Privacy policy

Ezequiel Migueles, a private individual resident in Spain, owner of Minthra: minthra.app and the apps for iPhone, Apple Watch and Android. Privacy contact: legal@minthra.app. There is no data protection officer because one is not required for this processing.

This policy describes what the product actually does today. If a feature changes how your data is handled, this page changes before the feature ships.

Account: your email address and, if you sign in with Apple or Google, the identifier that provider assigns you. From Apple and Google we only receive that identifier and your email, which may be Apple's private relay address. There is no password: you sign in with Apple, with Google, or with a six-digit code we email you, which works for 10 minutes and is stored only as a keyed hash. We also record which version of the terms you accepted, and when.

Profile: display name, goal, experience level, units, timezone, available equipment, a profile photo if you add one, and your app preferences (language, notification settings, quiet hours and meal reminders). If you use nutrition, also your date of birth, sex, height and body weight, which the calorie targets are calculated from.

Training: templates, programs and your enrollment in them, sessions, exercises including the ones you create, sets (weight, reps, RPE/RIR, duration, distance), notes, favorites, your body weight at the time of a session, and the progression suggestions calculated from all of this. Records and estimated one-rep maxes are worked out from your sets when you look at them; they are not a separate copy.

Body weight history: one entry per day, either typed by you or imported from Apple Health or Health Connect, marked with where it came from.

Nutrition, only if you turn it on: your nutrition profile (goal, pace, activity level, automatic or manual mode, training-day split), your daily targets and the date each one applies from, the review we run every two weeks with the figures behind it (how many weigh-ins, the trend, whether a change was applied), your diary entries (meal, food, amount, calories and macros, time), the foods you create, your favorites and your saved meals.

Meal descriptions: if you use meal analysis, the text you type or dictate is sent to be analyzed and the estimate comes back to your phone. Please don't include personal data in it. We send nothing else with it: no email, name or account identifier. We don't store the text or the estimate; only what you choose to log becomes a diary entry. A counter keyed to your account limits analyses per day and expires by itself at the end of the day.

Assistant chat: if you use the AI assistant, the messages you write and the answers it gives. To answer, the assistant reads your own data through read-only queries (the exercise catalogue, your workout history, records and estimated one-rep maxes, your nutrition diary against your targets, food search, your profile and your active program) and only the excerpts the question needs are sent along with your message. Nothing is changed in your account by it. Minthra stores the conversation (a title, your messages, the answers and the sources they cite) until you delete it, and a usage record for each model call: the feature, its cost in USD, the token counts and the time. Messages are limited to 30 a day and about 1 € a month per user. Please don't include personal data in your messages.

Barcodes: when you scan a barcode, our server looks it up in Open Food Facts, sending only the barcode number. Open Food Facts never learns who asked. Reading a nutrition label happens entirely on your phone: the image never leaves it.

Weather: the Today screen can show your local weather, only if you tap "Show weather". The app then asks for approximate location permission (reduced accuracy on iPhone, approximate on Android), only while the app is in use. Your phone rounds the coordinates to 0.1° (about 11 km) and sends only that rounded point to our API, which asks Open-Meteo (open-meteo.com) for the forecast for it. We do not store the location, link it to your account or log it; the API keeps the forecast in memory for 30 minutes, keyed by the rounded point only. Open-Meteo receives only those rounded coordinates from our server, never your IP address or identity. Weather data by Open-Meteo.com, licensed CC BY 4.0.

Devices and notifications: for each installation of the app, the token that lets us deliver a notification to it, its platform, timezone, language, app version, whether you allowed notifications, and a random installation identifier. Also the notifications themselves, which stay in the app's notification center, and the ones waiting to be delivered. A token says nothing about what you do in the app, and it changes when you reinstall.

Apple Watch: the name, model and watchOS version of a watch you pair, and the session token it uses to sync. Workouts you log on the watch sync like the ones you log on the phone. The heart rate and active energy the watch shows during a workout are read from Apple Health on the watch, shown on screen and never sent to us.

Support: when you report a problem from the app, your message, its topic, the email to reply to, the app version and build, platform, OS version, device model, language, recent error codes, and up to three screenshots if you attach them. From the form on minthra.app: your email, the subject, your message, the app version if you give it, and your language.

Security and logs: a log of sensitive account actions (signing in, asking to delete the account) and your session tokens, stored only as hashes. Our server logs record each request's method, path, status, duration and app version, with no IP address, no email and nothing you typed. Your IP address is used to limit abusive attempts: it appears in a counter that expires by itself within the hour and never reaches the database. On the support form and the email step of the account deletion page it is also sent to Cloudflare, with the bot check.

