Privacy Policy

1. Controller

Tarkan Yüksel
Bruno-Kuhn-Straße 19, 38518 Gifhorn, Germany
Email: info@turboverse.dev

2. What data we process

• Account data: username, email address, password (stored only as a hash, managed by Supabase Auth).
• Google sign-in: if you sign in with Google, Google transmits your email address and your profile name.
• Health data: injections (peptide, amount, time), protocols and reminder times, lab results, body weight, nutrition data (calories, macronutrients) and favorite peptides. These are health data within the meaning of Art. 9 GDPR — see section 5.
• Proof of consent: time, version and language of your consent to the processing of health data, the time of your age confirmation, the version of the terms you accepted, and your choice on audience measurement.
• Technical data: IP address, browser, access times (server logs of the hosting provider), your device's time zone.
• Sign-in sessions: for every sign-in, Supabase Auth stores the IP address, device or browser and time, to manage and protect your session.
• Security logs: times of password changes (to enforce the change limit).

3. Purposes

• Providing the app: recording, storing and displaying your entries, calculating the active-level curves, the daily plan and reminders
• Registration, sign-in and protection of your account
• Sending transactional emails (email confirmation, password reset)
• Service emails about your account and the app (see below)
• Technical operation, troubleshooting and security
• Anonymous audience measurement, only with your consent (section 8)

Service emails: we occasionally send notices to your account's email address that concern your account or the app — for example changes to the terms or to this privacy policy, security notices, important changes to features, or notice that an inactive account is about to be deleted (section 12). We do not send advertising or newsletters; for that we would first ask for your separate consent. We do not track whether you open an email or click a link in it. If your email client loads the logo in the email, it is fetched from our hosting (Vercel), which produces the usual access data (section 6). You can object to these emails with the unsubscribe link in each of them.

We do not sell data, show no advertising and create no profiles. There is no automated decision-making within the meaning of Art. 22 GDPR.

4. Legal bases

• Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR — your explicit consent for all health data.
• Art. 6(1)(b) GDPR — performance of the contract for account data, sign-in and transactional emails.
• Art. 6(1)(f) GDPR — legitimate interest in secure, stable operation (server logs, security logs, sign-in sessions) and in informing you about changes that concern your account or the app (service emails).
• Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent to audience measurement (section 8).
• § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) — storing information on your device where it is strictly necessary for the feature you use (section 9).

5. Consent for health data

TurboTrack processes health data only with your explicit consent. You give it at registration or before first use, via a separate checkbox that is not pre-ticked. We store the time, version and language of the consent.

TurboTrack is intended for people aged 16 and over. Younger people cannot effectively consent to the processing themselves (Art. 8 GDPR). Together with your consent you therefore confirm that you are at least 16 years old; we store the time of this confirmation as well.

You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) — by email to info@turboverse.dev or, most simply, by deleting your account (section 14). Since TurboTrack does not work without these data, withdrawing consent leads to the deletion of your account. The lawfulness of the processing carried out until then remains unaffected.

6. Storage location & hosting

Your account and health data are stored in a PostgreSQL database at Supabase (Supabase Inc., USA) in a data centre in Zurich, Switzerland. The European Commission has issued an adequacy decision for Switzerland. The connection is encrypted. Access to the database through public interfaces is blocked; the app accesses it exclusively on the server side.

The application is hosted by Vercel (Vercel Inc., USA). The server functions that generate your pages and store your entries run in a data centre in Frankfurt am Main, Germany. Your data are processed there for display, but not stored permanently at Vercel. Vercel stores technical access data (IP address, request logs) according to its retention periods.

Vercel receives your requests at the nearest location of its global network — for requests from Germany, also Frankfurt. Static files (scripts, images) are delivered there and your sign-in is checked before the request is passed on to the server functions.

7. Recipients & processors

• Supabase Inc. (San Francisco, USA) — database and authentication; storage in Zurich. Processor under Art. 28 GDPR.
• Vercel Inc. (San Francisco, USA) — hosting, server functions, audience measurement. Processor under Art. 28 GDPR.
• Resend Inc. (USA) — sending confirmation and password emails and the service emails (section 3). Only the email address, language and message content are transmitted.
• Google Ireland Ltd. — only if you sign in with Google (identity provider).

We serve fonts from our own server. Using the app does not open a connection to Google Fonts or any other font provider.

8. Audience measurement

Only if you agree, we use Vercel Web Analytics to see which pages are visited and how often. You are asked the first time you open the app; the choice is voluntary and the app works just the same without it. Without your consent the measurement script is not loaded, and nothing is ever measured before sign-in.

It records the page visited, the referring page, country, device type, browser and operating system. No cookies are set and no information is stored on your device; visits are grouped by a hash that changes daily, so there is no recognition across days. Your entries (injections, values) are not transmitted.

You can withdraw your consent at any time with effect for the future, or give it later, under Profile → Privacy.

9. Cookies & storage on your device

We set no tracking or advertising cookies. Only the following is stored on your device:

• Session cookies from Supabase Auth, so that you stay signed in.
• Time zone cookie (tz), so that times, "today" and reminders are shown in your local time.
• Language cookie (lang) — only if you choose a language yourself under Profile → Language. Without that choice, the language follows your device setting, which your browser sends with every request anyway; nothing is stored for it.
• Local storage of the browser or the app: which dashboard cards you have shown, your reminder settings and — only briefly during registration — the favorite peptides you selected.
• Service worker: stores only general files (icons, offline page), no personal content.

These are technically necessary for the features you use (§ 25(2) no. 2 TDDDG). For audience measurement we ask you first (section 8).

10. App for Android and iOS

The app shows the same application as the website. In addition, it schedules local reminderson your device: the peptide name and time are passed to your operating system's notification feature for this and stay on the device — there is no push server. Google sign-in in the app runs through a browser window on your device.

11. Transfers to third countries

Supabase, Vercel and Resend are based in the USA. Your health data are processed in Germany and stored in Switzerland (section 6); because of where the providers are based, access by them from the USA cannot be ruled out, and Resend sends emails from the USA. Transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

12. Retention period

Your data remain stored until you delete individual entries or your account, or withdraw your consent.

Inactive accounts: if you have not signed in for 12 months, we delete your account with all its data. Before that you receive an email giving you at least four weeks; signing in during that time is enough to keep your account.

For the service emails, your email address is also kept in a contact list at Resend. If you delete your account, we remove it there before the next mailing. If you only unsubscribe from the service emails, it stays there with that note, so that you receive no more of them.

Supabase Auth deletes sign-in sessions when you sign out or the session expires. Vercel deletes server logs automatically according to its retention periods; we only look at them when something goes wrong and do not link them to your account.

13. Your rights

Under the GDPR you have the right at any time to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw your consent (Art. 7(3) GDPR)

To exercise your rights, please contact the email address given above.

14. Deleting your data

You can delete your account yourself at any time under Profile → Danger Zone → Delete account (in the German version of the app: Profil → Gefahrenzone → Account löschen). Deletion takes effect immediately, with no waiting period. Alternatively, you can request it by email to info@turboverse.dev.

All personal data (account data, injections, weights, lab results, nutrition data, protocols, favorites, password change logs) are irreversibly removed from the database. Detailed instructions are available at track.turboverse.dev/delete-account.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR. Competent supervisory authority: the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen).