1. Who we are
The Nousshub mobile application (the "App" or the "Service") is developed and operated by the sole proprietorship Sidiropoulos Andreas Anestis (Greek: Σιδηρόπουλος Ανδρέας Ανέστης), with its registered address at Kristoni, 61100, Kilkis, Greece, Greek Tax ID (AFM) 104476881, Kilkis Tax Office (hereinafter "we", "us", "Nousshub").
For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and Greek Law 4624/2019, we act as the Data Controller of the personal data described in this Policy.
| Contact for | Details |
|---|---|
| General enquiries and support | [email protected] |
| Personal data matters and exercise of your rights | [email protected] |
| Postal address | Kristoni, 61100, Kilkis, Greece |
| Phone | +306986896650 |
| Website | https://nousshub.com |
2. What this Policy covers
This Privacy Policy explains which personal data we collect when you use the Nousshub App and its related services (servers, website, customer support), for what purpose we process them, on what legal basis, with whom we share them, how long we keep them and what rights you have.
This Policy does not cover processing carried out independently by third parties such as Apple Inc., Google LLC, the Apple App Store and Google Play. Those third parties are governed by their own privacy policies.
3. What data we collect
We collect only the data needed for the App to work. Many categories are optional: the App works without them, but with limited features.
3.1 Account and profile data
| Data | Source | Required |
|---|---|---|
| First name, last name, email address, password (stored only as a cryptographic hash, never in plain text) | You, at registration | Yes |
| The version of the Terms of Use and Privacy Policy you accepted, and the date and time of acceptance | You, at registration or when you are asked to accept a new version | Yes — needed to document the conclusion of the contract |
| Profile photo, height and age | You, optionally, during initial setup or from the settings | No |
| Username, phone, date of birth, gender, country, city and address details | You, optionally, if you fill them in | No |
| Device time zone and app language | Device | Yes — needed to calculate daily and weekly goals correctly |
| Identifier from Google or Apple, as well as the name and email address the provider passes to us | Google / Apple | Only if you choose to sign in with Google or Apple |
Optional profile details are kept in your account on our servers and also as a local copy on your device, so they can be shown without an internet connection. The exception is the profile photo, which is stored only locally on your device and is not sent to our servers.
When you use Sign in with Apple you can choose to hide your email address. In that case we receive an anonymous Apple relay address, not your personal address.
3.2 Health and wellness data (special category)
If you grant the relevant permission, the App reads data from Apple Health (iOS) or Health Connect (Android). These are special category data under Article 9 GDPR and we treat them with enhanced protection.
| Group | Specific measurements |
|---|---|
| Activity | Steps, active calories, basal calories, walking distance, cycling distance, flights climbed, exercise minutes, stand hours |
| Heart and recovery | Heart rate (average, minimum, maximum), resting heart rate, heart rate variability (HRV), maximal oxygen uptake (VO₂max), blood oxygen saturation (SpO₂) and respiratory rate (iOS only) |
| Running form (iOS only) | Running speed and power, stride length, ground contact time |
| Sleep | Total sleep duration and, if your device measures them, deep sleep and REM sleep |
| Body measurements | Body weight, body fat percentage, lean body mass |
| Workouts | Activity type, start and end time, duration, calories, distance, average heart rate |
You can grant access to only some of the categories above. The App works with whatever you allow.
The App also writes data back to Apple Health / Health Connect, specifically the body weight you enter, so that your other apps stay up to date. This is done only with your permission and only on your device.
3.3 Training and activity data
- The sports you choose and the programmes and workout templates you create.
- Exercises, sets, reps, weights, rest times, equipment and the notes you write.
- Timed sessions (intervals, rounds, durations).
- Endurance activities (running, cycling): duration, distance, pace or speed, indoor or outdoor.
3.4 Location data
The App uses your location in one case only: when you record an endurance activity with GPS.
| Case | What is collected | Where it is stored |
|---|---|---|
| Route recording during a run or ride | A sequence of geographic coordinates (your route), distance and pace. Recording continues while the App is in the background or the screen is locked, so the measurement is not interrupted. | Locally on your device and, together with the activity summary, on our servers in the EU, so that your history remains available from another device. |
We do not track your location when you have not started recording an activity, and we do not use your location for advertising or profiling.
