Privacy Policy

1. Controller

Becker Kraume GmbH

Schönhauser Straße 8

50968 Köln (Cologne)

Germany

Email: support@femify.de

This privacy policy applies to the use of our services on www.femify.de (landing page/purchase page), app.femify.de (PWA/web app) and the native iOS app "Femify" in the Apple App Store.

2. Data Protection Officer

We have not currently appointed a data protection officer, as this is not required under the GDPR. If you have any questions about data protection, you can contact us at any time at support@femify.de.

3. Data Collected

3.1 Personal Data

We collect and process the following personal data:

Upon registration:

  • Email address
  • Name (first name, last name)
  • Gender

When using the app:

  • Weight data and body measurements (height, weight, body fat percentage, muscle mass)
  • Fitness goals and training plans
  • Workout data (exercises, sets, repetitions, weights, duration)
  • Progress data and statistics
  • Cycle data (menstrual cycles, symptoms) - special category under Art. 9 GDPR
  • Connect profile data (username, avatar, bio, social media links)
  • Friend relationships and blocks
  • Preferences for training partner matching
  • Reports about other users (when using the reporting function in the Connect feature)

When using the nutrition feature:

  • Nutrition data (meals, calories, macronutrients, micronutrients)
  • Nutrition goals and preferences (calorie target, macro distribution, diet type)
  • Food search queries and barcode scans
  • Recipes (your own and imported ones)
  • Shopping lists
  • Water and portion tracking (fruit, vegetables)
  • Allergies and intolerances - special category under Art. 9 GDPR
  • AI-based nutrition scans (photo tracking, restaurant menus, fridge scans) - temporary, max. 7 days

When using the coaching feature (1:1 support by a coach):

  • Chat messages with your coach (text as well as image, video, audio and document attachments)
  • Check-in responses (weekly questionnaires on training, nutrition and well-being)
  • Injury and equipment notes - health data under Art. 9 GDPR
  • Calendar entries (e.g. competitions, appointments)
  • Training plans and nutrition goals created by your coach

When using the AI assistant Lucy (only with your consent):

  • Your questions to Lucy and Lucy's answers
  • With separate consent per area: training data, nutrition data and body data (see section 9.5) - health data under Art. 9 GDPR
  • With separate consent: your chat history with Lucy (90 days at most)
  • Questions for which Lucy's knowledge base returns no result

When purchasing on the landing page:

  • Email address
  • Payment information (processed by Stripe/PayPal, not stored by us)

3.2 Technical Data

  • IP addresses (automatically upon server access)
  • Device information (browser, operating system, PWA installation)
  • Location data (optional, only when using Connect Discover, anonymized via geohash)
  • Usage log of the AI features (Lucy, photo tracking, label, fridge and restaurant scan, recipe import, meal plan, exercise analysis, voice input for the shopping list): for each request the feature used, the AI model, the number of tokens and images processed, the resulting cost, the credits used and whether the request succeeded. No content is stored, neither your questions, photos, videos and texts nor the AI's answers. Only Femify can analyse the log internally; you and other users have no access to it

4. Purpose of Processing

We process your data for the following purposes:

  • Performance of contract: Provision of the Femify PWA and premium features
  • Account management: Registration, login, profile management. As part of the login process, we check server-side whether an entered email address is already registered in our system. This serves solely to optimize the user experience (automatic redirection to login or registration) and is carried out on the basis of Art. 6(1)(b) GDPR (performance of contract / pre-contractual measures).
  • Fitness tracking: Storage and analysis of your training and progress data
  • Personalized training: Creation of individual training plans based on your goals
  • Connect feature: Social functions, friendships, data sharing (only with your consent)
  • Cycle tracking: Tracking of menstrual cycles (only with explicit consent)
  • AI-based training advice and movement analysis: Analysis of movement data for personalized feedback
  • AI assistant Lucy: Answering your questions about training and nutrition; with your consent, based on your own training, nutrition and body data and your saved chat history (consent only, see section 9.5)
  • Payment processing: Processing of subscription payments
  • Email delivery: Sending of transactional emails (access codes, confirmations)
  • Support: Handling of support requests
  • Nutrition tracking: Storage and analysis of your nutrition and nutrient data
  • Personalized nutrition: Calculation of individual calorie targets based on your body data and goals (TDEE calculation)
  • AI-based nutrition analysis: Recognition of foods from photos, analysis of restaurant menus and nutrition labels (temporary processing, data is deleted after max. 7 days)
  • Recipe management: Storage and import of recipes incl. nutritional value calculation
  • Shopping lists: Management of shopping lists based on recipes and foods

