Privacy Policy

Last updated: October 21, 2026

This policy explains what data the NEAT365 iPhone app (the "app") and the neat365.net website process, how and why. In short: your records stay on your phone, and only what a feature needs in order to work goes to our server and our partners.

In short

• The records you enter (steps, sleep, water, food, workouts, supplements, cycle, measurements, spending and notes) are stored on your phone and are not sent to our server.
• Our server keeps only your account or anonymous guest ID, your daily usage counts and your Premium status.
• The AI features (the Assistant, "Add with a photo", "Find with AI" and, in some languages, quick log) send what they need to Google's Gemini API, only when you use them and only after you agree.
• Your Apple Health data is never used for advertising, marketing or data mining, and is never sold.
• We don't show ads, we don't track you, and we don't sell your data.

1. Controller and contact

NEAT365 is developed and provided by Muhammed Zahid Pehlivan (individual developer, Türkiye), who is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).

For any question or request about this policy or your data: [email protected]

2. What stays on your phone

The following is stored only in the app's space on your phone. It is not sent to our server, and we cannot see it:

• Your profile: your name, age, sex, height, weight, goals and your answers to the questions when you first open the app.
• Your records: water, food, workouts, supplements and medicines, cycle, measurements, mood, spending, reminders and notes.
• Daily summaries read from Apple Health (see section 3).
• Photos: start and progress photos, your profile photo, receipts.
• Sleep sound clips: short clips recorded during sleep tracking. They are deleted automatically after 7 days.
• Your conversations with the Assistant.

Like other app data on your phone, this data may be included in your phone's own backup (iCloud or computer). Apple keeps that backup; we have no access to it.

The encrypted file you create with "Back up" and the PDF summaries go only where you choose to send them. We never receive your backup file and we don't know its password.

3. Apple Health (HealthKit)

If you allow it, we read the following from Apple Health:

• Activity: steps, walking and running distance, active energy, flights climbed, exercise time and workouts.
• Heart and breathing: heart rate, resting heart rate, heart rate variability (HRV), respiratory rate, blood oxygen and VO₂ max.
• Sleep: sleep stages, breathing disturbances during sleep and wrist temperature during sleep.
• Body: weight, height, body fat percentage and waist circumference.
• Nutrition: water and dietary energy.
• Profile: your date of birth and biological sex, to fill in the questions when you first open the app.
• Cycle (only for women who turn on cycle tracking): basal body temperature.

We write only two things to Apple Health: the water you log in the app and the workouts you finish in the app.

This data is used to show your daily summaries, goals and insights. The app may also read it in the background when new data arrives, so that your widgets stay up to date.

Your Apple Health data:

• is never used for advertising, marketing or data mining;
• is never sold or shared;
• is never written to iCloud by the app.

The only way it leaves your phone: if you agree to use the Assistant, a summary goes to the AI service together with the question you ask (see section 5). You can change your permissions at any time in the Health app.

4. Our server

Our server is hosted by Supabase in the European Union (Frankfurt, Germany). It keeps only the following:

• Account: if you sign in with Apple, Google or email:
  • your account ID;
  • your email address (this can be Apple's private relay address);
  • your sign-in method and dates;
  • if you signed in with Google, the name and profile photo address that Google provides.
• Guest ID: if you use the app without signing in, an anonymous ID specific to the app that doesn't say who you are. It is needed to protect requests to our server against abuse.
• Daily usage counts: how many times a day you use the AI and move animation features. Kept only to limit abuse (for example, bots) and to count usage on the free plan.
• Your Premium status: whether Premium is active, until when, which plan, and which store it was bought from. This comes from RevenueCat and is used to unlock Premium features on the server.
• Sign in with Apple token: if you signed in with Apple, the refresh token Apple provides. Kept only so that we can also revoke your Apple sign-in when you delete your account.

The content of AI requests is not stored on our server; it is only passed on to Google. The one exception: food names typed into "Find with AI" and the nutrition values found are stored without any information about who typed them, so that later searches are faster.

