Privacy Policy
Last updated: October 2026
1. Controller
The controller responsible for data processing is:
Elias Enghauser (Visin) · [email protected]
This policy covers the “Visin” app (iOS & Android) and the website visin.fit.
2. What data we process – and why
We only process data required to operate the app or that you actively provide:
- Account data: name, email address and profile picture at registration/login via email, Google or Apple. Purpose: account management. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
- Fitness & nutrition data: workouts, sets/reps, HIIT/interval and outdoor sessions, meals, macros and calories, body measurements and weight you enter yourself. Legal basis: Art. 6(1)(b) GDPR.
- Health data from Apple Health / Health Connect: if you opt in, we sync sleep, steps, weight, calories, workouts and nutrition with Apple Health or Google Health Connect (read & write). This data is stored in your Visin account like any other app data, including on our servers for cross-device sync. Legal basis: your explicit consent as a special category of personal data, Art. 9(2)(a) GDPR – revocable at any time via your device permissions.
- Cycle tracking: only if you enable period tracking in Settings, we process the cycle entries you log to show you personalised insights (e.g. correlations with training or sleep). Legal basis: your explicit consent, Art. 9(2)(a) GDPR – the feature is off by default and revocable at any time.
- Location data: when you use outdoor run/ride tracking, we record route, distance, pace and elevation via GPS – at your request also with the screen locked (background location), so tracking doesn’t stop e.g. in an armband. Location is only collected during an active recording session. Legal basis: Art. 6(1)(b) GDPR, plus your consent for background location, Art. 6(1)(a) GDPR.
- Camera & photos: photos of meals or recipes are sent to an AI service (Google Gemini, see section 3) for automatic recognition. Barcode scans are processed locally on your device. Legal basis: Art. 6(1)(b) GDPR.
- Microphone & speech recognition: when you dictate a meal, your speech is converted to text via your operating system’s speech recognition. Legal basis: Art. 6(1)(b) GDPR.
- Bluetooth: connecting to heart-rate monitors/fitness trackers to record your heart rate during workouts. Legal basis: Art. 6(1)(b) GDPR.
- Motion sensors: your device’s step-counter/activity data to show cadence/steps during outdoor activities. Legal basis: Art. 6(1)(b) GDPR.
- Device & connection data: a random device ID, IP address, and OS/app version. Purpose: bug fixing, stability, and abuse/spam prevention (e.g. banning malicious accounts). Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
- Push notifications: a device token (Firebase Cloud Messaging) for reminders (e.g. rest timers) and messages from friends. Legal basis: Art. 6(1)(b) GDPR, can be disabled in device settings.
- Social & community data: friendships, direct messages, feed posts, reactions to them (emoji plus timestamp), publicly shared recipes/training plans, ratings, and your display name/avatar, if you use these features. This content is visible to other users, or to anyone visiting a shared link if made public. Legal basis: Art. 6(1)(b) GDPR.
- Purchase data: for a Visin Pro subscription, we process your purchase/subscription status via RevenueCat and the App Store/Google Play. Your payment details (card etc.) are handled exclusively by Apple/Google and never reach us. Legal basis: Art. 6(1)(b) GDPR.
- Usage analytics & crash reports: We use the analytics service PostHog (PostHog Inc., data processed on servers in the EU) to understand which features are used and to find bugs. We record pseudonymous usage events (e.g. “workout started” or “meal logged”) with figures such as the duration and distance of a workout or outdoor activity, streak length, your chosen nutrition goal (lose/maintain/gain) and subscription and trial status, plus technical device and app data (e.g. device model, operating system and app version, language, install source such as the App Store or Google Play) and error and crash reports – linked to an internal user ID and a random installation identifier. We do not send GPS coordinates, food names, free text or body measurements. PostHog may derive an approximate location (country, region, city) from your IP address before discarding it; the IP address itself is not stored. There is no screen or session recording, no advertising, and no combining with data from other apps. Legal basis: our legitimate interest in a stable app that we develop according to actual needs, Art. 6(1)(f) GDPR. Objection: You can turn usage analytics off at any time in the app under “More → Settings → Privacy → Usage analytics”, or object via the contact address in section 9. Once it is off, no usage data is linked to your account any more; from the next app start at the latest we only send crash and error reports without any link to your account (with the random installation identifier), so we can keep fixing bugs. If you delete your account, we also have PostHog delete the app analytics data linked to your user ID (see section 4).