5. Legal Basis

The processing of your data is carried out on the following legal bases:

  • Art. 6(1)(b) GDPR (performance of contract): For all data required to provide the app and fulfill the contract (account data, workout data, weight data, etc.)
  • Art. 6(1)(a) GDPR (consent): For the Connect feature (data sharing with friends), optional cycle tracking
  • Art. 9(2)(a) GDPR (explicit consent): For cycle data (health data)
  • Art. 9(2)(a) GDPR (explicit consent): For allergy data and intolerances (health data)
  • Art. 6(1)(a) GDPR (consent): For using the AI assistant Lucy
  • Art. 9(2)(a) GDPR (explicit consent): For sharing training, nutrition and body data with Lucy and for storing your chat history with Lucy (see section 9.5)
  • Art. 9(2)(a) GDPR (explicit consent): For sharing body data and injury notes with your coach as part of the coaching feature (consent given when accepting the coaching invitation)
  • Art. 6(1)(f) GDPR (legitimate interest): For technical data (IP addresses, device information) to ensure functionality and security
  • Art. 6(1)(f) GDPR (legitimate interest): For the usage log of the AI features (section 3.2), to manage the cost of the AI features, enforce fair usage limits and detect misuse

6. Recipients of the Data (Third-Party Providers)

We use the following third-party providers to process your data:

6.1 Payment Processing

Stripe (Stripe, Inc., USA)

  • Purpose: Payment processing for premium subscriptions
  • Data: Email, payment information (not stored by us)
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: EU Standard Contractual Clauses (SCCs)
  • Privacy policy: https://stripe.com/de/privacy

PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg)

6.2 Email Delivery

Resend (Resend, Inc., USA)

  • Purpose: Sending of transactional emails (access codes, confirmations)
  • Data: Email address, email content
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: GDPR-compliant according to their privacy policy
  • Privacy policy: https://resend.com/legal/privacy-policy

6.3 Database & Hosting

Supabase (Supabase, Inc., USA)

  • Purpose: Database, authentication, backend services
  • Data: All personal data (account, profiles, workouts, etc.)
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: GDPR-compliant, EU region
  • Privacy policy: https://supabase.com/privacy

Vercel (Vercel, Inc., USA)

  • Purpose: Hosting of the PWA, edge functions
  • Data: IP addresses, technical data
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
  • Data protection: GDPR-compliant, EU region (location: Frankfurt, FRA1)
  • Privacy policy: https://vercel.com/legal/privacy-policy

6.4 CDN & Media

BunnyCDN (bunny.net)

  • Purpose: Content delivery network for videos (Flow feature)
  • Data: IP addresses (when retrieving videos)
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: GDPR-compliant, EU region
  • Privacy policy: https://bunny.net/legal/privacy/

6.5 AI Services

Microsoft Azure AI Services (Microsoft Corporation, USA)

We use various Microsoft Azure AI services to provide our app features:

AI chatbot service (AI assistant Lucy):

  • Purpose: Answering your questions about training and nutrition
  • Data: Your question, up to the last 10 messages of the current chat and basic details from your profile (first name, training goal, experience level, preferred training days and session length, available equipment, unit system); only with your consent also training, nutrition and body data (see section 9.5)
  • Legal basis: Art. 6(1)(a) GDPR (consent), for shared health data Art. 9(2)(a) GDPR
  • Data protection: Microsoft data processing agreement (DPA) in place, Data Zone Standard (EUR), EU region
  • Privacy policy: https://www.microsoft.com/licensing/docs/customeraddendum

Knowledge base service (Azure AI Search, for Lucy's answers):

  • Purpose: Searching Femify's knowledge base for relevant expert content so Lucy can give well-founded answers
  • Data: Your current question to Lucy as a search query, no training, nutrition or body data
  • Legal basis: Art. 6(1)(a) GDPR (consent to using Lucy)
  • Data protection: Microsoft data processing agreement (DPA) in place, EU region (location: Sweden, Sweden Central)
  • Privacy policy: https://www.microsoft.com/licensing/docs/customeraddendum

