Your data. Plain talk.

PURPOFF CORE is an AI coaching app for athletes who train and eat with intention. We're an independent team — contact us anytime at contact@purpoff.com.

Data controller: ФОП Лєпьошкін Михайло Євгенович, tax number 3778401593, бул. Шевченко 472, Черкаси, Черкаська область, 18006, Україна.

EU representative (Art. 27 GDPR): As our data controller is established outside the EU, we have appointed a representative in the European Union whom you — or a supervisory authority — may contact on all matters relating to the processing of your personal data. iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria. Contact: app.prighter.com/portal/17436604695.

Only what we need to coach you well. Specifically:

• Your account — email and a Supabase-hashed password.
• Your profile — height, current weight, goal, training level (if gym-related).
• Your training data — programs, sessions, sets, reps, weights, RPE, session notes.
• Your nutrition data — meals synced from your catering provider plus any manual logs.
• Your activities — walks, runs, yoga, and anything else you log.
• Your coaching briefs — the daily output written specifically for you.
• Your weight history if you log it.

So we can write you a useful coaching brief. That's it. The brief reads your last 30 days of training + meals + recovery and synthesises one short prescription per morning. Your data never leaves this purpose.

Your data lives in Supabase, hosted in the Paris (EU, eu-west-3) region. Encrypted at rest, encrypted in transit. Some processing (AI coaching via Google) involves a transfer to the United States, carried out under the EU Standard Contractual Clauses / EU-US Data Privacy Framework. We do not store backups outside the EU.

Two narrow exceptions:

• AI provider (Google) receives a pseudonymised summary of your training + nutrition + recovery (and any photo you attach in chat) to generate your coaching. No email, no name, no account ID. We use Google's paid API, under which your data is not used to train Google's models.
• Your catering provider To fetch and edit your meal plan on your behalf, we store the email and password you enter for your catering account, encrypted (AES-256-GCM). They are used only to log in to your catering provider and are deleted when you delete your account.
• Infrastructure providers Our hosting providers (Supabase for the database, Railway for the API, Vercel for the website) process data on our behalf under data-processing agreements. OpenFoodFacts is queried for barcode lookups (no personal data).

We never sell, trade, or share your data with advertisers, data brokers, insurance companies, or any other third party.

You own your data and you can:

• Access & move it — export all your data as a JSON file from Settings (Art. 15 & 20).
• Correct it — every profile + training value is editable in-app (Art. 16).
• Delete it — one tap in Settings (or the Delete-account page) permanently deletes your account and all data, including saved catering logins. Irreversible (Art. 17).
• Withdraw consent — turn off any consent in Settings; as easy to withdraw as to give (Art. 7).
• Object / restrict — email us and we'll stop processing (Art. 18 & 21).

You can also email contact@purpoff.com and we'll action any request within one month. You also have the right to lodge a complaint with your supervisory authority — in Poland, the UODO (uodo.gov.pl).

We process your health & nutrition data (special-category data under GDPR Art. 9) on the basis of your explicit consent, given at signup and withdrawable at any time. Your data is kept for as long as your account exists; deleting your account permanently erases it, and time-limited caches are purged on a rolling schedule. Encrypted database backups may retain a copy for a short rotation window (up to 30 days) before they are overwritten. No archive, no shadow copies.

One cookie — your locale preference. No analytics, no advertising, no third-party trackers. Auth uses a session cookie that lives only while you're signed in.

PURPOFF CORE is for athletes aged 16 and over. We don't knowingly collect data from anyone younger.

If we materially change anything — what we collect, who else sees it — we'll email every active user 14 days before the change takes effect. The current effective date sits at the top of this page.

Questions, exports, deletions, complaints — write to contact@purpoff.com or contact@purpoff.com for anything else.