Privacy policy

1. Wie zijn wij?

Vytrix is a fitness and wellness application developed by Vincent Molenkamp (sole proprietorship), based in the Netherlands.

• Verwerkingsverantwoordelijke: Vincent Molenkamp / Vytrix
• KvK-nummer: 42078574
• Privacy-contact: privacy@vytrix.app
• Beroep / Appeals (DSA): appeals@vytrix.app
• Data Protection Officer (FG/DPO): is appointed for v1.0 launch (large-scale Article 9 processing — mandatory under GDPR Art. 37(1)(c))

2. What data do we collect?

2.1 Accountgegevens

Naam, e-mailadres, gebruikersnaam, profielfoto (avatar), geboortedatum, geslacht.

2.2 Trainings- en activiteitsgegevens

Oefeningen, sets, reps, gewichten, trainingsduur, trainingstemplates, routines, persoonlijke records, aangepaste oefeningen.

2.3 Gezondheidsgegevens (bijzondere categorie — AVG Artikel 9)

This data will be only processed after your explicit permission (GDPR Art. 9(2)(a)) and consent can be withdrawn at any time via Settings → Privacy → Withdraw consent — as easy as giving it.

• Slaapdata: bedtijd, wektijd, slaapduur, slaapkwaliteit, slaapfases.
• Voedingsdata: voedsellogboek, calorieën, macronutriënten, micronutriënten, waterinname, supplementen.
• Lichaamsmetingen: weight, BMI, body fat percentage, body circumferences, fat-free body mass, body water mass.
• Hartslagdata: hartslag (BPM), HR-zones, hersteldata, HR-variabiliteit (HRV).
• Voortgangsfoto's: body photos with metadata.
• Maaltijdfoto's (optional): Processed briefly by Google Vertex AI over the EU multi-region eu (not used for model training). Only extracted nutritional data is stored.
• Productfoto's (barcode/label scan): depending on the selected scanner, briefly processed by Google Vertex AI in the EU multi-region or by OpenAI for reading the label. The barcode and an existing product name can also be sent as context.
• Menstrual cycle (optioneel): zie aparte sectie hieronder.

2.3a Menstruatiecyclus en reproductieve gezondheid

Reproductive health data deserves special attention. Vytrix follows Mozilla / Privacy International best practices for period-tracking apps in a post-Roe geopolitical climate.

Wat verzamelen wij? Startdatum laatste menstruatie, cycluslengte (21-35 dagen), periode-lengte (3-10 dagen), afgeleide cyclusfase (menstruatie / folliculair / ovulatie / luteaal).

How do we use this data? Automatische luteale-fase calorie-aanpassing (+150 kcal, uitschakelbaar), notificaties over verwachte vochtretentie (uitschakelbaar), visuele indicatoren in trainingskalender, fase-specifieke trainingstips.

Garanties:

1. Optioneel — only active if you turn cycle tracking on (default off).
2. Primary storage region Ireland — the Supabase Database, Auth and Storage of the Vytrix project are in AWS eu-west-1. Backups, support and other processing are subject to the current Supabase DPA and sub-processor conditions; we therefore do not make an absolute "EU-only" promise.
3. Not visible to coaches — regardless of other permissions.
4. Not shared with the AI provider — cycle data is not passed on to AI functionality.
5. Not used for advertising or profiling — this data is not used for ad measurement.
6. Independently removable — you can delete cycle dates without deleting the rest of your account.
7. Requests from authorities — we assess requests for validity under applicable law and limit disclosure to what is legally required. The terms and conditions of our processors may also apply to such requests.

2.3b Health Connect / HealthKit permissions

On Android devices, you can connect Vytrix to Health Connect. Permissions are only requested when you activate the corresponding function:

On iOS we use the equivalent HealthKit categories. You can revoke each permission individually via the Health Connect settings on your device.

