Privacy Policy

This privacy policy is applicable to the EiyoHub app for mobile devices, together with any related services operated by Cristian (collectively, the "Application"). Cristian is hereinafter referred to as the "Service Provider".

Data Controller Information

Cristian acts as the Data Controller responsible for the processing of your personal data.

• Name: Cristian
• Address: Iasi, Romania
• Email: support@eiyohub.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

The Application and related services acquire the information you supply when you download, access, or register for the service. Registration with the Service Provider is not mandatory. However, you might not be able to use some of the features offered by the service unless you register.

When you create an account, the Application collects your name, email address, and optionally your phone number. To personalize your nutrition and fitness experience, the Application also collects health and fitness information, including your gender, birthday, height, weight, body fat percentage, weight and fitness goals, workout logs (exercises, sets, reps, weights lifted), and nutrition/food logs. This information is used solely to calculate personalized calorie and macronutrient targets, track your progress, and provide the core functionality of the Application.

The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

• Contract performance: processing necessary to provide the Application or fulfil a contract with you.
• Consent: where you have given explicit consent to processing, including for marketing, analytics, or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
• Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality, provided those interests are not overridden by your data protection rights or fundamental freedoms.
• Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use cookies, SDKs, or similar technologies to support functionality and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential tracking technologies.

What information does the Application collect automatically?

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, and information about the way you use the Application.

Does the Application collect precise real time location information of the device?

This Application does not gather precise information about the location of your mobile device.

Does the Application use Artificial Intelligence (AI) technologies?

The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.

Do third parties see and/or have access to information obtained by the Application?

The Application uses the following third-party services to provide its core functionality. Each of these services may process personal data on the Service Provider's behalf, and each has its own Privacy Policy governing how it handles data:

• Supabase — used to authenticate users and securely store account and application data (profile information, workout logs, nutrition logs).
• Google Sign-In / Google Play Services — used to offer an optional sign-in method using your Google account.
• Resend — used to deliver transactional emails (email verification codes, password reset emails). Resend processes your email address solely for this purpose.
• Third-party food and exercise database providers — the Application uses external database providers to power food and exercise search features. Only your search query (e.g. the name of a food or exercise you search for) is transmitted to these services; no account information, email address, or other personal data is shared with them.

The Service Provider may share your information with third parties in the ways described in this privacy statement. Only aggregated, anonymized data, if any, is transmitted to external services to aid the Service Provider in improving the Application.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V, including:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

The Service Provider may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted service providers listed above, who work on the Service Provider's behalf, do not have an independent use of the information disclosed to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR.

What are my opt-out rights?

You can delete your account and all associated data directly within the Application, via Settings → Account → Delete Account. This will permanently and irreversibly delete your account, profile, workout history, and nutrition logs from the Service Provider's systems.

Alternatively, you can stop further collection of information from your mobile device by uninstalling the Application — though uninstalling alone does not delete information already stored with the Service Provider; use the in-app Delete Account feature, or contact the Service Provider, to request deletion of that data.

To request deletion of your personal data, withdraw consent, or exercise any of your rights, you may also contact the Service Provider at support@eiyohub.com.

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data based on its necessity for the stated purposes:

• User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law, or until you delete your account, whichever comes first.
• Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance or security purposes.
• Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you.
• Data required for legal compliance: Retained as long as required by applicable law.

You have the right to request deletion of your personal data at any time, except where retention is required by law, using the in-app Delete Account feature or by contacting support@eiyohub.com. Please note that some User Provided Data may be required in order for the Application to function properly.

How does the Application address children's privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (support@eiyohub.com) so that they will be able to take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. Access to your account is protected by authentication, and data is stored using Supabase's infrastructure, which implements physical, electronic, and procedural safeguards. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at support@eiyohub.com.

This privacy policy is effective as of 2026-07-26

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

• Right of Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your personal data (the "right to be forgotten") — available directly in-app via Delete Account.
• Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time by contacting the Data Controller.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority: https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the CCPA and CPRA provide you with additional rights regarding your personal information:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information collected about you.
• Right to Delete: You can request deletion of personal information collected from you — available in-app via Delete Account.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising. The Service Provider does not sell or share your personal information with third parties for advertising purposes.
• Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information (including health/fitness data) to essential purposes.
• Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at support@eiyohub.com.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, please contact the Service Provider via email at support@eiyohub.com.

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details above, or use the in-app Delete Account feature. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary, as permitted by applicable law.