Privacy Policy

HealthSync (hereinafter "HealthSync", "the app", "we", "us" or "our") is a personal health-tracking Progressive Web App offered as part of itsmarian's projects and reachable at https://healthsync.itsmarian.dev. The app combines calorie tracking (CalSync), hydration tracking (DropSync) and workout logging in a single interface.

The following Privacy Policy is intended to inform you about the types of personal data (hereinafter also referred to as "data") we process when you use HealthSync, the purposes for which we do so, and the extent of such processing. Because HealthSync handles information about your nutrition, hydration, fitness and goals, parts of the data we process may constitute data concerning health within the meaning of Art. 9 GDPR. We therefore explain these aspects in particular detail below.

The terms used herein are not gender-specific.

Last updated: 18 June 2026

Marian D. (operating under the name itsmarian)
Germany

HealthSync is a personal project of Marian and is provided as part of the itsmarian portfolio of projects.

E-mail address: support@itsmarian.dev

Legal notice / imprint: https://itsmarian.dev/imprint

The following overview summarises the types of data processed when you use HealthSync, the purposes of their processing, and the categories of data subjects concerned.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, in particular, specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transmission, and automated individual decision-making including profiling. The data protection laws of the individual German federal states may also apply.

Note on the applicability of the GDPR and the Swiss FADP: These data protection notices serve both to provide information pursuant to the Swiss Federal Act on Data Protection (FADP) and pursuant to the General Data Protection Regulation (GDPR). For this reason, please note that the terminology of the GDPR is used due to its broader geographical scope and comprehensibility.

Legal bases at a glance: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR); legal obligation (Art. 6(1)(c) GDPR); explicit consent for special categories of data, in particular health data, pursuant to Art. 9(2)(a) GDPR.

The entries you make in HealthSync - in particular food and drink logs, calorie and macro goals, hydration goals and workout sessions - may, depending on context, constitute data concerning health within the meaning of Art. 4(15) and Art. 9(1) GDPR. We process this data only in order to provide you with the core functionality of HealthSync as expressly requested by you (e.g. saving your food log so that you can see your daily intake).

Legal basis: Your explicit consent pursuant to Art. 9(2)(a) GDPR, which you grant by voluntarily registering for a HealthSync account, enabling cloud synchronisation and actively entering data into the app. Without this consent, cloud synchronisation cannot be provided.

Voluntary nature: You are never obliged to enter any health-related data. You may use HealthSync entirely locally (without an account), in which case your entries remain on your device in your browser's local storage and are not transmitted to our backend.

Withdrawal: You may withdraw your consent at any time with effect for the future by signing out, disabling cloud sync, deleting individual entries or deleting your account. The lawfulness of processing carried out prior to withdrawal remains unaffected.

No medical use: HealthSync is a personal-tracking tool. It is not a medical device, does not provide medical advice and must not be used as a substitute for professional medical consultation, diagnosis or treatment.

We implement appropriate technical and organisational measures in accordance with the applicable legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include, in particular: TLS/SSL encryption for all traffic to and from the app and its backend; access protection for the production database; row-level security (RLS) policies in our database backend so that each user can only read and modify their own data; optional Two-Factor Authentication (TOTP) for account login; storage of authentication tokens in secure HTTP cookies; and the principle of data minimisation in our database schema.

Securing online connections via TLS/SSL encryption (HTTPS): All connections between your browser and HealthSync, as well as between HealthSync and its hosting/backend providers, are protected by TLS/SSL. The presence of HTTPS in the address bar indicates that your session is encrypted.

Data processing in third countries: Where we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where such transfer occurs in the context of using third-party services, this is done exclusively in accordance with the applicable legal requirements.

Some of the services we (or you, when you opt in) use may be provided by companies based in the United States, including Vercel (hosting / CDN), Google LLC / Google Ireland Limited (Google Analytics and, where enabled by you, the Google Gemini API). For such transfers we primarily rely on the EU-US Data Privacy Framework (DPF), recognised as a secure legal framework by an adequacy decision of the European Commission dated 10 July 2023, and additionally on Standard Contractual Clauses concluded with the respective providers.

Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/.

Information on third-country transfers and applicable adequacy decisions can be obtained from the European Commission's information portal: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

We erase personal data that we process in accordance with the applicable statutory provisions as soon as the underlying consents are revoked or no further legal grounds for the processing exist.

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

To deliver HealthSync we rely on the following processors, each of which acts as a data processor under Art. 28 GDPR on the basis of a written data processing agreement.

HealthSync is offline-capable. To make this possible, the app uses your browser's localStorage to persist information such as your food and drink entries, daily goals, selected theme, onboarding state, AI opt-in flag and similar preferences directly on your device.

This local storage is not a cookie within the meaning of § 25 TDDDG / ePrivacy Directive when it is strictly necessary for the operation of the service you have requested (e.g. remembering your last entries so the app works without reload). Where local storage is used for purposes that are not strictly necessary, we will rely on the legal basis applicable to that purpose (typically your consent under Art. 6(1)(a) GDPR).

