TempusCore Privacy Policy

Last updated: 2 November 2026 · Version 4.4

At TempusCore we respect your privacy and protect your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This policy explains, in plain language, what data we collect, what for, who it is shared with, how long we keep it and what rights you have.

1. Who is responsible

Javier Ruiz Villalba, Tax ID (NIF) 53988888E
Postal address: Apartado de Correos 102 (PO Box), 06740 Orellana la Vieja (Badajoz), Spain
Contact email for any question about your data: tempuscoreapp@gmail.com · Phone: +34 623 819 011

TempusCore has no data protection officer because it is not required to have one; write to the email above and we will deal with you directly.

2. Guest mode: no account, no data on our servers

You can use TempusCore without creating an account (guest mode). In that case everything you log is stored only on your phone and we do not receive it. If you later create an account and decide to move that data to it, it is then sent to our servers and the rest of this policy applies.

With an account, whatever you log offline is stored encrypted only on your phone until the internet is back, and is then sent to your account.

If you have the Pro or Max plan and you turn it on, the app can read from Apple Health (iPhone) or Health Connect (Android, when available) only three things: your active energy and your resting energy for each day, to calculate your real daily energy expenditure, and your hours of sleep, for the indicative recovery hint in the Muscles tab. Those three values stay on your phone: they are not sent to your account, your coach does not see them and they never leave your device. The app uses them to work out your daily energy expenditure and your recovery hint each time you open the screen, without storing them; the only thing that reaches your account is the calorie target you choose to apply, just as if you had typed it yourself. If you do not connect Apple Health, the app may ask you how you slept (optional) and your answer is also stored only on your phone, encrypted. The app never writes to Apple Health, reads nothing you have not authorised and you can disconnect it whenever you want from Settings or from the Health app. A verified email is required.