3.5 Nutrition data
- Meals and foods you enter yourself, quantities and portions, time of consumption.
- Calories, macronutrients (protein, carbohydrates, fat) and micronutrients.
- Nutrition goals, water intake, foods you create, recipes and recurring meals.
- Barcodes you scan to look up foods.
3.6 Photos, voice recordings and AI recognition
The App lets you log a meal by photo, voice description or free text. In these cases:
- The photo, recording or text is sent to our servers and from there to an artificial intelligence service provider (Google — Gemini services) solely to recognise the food and estimate its nutritional values.
- The result comes back to the App so you can check and correct it before it is saved.
- The photo and the recording are not stored. They are processed only transiently, solely to produce the result, and are not kept either by us or in your account. Only the nutritional result you confirm as correct is saved.
We also use the camera to scan barcodes. Scanning takes place locally on the device and no image is sent to our servers — only the barcode number.
You can optionally choose a photo from your gallery as the background of your route image. This selection takes place locally on the device.
3.7 Subscription and payment data
Subscriptions are purchased exclusively through the Apple App Store or Google Play. Your card or bank account details are handled entirely by Apple or Google: we have no access to them and never receive or store them.
We receive and store: the subscription plan, its status and start and end dates, the store transaction and product identifier, the originating store, the amount and currency charged, and whether auto-renewal is active.
3.8 Technical and diagnostic data
- Device type and model, operating system and version, App version and build number, language.
- A stable installation identifier (device ID) generated by the App and used to manage your signed-in sessions.
- IP address, date and time of requests to our servers.
- Error and crash reports, with the technical trace of the error and the steps that preceded it.
3.9 Support data
When you submit a support request, we receive the request category, your message, the reply email address you provide and the technical and diagnostic data described in section 3.8, so that we can identify the problem.
What we do not collect. We do not collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation. We do not use advertising identifiers, do not integrate advertising networks and do not track your activity in other apps or websites.
4. Why we process your data and on what legal basis
| Purpose of processing | Data categories | Legal basis |
|---|---|---|
| Creating and managing your account, authentication and secure sign-in | Account, profile, technical | Article 6(1)(b) GDPR — performance of our contract with you |
| Providing the core features: training and nutrition logging, goals, statistics, history | Training, nutrition, profile | Article 6(1)(b) GDPR |
| Reading, syncing and displaying your health data, calculating the Readiness and Momentum indicators | Health (special category) | Article 9(2)(a) GDPR — explicit consent required, in conjunction with Article 6(1)(a) |
| GPS route recording during an activity | Location | Article 6(1)(a) GDPR — consent required, given through the device location permission when you turn on GPS |
| Food recognition from photo, voice or text | Photos, voice recordings, text | Article 6(1)(b) GDPR and, where the material contains special category data, Article 9(2)(a) |
| Managing subscriptions, unlocking features, enforcing usage limits | Subscription, account | Article 6(1)(b) GDPR |
| Issuing and keeping tax records | Subscription, account | Article 6(1)(c) GDPR — compliance with a legal obligation |
| Providing support and responding to your requests | Support, technical | Article 6(1)(b) and (f) GDPR |
| System security, prevention of abuse and fraud, detecting and fixing errors, improving the stability of the App | Technical, diagnostic | Article 6(1)(f) GDPR — our legitimate interest in running the Service reliably and securely |
| Sending local reminders and notifications on your device | User settings | Article 6(1)(a) GDPR — consent required, given by enabling the notifications permission |
| Sending informational and promotional messages about the Service | Email, name | Article 6(1)(a) GDPR — consent required; for existing customers and in relation to similar products, Article 11(3) of Greek Law 3471/2006 |
| Establishment, exercise or defence of legal claims | As applicable | Article 6(1)(f) and Article 9(2)(f) GDPR |
5. Your consent for health data
The processing of health data is based solely on your explicit consent. We want to be completely clear about what this means:
- Permission is granted per data category, through Apple Health or Health Connect. You can allow only some categories of data.
- You can withdraw the permission at any time from your device Settings. From the moment of withdrawal we immediately stop reading and receiving new data.
- Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- To have health data already synced to your account deleted, submit a request under section 10 of this Policy and we will then delete it.
In compliance with the Apple and Google terms, we expressly undertake that we do not use data from HealthKit or Health Connect for advertising, marketing, data mining or any purpose other than displaying and analysing your own health and training within the App, and we do not sell them or share them with third parties for purposes other than those set out in section 6 of this Policy.
