Last updated: October 20, 2026
ROXEX Labs ("we", "our", "us") operates the Renzy mobile application and website (renzy.app). This Privacy Policy explains how we collect, use, and protect your personal information.
When you create an account, we collect your name, email address, and authentication credentials (via email/password, Google Sign-In, or Apple Sign-In).
To provide our service, we collect data you provide including: meal photos and descriptions, nutritional goals, dietary preferences, allergies, weight, height, exercise data, supplement and medication tracking, and hydration logs.
Renzy can integrate with your phone's health app: Apple HealthKit on iOS and Health Connect on Android. The integration is optional and requires your explicit consent before any access; if you do not turn it on, Renzy reads no health data at all. With your permission, we may read (never write) the following data: daily steps, calories burned, workouts, sleep duration, and weight records.
Purpose: HealthKit data is used solely to display consolidated information within the App — adjusting your daily calorie balance based on real activity, weight-trend visualization, and personalized hydration recommendations.
We do NOT use HealthKit data for advertising, marketing, sharing with third parties, selling to data brokers, or inferring demographic or behavioral traits.
Storage: Data read from HealthKit is processed primarily on-device. Aggregated daily values (kcal, weight) are synced to our server tied only to your account, never to an advertising identifier. We never write data to HealthKit.
Control: Revoke access at any time: on iOS from Settings > Privacy & Security > Health, and on Android from the Health Connect app > App permissions > Renzy. You can also disable syncing from within Renzy in Settings > Health Sync. Upon revocation, server-stored health data is deleted within 30 days.
We collect device type, operating system, and push notification tokens to deliver notifications you have opted into.
We use PostHog (EU servers) as first-party product analytics to understand how the app is used: usage events and page views, tied to your account only if you sign in and accept the cookie notice. Until you accept the cookie notice, PostHog stores nothing on your device (no cookies, no local storage): it counts visits without being able to recognise you when you come back. If you accept, it stores an identifier (a ph_* cookie and local storage) to recognise your device on later visits; if you withdraw that later in Settings > Privacy, we delete it. Optionally, we record the session (session replay) with the strictest possible masking: ALL text, ALL form fields and ALL images (including your meal and progress photos) are blocked and never captured — only anonymous interaction and screen-layout events are recorded, never their content. Session replay is enabled only with your consent and honors the Do Not Track signal. We may also show short in-app surveys, never over health screens. We do NOT use any of this data for advertising, and we do not sell it.
With your explicit consent, we use Meta Pixel, Google Ads and TikTok Ads on public website pages, and Meta App Events on iOS and Android, to measure campaigns and attribute installs, visits, sign-ups, checkout starts and subscriptions. These providers may receive browser or device technical data, IP address and advertising identifiers; on iPhone, Meta can use the advertising identifier only if you also grant the iOS tracking permission. We do not send them photos, meals, health data, free text, email addresses or profile content, and we do not send mobile-app events to Google or TikTok. Measurement does not start before consent, honors Do Not Track and can be withdrawn at any time under Settings > Privacy.
Meal photos and descriptions are processed by AI (Anthropic Claude) to extract nutritional information. Photos are stored securely in encrypted cloud storage. AI analysis results are stored in our database to provide your history and progress tracking. If you scan a dish on one of our public pages without an account and tick the consent box, we keep that photo and its analysis for up to 48 hours so they can be moved to your account as your first meal if you sign up. They are only linked to an account if you claim them yourself (when you install the app or with the code we give you); otherwise they are deleted after 48 hours.
We do NOT sell your personal data. We share data only with:
All data is encrypted in transit (TLS) and at rest. We use industry-standard security practices. Authentication is handled by Supabase Auth with secure session management.
You have the right to:
To exercise these rights, contact us at soporte@renzy.app.
We retain your data as long as your account is active. When you delete your account, all personal data is permanently removed within 30 days. Photos of scans made without an account that nobody claims are deleted after 48 hours.
Renzy is not intended for children under 13. We do not knowingly collect data from children.
We may update this policy. We will notify you of significant changes via the app or email.
ROXEX Labs
Email: soporte@renzy.app
Website: renzy.app