The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any data that can be used to identify you personally.
Josef Haras
Dr.-Adolf-Schärf-Platz 10/309
1220 Vienna
Email: office@bauchgefuehl.app
This website is built with Next.js and React. These technologies are used to provide and render the website.
We use Supabase as our backend service. Supabase stores data in the EU and is subject to GDPR requirements.
Website newsletter. If you sign up for our newsletter on the website, we send you emails via Brevo (formerly Sendinblue) based on your consent. You can unsubscribe at any time via the link in every email or by writing to office@bauchgefuehl.app.
Legal basis: Art. 6(1)(a) GDPR (consent).
Service messages in the app. When you start a trial or a free access period in the Bauchgefühl app, we send account-related service emails to the address on your account: a confirmation at the start and a notice before your access ends — and, if you have a payment method on file, before a paid subscription begins (incl. price and how to cancel). These messages are part of performing the contract and contain no advertising.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Companion emails (consent only). In addition, you can consent in the app to occasionally receive cycle tips and product updates by email. We log the time and wording of your consent. For these personalized emails we use, besides your email address, selected usage data from your account (e.g. the number of saved recipes and your access expiry date). Your health data (cycle entries, symptoms) stays end-to-end encrypted on your device and is never used for emails. You can withdraw your consent at any time via the unsubscribe link in every email or by writing to office@bauchgefuehl.app; the lawfulness of processing carried out before withdrawal remains unaffected.
Legal basis: Art. 6(1)(a) GDPR (consent).
Processor. All of the above emails are sent via Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany, as processor under Art. 28 GDPR; processing takes place within the EU. Recipient data is stored there for as long as your account exists or until you withdraw consent; it is deleted when your account is deleted.
This website uses Google Analytics to analyze website usage. Processing is based on our legitimate interest in optimizing our website. You can object to this data processing.
We use PostHog (EU hosting, Frankfurt) to analyze website usage. Before you consent, we only collect anonymous, storage-free usage data (no cookies, no recognition); your IP address is anonymized and not stored. After you consent via the cookie banner, we use PostHog with cookies for reach and funnel analysis as well as session replay (recording of anonymized page interactions; input fields are masked; sensitive areas such as quiz, login, and checkout are not recorded; retention 30 days). A data processing agreement (DPA) is in place with PostHog.
Legal basis: before consent Art. 6(1)(f) GDPR (legitimate interest in anonymous reach measurement without accessing your device), after consent Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via the cookie banner.
To improve Bauchgefühl, we also analyze how the app is used, using PostHog with data processing exclusively on EU servers (Frankfurt, eu.posthog.com). IP addresses are anonymized before storage. What we never collect: your health data. Cycle data, symptoms, moods, and all other health information stay encrypted on your device and are never transmitted to our analytics systems — we only record usage behavior, such as which features are used or where the app has problems. Two tiers apply: (a) during installation, onboarding, and sign-up we collect fully anonymous technical events (no identifier is stored on your device; each app start begins a new, unlinkable session — no personal data is processed). (b) Only if you explicitly consent after signing up do we link usage events (e.g. "a feature was used" — never its content) pseudonymously to your account. You can withdraw your consent at any time in the app settings ("Usage statistics" toggle); from that point on, no further data is collected and the analytics identifier is discarded.
Legal basis: Art. 6(1)(a), Art. 9(2)(a) GDPR (consent). Recipient: PostHog Inc. as processor (EU hosting; data processing agreement incl. EU standard contractual clauses).
The app uses Google Firebase to deliver push notifications (Firebase Cloud Messaging) and for crash and performance reports (Crashlytics, Performance Monitoring). This processes technical device information (e.g. device token, device model, OS version, app version, crash logs); no health data is included. The content of the classic on-device cycle reminders is computed exclusively on your device (for the server-generated proactive messages, see §4, "Google Vertex AI (proactive messages)"). Google Firebase Analytics is not used.
