Crunch Privacy Policy
Effective Date: 2025‑05‑20

1. Introduction
This Privacy Policy explains how UAB Crunch Health (“Crunch,” “we,” “our,” or “us”) collects, processes and protects your personal data when you use the Crunch mobile application (“App”).
By using Crunch, you agree to the data‑processing practices described below and in the App’s Terms and Conditions.

2. Data We Collect, Purpose & Legal Basis for Processing
Crunch processes the personal data listed in the table. Each processing activity is linked to at least one lawful basis under the EU General Data Protection Regulation (GDPR Art. 6). When a category may reveal health‑related information (dietary restrictions), we also rely on your explicit consent (GDPR Art. 9 (2)(a)).

3. Data Storage & Security

• Hosting: all data is stored on Hostinger servers in Vilnius, Lithuania.
  
  

• Third‑party processors:
  
  

  • Google Firebase – analytics & crash reports (global, including US)
    
    

  • Mixpanel – usage analytics (Germany)
    
    

  • Datadog – metrics & logs (Germany)
    
    

  • Google Cloud Vision API – optical‑character recognition of uploaded photos (EU or US regions, protected by Standard Contractual Clauses)
    
    

  • OpenAI GPT models – language processing & ingredient matching (EU or US regions, protected by Standard Contractual Clauses)
    
    

• International transfers: when data leaves the EEA we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU‑US Data Privacy Framework.
  
  

• Security measures:
  
  

  • All traffic is encrypted in transit (TLS with certificate pinning).
    
    
    

  • Access to raw images and logs is restricted to authorised staff and processors on a strict need‑to‑know basis.
    
    

4. User Rights under GDPR
You may exercise the following rights at any time by emailing info@crunchapp.co:

1. Information – learn how and why your data is processed;
   
   

2. Access & Portability – obtain a copy of your data, including original photos or extracted text;
   
   

3. Correction – fix inaccurate data;
   
   

4. Erasure – delete your account or individual photos;
   
   

5. Objection / Restriction – object to or limit certain processing (including reuse of photos for model training);
   
   

6. Human review – contest decisions made solely by automated processing (see section 5).
   
   

We may ask you to re‑authenticate before releasing copies of images or other personal data.

5. Automated Decision‑Making
Crunch automatically compares product ingredients against your dietary selections to determine suitability. No additional sensitive data is used. You may request human review, express your viewpoint and contest any automated decision (GDPR Art. 22).

6. Third‑Party Sharing
Crunch does not sell or trade your personal information. We share limited data only with the GDPR‑compliant processors listed below, solely for the services indicated:

7. Cookies & Tracking Technologies
Crunch uses cookies and similar technologies for:

• Authentication & authorisation – maintaining your session;
  
  

• Analytics & performance – understanding usage patterns (screens, searches, clicks) linked to a device identifier;
  
  

• No advertising tracking – we do not use advertising identifiers.
  
  

Crunch performs no facial recognition, geolocation extraction or biometric profiling on uploaded photos. You can manage cookie preferences in App settings.

8. Data Retention & Deletion

• User‑linked photos remain in product search until you request its deletion by emailing info@crunchapp.co, or delete your account.
  
  

• De‑identified copies used for the public product catalogue and model training are stored without personal identifiers and may be retained indefinitely.
  
  

• Other personal data is kept while your account is active and for up to one month after deletion, unless a longer period is required to establish, exercise or defend legal claims.
  
  

9. Contact & Compliance

• Data‑protection contact: info@crunchapp.co
  
  

• Supervisory authority: State Data Protection Inspectorate of Lithuania, L. Sapiegos g. 17, Vilnius; +370 5 271 2804; ada@ada.lt
  
  

Crunch may update this Privacy Policy from time to time; significant changes will be announced in‑app or by email.

By continuing to use Crunch, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.