3. What data we process, what for and on what legal basis

Data	What we use it for	Legal basis
Account: name, email address, password (stored only encrypted, never in clear), confirmation that you are at least 16 years old, whether your email is verified, the date your account was created (the moment you confirm your sign-up with the code we send you), the date you last used the app (recorded at most once a day, for deleting inactive accounts as described in section 6), the language we write your emails in, and the 6-digit codes we send you to verify the email or recover the password (we store only their fingerprint, not the code; they expire after 15 minutes).	Create your account, sign you in, check the minimum age, check that the email is yours and that you can recover access.	Performance of the service you ask us for (art. 6.1.b GDPR).
Health and wellbeing data (special category): workouts and sets, weight, habits, meals and water, calorie target, recipe preferences you choose (for example, no gluten-containing ingredients or no lactose-containing ingredients; we do not ask about allergies or illnesses), body measurements, profile data you enter (height, age, sex, activity level), weekly check-ins (sleep, energy, stress, hunger), vitals you log by hand (heart rate, blood pressure, glucose; the app does not interpret them) and the supplements you tick off each day; and, only if you turn it on (Pro and Max plans), the active energy, resting energy and sleep the app reads from Apple Health or Health Connect, processed on your phone only and never stored (your account only receives the calorie target you choose to apply), just like your optional answer about your sleep if you prefer to log it by hand (on your phone only, encrypted; used for the recovery hint).	Provide the app's features: diary, statistics, trends, daily energy expenditure, summaries and notices. Only for that.	Your explicit consent (art. 9.2.a GDPR); reading Apple Health or Health Connect also requires you to turn it on in the app and in the system permission, and you withdraw it by disconnecting it. We ask for it on a screen of its own when you create your account, separate from accepting the terms; we store the date and the version of the text you accepted. You can withdraw it at any time by deleting the data or the account (section 7). Without that consent, the app cannot offer you these features.
Coach–client relationship: chat messages, routines, programs and diets assigned, goals, ratings of workouts and the notes your coach writes about you.	So that coach and client can work together inside the app.	Performance of the service (art. 6.1.b) and, for anything that is health data, your explicit consent (art. 9.2.a), which you give when you accept the invitation and with each sharing switch.
Routines you share with a code: a copy of the routine (name and exercises) that anyone with the code can import.	So that another person can use your routine when you decide.	Your consent (when sharing). The copy is deleted automatically after 7 days, when you stop sharing it or when you delete the account.
Reports and blocks: who reports, whom, reason, optional comment and a copy of the reported message and of the 5 before it in that conversation. Chat filter: each message is automatically checked before it is sent against a short list of serious expressions (hate insults, explicit sexual content, incitement to self-harm); a blocked message is not stored and nobody sees it, it only warns you.	Keep a safe environment, review reports and comply with app store rules.	Legitimate interest in the security of the platform and its users (art. 6.1.f). The filter makes no decisions about your account: it only prevents that message from being sent.
Technical data: IP address on the server (to limit abuse and access attempts) and error logs without personal content.	Security and operation.	Legitimate interest (art. 6.1.f).
Error reports (Sentry): when the app or the server fails, a technical report is sent: the type of error, the screen where it happened, the app version, your phone's model and operating system, the language and a random install identifier that is not linked to your account. Never your health data, anything you type, your name, your email or screenshots; your IP address is not stored.	Find and fix bugs so that the app works.	Our legitimate interest in keeping the service running (art. 6.1.f), weighed in our data protection impact assessment. You can turn it off in Settings → Privacy → "Error reports" and object at any time (section 7).
Usage data (PostHog), only if you turn on "Help us improve the app": which screens and features you use (for example, "opened Recipes" or "finished onboarding"), with properties that carry no personal value (screen, plan, language, version, operating system) and a random identifier that is not linked to your account. Never health data, text you type, routine names, messages or amounts; no session recording and no automatic capture of taps.	Understand how the app is used overall in order to improve it (what works, where people drop off).	Your consent (art. 6.1.a GDPR and art. 22.2 of the Spanish LSSI): the switch is off until you turn it on (in Settings → Privacy) and you can turn it off whenever you want; not using it does not affect any feature.
Your plan and subscription: current plan, transaction identifier and start, renewal or end dates that Apple or Google tell us through RevenueCat and, if yours is a founder account, the Apple offer code we have assigned to you (or, on Android, the end date of the gifted month). Never your payment details.	To give you the features of the plan you have taken out, give you the founders' gift (terms, section 5) and sort out any problems with your subscription.	Performance of the contract (art. 6.1.b).
Device identifier for notifications, only if you turn them on in Settings and grant the system permission.	Notify you of new messages and of what your coach sends you; if you are a coach, a daily summary with numbers. Notices carry generic text, without chat content or health data.	Your consent (system permission and switch in Settings). It is deleted when you turn notifications off, sign out or delete the account.
"Let me know when it's out" list (website), only if you sign up on tempuscore.app: your email, the website language and proof of your consent (version of the text you accepted and the dates you signed up and confirmed). You don't need an account and it isn't linked to one.	To email you when the app launches and remind you of the founders' offer: two emails at most.	Your consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish Information Society Services Act, LSSI), with an unticked box and email confirmation; you withdraw it with the unsubscribe link in each email or by writing to us.

What we do not do: we do not use your data for advertising, we do not profile you, we do not make automated decisions with effects on you, we do not track you across apps or websites and we do not sell your data. Analytics and error reports never contain health data or anything you have written.