2.3c Limited Use Statement (Health Connect)

Use of information received from Health Connect complies with the Health Connect Permissions policy, including the Limited Use requirements.

Specifically:

• We use Health Connect data uitsluitend for the functions mentioned in §2.3b.
• We share Health Connect data nooit with advertising networks, data processors for marketing, lenders, insurers or employers.
• We use Health Connect data niet for determining employment, insurability or for unauthorized social division.
• We do not sell Health Connect data to third parties under any circumstances.

2.4 Social data and messages

• Feed content: posts, comments, likes, friendships, challenges, leaderboard participations.
• Direct messages and group chats: text and shared content (photos, links, food shares, workout shares). Messages are only visible to sender, recipient(s) and — for reported content — our moderation procedure. Not shared with third parties.
• UGC moderation metadata: reports are stored in social_reports; reports about you are not visible to you.

2.5 Coach client data

Training programs, progress, messages with your coach (if applicable). The coach is an independent controller. Reproductive health data (§2.3a) is excluded from coach access.

2.6 Technical data and device IDs

Device type, operating system, app version. Optional Android installation measurement has a separate choice (§2.8a). The new iPhone measurement link does not read IDFA. We do use a Firebase Installation ID and a push notification token for account linking, fraud prevention, and notifications.

2.6a Background functions (Foreground Service)

During a workout, the app can show a rest timer (60-300 seconds) on the lock screen notification. There will be no location tracking, audio recording or other background processing executed outside this timer you started.

2.7 Location data (optional)

When using "detect gym", the app collects your data once approximate location (city level, not exactly). Location is not continuously tracked and not stored on our servers unless you link a gym to your profile (those coordinates only).

2.8 App performance and analytics

• Crash reports via Firebase Crashlytics (Google Ireland Limited, EU). No personal training, health, or cycle data.
• App interactions via our own Supabase analytics on EU servers. Pseudonymized.
• Diagnostic data such as app version, OS version, device model.
• Website performance via Vercel Analytics and Speed Insights. URL parameters and snippets are removed before submission.
• Optional website analytics via PostHog on the European endpoint, only after your explicit choice. DNT and Global Privacy Control are treated as a denial; legal pages do not use PostHog.

This data is not shared with third parties for marketing or advertising.

2.8a Optional installation measurement

After the measurement function has been made available, you can individually choose in the app whether you help measure our advertisements. Denying does not affect the functions of Vytrix. This is separate from product statistics and newsletters.

• Android: After approval, we will send a one-time installation notification with your Android advertising ID to Meta (Facebook and Instagram). Meta also receives your IP address through the connection. We do not store the advertising ID on our servers. Removed advertising IDs and disabled ad tracking will be respected. An update of an existing installation is not reported as a new installation.
• iPhone: After your choice, we ask Apple via SKAdNetwork to attribute the installation in aggregate. This link does not read IDFA or IDFV and does not send an individual installation request to Meta. Apple determines which aggregated reporting the winning ad network receives.
• We do not share account ID, email, workouts, nutrition, weight, HealthKit/Health Connect data, purchases or subscriptions for this purpose.
• Your choice and a one-time measurement status are stored locally. You can withdraw consent via Settings → Privacy → Measure app installs. New shipment stops; Data already received by Meta and a report already registered with Apple cannot be retrieved in this way. You can request help with your privacy rights via privacy@vytrix.app. Meta processes received data under its own privacy policy: Meta Privacy Policy.
• This first measurement route is limited to installations. Vytrix will not show any advertisements in the app. Meta may also process this data outside the European Economic Area, subject to applicable Meta terms and transfer mechanisms.

2.9 Product interest and early access email

If you go through Connect Devices in the app or via the shop/waiting list on this website, you indicate an interest in the Vytrix Food Scale or Body Scale, we process the provided email address, the individual product, your choice (purchase, test or just updates), the source (app or website), language, optional country/region, consent version, shipping/provider acceptance metadata and the moment you complete the confirmation. An alternative email address from the app remains separate from your account; Only an exactly identical, already confirmed account address can be technically linked to your account.

