Privacy policy
Version of 28 October 2026.
Draft. This text is pending review by a data protection expert before the app is published.
Who is responsible
The controller of your data is Alejandro Bosquet, an individual who provides Recarga (a 17lab project). For any question about your data, write to 17lab.pro@gmail.com.
Your health data
What you eat, your diet and your sex and age say things about your health, so we treat them as health data (Art. 9 GDPR). We only store them if you give us your explicit consent, on a screen of its own right after creating your account, separate from accepting these texts. We store the date you gave it and the version of the text you accepted. Without that consent the app can't work, because we couldn't store your diet or what you eat.
What data we store
- Your account: name, email, password (handled by Supabase; we never see it), the language of your emails and when you accepted these texts and the consent.
- Health data, with your consent: sex (“I'd rather not say” is an option) and year of birth; your diet (calorie and macro targets, day types, meals and times); your meal library; what you eat each day (what counts from the plan, changes, swaps and extras); the supplements you set up and tick off; the foods you create, the products you scan and the micronutrient references you edit.
- Plus: if you subscribe, the plan, its status (trial, active, cancelled) and when it ends. Payment is handled by the store (App Store or Google Play) and we don't see your payment details.
- On your phone we keep a copy of your profile and anything you log offline until it is uploaded.
Scanner. The app uses the camera only while you scan a barcode and does not store images. To find out which product it is, your phone looks up the code in Open Food Facts, an open database; we send it nothing about you, only the code. What you scan is stored in your account.
What we use it for and on what legal basis
Only to make the app work: counting your diet as done, working out how your day is going, swaps between foods and suggestions, and showing you your history. The app doesn't create diets or recommend supplements: it records what you decide. There are no ads, we don't track you across apps or websites and we don't sell or share your data.
- Your account and account emails: the contract you accept with the Terms (Art. 6(1)(b) GDPR).
- Health data: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
- Plus: the subscription contract (Art. 6(1)(b) GDPR).
Who we share data with
No one other than the providers we need to run the service, who process data on our behalf and can't use it for anything else. When they are outside the European Union, data leaves with one of the GDPR safeguards:
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Supabase | Database and accounts (email and password) | European Union (Paris) | Data does not leave the EU |
| Resend | Account emails: confirming your email and resetting your password | United States | EU-US Data Privacy Framework |
| Vercel | Hosting for this website and the services the app uses | United States | EU-US Data Privacy Framework and standard contractual clauses |
| RevenueCat | Managing the Plus subscription: your user identifier and the status of your purchase | United States | European Commission standard contractual clauses |
Apple and Google charge subscriptions as independent controllers, under their own privacy policies.
Your assistant (Plus). If you connect your AI assistant (Claude, ChatGPT…) to Recarga, the data you ask it for goes to that service, under its own terms. We remind you of this in a separate notice when you connect it, and you can disconnect it at any time.
How long we keep it
For as long as you have an account. If you withdraw your consent or delete your account, your data is deleted straight away, and any backups that might contain it expire within 30 days at most.
Your rights
- Withdraw consent: in Profile → Privacy. When you withdraw it we delete your Recarga data (diet, library, history and supplements); your account stays, but the app won't work until you give it again. Withdrawing it doesn't affect what was processed before.
- Download your data (portability): in Profile → Privacy, a file with everything in JSON and what you eat per day in CSV.
- Delete your account: in Profile, without asking us. Your Recarga account and all its data are deleted; your Sobrecarga account, if you have one, is not touched. If you no longer have the app, write to us from your account email and we'll delete it within 30 days at most.
- To access your data, correct it, restrict its use or object to any processing, write to 17lab.pro@gmail.com. We reply within one month at most.
If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority where you live.
Security
Data travels encrypted and each account can only read its own data: the server checks it on every request.
Minimum age
Recarga is not intended for people under 16.
Changes
If we change anything important in this policy, we'll tell you in the app before it applies and, if it affects your health data, we'll ask for your consent again.