4. Who it is shared with

• Your coach, only if you accept their invitation with a code. While you are connected, they always see, without you having to turn anything on, your workouts, your last 30 weight entries and the percentage of habits completed. To see your body measurements, your vitals (last 30 days) or your nutrition summary (calories and macros of the day, without the detail of foods) there is a separate switch for each one, off by default, which you can turn off whenever you like. The private notes your coach writes about you are not shown in the app, but they are data about you: you can ask us for them by exercising your right of access (section 7) and we will provide them, except for any part that affects another person's rights. When you leave the relationship, the chat and everything assigned are deleted. Your coach undertakes to use your data only for that relationship (see annex A of the terms).
• Providers that host the service (data processors, under a data protection contract): the application server (Render, in Frankfurt, Germany) and the database (MongoDB Atlas, on Amazon Web Services, Frankfurt, Germany). Your data is stored in the European Union.
• Expo (the service that delivers notifications to the phone), only if you turn notifications on: it receives your device identifier and the generic text of the notice, never chat content or health data, and does not store the text. Expo is in the United States and is certified under the EU–US Data Privacy Framework; it also acts as a data processor under the European Commission's standard contractual clauses. Expo uses Apple and Google for the final delivery to the phone.
• Resend (the service we use to send emails): it receives your email address and the 6-digit code when you verify your email or recover your password (the message carries neither your name nor health data) and, if you join the "Let me know when it's out" list, your email address to send you the confirmation message and, at most, the two notices; and, separately, the internal alerts for each new report (only an identifier, the reason and the date; never content or names). Resend is in the United States, certified under the EU–US Data Privacy Framework, and acts as a processor under the standard contractual clauses; emails are processed in its European Union region (Ireland) once the tempuscore.app domain is verified there.
• App stores (Apple App Store and Google Play) distribute the app and sell and charge for the Pro and Max subscriptions as the sellers of record. They do not receive data from your TempusCore account; what they process about your Apple or Google account (downloads, payments) is governed by their own policies. Expo delivers notifications through Apple (iOS) or Google (Firebase Cloud Messaging, Android).
• RevenueCat (a service that checks for us that your subscription is valid and tells us about renewals, cancellations or refunds): it receives from Apple or Google the transaction identifier and, from us, only an anonymous identifier of your account; never your email, your name or health data. RevenueCat is in the United States and acts as a processor under the European Commission's standard contractual clauses. In turn, it relies on providers, also in the United States, to host the service and for its internal tools, including artificial intelligence tools used by its support team; they are bound by the same obligations and safeguards, can only see that anonymous identifier and the purchase data, and do not use them to train models.
• Apple Health / Health Connect: the active energy, resting energy and sleep the app reads from there do not leave your phone: they are not sent to your account, your coach does not see them and nobody receives them. The app uses them to work out your energy expenditure and your recovery hint on the spot, without storing them; the only thing that reaches your account is the calorie target you choose to apply, under the same rules as one you type yourself. Apple and Google receive nothing from TempusCore.
• Sentry (error-reporting service): receives the technical reports described in section 3, with a random install identifier and without IP address, name, email or health data. The data is stored in its European Union region (Germany). Sentry (Functional Software, Inc., United States) acts as a processor, is certified under the EU-U.S. Data Privacy Framework and applies the standard contractual clauses. It can be turned off in Settings → Privacy.
• PostHog (product-analytics service), only if you turn on "Help us improve the app": receives the usage events described in section 3, with a random identifier and without name, email or health data. The data is stored in its European Union region (Germany). PostHog (PostHog, Inc., United States) acts as a processor, is certified under the EU-U.S. Data Privacy Framework and applies the standard contractual clauses.
• Open Food Facts (a public, collaborative food database): if you scan a barcode, the app queries them directly with that code and, as on any internet connection, they see your IP address. Nothing else is sent to them. Food data comes from Open Food Facts (openfoodfacts.org), available under the ODbL licence.
• Authorities, only when a law or a court order requires it.

Nobody else receives your data.

5. Privacy in chat and reports

Chat messages are private between the two people. If you report a message, the server keeps a copy of that message and of the 5 before it in that conversation so that a member of the team can review them. That copy is kept even if the relationship is deleted or there is a block. The reported person is not notified of the report. We do not read chats routinely: the only automatic check is the filter of serious expressions described in section 3, which acts before the message is sent and stores nothing.

6. How long we keep the data

• Your account and health data: for as long as you have the account. When you delete it from Settings, we remove your account, your workouts and the workout in progress, habits, meals, weight, measurements, vitals, supplements, your own foods, relationships, chats, routines, programs, ratings, consents, your subscription data and the notification identifier; any founder code assigned to you is no longer linked to you and is never reused. Deleting your account does not cancel a subscription taken out with Apple or Google: cancel it first from your Apple or Google Play settings (terms, section 5).
• Unfinished sign-up: if you start creating an account and do not confirm the code we email you within 24 hours, what you entered is deleted automatically.
• "Let me know when it's out" list: if you don't confirm your email within 72 hours, we delete it; if you unsubscribe, immediately; and on 1 February 2027 we delete the whole list (it disappears from backups within 8 more days).
• Inactive accounts: if you do not sign in for 18 months in a row, we delete your account and all its data. Before that we email you twice, 60 and 15 days before; signing in to the app is enough to keep the account active. Reports that concern you are kept for the period stated below even if the account has been deleted.
• Local copy on your phone: the app keeps an encrypted copy to work offline. When you sign out, your health data, diary and scanned products are deleted; your own foods, saved diets and the workout in progress stay encrypted on the phone (they exist only there) until you delete the account or uninstall the app.
• Reports received about a person who later deletes their account: kept for 12 months after they are resolved (or from the deletion of the account, if they were pending), so that action can be taken if the same person returns, on the basis of legitimate interest in the security of the platform. After that period they are deleted automatically.
• Reports you made: if you delete your account they are anonymised (what identifies you is removed) and the reported message is kept for the same reason and period.
• Technical logs (IP, errors): 30 days at most.
• Error reports (Sentry): 90 days at most (currently 30). Usage data (PostHog): 12 months; then they are deleted. As they are not linked to your account, deleting the account does not identify them; if you turn the switches off, they stop being sent immediately.
• Backups: the database is backed up automatically every day and each backup is kept for 8 days. When you delete your account, your data disappears from the database immediately and from the backups within 8 days at most. Backups are only used to restore the service after a failure, never to recover data that you have deleted.

