Privacy Policy

This website (rootinez.com)

The website is delivered from servers of Hetzner Online GmbH in Germany. Accessing it creates server logs (IP address, time, requested page, browser), which we keep for security and troubleshooting for no more than 14 days (Art. 6 (1) (f) GDPR).

The website does not set any cookies, does not embed content or fonts from third parties and does not use any analytics or tracking services. As long as the preview access is active, your browser remembers for the duration of the session that you have entered the password (session storage, § 25 (2) No. 2 TDDDG).

If you send us an email, we process your details in order to answer your enquiry (Art. 6 (1) (b) or (f) GDPR).

The controller is the same as for the app (section 1 below). The privacy policy of the Rootinez app follows.

1. Controller

The controller responsible for processing your data in the Rootinez app (web version and apps for iOS and Android) is: Crytech Berlin UG (haftungsbeschränkt) c/o TUECHTIG, Haus 06, Aufgang D, Etage 1 Oudenarder Str. 16 13347 Berlin Germany Phone: +49 30 28851150 Email: eichhorn@crytech.berlin

We are not obliged to appoint a data protection officer. Please send any questions about data protection to the email address above.

2. Summary

Rootinez helps you log foods, keep track of your micronutrients and plan dietary supplements. Everything you enter — including health data — is stored by the app on your device or in your browser only. We do not receive this data.

Only if you voluntarily create an account and expressly consent do we store a copy of your data in your account. AI features are only available with an account and a separate consent. We do not sell data, do not show third-party advertising and do not use any tracking or analytics services.

3. Use without an account: storage on your device

Without an account, what you enter stays on your device: your profile (e.g. date of birth, biological sex, country, diet, goals, answers from the initial survey), logged foods and meals, active nutrients, intake times and intakes, your own foods and recipes, blood values and settings such as language and reminders. In the apps it is kept in the app's storage, in the web version in your browser's local storage.

We have no access to this data and do not process it. Storing it on your device is strictly necessary for operation (§ 25 (2) No. 2 TDDDG). We do not set any cookies for advertising or analytics purposes.

You can save a backup as a file and load it again; you alone decide what happens to that file. Whether your device includes the app data in its own backup (for example with Apple or Google) depends on your device settings. You remove the data from your device with "Delete all data on this device" in the settings, by deleting the app or by clearing your browser's site data.

4. Food and nutrient data, barcode scan

The app retrieves foods, nutritional values, nutrients, recipes and products from our databases at the provider Supabase Inc. (970 Toa Payoh North #07-04, Singapore 318992); the servers are located in Ireland and in the United Kingdom (London), for which an adequacy decision of the EU Commission exists. Only your search terms and, for technical reasons, your IP address are transmitted — not linked to any account and without health data (Art. 6 (1) (b) and (f) GDPR).

If you scan a barcode and the product is not in our database, the app queries the open product database Open Food Facts (Open Food Facts, France). Only the barcode number and, for technical reasons, your IP address are transmitted.

The web version of the app is delivered from servers of Hetzner Online GmbH in Germany. This creates server logs (IP address, time, requested file, browser), which we keep for security and troubleshooting for no more than 14 days (Art. 6 (1) (f) GDPR).

5. Optional account

You only need an account if you want to take your data to other devices, keep it permanently in the web version or use AI features. For the account we process your email address, your password (stored only as an encrypted hash), technical login data (session key, time of login) and your chosen language. The legal basis is Art. 6 (1) (b) GDPR.

With your explicit consent (Art. 9 (2) (a) GDPR), which you give when creating the account or signing in, we store a copy of your device data from section 3 — including health data — in your account and keep it up to date while you are signed in. We use this copy exclusively to make it available to you on your devices; there is no analysis and no automated decision-making within the meaning of Art. 22 GDPR.

The copy is stored at Supabase (see section 4) on servers in the United Kingdom; we have a data processing agreement with Supabase (Art. 28 GDPR). The connection is encrypted, and the database only releases each copy to its own account.

You can withdraw your consent at any time with effect for the future: with "Delete copy in my account" in the settings (your account remains) or by deleting the account. In both cases the data on your device is kept.

6. AI features

Recognising a meal from a photo and reading ingredient lists use artificial intelligence. They are only available with an account, so that we can secure and limit the calls, and only after you have given separate consent.

The photo or the text of the ingredient list is transmitted via our server to OpenAI (OpenAI Ireland Ltd., Ireland; processing also by OpenAI, L.L.C., USA) — without your name or email address. Under its contractual terms, the provider does not use data from its programming interface to train its models and stores it only temporarily, at most, to detect misuse. For the USA, the transfer is based on the adequacy decision on the EU-US Data Privacy Framework or on standard contractual clauses. To limit usage, we store the time, the feature and your account for each call.

The legal basis is your consent (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR). You can withdraw it at any time in the settings; the app remains fully usable without AI features.

7. Reminders

The app schedules reminders for your intakes on your device. For this it asks for permission to show notifications; nothing is transmitted to us or to a notification service. You can switch off notifications at any time in your device settings.

8. Paid features

If the app offers paid features, purchases in the apps are made via Apple's App Store or Google Play; these providers process the payment data themselves. To manage your subscription we use RevenueCat (RevenueCat, Inc., USA), which receives a pseudonymous user ID and the purchase status from us. In the web version, a purchase requires an account; payment is made via Stripe (Stripe Payments Europe, Ltd., Ireland). The legal basis is Art. 6 (1) (b) GDPR; we keep invoice and accounting data for up to ten years due to legal obligations (Art. 6 (1) (c) GDPR).

9. Product links

For some products we link to the websites of manufacturers or retailers. If you open such a link, their privacy policies apply there. We count how often product links are tapped without linking the count to any person.

10. Retention and deletion

Data on your device stays there until you delete it (see section 3). We store account data for as long as your account exists, and the copy of your device data until you delete it or otherwise withdraw your consent. If you delete your account in the settings, we delete the account, the copy and the usage logs of the AI features unless there is a legal obligation to retain them. Backups of our database are overwritten within 30 days.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7 (3)). With an account, you can export the data in your account in the settings; you back up the data on your device yourself as a file.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

12. Health data of users in the USA

For users in the USA, in particular under the Washington My Health My Data Act and comparable laws of individual states: we only collect consumer health data if you create an account and expressly consent (section 5) or use an AI feature after giving separate consent (section 6). It consists of the categories listed in section 3. We use it only to provide you with the copy on your devices or the AI analysis.

We do not sell this data and only share it with the processors named above (Supabase and, when you use AI features, OpenAI). You can request access, delete the data and withdraw your consent — in the app settings or by email to the address in section 1. We will not discriminate against you for exercising these rights. Details are set out in our Consumer Health Data Privacy Policy.

13. Changes

We adapt this privacy policy when the app or the legal situation changes. The version published in the app applies.