Account data is stored with Supabase on servers in Ireland (European Union). Each account can only read and change its own data, and account emails are sent with Resend from Ireland. This page is not a security or legal certification.
‹ Back to TaraPrivacy
What data is processed, where it is and how to exercise your rights.
This is an English translation provided for convenience. The Spanish version is the binding one.
In short: you can use Tara without an account: what you log (weight, meals, activity, injuries, profile) is then stored only on your device in browser storage; another person with device access could see it. If you create an account, that data is also stored in our Supabase database (servers in Ireland, EU) so you don't lose it and can use it on several devices. Server rules stop any account from reading another account's data, and you can delete your account and all its data whenever you like from the app.
Data controller
- Controller: Álvaro Peña Vélez
- Tax ID (NIF): 58438949C
- Address: Calle Alfonsina Storni, 3A, 39012 Santander (Cantabria, Spain)
- Contact: [email protected]
What data is processed and why
| Data | Where it is | Purpose and legal basis | Retention |
|---|---|---|---|
| Profile, questionnaire, meals, weight, water, activity, injuries, saved products and meals, your avatar and the name you'd like to be called, without an account | Only on your device (the browser's database, IndexedDB). It is not sent to the owner or to third parties. | Making the app work when you use it. The owner does not access or process it. | Until you delete it from the app or clear your browser data |
| Account data: email, password (managed by Supabase Auth), sign-up date and date of consent | In Tara's database (Supabase, servers whose region must be confirmed by the operator) | Creating and maintaining your account and identifying you. Legal basis: performance of the contract of use you accept when signing up (art. 6.1.b GDPR). | While you have the account. Deleted when you delete it. |
| Your logs, with an account: the same data as in the first row, including health data (weight, meals, activity, injuries) | On your device and in Tara's database (Supabase; servers in Ireland, EU). Each account can only read its own data. | Storing and syncing it across your devices. Legal basis: your explicit consent, given when creating the account (arts. 9.2.a and 6.1.a GDPR). You can withdraw it by deleting your account. | While you have the account. Deleted when you delete it. |
| Account emails (welcome and password change) | Sent from Tara's email address through the configured email provider | Activating the account and recovering access. Legal basis: performance of the contract (art. 6.1.b GDPR). | Those kept by the sending mailbox; not used for advertising |
| Your email and whatever you tell us | In the owner's mailbox | Answering your query. Legal basis: your consent when writing to us (art. 6.1.a GDPR). | As long as needed to help you and, afterwards, the limitation period for possible liabilities |
| Anonymous count of app opens: each time you open the app, 1 is added to that day's total, distinguishing only whether you are logged in, whether you use the installed app and the language | In Tara's database (Supabase; servers in Ireland, EU), as daily totals. It does not include your IP or any identifiers, and nothing is stored on your device. | Knowing how many people use Tara, with and without an account, in order to improve it. Legal basis: legitimate interest (art. 6.1.f GDPR). The stored totals cannot identify anyone. | Daily totals are kept while Tara exists |
| App error log: the technical error message, the version, the screen, the language, whether you were signed in, the browser and your last steps in the app (which screens and buttons, never what you type). Also notices that the app repaired itself | In Tara's database (Supabase). The app removes any email first; it includes no health data, IP address or identifiers. A technical summary of grouped errors, without the full browser details, is copied to a private GitHub repository to fix them. | Detecting and fixing faults. Legal basis: legitimate interest in the app working properly (art. 6.1.f GDPR). | 60 days |
| Technical connection data (IP address, browser, date) | In the logs of the hosting provider (Cloudflare) | Serving the website securely. Legal basis: legitimate interest (art. 6.1.f GDPR). | According to each provider's policies |
Some of the data you store in the app, such as weight or injuries, is health data. Without an account, it stays on your device and the owner has no access to it. With an account, it is only stored with your explicit consent, solely to sync it for you: it is not analysed, sold, shared with anyone or used for advertising.
Camera
The camera is only used, with your permission, while the barcode scanner is open. Images are processed on your device and are not stored or sent anywhere.
Links to other websites
Some supplement recommendations may include an affiliate link to Amazon, and a link to support Tara with a donation may appear in Settings. They are labelled as such. When you tap them you leave Tara and go to that third party's website, which processes your data under its own policy; Tara does not send it any of your data.
Providers and international transfers
- Supabase, Inc.: database and account system, with data hosted on servers in Ireland (European Union). Acts as data processor.
- Resend (Resend, Inc., United States; sent from servers in Ireland, EU): sends account emails (welcome, confirmation and password recovery). It receives only your email address and that message. Acts as a processor.
- Web hosting Cloudflare Pages (Cloudflare, Inc., United States): serves the app's files and may log technical access data. During the move, the old address remains on Netlify, Inc.
- Cloudflare, Inc. (Cloudflare Web Analytics): counts visits in aggregate (pages, country, device type and browser). It uses no cookies, stores nothing on your device, and does not build profiles or identify anyone. Legal basis: legitimate interest in knowing how the app is used (art. 6.1.f GDPR).
- Fonts and libraries: served from Tara's own domain. Your browser does not connect to Google or other servers to load them.
- Open Food Facts (non-profit association, France): when you scan a barcode you haven't saved or search for a supermarket product, that barcode or your search text is sent to it to get its nutrition data. If Tara's intermediate server on Cloudflare is active, the request goes through it and Open Food Facts does not receive your IP address; otherwise your browser sends it directly. Nothing else is sent.
- USDA FoodData Central (U.S. Department of Agriculture): if a scanned barcode is not in Open Food Facts, Tara's intermediate server on Cloudflare sends it only that barcode to look the product up. USDA does not receive your IP address or any other data.
- Have I Been Pwned (Pwned Passwords service, served by Cloudflare): when you create the account or change your password, it checks whether that password has appeared in leaks from other websites. Only the first 5 characters of a scrambled fingerprint (SHA-1 hash) of the password are sent, never the password or your email, and the result is worked out on your device.
- Cloudflare Turnstile, only if enabled: when you create the account, sign in or recover your password, it checks that you are not an automated program. Cloudflare analyses technical browser signals; it uses no advertising cookies.
- Google (Google LLC), only if you choose «Continue with Google»: Google identifies you and shares your email and name with Tara to create or open your account.
- GitHub (GitHub, Inc., United States): keeps in a private repository the app's code, encrypted database backups (if the operator turns them on) and the technical summary of grouped errors, with no emails, health data or identifiers. Acts as data processor.
- Anthropic (Anthropic, PBC, United States): its Claude tool analyses that technical error summary and the app's code to prepare fixes. It does not receive your logs, your email or your health data.
Some of these providers are in the United States. Transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's standard contractual clauses.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [email protected]. You control the data you store in the app directly: you can download it (Settings → This app on your phone → Download backup), delete it from the device or delete your account with all its data (Settings → Your account → Delete my account) at any time. If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Minors
Automatic plans are intended for adults aged 18 and over only.
Changes
If this policy changes, we will publish the new version on this page with its date.