5. AI (Google Gemini)

The service called "a third-party AI service" in the app is Google LLC's Gemini API. Requests are passed to Google through our server.

These features send nothing until you agree. Consent is asked separately for the Assistant and for food recognition; quick log works with the Assistant's consent. You can withdraw your consent at any time in Profile → AI permissions; once you do, nothing is sent.

Each feature sends the following:

• Assistant: with every question:
  • your age, sex, height, weight, units, goals and daily targets (steps, water, sleep, calories and nutrients);
  • your activity level, training experience, weekly training days, training places and your fitness answers;
  • your eating style, allergies, health conditions (including pregnancy or breastfeeding) and injuries;
  • a summary of the last seven days' steps, sleep, water, calories, workouts and mood;
  • today's meals, your workout program, your nutrition plan and the app's note of the day;
  • findings about your sleep, steps, water, mood, habits (with their names), medicine, supplement and spending patterns;
  • the date and time;
  • the latest messages of that conversation.

  Your name is not sent. Your conversations stay on your phone.

• Add with a photo: the photo of your plate.
• Find with AI: the food name you type.
• Quick log (in languages other than Turkish and English):
  • the sentence you say or type;
  • today's date, time and weekday;
  • your units;
  • the names and kinds of your medicines and supplements and their times not yet marked today;
  • the names and kinds of your habits not yet marked today;
  • whether a workout is planned for today.

  The app shows you what it will save from the answer; nothing is saved until you confirm. Turkish and English sentences are read on your phone and go nowhere.

Google processes this data under the terms of the paid Gemini API: it does not use it to train its models and may keep it for a limited period to detect abuse.

AI can make mistakes and does not give medical advice.

6. Service providers

The app talks to the following services, directly or through our server. With every connection, your IP address also reaches the other side, as is normal on the internet.

• Supabase (server and database, EU): what is listed in section 4.
• Google (Gemini API): what is listed in section 5.
• Apple: App Store purchases, Sign in with Apple, notifications and speech recognition.
  • Apple takes the payment; your payment details never reach us.
  • For voice logging, what you say is first turned into text by your phone's own speech recognition. If your phone doesn't support that, Apple's speech recognition service is used. The audio never reaches us.
• RevenueCat (Premium subscription): your purchase record and subscription status, with your account ID on our server (a random ID).
• Sentry (crash reports, EU): if the app crashes or a page fails to open, the technical details of the error. That means the type of error, where in the code it happened, your phone model, and the iOS and app versions. Your name, account, health data, records and screen contents are not sent, and your IP address is not stored.
• Sign in with Google: the name, email address and profile photo address Google provides when you sign in.
• Sign in with email: the sign-in code is sent to your email address through an email delivery service.
• Open-Meteo (weather): the coordinates of the city you choose.
• Open Food Facts (barcodes): the number of the barcode you scan.
• WorkoutX (move animations and instructions): fetched through our server; nothing about you is sent.
• Expo (app updates): updates are downloaded from Expo's servers.

Each of these providers processes data only to provide its service to us. Each is bound to protect it at least as well as this policy and Apple's guidelines require. Apple's and Google's own privacy policies also apply to their sign-in services.

7. Legal bases

• Performance of a contract: to provide the app, your account and the Premium you buy.
• Your explicit consent:
  • reading from and writing to Apple Health (the iOS permission);
  • the AI features, including processing special categories of personal data such as health data and transferring it to a provider abroad;
  • microphone, camera, photos, speech recognition, alarm and notification permissions.
• Legitimate interests: preventing abuse (usage counts) and fixing errors (crash reports).
• Legal obligation: where the law requires it.

8. International transfers

Our server (Supabase) and crash reports (Sentry) are in the European Union. Google, RevenueCat, Apple and Expo are companies based in the United States; your data may also be processed on their servers in other countries.

These transfers are based on:

• your explicit consent for the AI features;
• being necessary to perform the contract for the other services;
• safeguards such as the providers' standard contractual clauses.