App usage measurement: to tell whether a change to Minthra actually helps, we record a few facts on our own servers: which steps of the welcome flow you see and complete (or skip), which suggestions we show you and whether you accept or dismiss them, when you start, finish or discard a session, and how long it took from creating your account to your first set. Each one carries the time, your platform and the app version; never weights, reps, meals or anything you write. We use no third-party analytics service: this data is sent to no one and is never used for advertising or profiling.

minthra.app: if you accept analytics, Google Analytics 4 measures page views, where the visit came from, device and approximate location. The support form and the email step of the account deletion page use Cloudflare Turnstile to keep bots out, and Cloudflare receives your IP address for that check. On the deletion page, "Continue with Apple" and "Continue with Google" load Apple's or Google's sign-in script only when you click that button, never when the page loads or on other pages; if you use one, Apple or Google receives your IP address and browser information and may set their own cookies, under their own privacy and cookie policies. The apps themselves carry no third-party analytics, advertising or trackers; the usage measurement described above is our own and stays on our servers.

Your notes and messages are free text: avoid writing medical information in them.

Your body weight, your body measurements, what you eat and the workouts Minthra reads or writes in Apple Health or Health Connect can say something about your health. We treat all of it as health data.

We process it on your explicit consent (GDPR art. 9.2.a), which you give by entering it yourself, by turning on nutrition, or by connecting Apple Health or Health Connect. You withdraw it by deleting that data — one entry at a time, all your nutrition data at once, or your whole account — or by disconnecting the health integration. Withdrawing does not make earlier processing unlawful.

We never use it for advertising, marketing or profiling, we never sell it, and it only reaches the processors listed in "Recipients and processors", for the purposes described here.

Optional, off by default, and set per device. You turn it on from Profile and grant permission in the system dialog — iOS's Health permissions or Android's Health Connect permissions.

What Minthra reads: body-weight samples, with the time they were recorded, from the last 30 days, when you connect and each time you open the app. We keep the most recent sample of each day and store it in your Minthra account, marked as imported, so it appears in your weight history on every device you sign in on. A manual entry always takes precedence over an imported one for the same day, and a day you deleted is never imported again.

What Minthra writes: each completed strength workout — its type, title, start time and end time — on by default once you connect, and you can turn it off. If you also turn on writing nutrition, which is off by default and asks for its own permission, each meal you log is written as calories, protein, carbohydrate and fat. On Apple Watch, the workout you record is saved to Apple Health, and the heart rate and active energy are read only to show them on the watch during the workout.

We read nothing else: no heart rate history, sleep, steps, calories burned or clinical records, and no workouts recorded by other apps.

Imported weight serves your weight history, the features that already use body weight and, if nutrition is in automatic mode, the review of your targets every two weeks (see "Purposes and legal bases").

You can turn either direction off at any time in Minthra, and revoke the permission from iOS Settings → Health or from Health Connect. Turning it off does not delete weight already imported: you can delete individual entries in the app, and everything is deleted with your account and included in your data export. What Minthra already wrote to Apple Health or Health Connect stays under your control there; Minthra does not delete it.

Creating and maintaining your account, storing and syncing your training and nutrition across your devices and your watch, suggesting progression, and sending the emails the service needs (sign-in codes, export ready, deletion scheduled and completed, security notices): performance of the contract you accept when you sign up (GDPR art. 6.1.b), and your explicit consent for the health data described above (art. 9.2.a).

Calculating your nutrition targets and, in automatic mode, reviewing them every two weeks against your weigh-ins, whether typed or imported from Apple Health or Health Connect: your explicit consent (art. 9.2.a), given when you turn nutrition on. The review needs at least four weigh-ins, changes your daily target by at most 100 kcal, and tells you what it did; you can keep your previous target, switch to manual mode, or pause nutrition.

Writing your workouts and, if you turn it on, your meals to Apple Health or Health Connect: your consent (art. 6.1.a and 9.2.a), given with each switch and the system permission, and withdrawn by turning either off.

Analyzing a meal description: your explicit consent (art. 9.2.a), given each time you send a description for analysis. The feature is optional.

Chatting with the AI assistant, and the reading of your training, nutrition and profile data it needs to answer: your explicit consent (art. 9.2.a), given each time you send a message. The feature is optional. The usage record and the limits on messages and cost: our legitimate interest in keeping the service sustainable and free of abuse (art. 6.1.f).

Showing the local weather on the Today screen: your consent, given through the system location permission when you tap "Show weather" (art. 6.1.a), which you can withdraw at any time in your phone's system settings. It is used only for this feature, never for advertising or tracking.