Local data never leaves your device unless you actively sign in and enable cloud synchronisation. You can clear local data at any time via your browser's site settings or by signing out.

The term "cookies" refers to functions that store and retrieve information on users' end devices. Cookies may be used for various purposes, including ensuring the functionality, security and convenience of online offerings, as well as the analysis of visitor traffic. We use cookies in accordance with the applicable legal provisions. Where required, we obtain prior consent from users.

For a full description of the cookies HealthSync uses, please refer to our Cookie Policy.

General notes on withdrawal and objection (opt-out): You may withdraw any consent you have given at any time via the cookie banner ("Change Cookie Preferences" link in the footer of every page) and via your browser settings.

Using HealthSync without an account is possible - all entries are then stored only in your browser's local storage. If you want your data to be synchronised across devices, you may voluntarily create a user account. During the registration process, we collect the data marked as mandatory (e-mail address and a password). Passwords are never stored in clear text; they are hashed by our authentication provider (Supabase Auth).

In the context of registration and login, we additionally process your IP address and the time of each authentication action on the basis of our legitimate interests in protection against misuse and other unauthorised use. This data is not disclosed to third parties unless such disclosure is necessary to pursue our claims or there is a statutory obligation to do so.

HealthSync supports optional Two-Factor Authentication via Time-based One-Time Passwords (TOTP). When you enable MFA, an authenticator secret is generated and stored encrypted by our authentication provider. During login, you provide a six-digit code from your authenticator app, which is verified server-side.

If you choose "Remember this device", your e-mail address is added to a locally stored list (mfa_trusted_emailsin your browser's localStorage) so that the MFA step is skipped on this device for future logins. You can revoke this trust at any time by clearing the app's site data or signing out.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in account security (Art. 6(1)(f) GDPR).

HealthSync offers an optional AI Detection feature inside CalSync which can analyse food photos, camera input or text descriptions and return estimated nutrition values. This feature is strictly opt-in, disabled by default, and uses your own Google Gemini API key. Without an explicit opt-in and a valid API key, no AI request is ever sent.

When you actively trigger an AI request, HealthSync sends the food-related input you provided (image bytes or text description) directly from your browser to generativelanguage.googleapis.com, authenticated with your API key. We do not proxy this traffic through our servers and do not store the request or the model response on our backend.

The processing of that request is governed by Google's terms and privacy policy applicable to the Gemini API: https://ai.google.dev/gemini-api/terms and https://policies.google.com/privacy.

Legal bases: Your explicit consent (Art. 6(1)(a) GDPR) by enabling the feature and confirming the in-app AI terms; for health-related image or text content, additionally your explicit consent under Art. 9(2)(a) GDPR.

For details on how AI is used inside HealthSync, the risks it brings and your responsibilities, please refer to our AI Guidelines.

CalSync includes a barcode scanner powered by the open-source ZXing library running entirely in your browser. The camera stream itself never leaves your device - only the decoded numeric barcode is used for product lookup.

When a barcode is scanned, HealthSync queries the public Open Food Facts database to retrieve product information (name, brand, nutrition values). This query transmits the barcode and standard request metadata (IP address, user agent) to Open Food Facts.

Service provider: Open Food Facts (non-profit association), 21 rue des Iris, 94250 Gentilly, France. Privacy policy: https://world.openfoodfacts.org/privacy. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in providing a convenient food lookup feature you have actively triggered by scanning a barcode.

HealthSync loads Google Analytics (GA4) in order to understand how the app is used in aggregated, pseudonymous form (e.g. which views are most popular, on which devices HealthSync runs). Google Analytics is initialised with Google Consent Mode v2, where all storage categories (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage) default to denied. Storage and cookie placement are activated only after you grant consent through our cookie banner.

IP addresses transmitted to Google Analytics for EU users are not logged; Google only derives approximate geographic location metadata before discarding the IP. We do not use Google Analytics for advertising purposes.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses. Opt-out plug-in: https://tools.google.com/dlpage/gaoptout.

When you contact us (e.g. by e-mail) and in the context of existing user relationships, the information provided is processed to the extent necessary to respond to your request.

HealthSync is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. If you believe that a child has provided us with personal data, please contact us so that we can erase the data.

We request that you familiarise yourself regularly with the content of our Privacy Policy. We revise the Privacy Policy as soon as changes to the data processing activities carried out by us make this necessary. We will notify you as soon as changes require an action on your part (e.g. consent) or any other form of individual notification.

Where addresses and contact details of companies and organisations are provided in this Privacy Policy, please note that such details may change over time and we recommend that you verify the information before making contact.

This section provides an overview of the terms used in this Privacy Policy. Where terms are defined by law, the statutory definitions apply. The following explanations are intended primarily to aid understanding.