Movement analysis service (automated movement analysis):

  • Purpose: Analysis of movement data for personalized training feedback
  • Data: Anonymized movement data (joint angles, metrics), technical movement data for analysis
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: Microsoft data processing agreement (DPA) in place, Data Zone Standard (EUR), EU region
  • Important: Complete videos are not transmitted to external services. Only anonymized movement data and technical metadata are processed for analysis. The data is deleted after the analysis.
  • Privacy policy: https://www.microsoft.com/licensing/docs/customeraddendum

Other Azure AI services:

  • Purpose: Supporting AI functions (speech recognition, image analysis, document processing, translation, content moderation)
  • Data: Technical data, anonymized metadata
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: Microsoft data processing agreement (DPA) in place, EU region
  • Privacy policy: https://www.microsoft.com/licensing/docs/customeraddendum

6.6 Analytics & Performance

PostHog (PostHog, Inc., USA)

  • Purpose: Product analytics, error tracking, usage analysis; on www.femify.de additionally heatmaps, session recordings and click behavior to analyze and improve the landing page
  • We use two separate PostHog projects: one for the Femify PWA (app.femify.de, see Section 10.2) and a dedicated, independent project for the landing page (www.femify.de) — each configured and evaluated independently
  • Data: Anonymized/pseudonymized usage data, page views, click and scroll events; when session recording is enabled, additionally your interaction behavior on the page (input fields such as e-mail addresses are automatically masked)
  • Legal basis: on app.femify.de Art. 6(1)(f) GDPR (legitimate interest); on www.femify.de Art. 6(1)(a) GDPR (consent via the cookie banner, "Analytics" category)
  • Data protection: GDPR-compliant, EU servers (https://eu.i.posthog.com), IP anonymization enabled
  • Opt-out: In the PWA, disable at any time in the privacy settings; on www.femify.de, withdraw at any time via the cookie banner (see Section 10.6)
  • Session recording: Opt-in required (disabled by default), sensitive data is automatically masked
  • Privacy policy: https://posthog.com/privacy

Vercel Speed Insights (Vercel, Inc., USA)

  • Purpose: Performance measurement (Core Web Vitals)
  • Data: Anonymized performance metrics (LCP, FID, CLS)
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
  • Data protection: GDPR-compliant, anonymized
  • Privacy policy: https://vercel.com/legal/privacy-policy

6.7 Security & Spam Protection

Cloudflare Turnstile (Cloudflare, Inc., USA)

  • Purpose: Spam protection and bot detection during registration and login
  • Data: IP addresses (anonymized), device information
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
  • Data protection: GDPR-compliant according to their privacy policy
  • Privacy policy: https://www.cloudflare.com/privacypolicy/

6.8 Feedback & Support

Userback (Userback Pty Ltd, Australia)

  • Purpose: Feedback widget for bug reports and feature requests
  • Data: Screenshots, browser information, voluntary user comments
  • Legal basis: Art. 6(1)(a) GDPR (consent - voluntary use)
  • Data protection: GDPR-compliant according to their privacy policy
  • Privacy policy: https://www.userback.io/privacy-policy

6.9 Caching

Upstash Redis (Upstash, Inc., USA)

  • Purpose: Redis-based caching for better performance and session management
  • Data: Temporary cache data, session information
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
  • Data protection: GDPR-compliant, EU region (location: Frankfurt, FRA1)
  • Note: Provided via Vercel KV (powered by Upstash)
  • Privacy policy: https://upstash.com/privacy

6.10 Newsletter & Marketing

Klaviyo (Klaviyo, Inc., USA)

  • Purpose: Newsletter sign-up and email marketing
  • Data: Email address (only upon voluntary sign-up), location data automatically derived by Klaviyo from the IP address (city/region/country)
  • Legal basis: Art. 6(1)(a) GDPR (consent - voluntary newsletter sign-up)
  • Data protection: EU Standard Contractual Clauses (SCCs)
  • Opt-out: You can unsubscribe from the newsletter at any time (unsubscribe link in every email)
  • Privacy policy: https://www.klaviyo.com/legal/privacy

6.11 In-App Purchases (iOS)

RevenueCat (RevenueCat, Inc., USA)