Sending you notifications about your own training and nutrition — a reminder on a day you chose, a record you have just set, a meal reminder: consent (art. 6.1.a), which you give by turning notifications on in the app and allowing them on your phone. Either one withdraws it.

Answering your support messages: performance of the contract when you have an account, and otherwise our legitimate interest in replying to you (art. 6.1.f).

Protecting the service against abuse and unauthorized access, including rate limits and Turnstile on the support form and the email step of the account deletion page: legitimate interest (art. 6.1.f). This is minimal processing, and it protects you too.

Measuring how the app is used (the welcome steps, suggestions and sessions described above) to tell whether a change improves it: our legitimate interest (art. 6.1.f). It is a small amount of data, and it never leaves our servers.

Measuring use of the website: consent (art. 6.1.a and LSSI art. 22.2), which you can withdraw at any time from "Cookie settings".

Handling your rights requests and meeting legal obligations: legal obligation (art. 6.1.c).

We do not sell your data, we do not advertise, and we make no automated decisions with legal or similarly significant effects. Progression suggestions and target reviews are suggestions you can undo or ignore.

For as long as you have an account. If you ask to delete it, the deletion is scheduled for 30 days later and you can cancel it until then. After that, everything is deleted in one go: your profile and photo, your training, your body weight history, your nutrition data, your devices, notifications and paired watches, and your support records and screenshots. Your email is replaced with an anonymous value, and the security log is kept without being linked to you. We email you when the deletion is scheduled and when it is done.

A sign-up started with an email code and never completed is deleted after one day.

A data export is deleted 24 hours after it is generated. Screenshots attached to a problem report are deleted after 90 days. A support message's content is encrypted while it waits; the address to reply to and the subject are kept alongside it for at most that hour, and then it is delivered to our support mailbox, where we keep the conversation only as long as we need it to help you.

Assistant conversations are kept until you delete them: you can delete any conversation from the assistant's history in the app, and all of them are deleted with your account. The usage records (feature, cost, token counts and time, with no message text) are kept for as long as you have an account and deleted with it. The model provider keeps nothing.

App usage measurement data is kept for 13 months, and deleted sooner if you delete your account.

A notification token lasts as long as the app stays installed with notifications on: it is deleted when you sign out, when you turn notifications off, when your phone stops accepting it, and with everything else when you delete your account. A notification we could not deliver in time is dropped rather than sent late.

Products looked up in Open Food Facts are cached for 30 days, not linked to anyone. Technical records that let the app safely retry a request are kept for 30 days.

The location used for the weather is not kept: the rounded coordinates are not stored, and the forecast for a rounded point stays in the API's memory for 30 minutes.

The database provider keeps a point-in-time history of 6 hours, used only to recover the service after a failure; we keep no other backup copies. If we ever restore from it, deletions made since that point are applied again.

Server logs are kept for 7 days by our hosting provider. On the website, Google Analytics data is kept for 2 months.

You can delete all your nutrition data without deleting your account, from Profile → Data and privacy → Delete nutrition data in the app. That removes your nutrition profile, targets and reviews, diary entries, the foods you created, your favorites, your saved meals and your nutrition notifications at once. Your training, your body weight history and your account stay.

Pausing nutrition instead keeps everything and stops the reviews.

Fly.io, Inc.: hosting for the API, in Frankfurt.

Neon Inc.: the PostgreSQL database, on AWS in Frankfurt. It holds your account, profile, training, body weight and nutrition data. It also holds your assistant conversations and usage records.

Cloudflare, Inc.: serving minthra.app and the exercise animations in the app; storing your profile photo and problem-report screenshots in storage whose jurisdiction is the European Union, so they cannot leave the EU; and Turnstile, the bot check on the support form and the email step of the account deletion page. Serving the website means Cloudflare handles the connection and therefore sees your IP address, and for the Turnstile check our server also sends it your IP address; your photo and screenshots have no public address.

Upstash, Inc.: the Redis behind the limit on abusive requests and the daily meal-analysis counter, in Frankfurt. It holds one counter per IP address or account and time window, each expiring on its own.

Mailgun Technologies, Inc.: sending sign-in codes and account emails, and delivering support messages to our mailbox.

Google Ireland Ltd.: Firebase Cloud Messaging, which carries a notification's title and text to your phone, only if you turn notifications on. On iPhone and Apple Watch it hands the notification to Apple's push service.