7. Your rights

At any time you can:

• Access your data and take it with you (Settings → Export your data, as JSON or CSV).
• Rectify it by editing it in the app.
• Erase it (Settings → Delete account and data, or by writing to us; also explained at tempuscore.app/en/delete-account).
• Restrict or object to processing based on legitimate interest.
• Withdraw your consent whenever you wish, without affecting what was done before: by deleting the data, turning off the relevant switch or deleting the account, or, if you're on the "Let me know when it's out" list, with the unsubscribe link in any of its emails.

To exercise them outside the app, write to us at tempuscoreapp@gmail.com from your account's email address (or tell us how to verify it is you). We reply within one month at most. If you believe we are not handling your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of the European Union or European Economic Area country where you live (for example, Datatilsynet in Norway).

8. Minimum age

TempusCore is for people over 16. When you create the account you confirm that you are at least 16. If we detect the account of a person under that age, we delete it together with their data.

9. Security

Encrypted connections (https), encrypted passwords, an encrypted local copy on your phone (with the key kept in the device's secure store), limits against abuse, permissions so that nobody sees another person's data, and servers in the European Union. In Settings → Security you can verify your email, change your password and sign out of all other sessions open with your account; changing the password closes them automatically. No system is infallible: if there were a security breach affecting your data, we will tell you and notify the AEPD within the legal deadlines.

10. Health notice

TempusCore is a support tool. Its calculations, trends and notices (calories, weight, vitals) are indicative and do not replace the advice of a doctor, dietitian or other health professional. The app does not interpret your vitals or make diagnoses.

11. Changes to this policy

If we change this policy in an important way, we will tell you in the app before it applies and, if the change affects health data, we will ask for your consent again.

12. Our Instagram profile

We have an Instagram profile, @tempuscore, to show the app. This section only concerns people who follow it, comment on it or message us there. The app shares nothing with Instagram, and the website has no Instagram buttons or embedded content, only a link.

• Who processes your data on Instagram. Instagram is a service of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). Meta processes the data of Instagram users under its own privacy policy (privacycenter.instagram.com) and decides how the platform works, including cookies. Meta may transfer data to the United States, as it explains in that policy.
• What we see. The same as any professional profile. If you follow us, like, comment or message us, we see your username and your public profile, as well as your comments and messages. We also see the insights Instagram produces about the profile and the posts: reach, visits, link taps and aggregated audience data, such as age ranges or countries. These insights do not let us know who you are.
• Insights are a joint responsibility with Meta (Art. 26 GDPR), under the agreement Meta applies to professional profiles. Meta takes primary responsibility for that processing and for handling rights requests about it. You can exercise them with Meta or with us; if you write to us, we will pass your request on to Meta. Meta publishes the essence of that agreement at facebook.com/legal/terms/information_about_page_insights_data.
• Why, and on what legal basis. We use this data to answer your questions and to learn which posts people find interesting. The basis is our legitimate interest in presenting the app and attending to those who contact us (Art. 6(1)(f) GDPR).
• What we do with what you write. We read it and reply within Instagram. We do not copy it outside Instagram, link it to any app account or use it to send you advertising: we do not send commercial messages by direct message to anyone who has not asked for them. Please do not post your email, phone number or health information in a comment: if you do, we will delete it to protect you. To be told when the app is out, use the form on the website; for app support, use the contact email.
• How long we keep it. Comments and messages stay on Instagram until you or we delete them or the profile is closed. Insights last as long as Meta chooses to offer them.
• Your rights. You have those in section 7. You can exercise them with us at tempuscoreapp@gmail.com or with Meta from your Instagram settings. You can also unfollow us, delete your comments or block us at any time.

13. Contact

tempuscoreapp@gmail.com