6. Who we share your data with
We do not sell or rent your personal data. We share them only with the following recipients and only to the extent necessary:
| Recipient | Role | Data | Location |
|---|---|---|---|
| Railway Corp. | Processor — hosting of the application and database | All of your account data | EU |
| Google Ireland Ltd. / Google LLC (Gemini services) | Processor — food recognition. The material is processed only transiently and is not stored. | Meal photos, voice recordings, text descriptions | EU |
| Functional Software, Inc. (Sentry) | Processor — error reporting | Technical and diagnostic data, IP address, user identifier | EU (Germany) |
| RevenueCat, Inc. | Processor — subscription management | User identifier, subscription and store transaction details | USA |
| Sendinblue SAS (Brevo) | Processor — sending email | Email address, name, message content | EU (France) |
| 650 Industries, Inc. (Expo / EAS) | Processor — building and distributing App releases | Technical installation data | USA |
| Apple Inc. and Google LLC | Independent controllers | Purchase and subscription details, identification data when signing in with Apple or Google | USA / EU |
| Accountant, legal and technical advisers | Processors or independent controllers, as applicable | Only what is strictly necessary | Greece / EU |
| Public authorities and courts | Recipients required by law | Only what the relevant legal provision or decision requires | Greece / EU |
A contract under Article 28 GDPR has been concluded with each processor. In the event of a transfer or reorganisation of the business, data may be transferred to the successor of the business, who will be bound by this Policy. In that case you will be informed in good time.
7. Where data is stored and transfers outside the EEA
Our servers and database are hosted within the European Union. Your account data — including health data, nutrition entries and routes — remain within the European Economic Area.
However, some of the providers in section 6 are established in the United States — in particular RevenueCat for subscription management and Expo for building and distributing App releases. To the extent that personal data is transferred to them, the transfers take place with the safeguards of Articles 44 et seq. GDPR, namely:
- the European Commission adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework, where the provider concerned is certified, and/or
- the European Commission Standard Contractual Clauses, together with supplementary technical and organisational measures.
You can request a copy of these safeguards at the contact address in section 1.
No health data is transferred outside the EEA.
8. How long we keep your data
| Category | Retention period |
|---|---|
| Account and all of your content (workouts, nutrition, health, activities) | For as long as your account remains active. After a deletion request, they are deleted within 30 days of our receipt of your request. |
| Inactive accounts | If you do not sign in for 24 months, your account and data are deleted, after prior notice to you by email. |
| Health data | Same as for the account, or immediately after withdrawal of consent and a related deletion request. |
| Photos and voice recordings for food recognition | Not kept. They are processed only transiently and are stored neither by us nor by the recognition provider. |
| GPS routes of activities | Same as for the account |
| Error reports (Sentry) | 90 days from our receipt of the error report |
| Server logs | 12 months |
| Support requests and related correspondence | 24 months from resolution of the issue |
| Tax and accounting records | As required by tax law, at least five (5) years |
| Backups | Data remains in backups for 30 days after deletion from the live systems and is then permanently deleted. |
| Data related to legal claims | Until the relevant claims become time-barred |
9. Your rights
As a data subject you have the following rights:
- Access (Article 15 GDPR): to find out whether we process your data and to receive a copy.
- Rectification (Article 16): to correct inaccurate or complete incomplete data.
- Erasure (Article 17): to request deletion of your data, unless there is a lawful reason to keep it.
- Restriction of processing (Article 18).
- Portability (Article 20): to receive the data you provided to us in a structured, commonly used and machine-readable format. You can get a copy of your data at any time directly from the App, using the data export feature in Settings.
- Objection (Article 21) to processing based on our legitimate interest, and at any time to processing for direct marketing purposes.
- Withdrawal of consent (Article 7(3)), without affecting the lawfulness of prior processing.
- Complaint to the supervisory authority.
- Information: You have the right to be informed clearly and transparently about how we use your personal data and about your rights.
10. How to exercise your rights
Contact [email protected] or use the "Help & Support" screen in the App. We respond within one (1) month of receiving your request. This period may be extended by two further months if the request is complex, in which case we will let you know. Exercising your rights is free of charge.
