Privacy Policy

At Nuveli ("we", "us", "our"), we value the privacy of our users ("you", "your"). This policy explains what data we collect, how it is used, and your rights.

1. Data We Collect

• Account info: Email address and password (passwords are hashed with bcrypt and never visible in plain text).
• Profile data: Age, gender, height, weight, activity level, goal.
• Meal records: Photos, food descriptions, calorie/nutrient values.
• Health data: Water, weight, mood records.
• Device data: Push token, device type, app version.
• Usage: Screen views, button clicks (anonymous analytics).

2. Use of Data

• To generate AI analysis and coach responses (sent to OpenAI API).
• To create personalized progress charts and insights.
• To send notifications.
• To improve service quality and detect errors.

3. Third Parties

• Supabase — Data storage and authentication.
• OpenAI — Meal analysis and coach responses (images not stored).
• RevenueCat — Subscription management.
• Firebase — Push notifications, analytics, error reporting.

4. Data Retention

Your data is stored as long as your account is active. When you delete your account, all personal data is permanently deleted within 30 days.

5. Your Rights (GDPR + KVKK)

In-app, via "Settings > Privacy & Safety":

• Download your data.
• Delete your account and all data.
• Manage notification and data sharing preferences.
• Request to stop processing.

6. Security

Data is transmitted encrypted via TLS. Your health information is accessible only to you. Protected by Supabase Row Level Security (RLS).

7. Children's Privacy

Nuveli is intended only for users 18 years of age and older. Age verification is performed during registration. If we discover that a user under 18 has entered data, we will immediately close the account and delete all associated data.

8. International Data Transfers

Notice under GDPR Articles 44-49 and KVKK Article 9: the third-party services we use (OpenAI, Render, Firebase, RevenueCat) are based in the United States. Consequently, your data is transferred internationally to the extent required for service delivery. This transfer is necessary for providing the service, and by using the app you give explicit consent to this transfer. Third-party providers are subject to their own privacy policies and data protection standards.

9. Your Rights Under GDPR and KVKK

You have the following rights regarding your personal data:

• Right of access — confirm whether your data is being processed
• Right to information — request details about how data is processed
• Right to know the purposes of processing
• Right to know which third parties (domestic or international) receive your data
• Right to rectification — correct incomplete or inaccurate data
• Right to erasure ("right to be forgotten") — account deletion page
• Right to object to automated decisions (including AI analysis)
• Right to data portability

To exercise these rights, use in-app Settings → Privacy or contact support@nuveli.com.tr.

10. Data Breach Notification

In the event of a serious breach affecting the security of your personal data, we will notify you and the relevant supervisory authority within 72 hours, in accordance with GDPR Article 33 and KVKK Article 12.

11. Health Data Connection — Health Connect (Android)

When you enable "Connect phone health data" in Settings (off by default), Nuveli reads only your workout sessions from Android Health Connect: activity type, start time, duration, and the session's active energy (calories). This data is shown only in your in-app activity log; the calories shown are for information only and are never added to your daily calorie budget. Access is read-only — we never write to Health Connect, never share this data with third parties, and never use it for advertising. You can revoke access anytime in Settings or the Health Connect app. Imported workouts are deleted when you delete your account.

12. Contact

Questions: support@nuveli.com.tr