Herodicus - Privacy Policy
1. Data controller
The controller of your personal data is Przemysław Fiega, contact: kontakt@herodicus.pl. Write to this address for any matter concerning personal data.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| e-mail, first name, password (stored only as a secure hash - we do not know your password) | creating and operating your account, login | Art. 6(1)(b) - contract |
| profile data: sex, age, height, weight, target weight, nutrition targets, daily rhythm, preferences, training availability | calculating targets and personalizing plans | Art. 6(1)(b) and - for body-parameter data - your explicit consent (Art. 9(2)(a)), given when completing your profile; you can withdraw it by deleting this data or your account |
| diary entries: meals, nutritional values, workouts, shopping list, saved dishes | providing the core service (the diary) | Art. 6(1)(b) |
| meal photos and descriptions sent for analysis | one-off analysis by an AI model | Art. 6(1)(b) |
| credit balance, top-up and usage history, payment identifiers | settlements, complaints, accounting | Art. 6(1)(b) and (c) |
| IP address, login timestamps, technical data | security (abuse prevention, rate limits) | Art. 6(1)(f) - legitimate interest |
3. Meal photos - important
Recipe comments and photos. When you submit a comment, we store its text, public display name, date, account association and optional photo. We resize the photo and remove its metadata. Before review, only you and the editors can see it. Once approved, the display name, comment and photo are visible to readers. Edits require another review; the previously approved version remains visible meanwhile. The “Withdraw my comment and photo” button removes the material from public view. We retain the version and moderation history; withdrawal does not erase server data. To request erasure, contact the controller in section 1. Comment photos are not sent for AI analysis.
4. Artificial intelligence and recipients of data
1. Nutritional analyses are performed by an AI model provided by Anthropic (the provider of Claude models). Only the content needed for the analysis is sent to the provider: the meal photo/description and the profile data relevant to the plan (without your e-mail or name). According to the provider’s policy, data sent via the API is not used to train models. Transfers outside the EEA are based on appropriate safeguards (EU-US Data Privacy Framework / standard contractual clauses).
2. Payments are handled by Stripe - you enter card details directly with the operator; we receive only a payment confirmation and its identifier.
3. Data is stored on servers in Poland (hosting: LH.pl). We do not sell data and do not share it with advertisers.
5. How long we keep data
Account and diary data - until you delete your account. Billing data (credit purchase history) - for the period required by tax law. Security logs - up to 12 months.
6. Your rights
You have the right to access your data, rectify it, erase it (“right to be forgotten”), restrict processing, data portability, object, and withdraw consent at any time (without affecting prior processing). Just e-mail the address in section 1. You may also lodge a complaint with the Polish supervisory authority (President of the Personal Data Protection Office, uodo.gov.pl) or the authority in your country of residence.
7. Cookies and browser storage
The App itself does not use advertising cookies. In your browser’s storage (localStorage) we keep only: the logged-in device token, your language choice and minor interface settings. Logging out removes the token.
On the entry page we ask separately for your consent to measure advertising performance. If you click “I agree”, we load a tool provided by Meta Platforms Ireland Ltd. (the Facebook pixel). It sets its own cookies (_fbp, _fbc) and reports to Meta that you visited the page and that you created an account. The event carries your IP address, browser data and your e-mail address only as an irreversible SHA-256 hash that cannot be read back. We also send the same event from our server (Conversions API) so that one registration is not counted twice. The legal basis is your consent (Art. 6(1)(a) GDPR) and the sole purpose is advertising measurement.
Under the same consent we also load a tool provided by TikTok Technology Limited (TikTok Pixel). It sets its own cookie (_ttp) and reports to TikTok that you visited the page and that you created an account, together with your IP address and browser data. Its sole purpose is measuring TikTok advertising.
If you click “Essential only”, none of this is loaded and nothing is sent to Meta. The App works exactly the same. You can withdraw your consent at any time by clearing this site’s data in your browser settings, or by e-mailing the address in section 1.
With your consent to advertising measurement, we also estimate the country where you use the app. Your IP address is matched locally on our server using the DB-IP database; we do not send it to the database provider. We store only the first and most recently detected country codes and observation dates with your account, without storing an additional copy of your IP address. VPNs and mobile networks can affect accuracy. Without consent, we do not take new measurements. Country data is kept until your account is deleted or removed earlier on request.
8. Security
Transmission is encrypted (HTTPS), passwords are stored only as a hash (bcrypt), access to features is protected by device tokens, and login and sign-up rate limits protect against abuse.
9. Changes to this policy
We will inform you about significant changes in the App. The current version is always available at this address. In case of any discrepancy, the Polish version prevails.