Privacy Policy
This policy explains what personal data the Gut Garden mobile app and the website gutgarden.app (together, the “Service”) process, why, and what rights you have. We wrote it to be read — no legalese where plain words will do.
1. Who is responsible (data controller)
The Service is operated by Márton Takács, a private individual based in Hungary (the “controller” under the EU General Data Protection Regulation, GDPR).
Contact for anything in this policy, including exercising your rights: hello@gutgarden.app. Postal contact details are available on request.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data — your email address and a password (the password is handled entirely by our authentication provider Clerk; we never see it) | Creating and securing your account, signing you in | Art. 6(1)(b) — necessary to perform our contract with you (the Terms) |
| Your food log — your daily answers (plant and ferment counts, three yes/no answers), optional food tags, and the scores, streaks and statistics derived from them | Showing you your own scores, streaks and progress — the core function of the app | Art. 6(1)(b); to the extent this diet data reveals information about your health, Art. 9(2)(a) — your explicit consent, which you give at sign-up and can withdraw at any time by deleting your account |
| Technical logs — short-lived server logs (IP address, request time) generated when the app talks to our API | Keeping the Service secure and diagnosing failures | Art. 6(1)(f) — our legitimate interest in running a secure service |
| Language preference | Showing the app in your language | Stored on your device only — it never reaches our servers |
That is the whole list. Gut Garden has no ads, no analytics or tracking SDKs, and we do not sell or share your data for marketing. We do not profile you and make no automated decisions with legal or similarly significant effects (Art. 22 GDPR).
3. Where your data lives and who processes it
We use a small number of processors that handle data on our behalf under data-processing agreements:
| Processor | What they do | Location / transfer safeguard |
|---|---|---|
| Neon, Inc. (neon.tech) | Database hosting for your food log | EU — Frankfurt, Germany (eu-central-1) |
| Vercel, Inc. (vercel.com) | Hosts our API and this website | API served from the EU (Frankfurt); Vercel is a US company — transfers covered by the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Clerk, Inc. (clerk.com) | Authentication — stores your email and password hash | US — transfers covered by Standard Contractual Clauses / the EU–US Data Privacy Framework |
All data is encrypted in transit (HTTPS/TLS).
4. How long we keep it
- Account and log data — for as long as your account exists. When your account is deleted, your data is deleted from our systems within 30 days (residual copies in encrypted backups expire on the backup rotation schedule shortly after).
- Technical server logs — kept briefly by our hosting providers (typically under 30 days) and then deleted.
5. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy (Art. 15);
- Rectify inaccurate data (Art. 16) — you can edit any day's answers directly in the app;
- Erase your data (“right to be forgotten”, Art. 17);
- Restrict processing (Art. 18);
- Portability — receive your data in a machine-readable format (Art. 20);
- Object to processing based on legitimate interest (Art. 21);
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
To exercise any of these, email hello@gutgarden.app from the address on your account. We respond within one month. Exercising your rights is free.
Account deletion: email us and we will delete your account and all associated logs within 30 days of your request.
You also have the right to lodge a complaint with a supervisory authority — in Hungary, the National Authority for Data Protection and Freedom of Information (NAIH), Budapest, Falk Miksa u. 9–11, 1055; naih.hu — or the authority in your own EU/EEA country.
6. Children
Gut Garden is not directed at children. You must be at least 16 years old (or the age of digital consent in your country) to create an account. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
7. Security
We use industry-standard measures: encrypted transport (TLS), authentication handled by a dedicated provider (we never store passwords ourselves), access limited to authenticated sessions, and a deliberately minimal data footprint — we cannot lose what we do not collect.
8. This website
gutgarden.app sets no cookies and runs no analytics. Our hosting provider (Vercel) generates short-lived technical request logs as described above.
9. Not medical advice
Gut Garden is an educational habit tracker, not a medical device, and provides no medical advice, diagnosis or treatment. See the full disclaimer.
10. Changes to this policy
If we change this policy, we will post the new version at this URL and update the effective date. For material changes we will notify you in the app before they take effect.