TempoLife — Privacy Policy

Data Controller

The controller of your personal data is:

• Developer: TempoLife team / Probyte OÜ
• Application: TempoLife (org.tyrnpuu.medix)
• E-mail: info@tempolife.app
• Website: tempolife.app

This Privacy Policy describes how the TempoLife application collects, uses, stores and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Estonian Personal Data Protection Act.

What data we collect

2.1 Account & identity data

• Name and e-mail (at sign-up or via Google Sign-In)
• Profile photo (optional)
• Date of birth, sex, height, weight — only if you provide them voluntarily

2.2 Health data (GDPR Art. 9 — special category)

• Food diaries (calories, macros, photos)
• Steps, physical activity, workouts
• Sleep duration & stages, wake time
• Mood, stress level and well-being notes
• Body weight and fasting windows
• Heart rate (from Health Connect)

2.3 Technical data

• Device type, OS, app version (User-Agent header)
• IP address (server logs, kept max 90 days)
• Session identifier (PHP session, CSRF token)

2.4 What we do NOT collect

• Location history or background location — the optional restaurant search uses your location only while you search and does not store it (see section 2g)
• Device identifiers (IMEI, Advertising ID, MAC)
• Contacts, call logs, SMS
• Data from other apps — with one exception: if you connect Android Health Connect, we read the health data types you have explicitly permitted (see section 2a)
• Your photo gallery — the camera and picture access are used only for a food photo you take or pick yourself (see section 2b)

Android Health Connect

On Android, TempoLife can read health and fitness data from Health Connect, the data store built into Android. This is entirely optional. Nothing is read until you connect Health Connect inside the app and grant permission for each data type separately on Android’s own permission screen.

What we read

• Steps — daily step counts
• Sleep — sleep sessions and sleep stages (deep, light, REM, awake)
• Heart rate — heart-rate samples
• Resting heart rate — provider-computed resting-heart-rate measurements
• Heart-rate variability (HRV, RMSSD) — a millisecond value used for recovery trends
• Workout sessions — workout type, start, end and duration
• Body weight — weight measurements

We request read access only. TempoLife does not write anything back into Health Connect.

Why the app needs it

These data types power the app’s core screens: step and activity totals, sleep insights, the weight trend, and a dedicated Heart screen with the latest reading, a personal 28-day resting-heart-rate baseline, activity/sleep/fasting/meditation/mood context, workout zones and heart-rate recovery, plus a non-medical recovery overview based on resting heart rate, HRV, sleep and recent training load. Without Health Connect, this data cannot be filled automatically.

Where the data comes from

Health Connect is a store on your own device that other apps and devices write into — for example Samsung Health or Garmin. TempoLife reads what is already in Health Connect. It does not connect to those services directly and cannot see anything beyond the data types you have permitted. Health Connect itself runs on your device; connecting it does not send your data to Google.

How much history

If you separately grant history access, TempoLife may read up to the last 12 months of steps, sleep and body-weight data. The Heart module reads up to 35 days of resting heart rate and HRV for its baseline and up to 30 days of workout sessions. Without history access, Health Connect limits historical reads to roughly 30 days. Because wearables can generate thousands of samples, the general heart-rate import is capped to the most recent 7 days; denser samples are retained around recent workouts to calculate zones and 1/2-minute heart-rate recovery. Later syncs read only new or changed records with a short overlap.

Where it is stored

Data read from Health Connect is transmitted over HTTPS/TLS and stored in your own TempoLife account on our servers in Estonia (EU), exactly like data you enter by hand. It is visible only to you.

What we never do with it

• Health Connect data is never used for advertising or marketing, for personalised or interest-based advertising, or to build advertising audiences.
• It is never shared with advertising networks, advertising platforms, data brokers or information resellers.
• It is never sold, to anyone, for any purpose.
• It is never included in an analytics or advertising event sent from the app.
• It is not passed to any third party for that third party’s own purposes.

Withdrawing access

• In the app: disconnect Health Connect in the app settings. TempoLife then stops reading new data.
• On your device: Android Settings → Health Connect → App permissions → TempoLife, where you can remove individual data types or all access at once. Health Connect also keeps its own log of which apps have read your data.

Revoking access stops all future reads. Data that has already been synced stays in your TempoLife account so that your history is not silently lost — you can export it at any time (section 8), and it is permanently deleted when you delete your account (section 8a).