We may ask for additional information to confirm your identity, so that data is not disclosed to third parties.
10.1 Deleting your account
You can delete your account directly in the App, from Settings → "Delete account". To confirm your identity you will receive a six-digit code at your account email address.
Once you confirm, a thirty (30) day grace period begins. If you sign in again during this period, the deletion is cancelled. When the period ends, your account and all your data are permanently deleted, subject to section 8. Before deletion you can get a copy of your data using the data export feature (see section 9).
Alternatively, you can request deletion of your account and all your data by emailing [email protected] from your account email address, or through the support form in the App.
Deleting your account does not automatically cancel your subscription. Cancellation is done from the subscription settings of the App Store or Google Play.
10.2 Complaint to the supervisory authority
If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority:
| Item | Details |
|---|---|
| Address | 1–3 Kifisias Avenue, 115 23 Athens, Greece |
| Phone | +30 210 6475600 |
| [email protected] | |
| Website | www.dpa.gr |
11. Data security
We apply appropriate technical and organisational measures under Article 32 GDPR, including:
- Encryption of all communication between the App and our servers via TLS/HTTPS.
- Storing passwords only as a salted cryptographic hash, never in plain text.
- Authentication with short-lived tokens and a single-use refresh mechanism, so that a stolen token has limited value.
- Access control, so that each user can access only their own data.
- Error monitoring and regular security updates of software dependencies.
No method of transmission or storage is completely secure. In the event of a breach likely to result in a high risk to your rights, we will inform you without undue delay, in accordance with Articles 33 and 34 GDPR.
12. Minors
The App is intended for people who have reached the age of 16. We do not knowingly collect data from younger people. If we become aware that an account has been created by a minor under 16 without the required consent, we will delete it.
If you are a parent or guardian and find that your child has provided us with data, please contact us at [email protected].
13. Data that stays on your device
Some data is stored only locally on your device and is never sent to our servers, so that the App can work without an internet connection:
- Your profile photo.
- Display, theme and language preferences, and notification settings.
- The state of the current workout or activity, so that it is not lost if the App closes.
- Temporary copies of data that has not yet been synced.
This data is deleted when you uninstall the App or when a different user signs in on the same device. Because we do not receive or access it, we cannot give you a copy of it or delete it remotely.
14. Device permissions
The App asks for the following permissions. None is required for the core features and all can be revoked from your device Settings:
| Permission | Why we ask for it | If you decline |
|---|---|---|
| Apple Health / Health Connect | Reading your health data and writing weight | Health statistics and readiness indicators are not shown |
| Location (while in use and in the background) | Route recording for running and cycling, even with the screen locked | Endurance activities can only be logged manually, without a route |
| Camera | Scanning food barcodes and photographing meals | Meals can only be logged by searching or typing |
| Microphone | Logging meals by voice | Voice logging is not available |
| Photos | Choosing a profile photo or route background | You cannot set a photo |
| Notifications | Local reminders for nutrition, water, rest and workout completion | You do not receive reminders |
15. Notifications
The App's notifications are local: they are scheduled and shown by your device itself and are not sent from our servers. You can turn them on and off per category in the App Settings.
16. Marketing communications
We may send you informational messages about the Service, new features and offers only if you have given your consent or within an existing customer relationship and in relation to similar products and services, in accordance with Article 11(3) of Greek Law 3471/2006.
Every message includes an unsubscribe link and you can object at any time, free of charge. Service messages (email address confirmation, password reset, updates about your subscription, important changes to the terms) are not marketing communications and are sent regardless of your choice.
17. Automated decision-making
The App automatically calculates certain indicators — such as daily Readiness, the consistency indicator and the Momentum level — based on the data you record. These indicators are for information only, are intended solely for you, and do not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. We do not carry out automated decision-making or profiling with such effects.
18. Website and cookies
The App does not use cookies or third-party tracking technologies.
19. Changes to this Policy
We may update this Policy to reflect changes to the App or to the law. The current version is always available in the App and at https://nousshub.com/privacy.
For material changes we will inform you prominently in the App or by email at least thirty (30) days before they take effect. Where the change concerns processing based on your consent, we will ask for your consent again.
20. Contact
For any question about this Policy or the processing of your data, please contact us:
Sidiropoulos Andreas Anestis — [email protected] — Kristoni, 61100, Kilkis, Greece