Privacy Policy

1. Controller

The controller for data processing on this website and in the Julio app is:

Flexen UG (haftungsbeschränkt)
Paul-Heidelbach-Straße 14
34134 Kassel, Germany
Managing directors: Leonard Hoppe, Marcel Schneider, Leon Schmelzle
Commercial register: HRB 20498, Amtsgericht Kassel
Email: info@flexen.co

2. Scope

This privacy policy covers two areas:

• Website (sections 3–5): visiting flexen.co and contacting us by email.
• Julio app (sections 6–14): using the Julio app for iOS and Android, including your account, health and nutrition data, AI features and purchases.

Sections 15–19 (recipients, retention, your rights) apply to both areas.

3. Website: Hosting

This website is hosted by Google Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit the website, information (e.g. IP address, time of access, page requested, user agent) is automatically stored in server log files. This data is used solely for the purpose of stable website operation and cannot be attributed to specific individuals. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable website operation).

4. Website: Contact by Email

When you contact us by email (e.g. info@flexen.co), we process the data you submit (email address, content, name if provided) for the purpose of handling your request. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding). The data is deleted as soon as it is no longer required for our response and no statutory retention obligations apply.

5. Website: No Cookies, No Tracking, Local Fonts

This website sets no cookies and uses no tracking. No third-party scripts (e.g. Google Analytics, Facebook Pixel) are embedded.

This website uses locally hosted fonts (self-hosting). No connections to external font servers (e.g. Google Fonts) are established.

6. Julio App: Account, Registration & Minimum Age

Using the Julio app requires an account. We offer the following sign-up and sign-in methods:

• Email and password — we send you a verification email to confirm your address.
• Google Sign-In — sign in with your Google account.
• Phone number — sign in via one-time code (SMS); your phone number is only stored when you use this method.

Authentication is handled by Firebase Authentication (Google). Your account is assigned a pseudonymous user ID (Firebase UID), which your app data is linked to.

Minimum age 18 – no data of minors: The Julio app is intended exclusively for people who are at least 18 years old. During registration we ask for your date of birth. Registration cannot be completed without a date of birth showing that you are at least 18 years old: the app does not accept a later date, and our server rejects any user profile under 18. We therefore do not knowingly process personal data of minors. If we nevertheless learn that an account was created by a minor, we delete the account and the data associated with it.

Profile data: During onboarding and in your profile we process — to the extent you provide them — email address, username, display name, date of birth, height, weight, body fat percentage, gender, fitness goal, activity level, dietary preferences, allergies and intolerances, an optional note on pre-existing conditions, your medication status, your goals (calories, macros, water, steps) and your time zone.

The Julio app collects no location data. No location permission is requested and no location is determined or stored.

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract). Where profile data constitutes health data (e.g. allergies, pre-existing conditions), section 7 additionally applies.

7. Julio App: Health & Nutrition Data

Julio is an AI health coach. To make the app work, we process health data within the meaning of Art. 9 GDPR — but only with your explicit consent (Art. 9(2)(a) GDPR), which you give during onboarding and can withdraw at any time with effect for the future (in the app settings or by email to info@flexen.co).

This includes — in each case only if you use the feature:

• Steps and sleep: With your permission, the app reads step count and sleep data from Apple HealthKit (iOS) or Android Health Connect. Sleep you log manually in Julio can be written back to HealthKit/Health Connect. You control this access at any time via your device's system settings.
• Nutrition: meal logs, food photos, recipes and your fridge inventory.
• Medications: name, dosage, intake schedule and intake history. The AI accesses your medication data only with a separate, additional consent, which you can give in the app and withdraw at any time.
• Journal & mood: journal entries and your mood on a scale of 0–10.
• Cycle: if you use cycle tracking: start of your last period, cycle length and your contraceptive method (e.g. pill) to calculate your cycle phases.
• Weight & water: weight history and water tracking.
• Training: AI-generated training plans and exercises.

All of this data is stored in Cloud Firestore or Cloud Storage (Google, processed in the europe-west1 region) and linked to your Firebase UID.

Important: Julio is not a medical device and does not replace medical advice, diagnosis or treatment.

