Privacy Policy
Draft as of 2026-10-03. Not yet reviewed by a lawyer and may change. Items in square brackets are to be filled in by the owner. If this translation differs from the Russian version, the Russian version prevails unless mandatory law of your country says otherwise.
1. Who we are
1.1. The controller (operator) of your personal data is [owner's full name], [status: individual / self-employed / sole proprietor, tax ID], [postal address] ("we"). The service is the Rezhim ("Режим") app at [domain] (the "app").
1.2. Contact for data matters: [contact email]. We answer within one month (Art. 12(3) of Regulation (EU) 2016/679, "GDPR") and within 10 business days for requests under Russian Federal Law No. 152-FZ "On Personal Data" ("152-FZ").
1.3. [EU representative under Art. 27 GDPR: name and address — to be appointed before the app is offered to people in the EU; see the review report.]
2. What we process and why
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email, password (stored only as a hash), sign-up date | you, at sign-up | sign-in, sign-in and password reset emails | contract (Art. 6(1)(b) GDPR) |
| Your routine: supplements, workouts, schedule, daily check-offs, weights and sets, notes | you | show your daily plan and history | contract |
| Check-ins: weight, body measurements, well-being scores (energy, mood, sleep, pain and other scales) | you | show your progress | health data — explicit consent (Art. 9(2)(a) GDPR) |
| Food diary: foods, grams, calories and macros, custom foods and recipes | you, barcode scans | daily nutrition totals | contract; explicit consent where it reveals health information |
| Assistant: food photos, food descriptions, chat messages, weekly reviews, usage records (model, tokens, cost) | you, when you turn the assistant on | recognise food, answer questions, review your week; cap spending | consent (the "Assistant" switch in settings) |
| Feedback: text, email, page, browser type | the "Feedback" button | fix bugs, improve the app | legitimate interest (Art. 6(1)(f) GDPR) |
| Exercise searches with no result: query, filters | search | extend the exercise catalogue | legitimate interest |
| Technical data: IP address, browser type, request times, essential cookies | automatic | operate and secure the app, rate limiting | contract, legitimate interest |
2.1. Food photos are sent to the model provider for recognition and are not stored by us; only the result you confirm is saved.
2.2. We do not sell data, show ads, or make decisions with legal effects based solely on automated processing (Art. 22 GDPR).
2.3. The app is for people aged 18 and over.
3. Who receives data
3.1. Processors acting on our instructions, only to run the app:
| Processor | Role | Location | Terms |
|---|---|---|---|
| Supabase, Inc. | database and authentication | [Supabase project region — EU, to confirm] | Supabase DPA |
| Vercel Inc. | hosting and server code | functions in Frankfurt (fra1), global CDN, company in the USA | Vercel DPA |
| Anthropic, PBC (only if the assistant is on) | assistant answers | USA | Anthropic Commercial Terms |
3.2. Without your email or account ID, our server sends product search text and barcodes to Open Food Facts (France) and GIF search text to GIPHY (USA). Your browser loads exercise images from cdn.jsdelivr.net and GIFs from giphy.com, which see your IP address.
3.3. International transfers. Transfers to the USA rely on the EU–US Data Privacy Framework adequacy decision where the recipient is certified, otherwise on Standard Contractual Clauses (Art. 45–46 GDPR) [to verify for each processor]. The controller is located in Russia, a country without an EU adequacy decision; [lawyer to confirm the transfer analysis for access by the controller].
3.4. If you turn on "Share" for a routine, the routine (without check-offs, check-ins or food) is visible to anyone with the link.
4. How long we keep data
While your account exists. When you delete your account, data is deleted from the database immediately and from processor backups as they rotate [no longer than 30 days — to confirm].
5. Your rights
You can access your data, download all of it as a JSON file (Settings → My data → Download my data), rectify it in the app, delete your account and all data (Settings → My data → Delete account), withdraw consent at any time (turn off the assistant, delete check-ins or your account), object to processing based on legitimate interest, restrict processing, and lodge a complaint with your supervisory authority (Art. 15–22, 77 GDPR).
6. Security
Row-level access rules in the database (each user sees only their own rows), HTTPS, hashed passwords, server-only keys. We notify the supervisory authority within 72 hours of becoming aware of a personal data breach and inform you where the breach is likely to result in a high risk (Art. 33–34 GDPR).
7. Cookies and browser storage
Only strictly necessary cookies: the sign-in session (sb-…-auth-token), the last opened routine (pr_last), theme and colour (pr_theme, pr_accent). No analytics or advertising cookies, so no consent banner is needed (Art. 5(3) Directive 2002/58/EC; Article 29 Working Party Opinion 04/2012). Browser local storage keeps interface preferences only.
8. Changes
We will announce material changes in the app or by email. The current version is always at [domain]/legal/en/privacy.