Privacy Policy

Your entries stay on your device

Your habits, goals, nutrition and journal entries and your whole history are stored on your device. Renyu puts none of it on the Renyu server; only what is meant for friends and a Coach suggestion you report sit there, with your consent. For the Coach there is a small service that passes on to the AI model what you share for it; it does not store it, except a suggestion you report (see “Reporting a suggestion” in the Coach section). A copy only exists where you switch it on, for example with iCloud sync in your own iCloud, and never there for values from Apple Health, your cycle, your logbook and your thought records. Each of these places is named individually below.

Without your consent everything stays on your device and, if you switched on sync, in your own iCloud. Friends exist only with your consent: then a directory entry that anyone with a Renyu account and your friend code can read sits on the Renyu server so that someone can find you by your friend code, and sharing with friends runs through the Renyu server. Exactly what the directory contains is set out in the section “Public profile & friend code”, everything about the Renyu server in the section “Friends through the Renyu server”.

Sensitive data is protected by the device encryption of iOS (Data Protection) as soon as a device passcode is set. If you delete the app, the locally stored data is removed with it.

Apple Health (HealthKit)

When you connect Renyu to Apple Health, the app reads only the data types a feature actually needs (for example activity, sleep, recovery, your logged nutrition, body measurements, your mood and mindfulness entries, and values about walking and stairs, stand time, time in daylight and sound levels, cycling and running metrics, UV exposure and, if your Apple Watch records them, falls, AFib burden and heart rhythm notifications). The app only shows these medical-adjacent values; they are no substitute for a doctor’s assessment. Access starts only after you allow it in the Health permission dialog. The app keeps the most recently read values encrypted on this device so the Health tab doesn't open empty; “Delete all local data” removes them. If you turn on syncing with Apple Health in Cycle, the app reads and writes, with a permission of its own, period, spotting and these signs: cramps, backache, headache, bloating, breast tenderness, pelvic pain, breakouts, hot flash, night sweats, nausea, mood different than usual, tiredness, sleep different than usual and appetite different than usual. These entries stay on this device and in Apple Health. They don’t go to iCloud, to friends or to the Coach. They are only included if you pass on your cycle overview, an export or a backup yourself.

In addition, there are your date of birth and your biological sex. Both are only ever read, in order to work out the values that depend on your age: your fitness age, your cardio fitness level, your heart rate reserve and your basal metabolic rate, from which Renyu derives your calorie and nutrient goals. They only fill in what you have not entered yourself, and afterwards they stand in your Renyu profile, which the remaining age-dependent calculations draw on: training zones, strength and endurance ranks, and the estimated energy burned in a session.

This health data is only read on your device and prepared for display. It is never used for advertising, never sent to us and never passed on to anyone else by Renyu. It can only appear in a report or file that you pass on yourself (see “Sharing and links”).

You can manage your Health permissions at any time in the iOS Settings app under Privacy → Health. For technical reasons an app cannot change those permissions itself.

Health Connect (Android)

When you connect Renyu on Android to Health Connect, the app reads only what a feature needs. Renyu asks for each permission only when you open the matching feature, and uses the values only for the views in the app. Renyu reads your heart rate from today, your mindfulness sessions from the last 7 days and your steps up to 29 days back. Renyu reads active calories, workouts, nights, VO2max, resting heart rate, heart rate variability, blood oxygen, respiratory rate, body fat percentage and height up to 90 days back, and your weight up to 180 days back. Renyu also reads, for the day you view in the food diary, the amount you drank and your meals with their nutrition values from other apps, so the daily balance includes them. If you turn on syncing with Health Connect in Cycle, Renyu also reads your periods and spotting. For the comparison with your cycle, Renyu reads workouts from your first cycle entry on. Without your permission for older data, Renyu reads at the earliest from 30 days before your first permission.

Renyu writes to Health Connect only values you enter or record in Renyu yourself: sleep duration without sleep stages, which you enter by hand, your weight (entered by hand and confirmed with “Save to Health Connect”), and the water, calories and macros of your entries while “Send Nutrition to Health Connect” is on. Renyu writes periods and spotting only if you turn on syncing with Health Connect in Cycle. Renyu does not write symptoms. Saving an entry again replaces the old one; meals and cycle entries you delete in Renyu are removed there too. Health Connect asks for each permission on its own, and you can decline each one. The legal basis is your consent in Health Connect (Art. 9(2)(a) GDPR); you can withdraw it there at any time.

Nothing goes to us, to a cloud, to third parties, advertising or data brokers. You can decline any permission or withdraw it later in Health Connect. Renyu then keeps working without that feature. Renyu reads this data only on the device and prepares it for display. Your health values stay in the app's private storage on this device, which other apps cannot read, until you remove them with “Delete all local data” under Settings, Data and privacy, or uninstall the app. You delete the entries Renyu wrote to Health Connect in Health Connect. When you move to a new device with a direct transfer (Android 12 and later), Android takes your entries along, including photos, nutrition, fasting, workouts and mood. Cycle, mindfulness, lab values, medication, body values and your sleep entries are kept separately and do not move. Only the daily values of your review (steps, sleep duration, weight) move as a copy. Android's cloud backup does not take your entries, photos or health values. If you export your data as a file yourself, it contains the health values you entered yourself; values and workouts from Health Connect are not included. You can manage your permissions at any time in Health Connect.

Maps, place search and routes (Android)

Map, place search in the fitness area and route measuring send data to Google. They are off until you agree the first time you use one. You agree only once, and your agreement covers all three. If you attach a place to a habit or an appointment, the text you type goes to your device’s search service, which on most devices is run by Google. If you type nothing, nothing is sent. The map loads from Google the map tiles you look at; this tells Google which area you are viewing. When the map shows your route during a session, these are the tiles for the area you are in. Technically, Google also receives your IP address, details about your device and system version, how you pan and zoom the map, crash data from the map component and a random identifier of the map component. The map does not ask for your location and does not send it. Your name and your health data are not sent to Google.

For place search, Renyu passes your search term to your device’s search service, which on most devices is run by Google. If you tap a point on the map, its location (latitude and longitude) goes to that service too, so Renyu can find a name for it. If you have already set waypoints, a search window around them goes to the search service together with the search term and language, so roughly the area of your route. Your device decides which service that is and what it does with the data.

