Vulkan Privacy Policy
Vulkan is a nutrition and training mobile app developed by Lucas Verweij (“we”). This policy explains what data the app processes, why, and what rights you have. The short version: your data lives on your device, we never sell data, and we show no ads.
1. Data controller
Lucas Verweij (independent developer). Contact: lucasduijker@gmail.com.
2. Data the app processes
- Data stored only on your device (default): food log, training routines and sessions, body weight, goals and profile data (age, sex, height, weight, experience level), score, streaks and achievements. Vulkan works offline and without an account; in that mode this data never leaves your device.
- Account data (optional): if you create an account, we process your email address or your sign-in provider identity (Apple or Google) to authenticate you. While signed in, your app data (listed above) is synced to our backend (Supabase) so it can be restored and used across devices.
- Community: your chosen display name, your city (selected manually, never via GPS) and your score may be visible to other users in the local leaderboard.
- Purchases: subscriptions are processed by the App Store or Google Play; we never see or store payment details. We use RevenueCat to validate subscription status via transaction identifiers and a user identifier (anonymous if you have no account).
- Camera: used only to scan food barcodes when you enable it. Images are never stored or uploaded.
- Notifications: reminders are local; you can disable them anytime in system settings.
3. Purpose and legal basis
We process data exclusively to provide the app's features: nutrition and training logging, cross-device sync (account only), local leaderboard and subscription management. The legal basis is performance of contract (Art. 6(1)(b) GDPR) and, for the health data you choose to log, your explicit consent when using the corresponding feature (Art. 9(2)(a) GDPR). We do not use your data for advertising, nor sell or share it with third parties for commercial purposes.
4. Data processors
- Supabase (backend and authentication) — hosts account data and synced data.
- RevenueCat (subscription management) — receives store transaction identifiers to validate your subscription.
- Apple App Store / Google Play — process payments under their own privacy policies.
5. Retention and deletion
Local data is deleted when you uninstall the app or clear its data. If you have an account, we keep your synced data for as long as the account exists; you can request full deletion of your account and its data by writing to lucasduijker@gmail.com.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to the contact email. You may also lodge a complaint with your supervisory authority (in Spain, the AEPD).
7. Children
Vulkan is not directed at children under 16 and we do not knowingly collect their data.
8. Changes to this policy
Any changes will be published here with an updated “last updated” date. If a change is substantial, we will notify you in the app.