  • Purpose: Management of in-app purchases and premium subscriptions via the Apple App Store (iOS app)
  • Data: Anonymized user ID, purchase history, subscription status, App Store receipt data
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: EU Standard Contractual Clauses (SCCs); data is processed on US servers
  • Note: RevenueCat is only active in the native iOS app. In the web app (app.femify.de), payment processing is handled via Stripe.
  • Privacy policy: https://www.revenuecat.com/privacy

6.12 Nutrition Data Sources

FatSecret (FatSecret Pty Ltd, Australia)

  • Purpose: Food database for nutritional information, barcode resolution and product search
  • Data: Food search queries, barcode numbers (no personal user data is transmitted to FatSecret, only search queries)
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: Data transfers in compliance with the EU Standard Contractual Clauses (SCCs)
  • Note: Only food search queries are transmitted to FatSecret. Personal user data (name, email, food diary, etc.) is not shared with FatSecret.
  • Privacy policy: https://www.fatsecret.com/privacy-policy/

Open Food Facts (Open Food Facts Association, France)

  • Purpose: Fallback food database for product and nutritional information (only used when FatSecret returns no results)
  • Data: Barcode numbers, food search queries
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)
  • Data protection: GDPR-compliant (EU/France), open-source project
  • License: The data is available under the Open Database License (ODbL)
  • Privacy policy: https://world.openfoodfacts.org/privacy

6.13 Tracking & Marketing (only www.femify.de - Landing Page/Purchase Page)

Meta Pixel (Meta Platforms Ireland Limited, Ireland)

  • Purpose: Conversion tracking and measurement of advertising effectiveness in the checkout area of the website www.femify.de
  • Data: Pages visited, device information, IP address, browser information, timestamps, referrer URL, website interactions (e.g. clicks, page views)
  • Cookies: _fbp (90 days), _fbc (90 days)
  • Additional storage on your device (localStorage, in each case only after your consent): femify_fbclid - the click identifier from the ad you came to us through (7 days); femify_meta_am - the email address or phone number you entered into one of our forms yourself, used for more accurate attribution of your visit ("advanced matching"), until withdrawal. Before you make your choice in the cookie banner, none of this is stored on your device.
  • Legal basis: Art. 6(1)(a) GDPR (consent); Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)
  • Consent: The Meta Pixel is only activated after your explicit consent via our cookie banner. Without your consent, no data is transmitted to Meta, no cookies are set and no identifiers are stored on your device.
  • Data transfers to third countries: Data may be transferred to Meta Platforms, Inc. in the USA. The transfer is based on EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
  • Withdrawal: You can withdraw your consent at any time via the cookie banner. Upon withdrawal, the cookies _fbp and _fbc as well as the identifiers stored on your device (femify_fbclid, femify_meta_am) are deleted.
  • Note: The Meta Pixel is only active on www.femify.de (landing page/purchase page), NOT in the app (app.femify.de).
  • Privacy policy: https://www.facebook.com/privacy/policy/

TikTok Pixel (TikTok Technology Limited, Ireland / ByteDance Ltd., Cayman Islands)

  • Purpose: Conversion tracking and measurement of the advertising effectiveness of TikTok campaigns on www.femify.de
  • Data: Pages visited, device information, IP address, browser information, timestamps, referrer URL, website interactions (e.g. clicks, page views)
  • Cookies: _ttp (13 months), _ttclid (session)
  • Additional storage on your device (localStorage, only after your consent): femify_ttclid - the click identifier from the TikTok ad (7 days)
  • Pixel ID: D8RS5EJC77U2JEPM5B60
  • Legal basis: Art. 6(1)(a) GDPR (consent); Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)
  • Consent: The TikTok Pixel is only activated after your explicit consent via our cookie banner. Without your consent, no data is transmitted to TikTok, no cookies are set and no identifiers are stored on your device.
  • Data transfers to third countries: Data may be transferred to ByteDance Ltd. outside the EU. The transfer is based on EU Standard Contractual Clauses (SCCs).
  • Withdrawal: You can withdraw your consent at any time via the cookie banner. Upon withdrawal, the cookies _ttp and _ttclid as well as the identifier femify_ttclid are deleted.
  • Note: The TikTok Pixel is only active on www.femify.de (landing page/purchase page), NOT in the app (app.femify.de).
  • Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

6.14 Server-Side Transmission of Purchase Events (Conversions API)

In addition to the pixels described above, which run in your browser, our own servers transmit a purchase event ("Purchase") to Meta and TikTok after a completed purchase. Meta calls this server-side interface the "Conversions API", TikTok the "Events API". It is necessary because browser-based pixels frequently fail to fire due to tracking protection, ad blockers or dropped connections, which would otherwise leave us unable to assess the effectiveness of our ads.