For route measuring and the loop suggestion, Renyu sends the waypoints you set (latitude and longitude) and the way you travel (on foot or by bike) to the Renyu server. The server uses them to ask Google’s Routes API and returns the route to you. Only the waypoints, the way you travel and the language of the answer (German or English) go to Google, with no name, no identifier of your device and no proof of purchase. The Renyu server does not store the waypoints or the route and does not write them to a log. It only counts requests: per identifier of your app installation per minute and per calendar day, and in total for everyone per day. It deletes these counters after three days at the latest. Before each request it also counts requests per IP address in a 60-second window and keeps the address only as a non-reversible hash for this; it is deleted with the daily clean-up, at the latest after about 24 hours. It keeps the random identifier of this app installation and its verification key for at most 13 months after last use. The Renyu server runs at Cloudflare, which technically processes your IP address.

The first time a route is measured on this device (including the loop suggestion), the app asks Google Play Integrity for a token and sends it to the Renyu server. The server has Google check that the request comes from the Renyu app from Google Play on a genuine device. This protects against misuse and happens once per device, even without the Coach. Google receives details about the device and the app.

The basis is your consent (Art. 6(1)(a) GDPR). You withdraw it under Settings, Data and Privacy. After that, Renyu sends nothing to Google for the map, place search or route measuring. Renyu cannot take back what Google has already received. Google processes the data that reaches it as a controller in its own right, under the Google Privacy Policy: https://policies.google.com/privacy. For users in the European Economic Area, that is Google Ireland Limited. The map is also covered by the Google Maps End User Additional Terms of Service: https://maps.google.com/help/terms_maps/.

Access on your device that you allow

Besides Health, Renyu asks for these system permissions. iOS asks for each one the first time it is needed, you can withdraw each one in the iOS settings at any time, and none of them sends anything to us:

• Calendar: Renyu shows your events in the day grid and in the day plan and warns you when a routine block or a habit collides with something you have already scheduled. For that it reads the title, the start, the end, whether an event lasts all day, the name of the calendar it sits in, and the identifiers Renyu recognises it by.

If you ask it to, Renyu also writes plans of its own into the calendars you pick for that. Written are only the title, the start, the end and whether it lasts all day, never notes, locations or invitees. Without your choice nothing is written, changed or deleted.

If you link a calendar in both directions (which is the default when you link one) it also works the other way round: Renyu creates entries of its own on your device from those events, with title and time, so you can plan them beside your habits. You can set the direction to “read only” at any time.

So that a Renyu entry and its calendar event find each other again, the app remembers one line per pair: which area it belongs to, the two identifiers, two check numbers that only indicate *whether* something has changed, and when they were last reconciled. The title and the time of your event are not in there, and those lines stay on your device.

• Camera: you need the camera for the barcode scan, for scanning another person’s QR code, for a photo of a nutrition table, your meal or a lab report and for a photo of an exercise of your own. The app reads barcodes, nutrition tables and lab reports on the device; these pictures do not leave the device, are not saved and not passed on. The app reads another person’s QR code on the device; only the friend code that person shares is taken over. A meal photo leaves the device only if you send it to the Coach yourself and have agreed beforehand: it then goes through Renyu's service to OpenAI, Renyu does not store it; as a rule, OpenAI may keep it for up to 30 days to detect misuse, and does not use it for training. Only the barcode number is looked up at Open Food Facts, if you agreed to that. The photo of an exercise of your own is stored with the exercise, cropped square and without metadata such as the place it was taken; it leaves the device only through your own iCloud sync, if you turned it on.
• Microphone and speech recognition: Renyu needs both only when you dictate a meal instead of typing it, and only while the recording you started yourself is running. Your device turns what you said into text itself: recognition runs offline on this device only, there is no fallback to a server. The recording is not saved, your voice is never sent anywhere, and Renyu never listens in the background. If your device cannot do the recognition offline, dictation stays closed and you type as before.
• Face ID: Face ID is only asked for when you have locked a section of the app yourself. iOS does the check; Renyu only learns whether it succeeded and never sees your biometric data. Without Face ID you get in with your device passcode.
• Music: during a workout Renyu shows you what is playing so you can skip a track or pause without leaving the app. Only the current playback of the Music app is read, never your library.
• Motion sensors: While the home screen or a meet-up with friends is open, Renyu reads your iPhone's tilt and movement so the room and the avatars can move with it. The readings are discarded at once, never stored and never sent. iOS shows no prompt for this so far. With Reduce Motion turned on in the iOS settings, the sensor stays off.
• Notifications: if you allow them, Renyu reminds you of what you set up yourself: habits, goals, the log-in, the rest timer. The text says what it is about, so it appears on your lock screen. The app schedules these reminders on the device. If you use the social area, friend requests and cheers arrive as notifications through Apple's push service: the app stores the device token on the Renyu server, Apple delivers the notification. It carries the person's name only in encrypted form: Apple sees only that someone asks or cheers you on, and your device decrypts the name and shows it. Your device creates the key; it is stored on your device and on the Renyu server. Once the app has read the request itself, it may show a notification with the display name on your device. Silent notifications wake the app for syncing without showing anything.
• Screen Time: If you block apps during a focus session, Renyu uses Apple's Screen Time on your device. The apps you choose stay on your device and are never transmitted. iOS asks once for Screen Time access. The block lasts until you tap Finish or open Renyu after the focus session ends. Renyu only gets identifiers from Apple, no app names and no usage times. Your choice does not go to iCloud. You can take back access in iOS Settings under Screen Time.
• Location: when you start an endurance session on your iPhone, Renyu measures the distance and pace of your route on the device. Renyu stores the route itself only if you turn on “Save the route you ran”. Then the location points of your run, with time and altitude, are kept as a file on this device. They do not go to iCloud or to us. “Delete saved routes” removes them all. If you share a route as a file or link, it shows the exact path, often your home too. When you start an outdoor workout on your Apple Watch, Renyu saves its route and distance with the workout in Apple Health. Renyu keeps no copy and sends it nowhere. You can delete it in Health.