8. Julio App: AI Features (AI Coach Julio)

The AI coach Julio and other AI features of the app use the Google Gemini AI model (Google Ireland Limited / Google LLC) via Firebase AI / Vertex AI. The following content is transmitted to Google:

• Chat messages you send to Julio, together with the profile context required to generate a response.
• Food photos for automatic nutrition analysis. Before upload, we strip the EXIF metadata (e.g. capture location, device info) from the image.
• Voice recordings (e.g. for journal entries) for transcription. The audio file is not permanently stored — only the transcript is stored.

The AI accesses your medication data only with your separate consent (see section 7).

Legal basis: Art. 6(1)(b) GDPR (provision of the AI features as the core of the app); for health data, your explicit consent under Art. 9(2)(a) GDPR.

Note: AI output can contain errors and is not medical advice. For health concerns, please consult a medical professional.

9. Julio App: Permissions and Push Notifications

The app only requests device permissions when you use the corresponding feature:

• Camera: to photograph meals and scan barcodes.
• Photos/gallery: to select existing food photos.
• Microphone: for voice recordings that are transcribed (see section 8).
• Health data / activity recognition: to read steps and sleep (see section 7).
• Notifications: for reminders you configure in the app and for push notifications (see below).

You can revoke any permission at any time in your device's system settings.

Push notifications: If notifications are allowed for Julio on your device, the app registers your device with Firebase Cloud Messaging (Google) after you sign in. For this, we store one entry per device in your account (Cloud Firestore) containing the device token, the platform (iOS or Android), the app language and the time of the last update. We use this entry to send you notifications about friend requests, accepted requests, challenge invitations and new messages. A notification only contains a general note (e.g. “New message”), no sender and no message content; for messages, a technical identifier of the conversation is also sent so that your device can group notes from the same conversation. On iOS devices, delivery takes place via the Apple Push Notification Service (Apple). Reminders you set in the app are scheduled locally on your device.

When you sign out, the app deletes the entry for this device and the device token. If Firebase reports a token as invalid (e.g. after the app has been reinstalled), we delete the entry at the next delivery. When you delete your account, all entries are deleted. Legal basis: Art. 6(1)(b) GDPR (provision of the app's notifications).

10. Julio App: External Food & Medication Databases

To look up nutrition values and medications, the app queries external reference databases. Depending on the feature you use, only the respective search terms or barcode numbers are transmitted — not your profile:

• OpenFoodFacts (Open Food Facts, France) — When you scan a food barcode, only the product's barcode number is transmitted — no personal data and no information from your account. Processing takes place in the EU; no third-country transfer.
• FatSecret Platform API (FatSecret, USA) — food and nutrition database. The request is routed through our server (Cloud Function in the EU, europe-west1 region); only the food search term is passed to FatSecret, not your user ID. Where a transfer to the USA occurs, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• USDA FoodData Central (U.S. Department of Agriculture, USA) — government food and nutrition database. The request is likewise routed through our server (Cloud Function in the EU); only the food search term is transmitted, not your user ID.
• NLM RxTerms / RxNav (U.S. National Library of Medicine, USA) — medication database for searching medication names. This request is made directly from your device to a server in the USA. In doing so, the medication search term you enter (a health-related data point) and your IP address are transmitted. A third-country transfer to the USA takes place.

The legal basis for these lookup features is Art. 6(1)(b) GDPR (provision of the respective feature); where medication search terms constitute health data, your explicit consent under Art. 9(2)(a) GDPR.

11. Julio App: Purchases

Subscriptions (currently Premium as a monthly subscription) are handled entirely by the Apple App Store or Google Play. Payment processing is carried out exclusively by Apple or Google — we receive no payment data (no credit card or bank details), only the information about your subscription status. Legal basis is Art. 6(1)(b) GDPR (performance of contract). The privacy policies of Apple and Google apply to their data processing.

12. Julio App: Crash Reports (Crashlytics) and Diagnostics

To detect and fix app crashes, we use Firebase Crashlytics (Google). This processes diagnostic data (e.g. time of crash, device model, OS version, app version, system language, stack trace). While you are signed in, we attach your pseudonymous user ID (Firebase UID, see section 6) to the reports as an identifier so that crashes can be assigned to an account; the identifier is removed when you sign out. We do not enrich crash reports with personal content. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free app).

Objection: You can object to the transmission at any time in the app under Settings › Privacy & Data with the “Send crash reports” switch (Art. 21 GDPR). If you switch it off, the app no longer sends reports, removes the identifier and deletes reports on your device that have not yet been sent.