Meta Conversions API (Meta Platforms Ireland Limited, Ireland)

  • Purpose: Measurement of completed purchases and of the effectiveness of our ads on Facebook and Instagram
  • Data in hashed form (SHA-256): email address, phone number, first and last name, city, region, postal code, country. Please note: hashing is not anonymisation - Meta can compare these values against the corresponding values of its own user accounts and thereby attribute your purchase to a Meta account and an ad.
  • Data in plain text: purchase amount, currency, subscription product chosen, time of purchase, page visited, your IP address, your browser identifier (user agent) and the Meta identifiers fbc and fbp
  • Legal basis: Art. 6(1)(a) GDPR (consent - "Marketing" category in the cookie banner)
  • Consent: Your choice from the cookie banner is recorded when the payment process starts and evaluated server-side when the purchase completes. If there is no consent for the "Marketing" category, no event is transmitted to Meta. This does not affect your purchase or the provision of your access.
  • Avoiding double counting: The event from your browser and the event from our server carry the same event identifier, so that Meta merges both into a single purchase.
  • Data transfers to third countries: Data may be transferred to Meta Platforms, Inc. in the USA. The transfer is based on EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
  • Withdrawal: You can withdraw your consent at any time via the cookie banner. From the point of withdrawal, no further events are transmitted; events already transmitted can only be deleted at Meta itself (see Meta's privacy policy).
  • Privacy policy: https://www.facebook.com/privacy/policy/

TikTok Events API (TikTok Technology Limited, Ireland / ByteDance Ltd., Cayman Islands)

  • Purpose: Measurement of completed purchases and of the effectiveness of our TikTok campaigns
  • Data in hashed form (SHA-256): email address, phone number. Here too: hashing is not anonymisation (see above).
  • Data in plain text: purchase amount, currency, subscription product chosen, time of purchase, page visited, your IP address, your browser identifier (user agent) and the TikTok identifiers ttclid and ttp
  • Legal basis: Art. 6(1)(a) GDPR (consent - "Marketing" category in the cookie banner)
  • Consent and withdrawal: as for the Meta Conversions API - without consent for the "Marketing" category, no transmission takes place.
  • Data transfers to third countries: Data may be transferred to ByteDance Ltd. outside the EU. The transfer is based on EU Standard Contractual Clauses (SCCs).
  • Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

No uploads of customer or prospect lists: We do not upload email lists of our customers or of people who abandoned a purchase to Meta or TikTok (e.g. for "custom audiences", "customer lists" or "lookalike audiences"). Audiences for our ads are built exclusively from the events described above, which are collected with your consent.

6.15 Coaching (External Self-Employed Coaches)

If you use our coaching feature and accept a coaching invitation, your personal coach (and, where applicable, their coaching team) receives access to certain data of yours. Our coaches are external self-employed trainers who work for us exclusively under our instructions on the basis of a data processing agreement (Art. 28 GDPR).

  • Purpose: Personal 1:1 training and nutrition support
  • Data: Training and workout data, weight and body data (e.g. weight, body fat percentage, body measurements), injury and equipment notes, chat history incl. attachments, check-in responses, calendar entries, nutrition goals
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract) for contract and training data; Art. 9(2)(a) GDPR (explicit consent) for health data (body data, injury notes)
  • Consent: Before connecting with a coach, you are explicitly informed about the data access and must actively agree. Without your consent, no coaching connection is established.
  • Important: Your cycle data and allergy data are not visible to coaches by default. In the app's privacy settings you can optionally share, each individually: your current cycle phase (phase and cycle day only - never symptoms or historical data) and your allergy list. Each sharing setting is voluntary, applies only to your active coach and their team, can be revoked at any time and ends automatically when the coaching connection ends. Without sharing, access remains technically excluded.
  • Withdrawal: You can end the coaching connection at any time in the settings. This terminates the coach's data access.
  • Confidentiality: Coaches are contractually bound to confidentiality and may use your data exclusively for your support; they may not export it or share it with third parties.