Four places store coordinates permanently. Three of them only because you save them yourself: a planned running route (its first point is your location at the moment of the suggestion), the place anchor of a habit and, if you turn saving on, a route you ran. All three stay on the device and disappear when you delete them. The fourth is the route of an outdoor workout on your Apple Watch; it lives in Apple Health (see above). What the location is also used for on the internet (weather in your room, route suggestions and place search) is in the next section.

Calendar on Android: Renyu asks for access to your calendar (read and write) only when you tap an area under Settings, Calendar link, or allow the calendar under Settings, Permissions. You can withdraw it at any time under System settings > Apps > Renyu > Permissions. Read are the title, the start, the end, whether an event lasts all day, the name of the calendar it sits in, and the identifiers Renyu recognises it by, only from the calendars you link. If you ask it to, Renyu writes plans of its own into the calendars you pick for that. Written are only the title, the start, the end and whether it lasts all day, never notes, locations or invitees. Without your choice nothing is written, changed or deleted. If you link a calendar in both directions (the default), Renyu creates entries of its own on your device from those events, with title and time. You can set the direction to “read only” at any time. So that a Renyu entry and its event find each other again, the app remembers one line per pair: the area, the two identifiers, two check numbers that only indicate whether something has changed, and when they were last reconciled. The title and the time of your event are not in there, and those lines stay on your device. Renyu sends no event to us or to anyone else. If your device account syncs a calendar with a service (for example Google), that service does it, not Renyu.

Camera, microphone and internet on Android: Renyu asks for the camera only when you open the scanner, the photo of a nutrition table, the photo of a lab report or the scan of another person’s QR code, or take a photo of your meal or for a custom exercise. Pictures of barcodes, nutrition tables and lab reports do not leave the device, are not saved and not passed on. The app reads another person’s QR code on the device; only the friend code that person shares is taken over. A meal photo leaves the device only if you send it to the Coach yourself and have agreed beforehand: it then goes through Renyu's service to OpenAI, Renyu does not store it; as a rule, OpenAI may keep it for up to 30 days to detect misuse, and does not use it for training. Only the barcode number is looked up at Open Food Facts, if you agreed to that. The photo of an exercise of your own is stored with the exercise, cropped square and without metadata such as the place it was taken; it does not leave the device. You can also allow camera and microphone in advance under Settings, Permissions. Renyu asks for the microphone only when you tap the microphone in Nutrition. Your device turns what you say into text itself, without internet. The recording is not saved. You can withdraw the microphone at any time under System settings > Apps > Renyu > Permissions. You can withdraw the camera at any time under System settings > Apps > Renyu > Permissions. For the product search, Renyu uses the internet to reach Open Food Facts, an independent, non-profit service. It runs only when you tap “Look up online” and agree the first time. Then your search term or the barcode, for a search by name also your device’s language and country, and, as with any internet request, your IP address leave your phone, no health or body data. You can turn online search off again in Settings.

Reminders and widgets on Android: Renyu schedules reminders on this device. No data leaves the device for this. Notifications from friends are separate: they come through Firebase Cloud Messaging from Google. Only when you turn on the social area and agree does Google create a token and an installation identifier for this app installation, and Renyu stores the token on the Renyu server. The notification carries the person's name only in encrypted form: Google sees only that someone asks or cheers you on, and your device decrypts the name and shows it. Your device creates the key; it is stored on your device and on the Renyu server. Without the social area, no token is created. Widgets on your home screen show values from Renyu, such as habits, tasks, events, goals, nutrition and mood. They are created on the device and stay there.

Focus lock on Android: Renyu sees which app is in front and, during focus time, lays a calm overlay over the apps you choose. None of this leaves your device. It takes two steps in system settings, and you can take back both at any time.

What stays behind on your device

Some things Renyu stores permanently without needing any permission for it. None of it leaves your device, except through the iCloud sync in the next section and in the places under “Sharing and links”. Since it says above that most camera pictures are *not* saved, here is what very much does stay behind:

• Pictures you pick yourself: progress photos for a goal, pictures on your vision board and attachments in the journal stay stored until you delete them. They arrive through the iOS photo picker. Renyu gets no access to your library, only the one picture you tap. On Android: You pick pictures through the system photo picker, also for custom exercises and your running shoes. Renyu gets only the pictures you select there and no access to the rest of your library.

Renyu stores photos of your recipes on your device, reduced in size and without the place they were taken. With iCloud sync on, they are stored encrypted in your iCloud account and count towards your iCloud storage.