Camera and food photos

TempoLife asks for camera access for a single purpose: photographing a meal so that it can be recognised automatically instead of typed in by hand. You can also choose an existing picture instead of taking one. The permission is requested only when you first use the feature, and the app never takes pictures in the background.

The photo leaves your device

Food recognition does not happen on your phone. When you confirm, the photo is sent over HTTPS to a third-party AI vision service — Google (Gemini) as the primary provider, with Anthropic (Claude AI) as the fallback — which returns the identified foods and their estimated nutritional values. This is a transfer of your data to a third party outside the app, and it happens only after you have explicitly agreed in the in-app dialog. If you do not agree, no photo is ever sent and you can still log food manually.

What happens to the photo

• EXIF and GPS metadata are stripped from the image before it is sent.
• The photo is sent only at the moment of the request and is deleted from the provider’s servers afterwards under our agreements with them (see section 4).
• For ordinary AI processing, only the resulting food entry and nutrition values are saved. A separately consented public-archive copy is the exception described in section 2e.
• Food photos are never used for advertising and are never sold.

Anonymous-preview consent and abuse safeguards

For the no-account preview, we retain for no more than 2 days only a secret-keyed, day-scoped pseudonymous network subject, the consent version, and the event time. This record contains no photo, AI result, food entry, advertising identifier, or account and is never joined to marketing analytics. The consent-proof basis is your per-use consent and our duty to demonstrate it (GDPR Art. 6(1)(a) and Art. 7); the short request limit relies on our legitimate interest in preventing service abuse and disproportionate AI cost (Art. 6(1)(f)).

Because the preview has no account, this record cannot be attached to an account export or reliably used by us to identify a person. It is deleted automatically within 2 days. To exercise a right or object, contact the address in section 12; we will explain this practical limitation and honor a verifiable request as far as possible.

You can revoke camera access at any time in Android Settings → Apps → TempoLife → Permissions. The rest of the app keeps working normally.

Community and Tempo Feed

Community is optional. If you do not use it, none of your data is shared with other users.

What other people can see

• Profile: your display name, chosen emoji, level and points.
• Leaderboard: name, level and point total. You can hide yourself from it (Community → Privacy).
• Challenges: your participation and progress in challenges you join.
• Messages: whatever you choose to send. Messages can only be exchanged between friends.
• Feed: posts, stories, photos, polls, comments, reactions and follow relationships you create. You choose an audience for each post or story.

Nothing from your health logs is shared automatically. If you separately enable an activity category in Feed settings, followers may see a limited summary such as a step total, number of meals logged, sleep or fasting duration, an achievement, or that a weight check-in occurred. Exact weight, diary rows, notes, routes, mood, heart rate and other Health Connect data are not shown.

Reporting and blocking

Every user profile has Block and Report. Blocking stops interaction in both directions. When you report something we store who reported it, a reference to the reported content and your reason, so we can review it and remove content or suspend accounts where necessary.

Retention

Messages, feed posts and other community content are kept until you delete the content or your account. Stories expire after 24 hours; unattached feed photos are normally removed within two hours. Deleting your account removes your community profile, messages, media and community records as described in “Data deletion”.

Daily Plan Challenge (€100 campaign)

The Points Challenge is optional. If you do not join, none of your data is processed for the campaign.

What data the campaign uses

• Scoring data: the meal schedule frozen when you join, meal-plan completion, and each verified action’s type and timestamp. Food calories, weight, step quantity and sleep duration do not increase the score.
• Leaderboard data: your display name, point total, meal-adherence points, verified-action count and active days. Hiding yourself from the leaderboard (Community → Privacy) also applies to the campaign.
• If you win: your contact details (e-mail) for paying out the prize.

The campaign collects no new data — it only uses data you already log in the App — and does not share it with third parties or advertising networks.

Legal basis and retention

Campaign data is processed on the basis of your consent (joining) and performance of the campaign rules (contract). Campaign records are kept until you delete your account; payout-related data is retained for the period required by accounting law. In the hall of fame we keep only your display name and a summary result.

Optional public sharing, aggregates and public tools

Public meal card, gallery, photo-of-the-day and giveaway

Ordinary AI food photos are not stored on TempoLife servers. Only after a separate public web archive opt-in does the server create a metadata-stripped JPEG copy and public share card. Public fields can include the photo, food name, your caption, card content and share token; anonymous view and guess counters are not published as engagement metrics. The copy can appear in the gallery, search-indexed structured data and the photo-of-the-day rotation. The card expires after at most 90 days; an automated cleanup removes expired and orphaned files, although an operational failure can delay physical deletion until the next successful cleanup. A photo-of-the-day artifact is valid for at most 36 hours.

