Privacy policy
Your health data belongs to you. This policy states clearly which data we collect — and which we don't.
Translation for guidance — the German version is legally binding.
Controller
Sven Grabowski (TagoHealth)
Pletschmühlenweg 62
50259 Pulheim · Germany
Email: sven@jointago.app
Under § 38 BDSG (German Federal Data Protection Act) a data protection officer isn't required (sole trader below the threshold). For privacy questions you can reach the controller directly at the address above.
1. What we collect
2. What we do NOT collect
No location. No contacts. No advertising IDs, no ad tracking, no selling of data. Usage statistics only with your explicit consent (see above).
3. Third parties
Open Food Facts
For product data we send barcodes and search terms to openfoodfacts.org. A non-profit project.
Google Gemini
For AI photo recognition, your image is sent to Gemini. Encrypted, not stored permanently. You're asked before first use. Servers in the USA — Art. 49(1)(a) GDPR.
PostHog (usage statistics)
Only with the “Improve analysis” consent enabled: pseudonymous usage events to PostHog (PostHog EU, hosting in Frankfurt — data processing under Art. 28 GDPR, no transfer to the USA). Withdraw at any time in the settings — after that nothing more is collected.
Apple Health
Optional. Two-way exchange of steps, activities, weight. Only with Apple's separate permission prompt.
Sign in with Apple (iOS)
On iOS you sign in with your Apple ID. Apple sends us a signed token with a stable user ID and — only on first login — optionally your name and email. If you choose “Hide My Email”, we receive an Apple relay address; your real email stays with Apple. We don't store any Apple passwords and only request the minimum necessary scopes.
Google Sign-In (Android)
On Android you can sign in with your Google account. Google sends us your profile (name, email) for authentication. Google Sign-In isn't offered on iOS — there, sign-in works only via Sign in with Apple or email.
Apple IAP · Google Play Billing · RevenueCat
For the Pro subscription we use Apple In-App Purchase (iOS) or Google Play Billing (Android). Payment is handled entirely by Apple or Google — we don't see any payment data. To manage subscriptions we use RevenueCat Inc. (USA); a data processing agreement under Art. 28 GDPR is in place, and transfers are safeguarded by EU Standard Contractual Clauses.
Resend (email delivery)
For magic links, email verification and system emails we use Resend.com. Your email address and the email content are transferred. Server location EU, data processing agreement under Art. 28 GDPR in place.
Expo Push Notifications
For push notifications we use the Expo push service. An anonymous push token is sent to Apple or Google and Expo. The token can't be linked to your identity. You can turn off notifications at any time in the settings.
4. Storage
Primarily stored locally in an SQLite database on your device — the app works offline. With an account, additionally on our server in Germany (HTTPS-encrypted). Passwords are stored as bcrypt hashes; auth tokens are kept in the iOS Keychain or Android Keystore.
Even without an account, a record with the random device ID is created on first launch so your usage quota stays consistent across devices. If you register later, this anonymous record is “promoted” to your account — no second user record is created.
5. Your rights
The competent supervisory authority for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.
6. Data security
Local data is protected by the operating system. Auth tokens are stored in the iOS Keychain / Android Keystore. Server communication is TLS-encrypted, passwords are bcrypt-hashed (12 rounds). Chat messages and comments between users are additionally encrypted at rest with AES-256-GCM.
7. Retention & deletion
Your data is stored for as long as you use the app. Specific periods:
• Diary, symptoms, goals: until the account is deleted
• Anonymised daily patterns (with consent): within 30 days of withdrawal
• Usage statistics (with consent): collection stops immediately on withdrawal; stored events are pseudonymous
• Push tokens: on uninstall or logout
• Magic links: 10 minutes · email verification tokens: 24 hours
• Internal AI cost logs: 90 days, aggregated afterwards
8. Legal bases at a glance
• Account data (email, name, profile): Art. 6(1)(b) GDPR (performance of contract)
• Diary, nutrition values, weight: Art. 6(1)(b) GDPR (core function of the app)
• Symptoms (health data): Art. 9(2)(a) GDPR (explicit consent)
• Anonymised sharing for model training: Art. 6(1)(a) GDPR (consent, revocable)
• Push notifications: Art. 6(1)(a) GDPR
• AI image analysis (Gemini): Art. 6(1)(a) + Art. 49(1)(a) GDPR (consent to third-country transfer)
9. Automated decisions
The app calculates statistical correlations between ingredients and symptoms and suggests possible triggers (AI analysis report). These are expressly hints, not automated individual decisions within the meaning of Art. 22 GDPR. No legal or similarly significant effects are triggered automatically. You decide yourself whether and how you follow the recommendations. The app doesn't replace medical advice.