• Pictures you save to Photos: if you share a picture from your vision board and choose “Save Image” in the share sheet, iOS adds it to your Photos once you allow it. Renyu may only add there and does not read your library. On Android, Renyu has no permission for photos or storage and does not write to your gallery. When you share a picture on Android, such as a recipe card, it goes through the share sheet to the app you choose there. That app decides whether and where it is saved. Renyu does not read your gallery.
• Medication: if you add medication, Renyu stores the name, dose, times and which doses you ticked off on this device only. Renyu calculates nothing from it and sends none of it, not to iCloud, not to Apple Health and not to the Coach. The reminder shows the name only if you turn that on.
• Your Apple Watch: if you use it, it asks for its own Health permission; the one from your iPhone does not apply there. Your iPhone sends the watch a slice of the day. It holds the habits due today with their names, progress, streak and group, how many are done, how many are due tomorrow and at what times. It also holds your streak, your water level and your water goal, the planned workout, your pinned routines with their exercises and your most recently logged meals with name, calories and time. The app's language, your time zone, your settings for haptics and the end of the day and a still image of your avatar come with it as well. Figures for the watch's displays go along too: your steps, recovery and strain, each also as its course over the day, your fitness age, your calorie balance and the training volume of the week beside last week's. Renyu reads or calculates some of these on your iPhone from Apple Health; these figures go only to your own watch. A planned route you send to the watch travels the same way, and so does what you check off on the watch on its way back. Habit names appear on the watch face only if you turn on “Names on the watch face”. All of this runs over Apple's device pairing directly between your iPhone and your watch, without iCloud and without a server of ours. If you set the recovery alarm on your watch, the watch asks for its own permission to read heart rate variability and resting heart rate. It reads these values only during the wake window and keeps them on the watch. For this your iPhone sends the watch, the same way, the alarm's settings, your sleep goal and your usual range of these two values, two numbers per value. Every alarm on the watch reads the watch's motion sensor once a second during the wake window to notice a light movement. These readings are not stored and do not leave the watch.
• Sit-to-stand results: date and repetitions of the 1-minute sit-to-stand test, entered by you and stored only on this device, not synced and not shared. Deleted with “Delete all local data” or one by one in the test sheet.
• Files you send to Renyu: if you share something from another app (a GPX file with a route you ran, for instance), the share extension places it in a shared folder the app then picks it up from. That folder belongs to Renyu and sits on your device.
• Receiving from other apps: If you share a photo, a link, a routine or a workout (GPX or TCX) from another app with Renyu, Renyu reads it on the device and adds it only when you tap. Renyu fetches nothing from the internet for receiving. What happens with a recipe from a link is described under the features with network access.
• Widgets: so that a widget can draw your avatar, Renyu places a finished picture of it in that same shared folder, together with the figures the widget shows. If a widget shows a friend, their display name and where their habits and streaks stand are kept there too, but only as far as that person has unlocked it for you, and never a value from Apple Health. The widget only reads there. It calculates nothing and writes nothing back.
• Backup copy of your settings: So that your settings and your avatar are not lost if iOS cannot read the saved preferences, Renyu keeps a copy of them in a file on this device. It contains the same settings that are stored in iCloud when sync is on, such as appearance, reminder times, daily plan, training plans and your Renyu ID, plus your avatar and the views of this device. It never contains a value from Apple Health and no body measurements. The one exception is your nutrition goal (calories, nutrients and water per day), even if Renyu calculated it from your details or from Apple Health: it stays only in this file on this device and never goes to iCloud. The file stays on your device, not in iCloud and not in the device backup, and it is removed with “Delete all local data”.

iCloud sync

At first launch Renyu asks whether your entries should be synced with iCloud: “Sync with iCloud” or “Only on this device”. Nothing is preselected, and until you choose, everything stays on the device. You can change your choice at any time under “Sync with iCloud” (Settings → Data → Privacy). While sync is on, Renyu keeps a copy of these entries in your private iCloud database so your devices with the same Apple Account show the same things: habits and check-offs, goals, tasks, day plan, vision board, journal and reviews, your own foods and recipes, meal plan, shopping list and pantry, your own exercises, your favorites, notes and settings for exercises, your routines with their exercises, training plans, Cardio Plans with the heart rate zone you set as a target (a zone number, not a measured pulse), your running shoes, your rewards and some settings. Pictures you attached yourself are included, also the photo of a running shoe. For a habit that Apple Health ticks off, your own setting is included too: which kind of value is meant (for example steps) and the number you set as the target. Measured values from Apple Health are never included.

The copy is kept by Apple in your iCloud account, not by us. Renyu has no server that would hold this copy and cannot read your private database. Free text is encrypted on your device before it is stored in iCloud; with Advanced Data Protection for iCloud, only you hold the key.

The provider of iCloud is Apple. How Apple handles data in iCloud is described in Apple’s privacy policy.

Not synced are your nutrition diary with water, your nutrition goals and meals, your fasts with the fasting plan, your workouts with sets and personal bests and your meditation, as well as your cycle with symptoms, your logbook (log-in and log-out), your thought records with the mood before and after, your alcohol and nicotine entries and your medication with the doses you ticked off. They stay on the device where you enter them. Values from Apple Health and every figure calculated from them are not synced either, including check-offs of habits that Apple Health ticks off. On goals, the start value, current value and target number of a measurable result stay on the device when Apple Health, a habit that Apple Health ticks off or your training log fills it, and for body values you enter by hand, such as weight or resting heart rate. The name, unit and kind of source of such a result still sync. Each device reads Apple Health itself, with its own permission. The target pace of a Cardio Plan, planned routes, the routes you ran if you turn on saving, location anchors, calendar links, the tab bar layout and the app icon also stay on each device. If you back up your device to iCloud, Apple's backup also contains Renyu's data on this device; you control that in your iCloud settings.

Deleting applies everywhere: what you delete while sync is on also disappears from your iCloud and your other devices. “Delete all local data” removes the whole copy and also empties your other devices, including everything kept only there, such as nutrition, training, cycle and logbook. If you turn sync off, your data stays on this device and an existing copy in iCloud stays as it is. You can remove it in your device's iCloud settings under “Manage Storage”.

The legal basis is your consent (Art. 6(1)(a) GDPR, and Art. 9(2)(a) GDPR insofar as what is synced reveals something about your health, including anything you write yourself, for example if you mention your health in a journal entry). You give it by tapping “Sync with iCloud” below a sentence that names what is synced. You can withdraw it for the future at any time with the switch in Settings.

No tracking, no advertising

Renyu contains no analytics or advertising SDK, does not track you across apps or websites, and sells no data. There is no profiling for advertising purposes. After you agree, the map component from Google sends data to Google; which data is described under “Maps, place search and routes”. Google uses the identifier of the map component to measure how the component is used. Renyu receives none of it and does not analyze it.

Optional features that use the internet

A few convenience features fetch data from the internet while you are using them, only when you trigger them, and without identifiers that point to you:

• Product search (Open Food Facts): the search always starts in the food database on your device. That never leaves your device.

Only when you tap “Look Up Online” do the text you entered or the barcode you scanned go to the open food database, to fetch nutrition values. The request also carries your device’s language and country, so that matching results come back, the name and version of the app and, as with any internet request, your IP address. No identifier of yours goes with it.

No health or body data is transmitted in the process, no identifier, no account. Neither the request nor the result is stored permanently.

Recipe from a link: When you send the address of a recipe from Chefkoch, Emmi kocht einfach, Einfach Backen, Familienkost or Lecker to Renyu and choose “Recipe”, Renyu fetches exactly that page once to read the recipe, and then once the picture the page names for the recipe, from that site’s image server. The page address without any tracking tail, the picture’s address and, as with any request on the internet, your IP address go to that site. No data about you, no identifier and no cookies are sent. Only the recipe with its picture is stored, once you add it.