Entering that ISO week’s giveaway and displaying a winner name are additional choices tied to the exact approved rules version, material-terms hash and draw commitment for that round. Entry is unavailable until a one-time draw-secret hash has been published before opening. The eligibility check reads the account birthday, country and role to enforce the published minimum age, country list and staff exclusion; those profile fields are not put in the draw artifact. After close, the public audit publishes the secret reveal, a sorted list of pseudonymous entry keys derived from that week and public-card tokens, the list digest and winning key; it does not publish account IDs or the source tokens themselves. Consent does not roll into another week or changed terms. You can remove one item or all items at Public archive settings. Withdrawal immediately suppresses TempoLife publication and attempts to delete the JPEG and public fields; a revocation tombstone remains up to 100 days so TempoLife artifacts cannot republish it. Browsers, proxies, search engines or other recipients may retain a copy they cached while it was public. Account deletion immediately removes TempoLife public cards and copies.

Public aggregates

Regional and activity aggregates have separate settings. They publish only with at least 20 opted-in accounts, use completed or delayed periods and rounded buckets. The regional table omits points and streaks. Names, account identifiers, individual meals and health records never enter public aggregate output. Withdrawal excludes the account from the next calculation.

Estimate-to-label comparison

A voluntary pair contains an editable calorie estimate, same-serving package-label value, optional note and attestation/consent times. The public result covers only the previous completed month: one pair per contributor, at least 100 contributors, counts rounded down to 25 and metrics to whole units. Individual pairs are not published. One-click withdrawal immediately erases the note and calorie values, leaving only a revocation audit marker until account deletion.

Firefox extension and food search

The extension sends only the typed search term or selected food identifier to TempoLife’s food API. It sends no visited pages, page content, cookies or TempoLife account. Firefox stores up to five recent food names locally. TempoLife security logs may receive the search term, IP address, user agent and request time for no more than 90 days.

WordPress badge and Google Play reviews

The WordPress plugin requests only /counter.php?format=json. TempoLife receives the WordPress server IP, plugin user agent and request time (security logs, up to 90 days), but no visitor cookie, visitor IP or page URL. The reviews page may republish public review text, after contact details are scrubbed, plus its rating and Play link from the official Google Play Android Publisher API; the author name is omitted and snapshots older than 72 hours are not shown.

Telegram portion calculator

In an ordinary browser the calculator does not contact Telegram. When launched with Telegram Mini App parameters it loads Telegram’s SDK from telegram.org, which gives Telegram normal request metadata (including IP and user agent) and lets its JavaScript run on that calculator page. TempoLife does not read Telegram identity or init-data fields in this tool.

Optional publication relies on consent (GDPR Art. 6(1)(a)); security and operational logs rely on legitimate interests in protecting the service (Art. 6(1)(f)). Your portability export includes your share cards, remaining public JPEGs, comparison pairs and revocation records.

Quick-setup variant

A new account may be assigned to a quick-setup or standard-setup variant. We store only the account link, variant, a deterministic pseudorandom bucket derived from the account, and assignment time so the same person receives a consistent experience throughout setup. We do not create separate view, click, meal, photo, health, advertising or campaign events for this test; its result is assessed only from aggregate completion of the existing profile setup.

The record is not sent to Google Analytics or any other third party and is not used for advertising. The legal basis is our legitimate interest in reducing unnecessary setup friction through a minimal, privacy-preserving test (GDPR Art. 6(1)(f)); we document the balancing assessment before activation. You may object on grounds relating to your situation using the contact in section 12. An unfinished-setup assignment is deleted after 30 days and a completed-setup assignment after 90 days; it is removed immediately when an account-erasure request is processed and is included in the user’s data export until deletion.

Location (optional)

Location is optional and off until you turn it on. TempoLife asks for it only when you tap Use my location under the restaurant results of the food search — never when you open the app, and never in the background.

What it is used for

To show the restaurant menus that fit where you are: the menu of the country you are in (for example McDonald’s Estonia rather than the UK menu), with restaurants near you listed first.

