Privacy Policy

1. What we collect

We collect only what is strictly needed to run the service:

• Your email address (as your account identifier).
• A bcrypt hash of your password (never the plaintext).
• Your daily habit scores (0–10 per component) and the derived coefficient.
• Timestamps for account creation, session activity, and log updates.

We do not use analytics cookies, advertising trackers, fingerprinting, or third-party session-replay tools.

2. Cookies

One cookie is set: a signed, encrypted session cookie (ht_session). It is HTTP-only, secure in production, and SameSite=Lax. It contains no personal data — only an opaque session identifier. It is strictly necessary and therefore exempt from consent requirements under ePrivacy / GDPR.

3. Legal basis (GDPR)

Processing is based on performance of a contract (Art. 6(1)(b)) — you cannot use the service without an account. For security logging we also rely on legitimate interests (Art. 6(1)(f)).

4. Where your data lives

Data is stored on Supabase (Postgres, EU-West region). Application hosting is on Vercel. Both are GDPR-compliant sub-processors.

5. Your rights

You can exercise all core GDPR rights directly from the Settings page:

• Access & portability (Art. 15, 20) — download a full JSON export.
• Rectification (Art. 16) — edit any daily log at any time.
• Erasure (Art. 17) — delete your account; cascades to all logs.

To object to processing (Art. 21) or lodge a complaint, email privacy@healthtuner.app. You may also contact your national data-protection authority.

6. Retention

Data is kept while your account is active. When you delete your account, all logs and password-reset tokens are removed from our primary database immediately. Encrypted backups may retain the data for up to 7 days before being overwritten.

7. Security

Passwords are hashed with bcrypt (10 rounds). Sessions use encrypted, signed cookies via iron-session. All traffic is HTTPS with HSTS preload. Rate limits, CSRF origin checks, and strict CSP headers are applied to every route. See our security.txt for reporting vulnerabilities.

8. Children

Health Tuner is not directed at anyone under 16. Do not create an account if you are below that age.

9. Changes

We will update the "Last updated" date at the top of this page when the policy changes. Material changes will be announced via email to the address on file.