• Weather in your room (Apple WeatherKit): for the view out of the window a position rounded to about 1 km is sent to Apple Weather, and only if you allowed location access beforehand and “Show weather in the room” is on. The position is not stored and never transmitted exactly. On the device the app keeps only the kind of sky, for example rain, so your avatar is dressed for the weather in the widget and on your watch. The widget and the watch show the source credit of Apple Weather. On Android: the position goes instead to the Norwegian Meteorological Institute (MET Norway), under the same conditions, rounded to one decimal place, about 10 km. The position is not stored. The app keeps only the times and the kind of sky.
• Route planning (Apple Maps): when you plan a running route, the waypoints you set go to Apple Maps so a route can be calculated from them.
• Street names for planned routes (Apple Maps): when the app suggests a loop to you, or you place a waypoint on the map yourself, those points go to Apple Maps so that “street, town” appears instead of a row of numbers. This happens only after an action of yours, for at most six points, and without any identifier of yours. The full postal address is never taken over. Without a connection the corners simply stay unnamed.
• Place search for habits (Apple Maps): if you attach a place to a habit, the text you type goes to Apple Maps so suggestions can be made from it. If you type nothing, nothing is sent.
• Map, place search and route measuring (Android): After you agree, map requests, your search term and the waypoints of a route go to Google, the waypoints through the Renyu server, which does not store them. Details are under Maps, place search and routes (Android).
• Place search for habits and appointments (Android): If you attach a place to a habit or an appointment, the text you type goes to your device’s search service, which on most devices is run by Google. If you type nothing, nothing is sent.
• Food packages (renyu.info): the app fetches the list of available packages from our website renyu.info when you open the food database in the settings, when you open the food search while a package is being suggested there, or when you tap “Download”. A package is only downloaded when you tap “Download” or “Update”. The bundled package for Germany, Austria and Switzerland counts as downloaded. On its own the app only checks when “Update automatically” is on, at least one package is downloaded and the last check was at least a week ago; it then downloads a newer version over Wi-Fi only. This is how the bundled package, too, updates at most once a week over Wi-Fi while “Update automatically” is on.

Only fixed, public files are fetched. As with any request to a website, the server receives your IP address, the time, the requested file and a program label (user agent) that is the same on every device. No identifier of yours, no account and no health or nutrition data is transmitted. The website is hosted by united-domains GmbH (web hosting); processing takes place exclusively in the EU. The access data ends up in its server logs and is deleted after 7 days at most, or the IP address in them is shortened. The legal basis is Art. 6(1)(b) GDPR, because the request is the feature you trigger.

Coach (AI)

The Coach is an AI. It recognizes meals in a photo or a sentence, drafts training plans, suggests a week of meals, plans your day, suggests alternatives to the sources of a nutrient and, if you ask, gives you a follow-up question on a journal entry. Only when you start one of these features and have agreed beforehand does Renyu send what is needed through Renyu's own service to the AI model. For a meal, that is the photo or the sentence. For a training plan, it is your answers (days, duration, goal, equipment, experience, note), the number of weeks and the names of up to 60 routines in Renyu, your own and the included ones, with their focus. For alternatives, it is the nutrient, the names of at most ten foods that supply it in your nutrition with their share in percent, and your diet (everything, vegetarian or vegan). For meals and training plans, your consent is enough. Alternatives also need the area “Nutrition” under Settings, Renyu Pro, Coach, and two more features the matching area there: for the meal week (area “Nutrition”), your calorie goal, the names of your recipes with their calories per serving, the names of your meals (up to six) and a free note are included. For the day plan (area “Tasks and day plan”), the date, your waking hours, the times at which you are busy according to your calendar or plan (without titles), the names of habits due with their usual start time, the titles of open tasks and to-dos with their duration and a free note are included; if you turn on “strong hours” in the sheet, also two hour figures that Renyu forms from the times you tick things off and your focus times; values from Apple Health are not used for this and are not sent. Single entries of your food diary and averages are not included. A photo's location and capture details are removed first. Values from Apple Health, your name, your logbook and the titles of your calendar events are not sent; from your journal only the one entry on which you tap “Follow-up from the Coach” (see below). A free question to the Coach does not exist in this version. Should it return, Renyu sends it only when you submit it yourself and have agreed beforehand.

The recipients are Cloudflare, Inc. (operating the service the request passes through) and OpenAI Ireland Ltd., Dublin, Ireland (AI model), each as a processor. Processing may take place in countries outside the EU, mainly the United States, at OpenAI also by affiliated companies; the basis is standard contractual clauses or an adequacy decision of the European Commission and, for Cloudflare, its certification under the EU-US Data Privacy Framework.

On Android, Google is added: for Play Integrity, which route measuring also triggers, and for checking your purchase with Google Play.

Renyu stores neither your request nor the result on a server, with one exception: a suggestion you report (see “Reporting a suggestion” below). Renyu's service stores only what it needs for protection against misuse: a random identifier of this app installation with its verification key, a non-reversible hash of your purchase, the summed cost of your requests per day and month and the summed cost of all requests together per day, for at most 13 months. Apple confirms the verification key through App Attest. Apple learns that this app installation is genuine, but nothing about your requests. If the model rates a request as outside the Coach's topic, the service counts this per purchase hash and day and may pause the Coach for you for a while; the counter is deleted after at most four days. This also applies to “Suggest alternatives”. So that nobody floods the service with requests, it counts requests per IP address in a 60-second window and keeps the address only as a non-reversible hash for this; it is deleted with the daily clean-up, at the latest after about 24 hours. The service runs at Cloudflare, which technically processes your IP address. OpenAI generally keeps requests and answers for up to 30 days to detect misuse, longer only where the law requires it or it is needed to prevent harm, and does not use them to train models.

On Android, when this device first signs in, the app asks Google Play Integrity for a token and sends it to the service. This happens for the Coach or for route measuring, whichever you use first. The service has Google check whether the sign-in comes from the Renyu app from Google Play on a genuine device. This protects against misuse and happens once per device. Google receives details about the device and the app. With every request the app also sends the proof of your purchase from Google Play; the service checks it live with Google Play and does not store it.