9. Retention

• Records on your phone: until you delete them or remove the app.
• Sleep sound clips: 7 days.
• Your account: until you delete it.
• Guest ID: deleted automatically after 90 days without use.
• Daily usage counts: 30 days.
• Your Premium status: as long as your account or guest ID exists.
• Sign in with Apple token: until you delete your account; it is revoked at Apple when you do.
• AI requests: not stored on our server. Google may keep them for a limited period to detect abuse.
• "Find with AI" results: without any information about who searched, indefinitely.
• Crash reports: at most 90 days at Sentry.
• Purchase records: kept by Apple and RevenueCat under their own legal obligations.

10. Permissions

• Apple Health: see section 3.
• Microphone:
  • During sleep tracking, sounds such as snoring, coughing and sleep talking are recognized on your phone with Apple's sound analysis. Short clips stay on the phone and are deleted after 7 days.
  • The microphone is also used for voice logging and for asking the Assistant by voice.
• Speech recognition: to turn what you say into text.
• Camera and photos:
  • plate photos, for AI analysis;
  • progress and receipt photos, which stay on the phone;
  • your profile photo.
• Notifications: reminders and the backup alarm are scheduled on your phone. We don't use a push notification server.
• Alarms (iOS 26 and later): for the wake-up alarm in sleep tracking.

You can turn off any permission at any time in your phone's Settings; the feature that needs it then stops working.

11. Ads, tracking and sale of data

• We don't show ads.
• The app contains no analytics or advertising tools. Sentry only reports crashes.
• We don't track you across apps and websites, so we don't ask for App Tracking Transparency permission either.
• We don't sell, rent or trade your data.

12. Your rights

Under the GDPR and Article 11 of the KVKK, you can:

• find out whether your data is processed and ask for a copy;
• ask for inaccurate or incomplete data to be corrected;
• ask for your data to be deleted;
• ask for processing to be restricted, and object to processing;
• receive your data in a portable format;
• withdraw your consent at any time. Withdrawal doesn't affect processing done before it.
• If you have a complaint, you can contact Türkiye's Personal Data Protection Authority or, if you are in the EU, your country's data protection authority.

Send your request to [email protected]. We reply within 30 days at the latest.

Because we can't see the data on your phone, correcting, exporting and deleting it is in your hands:

• to export, use "Back up";
• to delete, use the options below.

13. Deleting your account and data

• "Delete account" (at the bottom of Profile, shown when you're signed in):
  • your account, usage counts and Premium status are deleted from the server;
  • if you signed in with Apple, your Apple sign-in is revoked;
  • all your records on this phone are deleted.

  Your data in Apple Health is not touched. Your subscription is not cancelled automatically; cancel it in Settings → [your name] → Subscriptions.

• "Erase all records" (in the same place): your account stays, and all your records on this phone are deleted.
• Removing the app from your phone also deletes the records on it.
• Your guest ID is deleted automatically after 90 days without use. If you want it deleted right away, write to us.

14. Security

• All connections between the app, our server and our providers are encrypted (HTTPS/TLS).
• Only the server's own functions can access its tables; they can't be read with the key inside the app.
• Your backup file is encrypted on your phone with the password you choose (AES-GCM, with a key derived through PBKDF2). We don't know your password.

No system is completely secure. If a breach affects your data, we will inform you and the competent authority as the law requires.

15. Age limit

NEAT365 is not meant for anyone under 18. The app asks for your age when you first open it and doesn't accept an age under 18. If we learn that data of someone under 18 has reached us, we delete it.

16. neat365.net

• The website uses no analytics or advertising tools.
• Its only cookie is "neat365_lang", which remembers the language you pick in the language menu (1 year).
• Cloudflare, which serves the site, may keep technical access logs such as IP addresses for a short time for security.

17. Changes

If this policy changes, we publish the new version in the app and on neat365.net and update its date. If what is sent to the AI service changes, we ask for your consent again.