The checkbox is disabled by default. Resend sends one confirmation email. The link will first open a confirmation page; Only after you press the confirmation button yourself is double opt-in completed and the address may receive updates about that specific product. Food and Body interest remain separate segments and we do not use health, training or nutrition data for these emails. Each product update contains a personal unsubscribe link. Unsubscribe immediately revokes consent for that record; Signing up again requires a new double opt-in.

2.10 Partner links in the app (sandbox test)

We are testing the connection between a partner link, new app registration and subscription in a limited sandbox test. Test payments do not generate real earnings or payouts.

Outside the App Clip pilot described below: The direct partner link opens Google Play on Android with the public partner code and the App Store on iPhone without referral data. This route does not write a partner cookie, create a unique installation token or create a registration context on the website. The public code identifies the partner, not you or your installation.

For older referral routes: The app initially keeps a received partner code only in memory. Only after you choose Use partner link in the app do we save a minimal registration context with a random key. For an eligible new registration, we link your account ID to the partner. Confirmed subscription payments and corrections can then be assigned to that referral. An existing account does not receive a new partner link.

Supabase (EU) stores the context after your explicit choice. On Android, Google Play receives only the public partner code for the installation handoff. Partner linking on iPhone is not available yet. You can still download the app. Existing handoff links remain recognisable only within their validity period when you open them. We do not silently read your clipboard or use device fingerprinting. RevenueCat and the existing payment processors handle payment data. The partner sees only their own totals, not your identity, health data or advertising ID.

For a direct partner code, the new server context expires without registration after 30 days by default, starting when it is created after your agreement in the app. The public code is reusable; an earlier website click does not start this period. Earlier expiry dates still apply to older token transfers. A recovery context prepared before registration stays locally for at most 90 days. Expired temporary server contexts are cleaned up after a seven-day buffer when new transfers occur; rejected decisions after 90 days. Test data is reviewed for targeted cleanup after the test. Accepted registration evidence and financial records are kept separately; final financial retention and a wider rollout are assessed separately.

When you choose Save or Start in the App Clip, Vytrix stores the exact workout, your next action, a transfer ID, the expiry time and a valid public partner code in its own storage shared by the App Clip and the full app (App Group). Opening or previewing alone does not save a new transfer. This local transfer remains valid for at most seven days from Save/Start; expired transfers are removed on the next access. The workout and health data are not sent to the partner or affiliate processing.

The automatic partner route through the App Clip is limited to the closed Dutch iOS pilot, with permitted partner codes and the existing checks before a new registration. This specific route needs no additional partner question or manually entered code. Mobile affiliate processing is still disabled in the publicly available full app; this website entry therefore does not yet promise partner linking at registration. For processing within this pilot, Supabase (EU) and the existing RevenueCat, store and payment services remain the recipients. Partners see only their own totals, not your identity, workout, health data or advertising ID. This route does not grant analytics or advertising consent or override a previous refusal. Older referral routes still require the existing explicit choice. For questions or objections, email privacy@vytrix.app.

This test does not change existing privacy choices. You do not need a partner link to create an account. Questions about the test or your data? Email privacy@vytrix.app.

3. Why do we process your data and on what basis?

4. With whom do we share your data?

4.1 Your coach (if applicable)

Only the data categories for which you have given permission. Reproductive health data is excluded from coach access.

4.2 Service providers (processors)

Full sub-processor list: vytrix.app/subverwerkers.

Changes to sub-processors will be announced at least 30 days before the effective date. Objection on data protection grounds? privacy@vytrix.app.

4.3 Other users

Only information that you share via social functions, limited by your privacy settings.