The legal basis is your consent (Art. 6(1)(a) and, where a request reveals something about your health, Art. 9(2)(a) GDPR). You can withdraw it at any time under Settings, Renyu Pro, Coach, entirely or for single areas. Without consent everything else in Renyu works as usual.

So that the service knows the Coach belongs to your purchase, Renyu sends the Apple-signed proof of your purchase with every request. It contains no name and no payment details. The service checks it and does not store it.

Reporting a suggestion. Under every result of the Coach you can report the suggestion (Android). If you choose a reason (Wrong, Inappropriate or Other) and tap “Send”, the text of that one suggestion, as it is shown, goes to the Renyu server at Cloudflare with your reason and the language of the app (German or English). If the suggestion names your routines, recipes, foods or tasks, those names are in the report too. No name, no account, no identifier of your device or app installation, no proof of purchase and no IP address are stored with the report. For the check, the app sends the random identifier of this app installation with a signature, as with every request to Renyu AI. This is how the service checks that the report comes from a genuine installation of the app. With the identifier it only counts how many reports arrive, and it deletes this count in the daily cleanup; as with every request, this counts as the identifier's last use; it is not attached to the report. Renyu reads reports to check where the Coach gets it wrong and does not pass them on to third parties. The report is deleted after 90 days. Because it is not linked to any device or account, Renyu cannot look up a single report on request or delete it earlier; the deletion after 90 days applies in any case. The legal basis is your consent by sending (Art. 6(1)(a) GDPR and, where the suggestion contains information on health, nutrition or training, Art. 9(2)(a) GDPR). You can withdraw it at any time for the future (Art. 7(3) GDPR): if you stop reporting, nothing more is sent. If you do not report, none of this is sent.

Follow-up to journal entries

Your journal stays on your device and, if you turn on sync, in your iCloud. The only exception: if you have the Coach (with Renyu Max or as an add-on to Renyu Pro), have given separate consent and tap “Follow-up from the Coach” on an entry, the text of that one entry is transmitted to answer it and is not stored by Renyu. As a rule, OpenAI may keep it for up to 30 days. You can withdraw your consent at any time in Settings.

There is a separate switch for it, “Follow-up to journal entries”, in Settings. It starts off. Turning it off withdraws your consent, and no entry goes out any more.

Sharing and links

You can pass on routines, training plans, recipes and your invitation as a file or as a link. You can pass on your vision board, or a single entry, as an archive (ZIP) with texts, links, photos and files or as one picture, and a single entry also as a file that someone can open in Renyu and add to their own vision board. You can also pass on a studio as a file or link, a habit as an invitation link, your shopping list as text and your avatar as a picture or look file. You can also share cards as an image, your cycle overview and your weekly, monthly or custom report as a PDF, all your entries as a ZIP with “Export my data”, and a journal entry or a goal as text. This only happens when you trigger it yourself, through the iOS share sheet. You save a cycle backup yourself through the Files app, in a place you choose. The cycle overview, report, export and backup can contain health data, including cycle entries from Apple Health and body values you entered in Renyu. Where a file goes is up to you. We receive none of it. A link contains the content itself, in the part after the # sign. That part is not sent to renyu.info when the page is opened. Our web host (united-domains GmbH) processes IP address, time and the requested page when the page is called, as with any page view, but not the content. The app you use to send the link can read the whole link, like any message you write there. For a link it receives, Renyu retrieves nothing from the internet and adds nothing without your confirmation.

Sharing on Android: You can pass on recipes as text, image, PDF or link, routines and training plans as a file, your studio as a link, routes as a GPX file, cards as an image or text, your vision board as an image or ZIP file, single vision board entries also as a Renyu file or text, and journal entries as text. As a file you can also pass on your cycle overview (PDF) and, with “Export my data”, your entries (ZIP file). This only happens when you trigger it yourself, through the Android share sheet. The cycle overview contains your cycle entries and days from Health Connect. You save a cycle backup yourself as a file in a place you choose, with or without a password. It also contains your cycle entries. The export can contain health data that you entered yourself, such as nutrition, fasting, workouts, cycle, mindfulness, lab values, medication, body values and sleep. Values and workouts that come from Health Connect are not included. Where a file goes is up to you. We receive none of it. A link contains the content itself, in the part after the # sign. For a recipe that is the recipe without a photo, for your studio its name and the equipment it lacks. That part is not sent to renyu.info when the page is opened. Our web host (united-domains GmbH) processes IP address, time and the requested page when the page is called, as with any page view, but not the content. The app you use to send the link can read the whole link, including your note on the recipe, like any message you write there. When you open a Renyu link, Renyu first shows a preview. Renyu does not fetch anything from the internet for a received link and takes nothing over without your confirmation.

Receiving from other apps: If you share a photo, a link, a routine or a workout (GPX or TCX) from another app with Renyu, Renyu reads it on the device and adds it only when you tap. Renyu fetches nothing from the internet for this.

Public profile & friend code

The social area has one place that does not sit on your device: for someone to find you by your friend code, that code has to be lookupable somewhere. With your consent, your directory entry sits on the Renyu server for that. This one entry then no longer sits with you alone. Without consent there is no entry.

It is created only when you accept the terms of use for the social area and consent to the Renyu server. If you do not consent, there is no profile and no entry.

Anyone with a Renyu account who knows your friend code can read this entry. They need not be your friend, and you do not find out. That is why it contains exactly this, and nothing else:

• Your display name: the name you give yourself.
• Your Mii avatar as the set of its parts (face, hair, colours, clothing). A drawn figure, not a photo of you.
• Your friend code as the entry's name, and a pseudonymous account identifier on the Renyu server. It says nothing about you but links the entry to your account.

The entry has no other fields. Health, body and nutrition values, habits, streaks, badges, training plans and your daily rhythm have no field there. What you knowingly share with one particular person goes the other way, through the Renyu server, described in the next section.