“Send diagnostics”: Only when you trigger it yourself (in the settings under “About” or under “Help & Support”) does the app send us a diagnostics report. It contains your pseudonymous user ID, app version and build number, platform, operating system version, device model, system language, your optional note and the app log (up to the 500 most recent entries). The log records technical events and error messages (time, area, message, where applicable error text and stack trace). It is not intended to record content such as meals or messages; however, error texts are not filtered for content and may in individual cases contain information relating to you. Until it is sent, the log stays on your device; it is deleted when you sign out.

The report is stored in Cloud Firestore (Google, europe-west1 region); only our team can read it. We delete it 90 days after it was sent (technically usually within 24 hours after the deadline), immediately when your account is deleted and earlier on request. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing errors and handling your request).

13. Julio App: Analytics (PostHog)

If you consent, we use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA) to analyse how the Julio app is used. Usage analytics are switched off by default (opt-in). Without your consent, the analytics component is not started and no analytics data is sent to PostHog.

Consent and withdrawal: You give your consent in the app under Settings › Privacy & Data with the “Pseudonymous usage analytics” switch. You can withdraw it there at any time with effect for the future by switching it off. On withdrawal, the app stops collection immediately and removes the link to your pseudonymous identifier on your device. Consent applies to your account: we store your choice, together with the time, in your account so that it applies on all your devices. Consent given in earlier app versions does not carry over: usage analytics stay switched off until you consent again. After a withdrawal, we no longer collect analytics data; data already collected is deleted on request (info@flexen.co) and at the latest when your account is deleted.

Legal basis: Art. 6(1)(a) GDPR (consent).

Purpose: improving the app, understanding which features are used, measuring user retention, and detecting errors and delays in the AI features.

Data processed:

• Pseudonymous identifier: your Firebase UID (see section 6), used to associate events with your account. We do not send your email address, name or phone number to PostHog.
• Account attributes: sign-up date, premium status, date of last activity and app language.
• Usage events with time: sign-up and sign-in (with sign-in method), sign-out, the fact that a meal was logged via Julio or a workout was completed (without any further details), message sent to Julio (message length and whether it belongs to an existing chat), purchase completed (product, price, currency, new purchase or restore) and technical values of the AI nutrition estimate, such as response time, cache use, model used, success or type of error, estimate confidence and the length and kind of input – never the text you entered.
• App installed, updated, opened or moved to the background, and views of individual, predefined screens.
• Standard device and app properties sent automatically by the PostHog SDK (e.g. device model, operating system and version, app version, language setting). Your IP address is transmitted to PostHog as a technical necessity of the transfer.

What we explicitly do NOT send to PostHog: details of your meals (descriptions, photos, calorie and nutrition values, meal type), workout details (e.g. duration, exercises, training plan), the contents of your chat messages with Julio, weight, step and sleep values, medications, journal entries and cycle data. Screen recording (session replay), surveys and PostHog’s automatic error capture are switched off.

Storage location and third-country reference: We use PostHog's EU cloud; the data is stored on servers in Frankfurt, Germany. PostHog Inc. is based in the USA and may also process data outside the EU to provide its services, for example through sub-processors. Where data is transferred to the USA in this context, the transfer is based on the EU-US Data Privacy Framework, under which PostHog is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the data processing agreement (as of 27 September 2026).

Retention: Events are deleted at PostHog after 12 months. The account attributes (see above) remain stored until your account is deleted. When you delete your account, we immediately request the deletion of your analytics data at PostHog (see section 16).

Data processing agreement: We have a Data Processing Agreement (DPA) with PostHog pursuant to Art. 28 GDPR. PostHog privacy policy: posthog.com/privacy.

14. Julio App: Social Features

The social features are optional. We only process the following data to the extent that you use the respective feature.

Discoverability, username and friend code: When you register, you decide whether others can find you by your username; this is switched off by default, and you can change it in the app at any time. Only when it is switched on can others find you in the user search, by your exact username or by your friend code, and only then can they send you a friend request. We reserve your username and friend code uniquely for your account.

Profile: Your display name, your username, your visibility setting and your number of friends are visible to all signed-in users. Your bio as well as your level and up to 12 achievements are only shown to people your visibility level allows (friends only, followers or all signed-in users; friends only by default); you decide separately whether they see none of this, only the level, or level and achievements. Age, weight, height, health and cycle data are never part of your profile for others. Before you make your profile visible beyond “friends only”, you agree to our community guidelines once; how we store this agreement is described under “Direct messages”.