3. Sharing with third parties / recipients of your data
We do not sell your data. To operate the app, we use the following processors/third-party providers, each strictly limited to the purpose stated:
- Google Firebase (Google Ireland Ltd. / Google LLC): login (Authentication) and push notifications (Cloud Messaging).
- Google Sign-In & Sign in with Apple: optional login methods, if you choose them. With Sign in with Apple we store a token issued by Apple, encrypted, on our server – solely to revoke it with Apple when you delete your account; it is deleted along with the account.
- Google Gemini API (Google LLC): AI analysis of food/recipe photos and text, and the optional chat coach.
- PostHog (PostHog Inc., data processed on servers in the EU): usage analytics and crash reports in the app (can be turned off, see section 2) and reach measurement for the website (see section 6).
- OpenFreeMap: map tiles for the map of runs and rides. When the map loads, the service receives your IP address, the app identifier and version (User-Agent) and the requested map areas; your recorded route is not transmitted.
- RevenueCat, Inc.: subscription/purchase status management.
- Apple App Store / Google Play: payment processing for purchases.
Where any of these providers process data outside the EU/EEA – in particular in the US – this is based on EU Standard Contractual Clauses (Art. 46 GDPR) or an adequacy decision, where applicable. Beyond this, we only disclose data to third parties where legally required or explicitly requested by you (e.g. visible social content, see section 2).
4. Retention period
Your data is stored for as long as your Visin account is active. If you delete your account – possible directly in the app under “Delete Account” – your personal data, including fitness, nutrition, health and location data, is removed from production systems immediately; residual copies in backups persist for a maximum of 30 days before being automatically overwritten. Publicly shared content (e.g. recipes, training plans, feed posts, chat history) that remains relevant to other users is kept but anonymised – your name and profile are removed. When you delete your account we also have PostHog delete the app analytics data linked to your user ID (see section 2); PostHog removes the individual events with a delay. Crash reports without a link to your account and the website's reach measurement (section 6) are not tied to any account and are not covered by this.
5. Device permissions Visin requests
Visin only requests permissions tied to a specific feature, at the point you use it. You can revoke any permission at any time in your device settings; the app remains usable with reduced functionality.
- Camera – photos of meals/recipes
- Photo library – selecting existing photos
- Microphone & speech recognition – dictating meals
- Location, including in the background – recording outdoor runs/rides with the screen locked
- Motion & fitness/activity recognition – step counter, cadence
- Bluetooth – connecting heart-rate monitors
- Health data (Apple Health/Health Connect) – syncing sleep, weight, workouts, nutrition
- Notifications – reminders and messages
6. Website visin.fit
Our website loads fonts from Google Fonts, which transmits your IP address to Google. For reach measurement and to improve the site, we use the analytics tool PostHog (EU-hosted) without cookies and without storing anything on your device (no local or session storage either): page views and clicks (e.g. on install buttons) are recorded with a random identifier that exists only in your browser's memory for that one page view – you are not recognised across page views. On pages with shared content (e.g. recipes or training plans) we also record a pseudonymous reference to the person who shared it – an identifier derived from their internal user ID, not the user ID itself. PostHog may derive an approximate location (country, region, city) from your IP address before discarding it; the IP address itself is not stored, and there is no session recording. We do not use marketing or advertising cookies and do not share this data with third parties for advertising. Legal basis: our legitimate interest in a needs-based website design, Art. 6(1)(f) GDPR. You can object at any time via the contact address in section 9.
7. Data security
We transmit all data encrypted (TLS/HTTPS) and protect our systems using current technical and organisational measures. Complete protection against unauthorised access cannot be guaranteed.
8. Minimum age
Visin is not directed at children. Use is only permitted from age 16. Individuals under 16 may only use the app with the consent of a parent or legal guardian.
9. Your rights
Under the GDPR you have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR) – also directly via “Delete Account” in the app
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent already given, with future effect (Art. 7(3) GDPR)
Submit requests to: [email protected]
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe the processing of your data violates the GDPR – e.g. the authority responsible for your place of residence.
11. Changes to this policy
We update this privacy policy whenever the app or legal requirements change. The current version is always available at visin.fit.