Friend requests use the same directory. When you send a request, an envelope addressed to that one person lies there. It holds the pseudonymous identifiers of you and the person you asked (the account identifiers on the Renyu server), your display name, your friend code, the invitation to your friendship and its expiry date. If the person accepts, their app leaves an answer for you the same way, with the same details about them. After 14 days an envelope expires and is no longer delivered. It is deleted once you are connected or it has expired, and the server does that. Nothing measured about you is in it. Cheering uses the same mailbox so that it arrives even when the app is closed. The envelope holds the pseudonymous identifiers of you and the person, your display name, your friend code and the time. If you send emojis, they, up to three, are in the envelope too, so that the notification on the lock screen can show them. They lie there as plain text. The cheer stays on the Renyu server until you cheer again, the friendship ends or you delete your account; every new cheer overwrites it. After 24 hours the app no longer notifies about it. If you end a friendship, the app leaves an “ended” envelope with the same details about you the same way, so that the other app closes the friendship too; it expires after 14 days.

Reports go there as well: if you report a profile or an invitation link, the identifier of the reported profile (for a link, the sender's friend code), the reason you picked and the time are stored. The report sits on the Renyu server, together with your account identifier. The server deletes it after six months at the latest; with “Delete social profile” you remove your own reports yourself. The app also opens a prepared email to support@renyu.info with that identifier and the reason. If you send it, we see your sender address. We use it only to handle the report and keep the email only as long as handling it requires.

The legal basis for the social area is your consent (Art. 6(1)(a) GDPR). For reports and protection against abuse it is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the users of the social area from abuse.

Friends & sharing (if used)

When someone accepts your request (or you accept theirs), this friendship runs through the Renyu server and is meant only for this person. Its contents sit there as plain text, protected by the encrypted transfer at Cloudflare and by access rules. They never go to third parties and never to advertising.

This is what a friend sees, and nothing else: your display name, your avatar with its ring, your friend code, your banner and your level; a random Renyu identifier without a name, which is not shown to anyone; the badges you pin to your profile (for habits, tasks, journal, goals, level, friends and Renyu), with their kind and their step, never with a measured value and never with the content of a goal or entry; your habit streaks, meaning your overall streak and how many of the habits due today you have done, for example “2 of 5”. Per habit, friends see its name, symbol, colour, current streak, whether it is due today and whether it is done today only if you turn on habit details for that person (off by default); habits you keep together are always shown to them with their name. Also training plans you explicitly send to this person, and when you last cheered them on, if you like with one of three fixed gestures (hi, thumbs up, applause) or with up to three emojis from your device’s emoji keyboard, never with a text of your own.

Weekly round: if you take part, you share with your friends the number of habits you checked off yourself this week. Nothing more, and only while the “I'm taking part” switch is on.

Streaks and pinnable badges come only from your own entries. A habit that Apple Health ticks off or that is linked to Apple Health does not appear there and does not count. Badges based on workouts, goals or values from Apple Health stay on your device and cannot be pinned. No value from Apple Health and no body value reaches another person. From your nutrition, only what you send to friends yourself as a recipe or meal goes out.

A training plan goes only to the person you send it to: its name, its notes, its schedule, all weeks and training days and, per day, the exercises with the planned sets, reps, durations and distances. What you actually trained (sets, weights, heart rate) does not travel.

Recipes you send to friends yourself: ingredients, steps and the nutrition values of the dish. Renyu never shares your food diary.

If you send a logged meal to friends, it travels as a recipe with one serving: name, parts and nutrition values. When you ate and that you ate it does not travel.

Invitation to a shared habit: when you invite a friend, they see the name, symbol, colour and rhythm of that one habit. An invitation link contains the same details and your friend code. When your friend accepts, you learn the name of their habit. If you both switch on “A tick counts for both”, your friend sees on which of the last seven days you ticked this habit off by hand, and your tick counts for them too. Targets, notes and all other entries do not travel, and a habit that Apple Health ticks off cannot be shared this way.

Streaks, level and the badge areas are visible by default, streaks only as progress (“2 of 5”). You turn streaks off under Social → your profile → Visibility, and the level and each area under “What friends see”. You release the details per habit for each person separately on their page (“Habit details”), off by default. You take a badge off your profile under “What friends see”. With the next sync everything disappears from every shared area, not just from view.

In Renyu, you and the other person only see the display name.

Friends through the Renyu server

Renyu runs a service for friends at Cloudflare. The data is stored in the EU. Without your consent Renyu creates no account there.

Only what you enter yourself goes to friends, never a value from Apple Health.

With your consent, everything you share with a friend goes through the Renyu server. That is your profile with streaks, level, pinned badges, banner and ring, your individual habits only for friends where you switch that on, invitations to shared habits, training plans, recipes and meals with their nutrition values and cheers you send, and the weekly round if you join. It is stored there as plain text, protected by Cloudflare's encrypted transport and by access rules.

Up to version 0.5.45, friendships ran through Apple's iCloud. With version 0.5.46 the app cleans up once: these friendships end on the device, and the entries for them in your iCloud, the directory and the shared areas, are deleted. Your social profile stays. Former friends connect once more. Without your consent you cannot connect with friends; the rest of Renyu keeps working as usual.

What is stored on the Renyu server is what friends see of you: your profile, your streaks and your level. Streaks and level are on at first, and you can switch them off in the settings for friends.

To protect against abuse, the Renyu server keeps a daily hash of your network address and the proof of your device (on iPhone App Attest, on Android the attestation from the Android key store). The network address is stored only as a daily hash and deleted after three days at the latest. It deletes the proof of your device together with your account.

With your consent, the Renyu server keeps this device's notification token. It is a random identifier that Apple or Google assigns for notifications. The Renyu server uses it only to send you notifications from friends, such as a friend request or a cheer. If you delete your account on the Renyu server or withdraw your consent, it deletes the token and the key.

The Renyu server deletes reports after six months at the latest.

You get access to and deletion of your data on the Renyu server in the app. You can also reach us at contact@renyu.info.

How to delete your account on the Renyu server is also described at https://renyu.info/en/privacy/#konto-loeschen.

The legal basis for the Renyu server is your consent (Art. 6(1)(a) GDPR). For reports and the daily hash that protects against abuse it is Art. 6(1)(f) GDPR.