7. Retention Period

We store your data only for as long as necessary for the respective purposes:

  • Account data: Until you delete your account
  • Workout data: Until you delete your account
  • Weight data: Until you delete your account
  • Cycle data: Until you withdraw your consent or delete your account
  • Connect data: Until you delete your account or deactivate the feature
  • Connect reports (UGC reports): Until processed by our support team, then max. 90 days
  • Account deletion log: 10 years (GDPR obligation to provide evidence; contains only metadata, no content data)
  • AI analyses: 90 days, then automatic deletion
  • Azure AI services data: 30 days, then automatic deletion (in accordance with Microsoft policies)
  • Chat history with Lucy: 90 days per message, then automatic deletion; earlier if you delete the history, turn off the "Chat history" setting or withdraw your AI consent
  • Questions without a result in Lucy's knowledge base: 90 days, then automatic deletion
  • Usage log of the AI features: 90 days, then automatic deletion; afterwards only daily totals per feature remain, without any reference to you
  • PostHog analytics: Until you delete your account or disable analytics
  • Session recordings: Until you delete your account or disable session recording
  • Newsletter data (Klaviyo): Until you unsubscribe from the newsletter
  • Payment data: In accordance with statutory retention obligations (10 years for invoices)
  • Nutrition data (meals, tracking): Until you delete your account
  • Nutrition goals and preferences: Until you delete your account
  • Allergy data: Until you withdraw your consent or delete your account
  • AI nutrition scans (photo tracking, restaurant, fridge): 7 days, then automatic deletion
  • Recipes and shopping lists: Until you delete your account
  • Coaching data (chat history, check-ins, notes, plans): Until you delete your account
  • Consent records (e.g. coaching data sharing, AI consent): Retained as evidence even after withdrawal (GDPR accountability obligation)
  • Food search queries: Until you delete your account
  • Meta Pixel cookies (_fbp, _fbc): 90 days (only with consent on www.femify.de)
  • TikTok Pixel cookie (_ttp): 13 months (only with consent on www.femify.de)
  • TikTok Pixel cookie (_ttclid): Session (only with consent on www.femify.de)
  • Click identifiers on your device (femify_fbclid, femify_ttclid): 7 days, then deleted automatically (only with consent on www.femify.de)
  • Advanced matching data on your device (femify_meta_am): Until you withdraw your consent (only on www.femify.de)
  • Cookie consent (femify_cookie_consent): Until withdrawal; contains your choice, the timestamp and the banner version as a record of consent
  • Purchase events transmitted to Meta/TikTok (Conversions API): Retention is governed by the respective platform's rules; we do not store the events additionally ourselves

8. Your Rights (Art. 15-22 GDPR)

You have the following rights:

  • Access (Art. 15 GDPR): You can request information about the data we store about you
  • Rectification (Art. 16 GDPR): You can request the correction of inaccurate data
  • Erasure (Art. 17 GDPR): You can request the deletion of your data. In the app, you can delete your account and all associated data yourself under Settings → Privacy → "Permanently delete account". Alternatively, contact support@femify.de.
  • Restriction (Art. 18 GDPR): You can request the restriction of processing
  • Data portability (Art. 20 GDPR): You can receive your data in a structured format
  • Objection (Art. 21 GDPR): You can object to the processing (where based on legitimate interest)
  • Withdrawal of consent (Art. 7 GDPR): You can withdraw your consent at any time

Contact for exercising your rights:

Email: support@femify.de

9. Special Categories of Personal Data (Art. 9 GDPR)

9.1 Cycle Data

Cycle data (menstrual cycles, symptoms) constitutes health data under Art. 9 GDPR and requires explicit consent.

Legal basis: Art. 9(2)(a) GDPR (explicit consent)

Consent:

  • You must explicitly consent to the processing of your cycle data
  • Consent can be withdrawn at any time
  • Without consent, no cycle data is processed

Data processed:

  • Period start and end dates
  • Optional symptoms (mood, energy, pain, sleep quality, etc.)

