give you neither a rank nor points (XP); only the fact that you left is recorded. If only one person remains as a result, the challenge ends without a result. Once the period has ended, you can no longer leave; the challenge is then evaluated with the values collected with your consent up to that point. If you decline an invitation, we do not evaluate anything for you. Challenges have no deletion period; when you delete your account, we delete the challenges you took part in and remove your identifier from challenges you left or declined.

Blocking: If you block someone, we store the person's user ID, username and display name as well as the time in your block list; only you can see the list. An existing friendship and open requests end, you can no longer find each other via search, username or friend code, and your direct messages are not visible to either of you as long as one of you blocks the other. We then note on your shared conversation that it is blocked; it does not say who blocked whom. The conversation no longer appears in the message overview for either of you, not even as a preview. As soon as neither of you blocks the other any more, it appears again. Your data export shows for the conversation whether it is blocked, but not who blocked whom. Your own block list is part of your export; other people's block lists are not. The note is deleted together with the conversation (12 months and 7 days after the most recent message or when an account is deleted).

Reporting: You can report profiles, conversations, individual messages and answers from Julio. A report contains your user ID, a reference to what was reported, the reason, your optional comment (up to 500 characters) and the time. If you report a direct message, we also copy its text into the report so that it remains available as evidence even if the message is deleted later. Only our team sees reports; to review them it can view the reported content. If you report an answer from Julio, we see the reported answer and, to review it, can look at the conversation before it; only a reference to the answer is stored (12 months). The reported person does not learn who reported them. We delete reports, including any copied text, 12 months after receipt (technically usually within 24 hours after the deadline). We only keep a report longer if, in an individual case, we need it for a specific legal claim, for example to assert it or to defend ourselves (Art. 17(3)(e) GDPR). If an account involved is deleted, we remove its user ID and username from the report; the reason, comment and any copied text are kept until the deadline.

Reports without an account: People without an account can also report content by email to support@flexen.co. We then process the email address, the information in the report and our reply in order to review the report (Art. 6(1)(f) GDPR, legitimate interest in a safe community) and delete them after 12 months, like reports from the app. We review reports within 48 hours; in case of clear violations we block immediately.

In-app notifications: Friend requests, accepted requests, challenge invitations and new messages appear in your notification overview (with the other person's user ID and, for friend requests, also their display name). We delete these entries automatically after 90 days. For push notifications, see section 9.

Deletion: When you delete your account, we delete your profile, the reservation of your username and friend code, friendships, requests, nudges, the activity overview, the challenges you took part in (we remove your identifier from challenges you left or declined), conversations, your notifications and entries about you in other people's block lists and notification overviews; reports are anonymised as described. Posts, comments and likes from earlier app versions are deleted as well.

Legal basis: Art. 6(1)(b) GDPR (provision of the social features you use). Showing your display name and your username wherever someone interacts with you is based on our legitimate interest in making it clear who sends a request, takes part in a challenge or writes a message (Art. 6(1)(f) GDPR). Where you show friends activity values, this is based on your consent (Art. 6(1)(a) GDPR; for health values Art. 9(2)(a) GDPR), which you can withdraw at any time via the sharing settings. The evaluation of your values in challenges is based on your explicit consent when creating or accepting a challenge (Art. 6(1)(a), Art. 9(2)(a) GDPR); you withdraw it with effect for the future by leaving the challenge during its period via “Leave challenge”. Reports, the copy of reported direct messages and the retention of reported content are based on our legitimate interest in a safe community and in the defence of legal claims (Art. 6(1)(f) GDPR).

15. Recipients & Third-Country Transfers

We use the following service providers (processors or independent controllers):

• Google Ireland Limited / Google LLC — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions (europe-west1 region), Cloud Logging, Firebase App Check, Crashlytics (only with consent), Firebase Cloud Messaging (push notifications) and Vertex AI (Gemini) for the AI features, including web search (section 8).
• Apple (Apple Distribution International Ltd., Ireland, or Apple Inc., USA) — Sign in with Apple (section 6), delivery of push notifications on iOS (section 9) and purchases and subscriptions via the App Store (section 11).
• Google as operator of Google Play — purchases and subscriptions on Android (section 11).
• OpenFoodFacts (France) — product data for barcode scans and the food search (barcode number or search term and the device's IP address, see section 10).
• FatSecret (Australia; servers EU/USA) and USDA FoodData Central (USA) — food/nutrition databases, each via our server proxy in the EU and with the search term only (see section 10).
• U.S. National Library of Medicine (NLM RxTerms) (USA) — medication search via our server proxy in the EU, with the search term only (see section 10).
• PostHog Inc. (USA; stored in the EU cloud in Frankfurt) — usage analytics for the app, only with your consent (see section 13).

