Privacy policy

At Digelia, respecting your privacy is a priority. This policy explains what data we process, why, and what your rights are.

Data we process

• Account: email address and profile information you provide, or that Google or Apple send us if you use their sign-in (see “Signing in with Google or Apple”).
• Tracking data: meals, symptoms, hydration and feelings you log. They belong to you.
• Technical data: information strictly necessary for the proper functioning and security of the service.

Purposes

Your data is used solely to provide the service: logging your meals, computing your trends and syncing your devices. We never sell your data to third parties.

Retention

Your data is kept as long as your account is active. You can export or delete it at any time from the app.

Signing in with Google or Apple

You can create your account and sign in with your Google account or with Apple (“Sign in with Apple”), instead of a password. This sign-in method is optional: signing up with an email address and a password remains available.

When you use it, we receive from Google or Apple only what is needed to create your account: a technical identifier specific to Digelia, your email address and, where applicable, your name. We never receive your password and have no access to any other data in your Google or Apple account (contacts, calendar, photos, files…).

If you choose Apple’s “Hide My Email” option, we only receive a relay address (ending in @privaterelay.appleid.com): your real address is never disclosed to us.

For this processing only, Google (Google Ireland Limited) and Apple (Apple Distribution International Ltd.) act as independent controllers: they know that you are signing in to Digelia and process that information under their own policies (Google, Apple). On our side, the legal basis is the performance of our contract with you (Article 6(1)(b) GDPR): this data is used only to create your account and authenticate you, never for advertising.

You can revoke Digelia’s access at any time from your Google account or Apple ID settings. Doing so will prevent you from signing in this way, but it does not delete your Digelia account: for that, use account deletion in the app or write to us.

AI food photo analysis

The app offers an optional feature that analyzes a meal photo to recognize the foods in it. It is enabled only with your explicit consent: without your agreement, no photo is sent and the feature stays off.

When you consent, the relevant photo is sent, through its application programming interface (API), to the AI provider OpenAI, for the sole purpose of recognizing the foods present. In line with OpenAI’s enterprise privacy policy, this data is not used to train its models. You can withdraw your consent at any time in the app settings; the feature is then no longer used.

Audience measurement

To understand how the site is used and improve it, we use Matomo, an analytics solution that we host ourselves. Measurement is done without cookies, your IP address is anonymized, and no data is sold, shared with third parties, or used to track you across other sites. This audience measurement therefore does not require your consent, in line with the French data protection authority (CNIL) guidelines. If your browser sends the “Do Not Track” signal, no measurement is performed; you can also object at any time by writing to privacy@digelia.app.

Advertising cookies (Google Ads)

To measure the effectiveness of our advertising campaigns, we use Google Ads (Google Ireland Limited). This service may set cookies and send data to Google only if you consent through the banner shown on your first visit. By default this tracking is disabled and no advertising cookie is set (Google’s “Consent Mode” mechanism). You can decline at any time, and change your mind by clearing the site data your browser has stored for Digelia.

Your rights

Under the GDPR, you have the right to access, rectify, erase, port and object. To exercise them, contact us at privacy@digelia.app.

Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access.

Where your data is hosted

Your account and tracking data are hosted by OVH, a French provider, on servers located in the European Union. Only the processing operations described below may, where applicable, involve providers outside the EU (see “International transfers”).

International transfers

Some of our processors, including OpenAI (photo analysis), RevenueCat (subscriptions), Expo (notifications) and Cloudflare (spam protection), are located outside the European Union, in particular in the United States. Where your data is transferred there, the transfer is covered by appropriate safeguards under the GDPR, in particular the European Commission’s standard contractual clauses (and, where applicable, the EU–US Data Privacy Framework).

Spam protection

To protect our forms (waitlist) against bots and abusive sign-ups, we use Cloudflare Turnstile, a CAPTCHA alternative configured in invisible mode: you are never shown a checkbox or a puzzle. For this sole purpose, Cloudflare may process technical data (such as your IP address and browsing signals) to tell a human apart from a bot. This processing is governed by the Cloudflare Turnstile Privacy Addendum.

Push notifications

If you enable notifications, we use Expo’s push notification service to send them. For this purpose, a device token (a technical identifier specific to notifications) is processed and then relayed to Apple (APNs) or Google (FCM) depending on your device; this token does not identify you personally. This processing is governed by Expo’s privacy policy.

Sending emails

To send you service-related emails (for example account confirmation or password reset), we use Brevo, a French provider acting as a data processor. For this sole purpose, your email address is sent to it, on servers located in the European Union. This processing is governed by Brevo’s privacy policy.

Payments and subscriptions

Your subscriptions and in-app purchases are managed through RevenueCat, which acts as a data processor. The payment itself is processed by the App Store (Apple) or Google Play (Google): we never have access to your payment card details.

To link your subscription to your account, we send RevenueCat an account identifier, your subscription status and a purchase identifier, as well as your email address and name (“customer attributes”). This data is used only to manage and restore your subscription and to help you if needed. This processing is governed by RevenueCat’s privacy policy.

Contact

For any question about this policy: privacy@digelia.app.