Friendships: Friend requests are handled by our server. We store the sender, recipient, status and time; the person you send a request to receives a notification with your display name. If they decline, we delete the request, and you cannot send them a new one for 24 hours. If they accept, we store the friendship (both of your user IDs and the time). You can end friendships at any time. Friends can “nudge” each other at most once a day; for this we store the sender, the recipient, the sender's display name and whether the nudge has been seen. The app no longer offers a follow feature; follow connections from earlier versions are deleted when you block someone and when you delete your account.

Activity overview for friends: Your friends see your display name and, to the extent you share it, your profile photo, your level, when you were last active, your streak and, via the “activity” setting, today's steps, calories eaten and burned, your protein and your water (each can be switched off individually). Profile photo and level are shared by default; activity, streak and “last active” are not. Individual meals, journal entries, medications and your weight are not shared. Only you and your friends can read the overview.

Direct messages: You can only exchange messages with friends, as long as neither of you has blocked the other. For each message we store the sender, the time and the text (up to 2,000 characters) or a challenge invitation; for each conversation the two participants, a preview of the last message (up to 140 characters), the number of unread messages, when it was read and when someone deleted the conversation for themselves. Messages are stored on our servers (Cloud Firestore) and are not end-to-end encrypted. Only the two participants can read them; after a friendship ends the history remains readable, while a block is in place it is not visible to either of you. Push notifications and the notification overview do not contain message text. Before your first direct message, you agree to our community guidelines once. We store this agreement with the time and the version of the guidelines in your account; it cannot be changed afterwards, and we ask again when there is a new version. It is included in your data export and deleted with your account.

Deleting messages: “Delete for me” only hides a message for you; once both of you have hidden it, we delete it permanently. “Delete conversation” hides all previous messages for you, while the other person keeps their history; you will see new messages again. Whatever both of you have deleted for yourselves is deleted permanently, and if no message remains, so is the conversation. Independently of this, we delete every message 12 months after it was sent and a conversation, including its preview, 12 months and 7 days after its most recent message, so that it never disappears before its messages (technically usually within 24 hours after the deadline). If someone deletes their account, we delete their conversations completely, including for the other person. Your data export contains all messages of your conversations that are still stored, including those you have hidden for yourself, but not when the other person deleted something.

Challenges: You can invite friends to challenges (steps, calories eaten, water in glasses, calories actively burned or protein over 1, 3 or 7 days). When you create or accept a challenge, you expressly consent to us evaluating your value for this metric during the challenge period; we store the metric and the time of your consent in the challenge. We also store the participants, invitation status, target and period. To evaluate a challenge, our server only reads the daily values of participants who have consented. All participants see names, status, ranking and winner; only you see your final value. Friends only see your value for today if you share it in the activity overview.

Leaving a challenge: As long as a challenge has not yet started or its period has not yet ended, you can leave it at any time. We then remove your consent, do not evaluate you and give you neither a rank nor points (XP); only the fact that you left is recorded. If only one person remains as a result, the challenge ends without a result. Once the period has ended, you can no longer leave; the challenge is then evaluated with the values collected with your consent up to that point. If you decline an invitation, we do not evaluate anything for you. Challenges have no deletion period; when you delete your account, we delete the challenges you took part in and remove your identifier from challenges you left or declined.

Blocking: If you block someone, we store the person's user ID, username and display name as well as the time in your block list; only you can see the list. An existing friendship and open requests end, you can no longer find each other via search, username or friend code, and your direct messages are not visible to either of you as long as one of you blocks the other. We then note on your shared conversation that it is blocked; it does not say who blocked whom. The conversation no longer appears in the message overview for either of you, not even as a preview. As soon as neither of you blocks the other any more, it appears again. The note is part of your data export and is deleted together with the conversation (12 months and 7 days after the most recent message or when an account is deleted).

Reporting: You can report profiles, conversations, individual messages and answers from Julio. A report contains your user ID, a reference to what was reported, the reason, your optional comment (up to 500 characters) and the time. If you report a direct message, we also copy its text into the report so that it remains available as evidence even if the message is deleted later. Only our team sees reports; to review them it can view the reported content and, for reported answers from Julio, the chat concerned. The reported person does not learn who reported them. We delete reports, including any copied text, 12 months after receipt (technically usually within 24 hours after the deadline), unless we need a report to defend legal claims. If an account involved is deleted, we remove its user ID and username from the report; the reason, comment and any copied text are kept until the deadline.

