Privacy Policy

Last updated: 5 July 2026 · Applies to the Fennel web app and mobile app (beta)

Who we are

“Fennel” (myfennel.com) is a personal food-tracking tool for people managing dietary conditions such as kidney stones, gout, CKD, and coeliac disease. We are a small, independent application. For anything in this policy, contact support@myfennel.com.

What data we collect

Account data: your email address, an optional display name, and, if you sign in with Google, your Google account identifier and profile picture.
Health data (special category under GDPR Art. 9): the dietary conditions you select, foods and portions you log, hydration entries, symptoms you record, your nutrient targets, and reports generated from them. This data exists only so the app can work for you. It is never sold, never shared with third parties, and never used for advertising.
Content you create: custom foods, recipes, and answers you submit through in-app feedback or surveys.
Preferences: units, timezone, and similar settings.
Usage data: server logs (IP address, request timestamps) retained briefly for security and debugging, plus cookieless, aggregated page analytics that cannot identify you.

Legal basis for processing

Health data is a special category under GDPR Article 9. We process it only on the basis of your explicit consent, recorded when you create an account (or, if you signed up with Google, on the consent screen shown before first use). You may withdraw consent at any time by deleting your account, which removes your data.

Family sharing

If you join a family plan, only custom foods marked as family-shared are visible to other members of your household. Your conditions, food diary, symptoms, hydration, targets, and reports are never visible to family members; each person’s health data stays private to their own account.

Where your data is stored (all EU)

We deliberately run the whole service inside the EU:

Database: Neon (PostgreSQL), Frankfurt, Germany.
Application hosting: Vercel, with server functions pinned to Frankfurt, Germany.
Transactional email (password resets, invites): Resend, EU region (Ireland).
Error monitoring: Sentry, EU region (Germany), configured so that crash reports contain no IP addresses, user identifiers, or request contents.
Abuse protection: Upstash (rate-limiting counters only; no health data ever reaches it).

Authentication uses encrypted tokens stored in a cookie on your device. If you sign in with Google, Google processes that sign-in under its own privacy policy.

How long we keep your data

For as long as your account is active. You can delete your account and all associated data at any time, in the mobile app (Settings → Account & privacy) or on the web (Settings); see how to delete your account. Deletion is immediate in our database, and residual database backups expire within days.

Your rights (GDPR)

Access: request a copy of your data.
Rectification: correct inaccurate data (most of it directly in the app).
Erasure: delete your account and all data, self-service in Settings.
Portability:download a full machine-readable copy of your data (JSON or CSV) any time from Settings → Privacy & Data, or generate a clinician report in the app.
Objection / withdrawal: withdraw consent and stop all processing by deleting your account.

To exercise any right, email support@myfennel.com. You also have the right to lodge a complaint with your national data protection authority.

Cookies

We set a single authentication cookie (httpOnly, secure) so you stay signed in. No third-party tracking or advertising cookies are used. Page analytics are cookieless and aggregated.

Beta notice

Fennel is currently in beta. The service, including this policy, will evolve; we will notify you of material changes by email or an in-app notice.

Medical disclaimer

This application is informational only and does not constitute medical advice. Nutrient values are compiled from published research but vary by food variety, preparation, and analytical method. Always follow guidance from your clinician or dietitian.