Storage:

  • Data is stored encrypted
  • Only you have access to your cycle data. Exception: if you use 1:1 coaching, you can optionally share your current cycle phase (phase and cycle day only - never symptoms or historical data) with your coach (see section 9.4). Without this separate consent, access remains exclusively yours.
  • Row Level Security (RLS) ensures data protection

9.2 Weight Data

Weight data may qualify as health data. We process it for the performance of the contract (fitness tracking).

Legal basis: Art. 6(1)(b) GDPR (performance of contract)

Optional: You can share weight data in Connect (only with your consent via the privacy settings).

9.3 Allergy Data

Allergies and intolerances constitute health data under Art. 9 GDPR and require explicit consent.

Legal basis: Art. 9(2)(a) GDPR (explicit consent)

Consent:

  • You must explicitly consent to the processing of your allergy data
  • Consent can be withdrawn at any time
  • Without consent, no allergy data is processed

Data processed:

  • Allergies (e.g. gluten, lactose, nuts, soy, etc.)
  • Intolerances
  • Diet type (e.g. vegan, vegetarian, etc.)

Purpose:

  • Personalization of the food search
  • Warnings about potentially incompatible foods
  • Adjustment of recipe suggestions

Storage:

  • Data is stored encrypted
  • Only you have access to your allergy data. Exception: if you use 1:1 coaching, you can optionally share your allergy list with your coach (see section 9.4). Without this separate consent, access remains exclusively yours.
  • Row Level Security (RLS) ensures data protection

9.4 Data Sharing with Coaches

As part of the coaching feature, body data (weight, body fat percentage, body measurements) and injury notes are shared with your coach. This data constitutes health data under Art. 9 GDPR and requires explicit consent.

Legal basis: Art. 9(2)(a) GDPR (explicit consent)

Consent:

  • You explicitly consent to the data sharing when accepting the coaching invitation
  • The time of your consent is documented
  • You can end the coaching connection at any time in the settings - this terminates the coach's access
  • Without consent, no coaching connection is established

Not shared automatically:

  • Cycle data and allergy data are not covered by the coaching consent given when connecting and remain visible exclusively to you by default

Optional additional sharing (each requiring separate consent):

  • Current cycle phase: In the app's privacy settings you can allow your coach to see your current cycle phase and cycle day - never your symptoms, period history or any other cycle details
  • Allergies: You can likewise share your allergy list (e.g. for nutrition planning)
  • Both sharing settings are voluntary, individually controllable and revocable at any time in the settings; upon revocation your coach immediately loses access
  • Each sharing setting applies only to your current coach (and their team) and ends automatically when the coaching connection ends - a later, different coach receives no access without new consent
  • The granting and revocation of each sharing setting is documented with a timestamp (Art. 7(1) GDPR)
  • Legal basis: Art. 9(2)(a) GDPR (explicit consent)

9.5 Data Sharing with the AI Assistant Lucy

Lucy is an AI assistant in the app. You can only use Lucy after giving your consent when you first open her. Without further consent, Lucy only knows the basic details from your profile (see section 6.5) and sees none of your training, nutrition or body data. Your messages to Lucy are sent to Microsoft Azure OpenAI to generate an answer (see section 6.5).

Consent per area (separate consent for each):

  • Training: Completed workouts, your training plan and the next scheduled session, your workout feedback without photos
  • Nutrition: Today's calories and macronutrients, the 7-day average and your water intake. Diet type and allergies only if you have also consented to the processing of your nutrition data
  • Body data: Weight and weight history, target weight and your check-in measurements, no photos
  • Chat history: Femify stores your questions and Lucy's answers for 90 days at most so you can continue a chat later. Shared training, nutrition and body data are not stored with it

Never sent to Lucy: cycle data, photos, messages with your coach and data of other users.