In-app notifications: Friend requests, accepted requests, challenge invitations and new messages appear in your notification overview (with the other person's user ID and, for friend requests, also their display name). We delete these entries automatically after 90 days. For push notifications, see section 9.

Deletion: When you delete your account, we delete your profile, the reservation of your username and friend code, friendships, requests, nudges, the activity overview, the challenges you took part in (we remove your identifier from challenges you left or declined), conversations, your notifications and entries about you in other people's block lists and notification overviews; reports are anonymised as described. Posts, comments and likes from earlier app versions are deleted as well.

Legal basis: Art. 6(1)(b) GDPR (provision of the social features you use). Where you show friends activity values, this is based on your consent (Art. 6(1)(a) GDPR; for health values Art. 9(2)(a) GDPR), which you can withdraw at any time via the sharing settings. The evaluation of your values in challenges is based on your explicit consent when creating or accepting a challenge (Art. 6(1)(a), Art. 9(2)(a) GDPR); you withdraw it with effect for the future by leaving the challenge during its period. Reports, the copy of reported direct messages and the retention of reported content are based on our legitimate interest in a safe community and in the defence of legal claims (Art. 6(1)(f) GDPR).

15. Recipients & Third-Country Transfers

We use the following service providers (processors or independent controllers):

• Google Ireland Limited / Google LLC — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions (europe-west1 region), Firebase AppCheck, Crashlytics, Firebase Cloud Messaging (push notifications) and Firebase AI / Vertex AI (Gemini) for the AI features.
• OpenFoodFacts (France) — product data for barcode scans (barcode number only, see section 10).
• FatSecret (USA) and USDA FoodData Central (USA) — food/nutrition databases, each via our server proxy in the EU and with the search term only (see section 10).
• U.S. National Library of Medicine (NLM RxTerms / RxNav) (USA) — medication search; queried directly from your device to the USA with the search term and IP address (see section 10).
• Apple / Google — handling of purchases and subscriptions (see section 11); Apple also for delivering push notifications on iOS (see section 9).
• PostHog Inc. (USA; stored in the EU cloud in Frankfurt) — usage analytics for the app, only with your consent (see section 13).

Processing primarily takes place in the EU (europe-west1 region). Where Google services transfer data to the USA, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and on the EU-US Data Privacy Framework, under which Google is certified (as of 12 June 2026). We have a Data Processing Agreement with Google pursuant to Art. 28 GDPR.

For the food and medication databases named in section 10 (FatSecret, USDA FoodData Central, NLM RxTerms / RxNav), data may be transferred to the USA. For the medication search via the NLM (US authority), the request is made directly from your device.

16. Retention & Deletion

We store your app data for as long as your account exists. When you delete your account, your personal data is deleted or anonymised in our active systems unless statutory retention obligations require longer storage. This includes profile, meal and daily logs, journal entries, AI chats, training plans, medications, cycle data, recipes, fridge inventory, weight history, achievements, weekly summaries, activity logs and snapshots, friendship data (on both sides), data exports, uploaded images, push tokens, diagnostics reports and your sign-in account. Backups are overwritten within 30 days at the latest.

When you delete your account, we also delete your analytics data at PostHog: through PostHog’s interface we request the deletion of your pseudonymous user profile together with all events assigned to it. PostHog removes the profile within minutes and the events in a subsequent deletion run. If the deletion at PostHog fails temporarily, we automatically retry it daily until it has been completed.

How to delete your account:

• In the app: Settings → Account → “Delete account” (with confirmation dialog) — deletion is started immediately.
• By email: to info@flexen.co — we delete your account within 30 days.

A step-by-step guide is available at flexen.co/en/delete-account.

17. Your Rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a data protection authority (Art. 77 GDPR), in particular the Hessian Commissioner for Data Protection and Freedom of Information

You can withdraw any consent you have given (e.g. for health data or AI access to your medication data) at any time with effect for the future (Art. 7(3) GDPR).

Contact us at: info@flexen.co

18. External Links

This website links to the Apple App Store and Google Play Store. The respective privacy policies of Apple and Google apply to data processing by these services.

19. Changes

We reserve the right to update this privacy policy to reflect changes in the legal landscape or in our services. The current version is always available on this page.

Last updated: 29 September 2026 (version 2.5)