Privacy policy

1. Who is responsible

David Guillén Serafín, founder of Eskulp, is responsible for your data (the "controller" under the GDPR). Contact: hello@eskulp.com.

2. What we collect

Account: your email address and password (stored only as a secure hash by our authentication provider), and a display name if you add one.

Profile: language, units, time zone, height, birth year, sex (optional) and goals.

Health and wellness data you enter or import: workouts, cardio, food, water, supplements, sleep, body measurements (weight, waist, body fat, skinfolds), notes, and files you import from other apps.

Technical: a session cookie that keeps you signed in, and security logs (IP address, time) kept by our hosting providers.

We do not use advertising, tracking cookies or third-party analytics.

3. Why we use it (legal basis)

To provide the app (your account, logging, charts, export): our agreement with you (GDPR art. 6.1.b).

Health data: your explicit consent (GDPR art. 9.2.a), which you give when you create your account. You can withdraw it at any time by deleting your account; this does not affect what was done before.

Security and abuse prevention (for example daily limits and a log of sensitive actions, which never contains health values): our legitimate interest (art. 6.1.f).

Feedback you send us: our legitimate interest in improving the app.

4. AI features

AI food logging ("Describe it") is optional. When you use it, the text you type is sent to Anthropic (USA) to split it into food lines. Under Anthropic's commercial terms it is not used to train their models and is kept only for a limited time. Calories and nutrients are then calculated by our own code from food databases. Results are estimates: review them before saving.

AI photo analysis is currently switched off.

5. Who processes data for us

Supabase: database and sign-in, servers in Frankfurt (Germany, EU).

Vercel: hosting of the app, processing in Frankfurt; Vercel is a US company.

Anthropic: AI food logging, only when you use it (USA).

Open Food Facts: receives only the barcode number when you scan a product.

Cloudflare (domain and email forwarding) and an email delivery service for account emails (confirmation, password reset).

Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell your data or share it with advertisers, insurers or employers.

6. How long we keep it

While your account exists. Deleting your account (Profile -> Delete account) erases all your records at once; database backups that may still contain them are overwritten within 7 days.

7. Your rights

Access and portability: download everything as Excel or CSV in Profile. Correction: edit any record. Erasure: delete your account in Profile. You can also ask for restriction or object to processing, and withdraw consent, by writing to hello@eskulp.com.

You can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or the authority where you live.

8. Security

Encrypted connections (HTTPS), encryption at rest by our database provider, database rules so each account can only reach its own data (tested automatically), two-factor authentication on our admin accounts, and an audit log of sensitive actions. No system is perfectly secure; if a breach affects you, we will tell you and the authority as the law requires.

9. Age

Eskulp is for people aged 18 or over.

10. Changes

We will tell you in the app about important changes. If they affect how we use health data, we will ask for your consent again.