Consent and withdrawal:

  • On Lucy's welcome screen, "Use her full potential" grants all four areas and "General tips only, without my data" grants none. Nothing is pre-selected
  • You can switch each area on or off at any time under Settings › Privacy. From that moment, Lucy no longer receives the data of that area
  • Turning off "Chat history" and withdrawing your AI consent delete the saved chat history. You can also delete individual chats in the history list or the whole history under Settings › Privacy
  • Granting and withdrawal are documented with a timestamp (Art. 7(1) GDPR)
  • Lucy only accesses your data through your own signed-in account. Access to other users' data is technically excluded (Row Level Security)
  • Legal basis: Art. 6(1)(a) GDPR (consent), for training, nutrition and body data and the chat history Art. 9(2)(a) GDPR (explicit consent)

10. Your Privacy Settings

10.1 Connect Feature Privacy

The Connect feature allows you to share data with friends. You have full control:

  • Granular privacy settings: For each data field (weight, workouts, goals, personal records), you can define who may see it (private/friends/public)
  • Default: Most data is set to "friends only" (friends) by default. Weight data is set to "private" by default
  • Opt-in: You must actively choose "public" to make data visible to everyone
  • Changeable at any time: You can change your privacy settings at any time in the settings
  • Reporting function: You can report inappropriate content or users via the three-dot menu on profiles. Reports are reviewed by our support team and deleted after processing.
  • Blocking: You can block other users. Blocks are not visible to the blocked user.

Shared data (optional):

  • Weight data (weight history chart - can display week, month or year)
  • Workout data (last 5 completed workouts)
  • Goals & progress
  • Personal records (PRs)
  • Profile information (username, avatar, bio)

Legal basis: Art. 6(1)(a) GDPR (consent via privacy settings)

10.2 Analytics & Data Collection

PostHog Analytics:

  • You can disable analytics at any time in the privacy settings
  • Once disabled, no more analytics data is sent
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Session Recording:

  • Session recording is disabled by default
  • You can enable session recording in the privacy settings (opt-in)
  • When enabled, sensitive data (passwords, emails, etc.) is automatically masked
  • Legal basis: Art. 6(1)(a) GDPR (consent)

10.3 Email Notifications

Transactional emails (Resend):

  • You can disable transactional emails (e.g. when a movement analysis is completed) in the privacy settings
  • If disabled, you will still receive in-app notifications
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract)

10.4 Cycle Tracker

Consent:

  • The cycle tracker requires explicit consent (Art. 9 GDPR)
  • Consent can be withdrawn at any time in the privacy settings
  • Upon withdrawal, all cycle data is irrevocably deleted
  • Legal basis: Art. 9(2)(a) GDPR (explicit consent)

10.5 Nutrition Tracking

Consent:

  • The nutrition feature requires explicit consent before first use
  • The consent covers the processing of your nutrition data and, where applicable, allergy data
  • Consent can be withdrawn at any time

AI features:

  • Photo-based meal tracking, restaurant menu analysis and fridge scans use Azure OpenAI for image recognition
  • Images are processed temporarily and not stored permanently
  • The results are stored for a maximum of 7 days and then automatically deleted

Data sources:

  • Nutritional data is obtained from various sources (FatSecret, Open Food Facts, BLS) - see Section 6.12
  • Only search queries are transmitted to external services, never personal food diaries

10.6 Cookie Settings (www.femify.de)

  • On www.femify.de we use a cookie banner with three categories to manage your cookie settings: technically necessary, analytics, marketing
  • Marketing cookies (Meta Pixel, TikTok Pixel) are only activated with your explicit consent
  • Your choice regarding the "Marketing" category governs not only the cookies in your browser but also the server-side transmission of purchase events to Meta and TikTok (see section 6.14 for details). Without your consent, no transmission takes place in either case
  • Analytics cookies (PostHog) are only activated with your explicit consent. On www.femify.de we use a dedicated PostHog project, separate from the Femify PWA, to analyze heatmaps, session recordings and click behavior on the landing page and to improve it (see Section 6.6 for details). This is independent of the PostHog usage in the Femify PWA at app.femify.de (see Section 10.2), which serves its own purposes and is controlled via the in-app privacy settings
  • You can change your cookie settings at any time via the cookie banner
  • Technically necessary cookies cannot be disabled

11. Right to Object

You have the right to object to the processing of your data where it is based on Art. 6(1)(f) GDPR (legitimate interest).

Contact: support@femify.de

12. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates the GDPR.

Competent supervisory authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)

Postfach 20 04 44

40102 Düsseldorf

Website: https://www.ldi.nrw.de

13. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to adapt it to changes in the legal situation or to changes in our service. The current version of this English translation is available at any time at our Privacy Policy; the binding German version is available at www.femify.de/datenschutz.

Last updated: October 2026