Last updated: 2026-09-23
Español English Français Português 日本語 한국어 简体中文
This document is published in several languages. If the versions differ in any way, the Spanish version prevails.
The controller of the personal data collected through the Aszen app is:
This policy explains what data the app processes, why, for how long and what you can do about it. It is written from how the app actually works, not from a generic template.
What Aszen does not do:
What we do: store what you record on your device and — if you create an account — sync it to a server so you can recover it and use it across devices.
If you create an account: your email address and a password. The password is handled by our authentication provider and stored hashed; we never see it in clear text. Without an account the app works locally and nothing is sent to any server other than as described in sections 8, 9, 10 and 11.
Name or nickname, date of birth, sex, height, and your preferred units and language.
If you use the CSV import from another app, the file is read on your device. What gets stored is the workouts and measurements you approve on the review screen; the original file is never uploaded anywhere.
Weight, body-fat percentage, body measurements and the food log are health data, a special category under Article 9 GDPR. We process them solely on your explicit consent, given when you enter them, and only to provide the service: showing them, computing your targets and — if you have an account — syncing them across your devices.
If you grant permission, the app reads your step count from Apple Health (iOS) or Health Connect (Android) to show it alongside your daily activity. That count is used in memory and is never written to the app's database, never synced and never sent to any server or third party.
We only read: we never write data to Apple Health or Health Connect. You can revoke the permission at any time from your operating system settings (iOS: Settings → Privacy & Security → Health; Android: Health Connect → App permissions). The app keeps working without the step count.
Notifications are local: your own device schedules them from your meal and training plan. There is no push notification server, and therefore no third party knows when you eat or train. You can turn them off in Settings or in your operating system.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: recording, showing and computing | Profile, training, food, measurements | Performance of a contract (Art. 6(1)(b)) and explicit consent for health data (Art. 9(2)(a)) |
| Creating and maintaining your account and syncing across devices | Email, password, all of the above | Performance of a contract (Art. 6(1)(b)) |
| Managing the paid subscription | User identifier and subscription status | Performance of a contract (Art. 6(1)(b)) |
| Detecting and fixing errors | Installation identifier, version, error type | Legitimate interest in a working app (Art. 6(1)(f)) |
| Understanding which features get used | Usage milestones identified per device | Consent (Art. 6(1)(a)): can be turned off in Settings |
| Showing the rewarded ad you asked for, and confirming it was watched so the reward can be granted | The device advertising identifier and technical request data | Consent (Art. 6(1)(a)), collected in the form shown before the first ad and, on iOS, in the system tracking prompt |
We do not sell or trade personal data. We rely on the following providers, which process data on our behalf and under our instructions:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Authentication, database and file storage | Your email and everything you sync with your account |
| RevenueCat | Managing paid subscriptions | Your account identifier and subscription status. It does not receive your body data or your logs |
| Sentry | Crash reports | Error type, app version, device model and the installation identifier. Your email is not sent, nor authentication headers, nor the contents of your records: database messages are reduced to the error type before leaving the device |
| Open Food Facts | Food lookup by barcode or by name | Only the code or text you search for. It is not told who is asking, nor your account, nor your food log |
| Google AdMob | Serving the rewarded ad and confirming it was watched | Your device's advertising identifier, your IP address and technical data (model, operating system, language), plus your answer to the consent form. It receives neither your email, nor your account, nor any of your records |
| OpenAI | Generating the answer for the artificial intelligence features | Only the content of that specific request, described in section 11. It receives neither your email nor your account identifier |
| Apple / Google | App distribution and subscription billing | Purchase data, processed by them as independent controllers under their own policies |
We may also disclose data where there is a legal obligation or a valid request from a competent authority.
To learn which features get used we record milestones — for example, that a first meal has been logged or that the subscription screen was opened — identified by a device identifier, not by your account.
The fields each milestone may carry are defined by a closed list inside the program itself, and text values may only take values from a fixed vocabulary. By design, a food name, a weight, a measurement or an email address cannot travel in these records.
You can turn it off in Settings → Share anonymous usage. The app works the same with the option off.
The app shows no banners, no interstitials, and no advertisement that appears on its own. There is a single format: a rewarded video that loads only when you tap the option to watch it, offered as an alternative to the subscription for unlocking an artificial intelligence request.
It is served by Google AdMob. To do so, Google receives your device's advertising identifier, your IP address and technical data such as the model, the operating system and the language. Google handles that data under its own policies.
Consent. Before the first ad you will see a Google (UMP) form where you decide whether to accept personalised advertising. If you decline, an ad is still shown — contextual, not based on your profile — and the reward is exactly the same: refusing personalisation does not cost you the feature. You can change your answer at any time from that same form, and reset the advertising identifier in your device settings (Android: Settings → Privacy → Ads; iOS: Settings → Privacy & Security → Apple Advertising).
On iPhone and iPad. After that form, iOS shows its own App Tracking Transparency prompt asking your permission to use the device advertising identifier (IDFA). If you decline, the ad is still shown without that identifier and the reward is the same. You can change your answer in Settings → Privacy & Security → Tracking. That permission is asked for this ad alone: the app does not track you across other apps or websites.
What never leaves the app. None of the data you record — weight, body fat, girths, meals, workouts, goals — is sent to the ad network or used to target what you see. Neither is your account or your email. The reward is confirmed server to server, from Google to ours, and what travels in that confirmation is the identifier of the ad transaction itself.
If you never use that option, no ad is loaded and nothing is sent to Google AdMob.
Some optional features send information to an OpenAI language model, always through a service of ours in between: the app never talks to the model provider directly, and the access key never travels inside the app. This happens only when you use that feature, never in the background.
Some of the providers listed above may process data outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision. You can ask us for a copy of the applicable safeguards at naiitder.dev@gmail.com.
No system is infallible. Should a security breach occur that poses a high risk to your rights, we will inform you and notify the supervisory authority as required by the GDPR.
You may exercise at any time your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, write to naiitder.dev@gmail.com from the address you registered with, stating which right you wish to exercise. We will reply within one month at the latest.
Some of these you can exercise directly: correct your data in the app itself, erase local data from Settings, or turn off usage analytics.
If you believe we have not handled your request properly, you may lodge a complaint with the data protection supervisory authority of your country. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es).
Aszen is not directed at children under 16 and we do not knowingly collect data from anyone below that age. If we find that an account belongs to someone under 16, we will delete it. If you are a parent or guardian and believe a minor in your care has provided us with data, write to naiitder.dev@gmail.com.
If we change this policy we will update the date in the header. Where the change materially affects how we process your data, we will tell you inside the app before it takes effect.
For any question about this policy or about your data: naiitder.dev@gmail.com.