Privacy Policy

Last updated: September 13, 2026

1. Who we are

A person responsible for personal data protection ensures compliance with this policy and handles requests to exercise your rights (full identity at the bottom of the page).

For any question or to exercise your rights: contact@novenya.app

This policy applies to the Novenya app (mobile and web). It implements the GDPR (EU 2016/679) and applicable personal data protection laws. The app is intended for ages 18 and up.

2. Data we collect

• Account: email, name, password (hashed), language, preferred units.
• Profile and self-reported health: age, weight, height, measurements, goals, reported injuries, sleep, stress, supplements — only what you enter.
• Activity and nutrition: workouts, exercises, loads, steps, hydration, food and meals, meal plans, dietary preferences.
• Progress photos: private, never visible to other users, face-blur available; automatically analyzed only if you request it. The Aesthetics section is different: photos you choose to post there are visible to the community (voting only, no comments), after automated screening and manual moderation of reports — restricted to ages 18 and up.
• Precise location (GPS) during your runs, including in the background if you allow it, to track and measure your route; if you turn on live sharing, your position is reachable through the link you send yourself, only while your run is active.
• Steps, weight, heart rate (resting, average, max), and sleep stages — read from Apple Health / Health Connect only if you turn on sync. Biomarkers (blood glucose, blood pressure, total/HDL/LDL cholesterol, triglycerides) are a separate manual entry (Premium): never automatically read from Apple Health / Health Connect.
• Technical data: IP address and device model (login, security, referral anti-abuse), approximate IP-based geolocation (local pricing and taxes), error logs, internal usage events, never resold or shared for advertising.
• Payment: on iOS/Android, subscriptions go through Apple App Store / Google Play via RevenueCat; Stripe is used only if a web payment option is offered. Either way, we only receive the subscription status, never your card number.
• Waitlist (website, before the store launch): your email, only to notify you once the app is available — never used for anything else, deleted if you create an account or upon request.

3. Why (legal bases)

• Providing the service (contract): tracking, the Novenya program, multi-device sync, automatic daily backup (can be turned off by deleting the backup in Profile → Data & Storage).
• Your consent (health data, photos): you enter this data voluntarily and can delete it anytime — that's how you withdraw consent.
• Legitimate interest: security, preventing referral fraud (IP/device fingerprint), internal improvement statistics.
• Legal obligations: accounting retention of transactions.

No decision producing legal effects is made in a fully automated way based on your personal information: app-generated suggestions are recommendations you remain free to follow or not. Exception: automated screening of a photo before publication in the Aesthetics section may reject a submission with no human involvement at that step — you can always ask for a human review of an automated decision concerning you by contacting us.

4. Your rights

Access, copy and portability (machine-readable export), rectification, deletion (individual items or the entire account: Profile → Account and privacy → Delete account), objection and restriction of processing based on legitimate interest.

We respond within one month (which may be extended by two further months for a complex request, with notice of the extension). You can also file a complaint with the competent personal data protection authority: Quebec's Commission d'accès à l'information (CAI) for Quebec residents, or your local authority (e.g. the CNIL in France) for EU residents.

5. Retention

• Active account: data is kept as long as you use the app.
• Account deletion: personal data erased within 30 days (backups included).
• Transactions: retained for the period required by tax law.
• Technical and anti-abuse logs: 12 months maximum.

6. Sharing and transfers

We never sell or rent your data. It is only shared with strictly necessary processors:

• Hosting (server + database): Railway (North America — Montreal, Canada).
• Stripe — payments for web-only subscriptions (PCI-DSS certified); no web payment option is offered at this time.
• Apple App Store / Google Play / RevenueCat — payments and subscriptions purchased in the App (the channel used today).
• Google / Apple / Facebook — verifying your identity if you choose to sign in with one of these accounts.
• Google Maps — showing the map during your runs.
• Anthropic — messages sent to the coach, data used to generate your program, and, only when you trigger an analysis, the relevant photos (meals, progress, Aesthetic, equipment); not used to train their models per their terms.
• Resend — sending our transactional emails.
• Open Food Facts / Spoonacular — food and recipe search (queries without your identity).
• IP geolocation service — IP address only, for currency and taxes.
• Google reCAPTCHA — anti-abuse protection (e.g. against mass fake-account creation), when this protection is enabled.

Some providers may be located outside Canada/EU; transfers rely on recognized safeguards (standard contractual clauses), and every cross-border transfer of personal data is subject to a privacy impact assessment.

7. Cookies and local storage

• Mobile app: no advertising cookies. Local storage (preferences, caches, drafts) needed for offline functionality.
• Web: only session-related local storage (login token, preferences, theme). No third-party trackers, no external targeted advertising.

8. Security

Hashed passwords, encrypted communications (HTTPS), sensitive data encrypted with AES-256 on your device, data access limited to what's strictly necessary, photos private by default. No system is foolproof — let us know immediately if you notice anything unusual on your account.

Incidents: in the event of a privacy incident presenting a risk of serious harm (unauthorized loss, access, or use of personal information), we notify Quebec's Commission d'accès à l'information (CAI) and affected individuals as required by Quebec's Law 25 — this duty applies to all users, not only EU residents. For European users, the competent supervisory authority is notified within 72 hours unless the risk is deemed unlikely (art. 33 GDPR), and affected individuals are informed without undue delay when the risk to them is high (art. 34 GDPR). An incident log is maintained.

Data controller and person responsible for personal data protection: Maxime Pigeon, doing business as Novenya (Quebec, Canada), owner.