What happens to your location

• Your device rounds the position to about 100 metres and sends it over HTTPS to our server only while you search.
• Our server uses it for that search and does not store it — not in your account, not in your diary, not in our logs.
• To learn which restaurants are nearby, our server asks the public OpenStreetMap service (Overpass API, run by FOSSGIS e.V., Germany) for the places in the surrounding map square of about 1 km, plus a margin. Only that map square is sent, from our server’s own address, with nothing that identifies you or your exact position.
• The list of restaurants in that map square is map data, not data about you. We keep it for up to 14 days so the next search is fast, and delete it once no one has searched there for 60 days.
• Your device remembers only whether you turned the feature on or off.

Turning it off

Tap Turn off under the restaurant results, or remove the permission in Android Settings → Apps → TempoLife → Permissions (in a browser: the site settings). Food search keeps working and uses your account’s country instead.

The legal basis is your consent (GDPR Art. 6(1)(a)), which you give by turning the feature on and allowing the permission, and which you can withdraw at any time as described above. Map data © OpenStreetMap contributors (ODbL).

How we use the data (purpose and legal basis)

Food search: when you search for a food we store the text you typed (up to 120 characters), the language the app was in, how many results came from our own food reference database and how many from the packaged-product database, and whether you saved a food within the following 15 minutes. It has one purpose: finding the searches that come back empty so we can fix them. The record is linked to your account, is not sent to Google Analytics or any other third party, and is never used for advertising or profiling. The legal basis is our legitimate interest in a food search that actually finds food (GDPR Art. 6(1)(f)); you may object on grounds relating to your situation using the contact in section 12. Records are deleted automatically after 90 days, are removed immediately when an account-erasure request is processed, and are included in the user’s data export until deletion.

TempoLife never uses your data for advertising, profiling, or sale to third parties. This applies in particular to health and fitness data read from Android Health Connect, which is never used for advertising, never shared with advertising networks or data brokers, and never sold.

Not a medical device

TempoLife is a general wellness and lifestyle app. It is not a medical device and is not intended to diagnose, treat, cure or prevent any disease or medical condition.

Everything the app shows — trends, scores, AI-generated summaries and coaching suggestions, and any figure read from Health Connect or a connected tracker — is provided for general information and self-tracking only. It is not medical advice and must not be relied on for diagnosis or treatment, or for starting, stopping or changing any medication or therapy.

Values such as calorie and nutrient estimates from photo recognition, sleep stages, and heart-rate readings come from consumer sensors and automated models and can be inaccurate. Always consult a qualified healthcare professional for medical advice, diagnosis or treatment. In an emergency call your local emergency number (112 in the EU) — do not rely on this app.

Third-party processors

Your data may only be processed by the following service providers, with whom we have signed Data Processing Agreements (DPA):

Food photos are sent to Google Gemini AI (or, as a fallback, Anthropic Claude AI) only for the request and are deleted from the provider afterwards. Photos selected through the ordinary in-app AI flow are not stored on our servers. The exceptions are the separately consented public-archive JPEG in section 2e and a metadata-free temporary JPEG created by the optional PWA share feature: the latter is held only for handoff, is not sent to AI automatically, and is deleted in under 10 minutes or immediately after its one-time retrieval. EXIF/GPS metadata is stripped.

Data read from Android Health Connect (steps, sleep, body weight, heart rate, resting heart rate, HRV and workouts) is stored in your TempoLife account on our own servers in Estonia. It is never shared with advertising networks, advertising platforms, data brokers or information resellers, and never sold. If you use the optional AI features — for example the AI coach or a trend summary — the figures needed to answer that specific request may be sent to the AI provider listed above for that request only, on the basis of your consent. They are never transferred for the provider’s own purposes and never for advertising.

International data transfers

Some services (Google Gemini, Anthropic Claude, ElevenLabs) are based in the United States. Data is transferred only under Standard Contractual Clauses (SCC) approved by the European Commission, the EU-US Data Privacy Framework, or other GDPR Chapter V safeguards.

By clicking “I agree” in the AI service dialog you give specific explicit consent to such transfer (GDPR Art. 49(1)(a)).