OpenRouter, Inc.: meal text analysis, and routine generation and adjustment, optional features. For a meal it receives only the description you write; to generate a routine, only your goal, experience level and equipment, the focus and length you choose, and the exercise catalogue; to adjust one, also the routine (its name, exercises, sets, reps and rest), the adjustment you pick and, if you write one, your free-text instruction, which may contain health information if you choose to include it (an injury, for example). None of them carries your email, name or any account identifier, and we do not store the instruction. OpenRouter passes the request to the AI model provider it routes it to. We require Zero Data Retention on every request: neither OpenRouter nor the model provider may keep it or use it for training. For the assistant chat it receives your message, the conversation so far and the excerpts of your own data that the assistant reads to answer; no email, name or account identifier. The request is routed to Anthropic (Claude Haiku), with Zero Data Retention required and data collection denied: neither OpenRouter nor Anthropic may keep it or use it for training. The conversation is stored by Minthra, not by them.

Open-Meteo (open-meteo.com): the weather forecast for the Today screen, only if you turn the weather on. It receives only the coordinates rounded to 0.1° (about 11 km), sent by our server, with no IP address of yours and nothing that identifies you.

Open Food Facts (world.openfoodfacts.org, privacy policy at world.openfoodfacts.org/privacy): the product photos shown in the app. The app loads them directly from images.openfoodfacts.org when a product is displayed, not through our server, so your device connects to Open Food Facts itself and it receives your IP address and standard request data. Minthra sends it no account data: no email, name or account identifier.

Google Ireland Ltd.: Google Analytics on minthra.app, only with your consent.

All of them act as processors under an art. 28 GDPR contract. Apple and Google, when you use them to sign in, are independent controllers of your account with them. Open-Meteo is not a processor: it receives only rounded coordinates, from our server, and nothing that identifies you. Open Food Facts is not a processor either: it receives only a barcode, from our server, and, for product photos, your IP address and request data directly from your device, as described above. We do not share data with anyone else unless the law requires it.

Apple Health and Health Connect are not among them: they are health stores on your own device, and Apple and Google receive no Minthra data through that integration.

Your account, training, body weight and nutrition data are stored in the European Economic Area: the API and the database in Frankfurt, your photo and screenshots in EU-jurisdiction storage.

Meal text analysis and routine generation and adjustment are the exception you should know about: what they send leaves the European Economic Area, because OpenRouter and the model providers it uses process requests in the United States. It is processed and discarded under Zero Data Retention, and only when you ask for it. The same goes for the assistant chat.

Notifications pass through Google's and Apple's push services, which may process them outside the European Economic Area. Fly.io, Neon, Cloudflare, Upstash, Mailgun, OpenRouter and Google are companies headquartered or with a parent company in the United States, so they may reach data from outside the EEA, for example to provide support.

Every transfer outside the EEA relies on the European Commission's standard contractual clauses or, where the recipient is certified under it, on the EU-US Data Privacy Framework.

If you sign in with Google or Apple, we only use the account identifier and email to create your Minthra account and identify you. We do not access your contacts, files or any other Google or Apple data, we do not use them for advertising, and we do not share them with third parties.

On the account deletion page, "Continue with Apple" and "Continue with Google" load their sign-in script only when you click that button. When you do, Apple or Google receives your IP address and browser information and may set their own cookies, under their own privacy and cookie policies, as an independent controller.

The Apple Health and Health Connect integration works differently: Apple and Google do not receive any Minthra data through it — see "Apple Health and Health Connect" above.

Minthra is for people 16 or older. If we detect an account belonging to someone younger, we will delete it.

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time.

From the app you can export your data and delete your account; you can also delete your account from minthra.app/delete-account/. The export comes in two formats: JSON, with everything — account, profile and photo, training, body weight history, all your nutrition data (profile, targets and reviews, diary, your foods, favorites and saved meals), notifications, devices and paired watches — or CSV, with your logged sets only. It is ready within minutes and can be downloaded for 24 hours from your signed-in account; we never send it as an email attachment. The JSON export also includes your assistant conversations and usage records.

For anything else, write to legal@minthra.app from your account's email address. We reply within one month at the latest. If you are not satisfied, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Encrypted connections (HTTPS), sign-in codes and session tokens stored only as hashes, sessions that renew every 15 minutes, the content of queued emails encrypted, profile photos and screenshots without public addresses, and restricted access to the servers. On your phone, you can add an app lock with Face ID or your fingerprint. If a breach affected you, we would notify you and report it to the AEPD as the GDPR requires.

Version 1.0, 14 October 2026, the first published version.

Version 1.1, 19 October 2026: the AI assistant chat.

Version 1.2, 19 October 2026: product photos from Open Food Facts.

If we make a material change to this policy, we will announce it in the app or by email before it applies.