4.4 We DO NOT share

• With advertising networks, except for the voluntary installation measurement in §2.8a
• With data brokers
• With employers, insurers or lenders
• Voluntarily with authorities beyond a valid legal request; each request is reviewed and limited to what is mandatory
• With any third party for its own marketing; Resend only processes email requested by Vytrix on our behalf

5. International transfer

Your data will be primair processed on servers in the EU (the primary Supabase region for Database, Auth, and Storage is Ireland). Additional processors, including Firebase, RevenueCat, Resend, OpenAI, Vercel, PostHog and Stripe, may process data outside the EEA. They use it where applicable EU-US Data Privacy Framework (DPF) and/or contractual guarantees such as Standard Contractual Clauses (SCCs), in accordance with GDPR Art. 46. The current combination differs per processor and is stated in the processing agreement or the linked privacy conditions.

Resend states that primary processing and storage takes place in the US. A European sending region only determines the route of the email and does not move stored account, message, or delivery information to the EU.

Reproductive health data (§2.3a) is not sent by Vytrix to AI, marketing or payment providers. The primary storage is in the Supabase region of Ireland; any ancillary processing or international transfer by the infrastructure party is subject to the Supabase DPA, sub-processor list and appropriate transfer safeguards.

6. Retention periods

7. Your rights

You have the following rights under the GDPR:

• Inspection (Art. 15) — view your data via Settings → Privacy
• Correction (Art. 16) — change your details in the app
• Erasure (Art. 17) — delete your account via Settings → Account; or via vytrix.app/account-verwijderen
• Restriction (Art. 18) — revoke consent by category
• Transferability (Art. 20) — JSON export via Settings → Privacy → "Export my data"
• Objection (Art. 21) — withdraw consent
• Withdraw consent (Art. 7(3)) — via the unsubscribe link in each product update or via privacy@vytrix.app. You can manage other categories in the app. Withdrawal will not affect the lawfulness of previous processing.
• Automated decision-making (Art. 22) — Vytrix takes geen decisions with legal or similarly significant effects.

Do you have a complaint? Then you can go to:

• Dutch Data Protection Authority (AP) — Netherlands: autoriteitpersoonsgegevens.nl
• Data Protection Authority (GBA) — Belgium
• BfDI — Germany
• CNIL — France

8. Consent management

You can give, view and withdraw consent per category via Settings → Privacy → Consent.

Withdrawing is as easy as giving (a tap). No consequences for the lawfulness of previous processing.

9. Target group and age

Vytrix is intended for adults 18 years and older. We consciously do not process personal data of minors.

When registering, the date of birth is checked via a neutral age picker. Users younger than 18 cannot create an account. If we discover that a minor has created an account, we will delete that account and all associated data.

10. Security

• AES-256 encryption at rest
• TLS 1.3 encryption in-transit; no cleartext traffic
• Primary Supabase Region for Database, Auth, and Storage: Ireland (eu-west-1)
• Row Level Security (RLS) on all personal data tables
• JWT authentication via Supabase Auth
• Private storage buckets; access via temporary signed URLs (24h)
• Coach-client data isolation via RLS + consent checks
• Automated retention cleanup (pg_cron)
• BDSG §22(2) "appropriate and specific measures" for German users

11. Cookies (Coach Portal and website)

The coach portal and this website use necessary storage/cookies for authentication, for example. PostHog is only loaded after explicit permission and not on legal pages; DNT and Global Privacy Control count as a refusal. Vercel Analytics and Speed Insights are used without cookies. See it cookiebeleid for details.

12. Changes

Bee substantial changes In this privacy policy we proactively inform you via:

1. An in-app banner upon next use
2. A blocking modal that requests renewed consent for the changed processing
3. An e-mail to the address known to us

Non-essential changes (linguistic refinements, typos) will only be published on this page via a version update.

13. Contact

• Privacy questions: privacy@vytrix.app
• Appeal against moderation actions (DSA Art. 20): appeals@vytrix.app

Company registration and current contact details are provided vytrix.app/contact.