Data retention

Your data is kept only as long as necessary to provide the service:

• Active account: account data is kept until deletion unless this policy gives a shorter period
• Account deletion (GDPR Art. 17): personal data is anonymised immediately; related logs are fully deleted within 30 days
• Server logs (IP, UA): max 90 days
• E-mail verification codes: 15 minutes or until used
• Magic-link credentials: the link lasts 15 minutes; the row containing the e-mail address and token hash is deleted on use, replacement, or within one minute after expiry
• Temporary food photo shared through the PWA: under 10 minutes or until its one-time retrieval, whichever comes first
• Anthropic AI requests: 30 days on Anthropic’s servers, then auto-deleted (per Anthropic DPA)
• Location (optional restaurant search): not stored — used only during the search; the list of restaurants per map square of about 1 km is kept up to 14 days and contains no user data (see section 2g)

Security

TempoLife applies technical and organisational measures to protect your data (GDPR Art. 32):

• All traffic over HTTPS/TLS 1.2+
• Passwords stored as bcrypt hashes — plain text never stored
• CSRF token protection on all mutating requests
• Content Security Policy (CSP), HSTS, X-Frame-Options: DENY
• Android: only official Play Store build, keystore SHA-256 signed
• Database (PostgreSQL) hosted in the EU (Estonia); backups encrypted
• Android device cloud-backup DISABLED (android:allowBackup="false")

Your rights

Under the GDPR you have the following rights, which you can exercise directly from the app (Profile → Privacy) or by writing to info@tempolife.app:

• Right of access (Art. 15) — you can see all your data in the app
• Right to rectification (Art. 16) — edit profile fields at any time
• Right to erasure (Art. 17) — email info@tempolife.app
• Right to restriction (Art. 18)
• Right to data portability (Art. 20) — the “Download my data” button returns a ZIP with JSON dumps
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7) — disable an integration or aggregate setting, or remove a public card/comparison pair; account deletion is not required
• Right to lodge a complaint — Estonian Data Protection Inspectorate: www.aki.ee

How to delete your account

TempoLife honours GDPR Article 17 (right to erasure). To delete your account, email info@tempolife.app from the address linked to your account. We will delete the account within 30 days.

What happens to your data

• Once processed: your email, name, profile photo and all personally-identifiable markers are anonymised in the database (e.g. deleted_12345_1714@deleted.tempolife). Your session is terminated. You can no longer log in.
• Within 30 days: all your personal health data (steps, sleep, mood, fasting sessions, food logs, etc.), together with any legacy records from removed features, is permanently deleted.
• After 30 days: nothing identifiable about you remains, except anonymised aggregate statistics and legally required audit logs (IP and email stripped after 30 days).

Cookies and local storage

TempoLife uses only storage required to run the service by default. Advertising and analytics measurement covers Google Analytics 4 (anonymous page views and product-funnel events), Google Ads click and campaign identifiers retained for up to 90 days, and a pre-signup app open measured with a random pseudonymous identifier. It is on by default on the basis of our legitimate interest in measuring which campaigns lead to sign-ups, and you can switch it off at any time in Measurement preferences, after which the identifiers above are removed. The app-open record (platform, limited user agent, first/last open and count) is deleted no later than 90 days after its last open. Advertising personalisation always remains disabled. You can change this choice at any time in Measurement preferences.

• PHPSESSID — session identifier (HttpOnly, Secure, SameSite=Lax)
• tempolife_ad_consent + tempolife_ad_consent_uid — your measurement choice and account binding, preventing a choice from transferring to another account on a shared device
• Google Ads click, UTM and measurement identifiers (_gcl_* / _ga*) — only while measurement is on, for up to 90 days; used to attribute an account signup and removed when you switch measurement off
• tl_device (up to 365 days) and tl_dseen (30 minutes) — only while measurement is on, for pseudonymous pre-signup app-open measurement; removed after account linkage or when you switch measurement off
• Google Analytics 4 — anonymous page views and product-funnel events, on by default (advertising personalisation off)
• Restohind page views — cookieless counts of pages opened on restohind.tempolife.app, measured with self-hosted Umami (page address, referrer, browser, country). No cookie and no advertising identifier.
• Signed-in usage telemetry — session length and screens visited for signed-in (non-guest) accounts, to operate and improve the product; first-party, 90 days, never sent to Google Analytics
• localStorage — theme, language, consent flags
• Service Worker — offline support and cache

Children’s privacy

TempoLife is intended for users aged 16 and above. Users under 16 may not create an account without parental/guardian consent. If we learn that we have collected data from a user under 16 without proper consent, we delete it immediately.

Changes to this policy

If the Privacy Policy is materially changed, we will notify you in the app (banner or e-mail) at least 14 days before the changes take effect. Continued use after the change means you accept it.

Prior versions are archived on GitHub.

Contact

• E-mail: info@tempolife.app
• Website: tempolife.app

Supervisory authority: Estonian Data Protection Inspectorate — www.aki.ee