Processing primarily takes place in the EU: Cloud Functions in the europe-west1 region (Belgium), Cloud Firestore in the EU multi-region “eur3”, Cloud Storage and the server logs (Cloud Logging) in europe-west1 and the AI features in the EU multi-region of Vertex AI. Data may be processed outside the EU in particular in the following cases: web search queries to Google Search and their logs at Google (up to 30 days, section 8.5), services of Google LLC and Apple Inc., and the US databases mentioned.

Where Google services transfer data to the USA, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and on the EU-US Data Privacy Framework (for Switzerland, the Swiss-U.S. Data Privacy Framework), under which Google is certified (as of 12 June 2026). We have a Data Processing Agreement with Google pursuant to Art. 28 GDPR. For sign-in and purchases, Apple's own privacy terms apply.

For the food and medication databases named in section 10 (FatSecret, USDA FoodData Central, NLM RxTerms), only search terms leave the EU; your profile, your user ID and your IP address are not sent along. For the recipients, the search terms cannot be linked to a person, so no personal data is transferred to a third country (reviewed on 6 October 2026). Please do not enter names or other personal details into search fields.

16. Retention & Deletion

We store your app data for as long as your account exists, unless a shorter period is stated in this policy. When you delete your account, your personal data is deleted or anonymised in our active systems unless statutory retention obligations require longer storage. This includes in particular profile, meal and daily logs, journal entries, AI chats including attachments, Julio's memory, training plans, medications, cycle data, recipes, fridge inventory, weight history, achievements, weekly summaries, activity logs and snapshots, friendship data (on both sides), direct messages, your consent records, the beta Premium note, data exports, uploaded images, push tokens, diagnostics reports and your sign-in account.

Fixed periods:

• Backups: Our database can be restored to an earlier state for the last 7 days (point-in-time recovery). In addition, we create a backup every day and keep it for 14 days. Deleted data is therefore removed from all backups after 14 days at the latest. We only use backups to restore data after an incident.
• AI cost log (without content, section 8.9): 30 days.
• Server logs (Google Cloud Logging; technical messages from our servers such as time, function and error, partly with your user ID): 30 days.
• Crash reports (Crashlytics), diagnostics reports and in-app notifications: 90 days.
• Direct messages and reports: 12 months (section 14).
• Web search logs at Google: up to 30 days (section 8.5).

When you delete your account, we also delete your analytics data at PostHog: through PostHog’s interface we request the deletion of your pseudonymous user profile together with all events assigned to it. PostHog removes the profile within minutes and the events in a subsequent deletion run. If the deletion at PostHog fails temporarily, we automatically retry it daily until it has been completed.

How to delete your account:

• In the app: Settings → Account → “Delete account” (with confirmation dialog) — deletion is started immediately.
• By email: to info@flexen.co — we delete your account within 30 days.

A step-by-step guide is available at flexen.co/en/delete-account.

17. Your Rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR); you start the data export yourself in the app
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a data protection authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information; in Austria it is the Austrian Data Protection Authority.

You can withdraw any consent you have given (e.g. for health data, the AI features, crash reports, usage analytics or a challenge) at any time with effect for the future (Art. 7(3) GDPR), usually directly in the app.

Contact us at: info@flexen.co.

Information for users in Switzerland

If you live in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies to you. You can exercise your rights under the FADP, in particular to information, to receive or transfer your data, to rectification and to erasure, through the same channels. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). Your data is processed in EU countries and, in the cases mentioned in section 15, in the USA. According to the Swiss Federal Council, the EU countries ensure an adequate level of data protection. For the USA, we rely on the Swiss-U.S. Data Privacy Framework where the respective recipient is certified under it, and otherwise on standard contractual clauses recognised by the FDPIC.

18. External Links

This website links to the Apple App Store and Google Play Store. The respective privacy policies of Apple and Google apply to data processing by these services.

19. Changes

We reserve the right to update this privacy policy to reflect changes in the legal landscape or in our services. The current version is always available on this page.

Last updated: 10 October 2026 (version 2.6)