Privacy Policy

Last updated: 24 September 2026. Effective on public launch.

Who we are (data controller)

Turul is operated by Häckl Gábor e.v., registered at 2141 Csömör, Liget utca 33, Hungary ("Turul", "we", "us"). We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at support@turul.app.

What data we collect

• Health and fitness data — workouts, sets/reps/weights, meals you log, fasting windows, body-composition measurements, and AI-generated programs derived from that data. Under the GDPR this is special-category (sensitive) data (Article 9) and we process it only on the basis of your explicit consent, given when you enter it.
• Health and wearable data read from Health Connect (Android) — if you connect Health Connect and grant the permissions, Turul reads your steps, active energy burned, resting heart rate, heart rate, sleep sessions and body weight. Health Connect is the Android system app other health apps write into, so these readings may originate from Samsung Health, Zepp/Amazfit, Fitbit, Google Fit, a connected watch or your phone itself. This is also special-category data under Article 9 and is processed on the basis of your explicit consent — see Health Connect below.
• Calendar data (optional) — if you connect Google Calendar, Turul stores each event's title, location, start and end time, all-day flag and calendar identifier, so your day can be planned around your commitments. Descriptions, attendees, guest lists and attachments are never requested or stored, and access is read-only — see Google API Limited Use below.
• Push notification token — if you enable notifications, the device token needed to deliver them, plus the reminder time and time zone you choose.
• Account information — your email address and authentication credentials, managed via Supabase Auth.
• Device & usage data — technical data needed to operate and debug the service (e.g. request logs, error reports, app/version and platform).
• Payment data — when paid plans launch, billing is handled by Stripe; we do not store full card details. (Public billing is not live yet.)

Legal bases for processing (GDPR Art. 6 & 9)

• Explicit consent — for health/fitness (special-category) data. You can withdraw consent at any time (see Your rights).
• Contract — to provide the app features you request (tracking, history, AI programs) and, in future, to fulfil a paid subscription.
• Legitimate interests — to keep the service secure, debug issues, and prevent abuse, balanced against your rights.
• Legal obligation — where required, e.g. issuing compliant invoices for paid plans (see Sub-processors).

How we use your data

• Operate core features (tracking, history, progress views).
• Generate AI-assisted content, such as workout programs and meal analysis.
• Diagnose bugs and maintain service reliability.
• Communicate with you about your account or the service.

We do not sell your personal data, and we do not use it for third-party advertising.

Health Connect (Android)

Reading Health Connect is entirely optional and off until you turn it on. What it means in practice:

• You grant each kind of data separately, in Health Connect's own permission screen, and you can review or revoke any of them there at any time. When you revoke, Turul stops reading immediately.
• Older history is a separate permission. Health Connect shares only about 30 days from before you connected unless you allow Turul to read your history; if you do, Turul may read up to 180 days so your longer-range charts are not empty.
• Reading while the app is closed is a separate switch, off by default. With it on, