Privacy Policy

Theron ("we", "our", "us") is a fitness application developed and operated in Greece. We are responsible for the processing of your personal data as described in this Privacy Policy.

Contact: support@theronapp.com

• Contract performance (Art. 6(1)(b)) — to provide the Theron service you signed up for.
• Explicit consent (Art. 9(2)(a)) — for health data processing. You grant this during onboarding and may withdraw at any time.
• Legitimate interests (Art. 6(1)(f)) — to improve the app, prevent fraud, and ensure security.

• Provide nutrition and workout tracking features
• Generate AI-powered insights, meal plans, and training plans. To do this we send the relevant data you provide — food photos, and (where you enable personalised plans) your meals, workouts, and body metrics — to OpenAI, our third-party AI provider. OpenAI processes this data solely to return your results and does not use it to train its models.
• Analyse food images using computer vision to identify nutritional content
• Calculate and display personalised macro targets
• Process and manage subscription entitlements via RevenueCat
• Send transactional emails (password reset, support replies) via Resend
• Improve the app through anonymised usage analytics
• Improve AI food recognition accuracy — only when you have explicitly opted in. We use your confirmed scan results (food names, quantities, and image references) to train and fine-tune our food detection model. This processing has the legal basis of your explicit consent (GDPR Art. 6(1)(a)) and you may withdraw at any time.

We do not sell your data. We share it only with the following processors, under GDPR-compliant data processing agreements:

Food logs, body measurements, and workout data constitute health data under GDPR. We process this data only with your explicit consent, granted during onboarding.

You may withdraw this consent at any time by deleting your account. Upon deletion:

• All health data is permanently deleted immediately
• Account data is deleted within 30 days
• No health data is retained in any backup or archive

You can delete your account directly within the Theron app at any time: go to Profile → Delete Account. This permanently deletes all your personal data, health data, food logs, workout history, and uploaded images. This action cannot be undone.

Alternatively, email support@theronapp.com with subject "Delete my account" and we will process the deletion within 30 days.

Theron uses AI to generate nutrition and fitness insights. These insights are informational only. They do not constitute automated decision-making with legal or similarly significant effects on you. All health and fitness decisions remain with you.

You may opt out of AI processing at any time by contacting support@theronapp.com.

• Health data — deleted immediately on account deletion
• Food scan images — discarded immediately after AI analysis; never stored (unless you have opted in to AI training data collection)
• AI training scan data — retained only while your consent is active. Deleted within 30 days if you withdraw consent or delete your account
• Account data — retained for 30 days after deletion (grace period), then permanently deleted
• Payment records — retained for 7 years (Greek tax law requirement)
• Support tickets — retained for 2 years

You have the following rights regarding your personal data. To exercise any of these, email support@theronapp.com. We respond within 30 days.

• Right to access — request a copy of all personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — delete your account and all associated data via the app or by email
• Right to data portability — request a machine-readable copy of your data by emailing support@theronapp.com; we respond within 30 days. Coaches can additionally export their clients, plans and revenue to Excel from the web dashboard at any time.
• Right to object — opt out of AI processing or analytics
• Right to withdraw consent — withdraw health data consent at any time without affecting prior processing
• Right to lodge a complaint — with the Hellenic Data Protection Authority at www.dpa.gr

• All data encrypted in transit using TLS 1.3
• Database encrypted at rest (Supabase)
• Access controls via Row Level Security (RLS) — users can only access their own data
• AI processing (OpenAI calls) performed server-side — your API keys never exposed to clients
• No Theron employee has direct access to individual health data
• Authentication via Supabase Auth with secure token management

Your data may be stored and processed outside the EU/EEA, specifically:

• Supabase — EU region where available; US transfers protected by Standard Contractual Clauses (SCCs)
• OpenAI — processes AI requests in the US; SCCs apply; data not retained for training
• RevenueCat — US-based; GDPR DPA signed; processes anonymous subscription identifiers only

Theron is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, contact support@theronapp.com and we will delete it immediately.

The mobile app does not use browser cookies. The website and web dashboard use two categories. Essential: Supabase authentication/session cookies, your language, theme and calendar-hour preferences, and the cookie-consent choice itself — these are required for the site to work and do not need consent. Analytics (consent only): Google Analytics cookies (_ga, _ga_*) are set only after you choose "Accept all" in the consent banner; choosing "Essential only" means the Google Analytics script is never loaded. We never use advertising or cross-site tracking cookies. You can change your choice at any time by clearing this site's cookies, which brings the banner back.

We may update this Privacy Policy. When we do, we will notify you via email and an in-app notice at least 14 days before the changes take effect. Continued use of Theron after the effective date constitutes acceptance of the updated policy.

Current revision: published July 25, 2026, in effect August 8, 2026. It adds the processors we already rely on (Stripe for web payments, Google Analytics, Vercel, Open Food Facts, and the Apple/Google push services), replaces an incorrect statement that the website set no cookies, and states that data-portability requests are answered by email within 30 days. One change applies immediately rather than after the notice period, because it is more protective of you: Google Analytics is no longer loaded unless you accept analytics cookies.