Legal basis: Art. 6(1)(b) GDPR (providing the app features you enabled) and Art. 6(1)(f) GDPR (legitimate interest in stability and bug fixing).
We use the Facebook Pixel for conversion tracking and remarketing. Processing is based on your consent, which you can withdraw at any time.
We use Google Tag Manager to manage tracking tools. Tag Manager itself does not process personal data.
Visible notifications (e.g. cycle reminders) are only shown if you have enabled notifications, and can be turned off at any time. In addition, we send invisible system pushes to all devices where you are signed in — regardless of your notification settings. These never display anything and contain no content or health data; they merely wake the app briefly in the background so it can create your encrypted backup and — if you have enabled the "Proactive messages" toggle — prepare a proactive message (see §4, "Google Vertex AI (proactive messages)"). The backup itself leaves your device exclusively end-to-end encrypted — we cannot read its contents. Delivery uses Firebase Cloud Messaging (see above).
Legal basis: Art. 6(1)(b) GDPR (performance of contract — providing the backup feature).
To generate personalized recipe suggestions, the following data is transmitted to an AI service (Google Vertex AI):
This data is used exclusively to generate the respective response and is not used for training AI models – neither by us nor by Google as the provider of the AI service. Processing is based on Art. 6(1)(b) GDPR (performance of contract) and Art. 9(2)(a) GDPR (explicit consent, which you give through your active, voluntary use of the AI recipe feature when you submit your request).
A data processing agreement (DPA) incl. EU standard contractual clauses is in place with Google. For more information about data protection at Google Vertex AI, please refer to Google's data processing addendum: https://cloud.google.com/terms/data-processing-addendum
When you save a recipe (swipe right) or dismiss it (swipe left) in the app's recipe area, our server uses these signals to suggest more fitting recipes in the AI chat: recipes you already saved are preferred where the fit is comparable, dismissed ones are avoided. Safety-relevant exclusions (e.g. allergens and intolerances) are unaffected and always apply. This is your own in-app behavior, feeding solely into the recipe feature you actively invoke; the swipes themselves are not transmitted to the AI service.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
If you enable the "Proactive messages" toggle in the settings (off by default), the app occasionally composes a personal push notification for you — for example a tip when your cycle phase changes, or an encouraging reaction to your activity. Unlike the other reminders, whose content is computed exclusively on your device, the text of these proactive messages is generated on the server: to do so, the app transmits in the background — even while it is closed — your current cycle phase and, if you have additionally enabled health sharing, a summary of your recent activity and sleep data to Google Vertex AI (EU region europe-west3) to generate the message text. At most one such message is created per day.
Health data is processed here — your cycle phase alone already counts as a special category of personal data under Art. 9 GDPR; with health sharing enabled, activity and sleep data are added as a further such category. This processing therefore takes place solely on the basis of your explicit consent, which you give by enabling the toggle. You can withdraw this consent at any time by turning the same toggle off again; from withdrawal on, no further data is transmitted for this purpose. The transmitted data is used exclusively to generate the respective message and is not used to train AI models — neither by us nor by Google as the provider of the AI service. A data processing agreement (DPA) incl. EU standard contractual clauses is in place per the Google Cloud DPA.
Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (explicit consent).
You have the following rights:
If you have questions regarding the collection, processing, or use of your personal data, or if you would like information, correction, blocking, or deletion of data, please contact: office@bauchgefuehl.app
Deleting your account.You can delete your account and all associated data at any time — in the app under "Profile → Delete account" or on our website at bauchgefuehl.app/account-deletion. After your request there is a 7-day grace period: if you sign in again during that time, the deletion is cancelled. Afterwards your account and the associated personal data are automatically and irreversibly deleted — from our own systems as well as from the processors we use. Data we must retain for legal reasons (e.g. accounting records) is excluded. Deleting your account does not cancel an App Store or Google Play subscription — please cancel any active subscription in your store's settings.
This privacy policy was last updated on July 24, 2026. We reserve the right to amend this policy so it always complies with current legal requirements.