On Android: Without your consent, Renyu creates no account on the Renyu server. Only what you enter yourself goes to friends, never a value from Health Connect. With your consent, everything you share with a friend (profile card, habit invitations, recipes, training plans) goes through the Renyu server. Without consent you cannot connect with friends; the rest of Renyu keeps working as usual. At the first sign-in, the server uses an attestation from the Android key store to check that a genuine Renyu app on a genuine device is asking; for this the server loads Google's check list, and no data about you goes to Google. You delete your account on the Renyu server in the app.

Storage and deletion

You can delete your data in the app yourself at any time (Settings → Data → “Start Over or Delete”). No copy of your entries sits on the Renyu server, only what you switch on for friends with your consent, so for everything that exists only on your device, that deletion is final.

You delete your account on the Renyu server in the app with “Delete social profile”. This removes your account, your directory entry, your friendships and everything you shared. Your own entries in the app stay.

“Delete social profile” (and “Delete all local data”) ends your friendships and deletes your open requests, your own reports and your directory entry. If you agreed to the Renyu server, Renyu also deletes your account on the Renyu server; backups are empty after 30 days at the latest. The profile disappears from the app at once; the deletion continues, even after a restart or without a connection, until everything is removed, and the app tells you when it is done. If that fails online in an exceptional case, the app tells you and tries again at later launches when there is a connection. Once it succeeds, the app tells you that too. If the app can no longer delete it online at all, it tells you once and names the way by email. If you write to us at contact@renyu.info, we delete your account within 30 days and confirm it to you by email.

If you no longer have the app, write to contact@renyu.info with your friend code and ask us to delete your account on the Renyu server. We then delete it within 30 days as described above and confirm it to you; backups are empty 30 days later. If we have reasonable doubts that the account is yours, we ask you first. We cannot reach your entries on your device; they are removed when you uninstall the app. You can remove a copy in your iCloud in your device's iCloud settings under “Manage Storage”.

A training plan a friend has already adopted into their own library is their own copy there. It belongs to that person and stays with them.

In-app purchases

You buy Renyu Pro, Renyu Max and the Coach through the App Store. Apple handles the purchase, the payment and the subscription as a controller in its own right, under Apple's own privacy policy. We never see your payment details, your name or your Apple ID in the process.

Renyu checks on your device which purchases belong to your Apple ID. The app sees only Apple’s signed purchase confirmation, such as which product, until when it runs, whether it was revoked and whether it comes through Family Sharing. It contains no name, no Apple ID and no payment details. As long as you do not use the Coach, this confirmation stays on your device. With the Coach, Renyu sends it to the Renyu service with every request. The service checks it but does not store it; it keeps only a non-reversible hash of your purchase (see “Coach (AI)”). In addition, Apple sends the Renyu service a signed notice when something changes for a purchase in Renyu, such as a renewal, a refund or the end of a subscription. This applies to every purchase, with or without the Coach. The notice contains details of the purchase (such as product, dates, country and price), but no name, no Apple ID and no payment details. On a refund, a revocation or the end of a subscription, the service puts the hash of that purchase on a block list so that the purchase no longer unlocks the Coach; it discards every other notice at once. It deletes the entry no later than 13 months after setting it. The legal basis is our legitimate interest in preventing misuse of the Coach after a refund (Art. 6(1)(f) GDPR). There is no customer account. Beyond that, we receive from Apple only aggregated sales and payment reports (such as product, country, number and proceeds), which do not show who bought.

Purchases on Android: Purchases in Renyu go through Google Play. Google handles the purchase, the payment and the subscription as a controller in its own right, under Google’s own privacy policy. Renyu never sees your payment details or your name. As long as you do not use the Coach, the proof of purchase stays on your device. With the Coach, the app sends it with every request to the Renyu service, as described under “Coach (AI)”.

Email support

If you write to support@renyu.info, we receive your email address, your name if you give it, and the content of your message including attachments. If you open the email from within Renyu, the app version and build are in the subject, the device model and iOS version in the text. You see this in your mail app before sending and can change it. If you report a missing exercise from the exercise search, the email contains only your search term and the app version, no device.

The mailbox is hosted by united-domains GmbH (Gautinger Straße 10, 82319 Starnberg), which runs it as a processor on our behalf (Art. 28 GDPR), exclusively in the EU. The legal basis is Art. 6(1)(b) GDPR if your request concerns the app or your purchase, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering your request.

We delete your email once your request has been dealt with. If it matters for business purposes, for example for an invoice, we keep it as long as the tax retention periods require and delete it afterwards.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Since your data sits locally on your device, you exercise these rights directly in the app.

Send questions about data protection and your rights under Art. 15 to 21 GDPR to contact@renyu.info. An email is enough. You also get access to and deletion of your data on the Renyu server directly in the app.

We also answer questions about data protection through the developer contact details on the product page in the App Store.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work or where the alleged infringement took place. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de.

Controller and contact

The controller within the meaning of the GDPR is Jan Malwitz, Im Drostebusch 18b, 48155 Münster, Germany. Email: contact@renyu.info. All further details are in the imprint.

This website

renyu.info consists of fixed pages. No cookies are set, no tracking pixels are loaded and no content from third-party servers is embedded; fonts, images and videos are hosted here. A small script reads the time on your device so the home page can show what the avatar is doing at that hour, and it starts the motion of the images. It stores nothing on your device and sends nothing. That is why there is no consent banner.

As with any web server, technically necessary access data arises when you visit: IP address, time, page requested, amount of data transferred, and browser and operating system as far as your browser sends them. They serve only to deliver the pages and to run the server securely, for example to detect attacks. They are not combined with other data, not analysed, and deleted after 7 days at the latest or the IP address in them is shortened.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is that the website is available and secure. You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR).

The website is hosted by united-domains GmbH (Gautinger Straße 10, 82319 Starnberg, Germany). The host processes the access data as a processor on our behalf (Art. 28 GDPR) and not for its own purposes, exclusively in the EU. It runs the servers in data centres of IONOS SE and NorthC Deutschland GmbH. The server logs are deleted after 7 days at the latest or the IP address in them is shortened.

Controller and contact

Controller under the GDPR

Jan Malwitz
Im Drostebusch 18b
48155 Münster
Germany

Email

contact@renyu.info

Everything else is in the legal notice (German). You can also assert your rights under Art. 15 to 21 GDPR here; an email is enough.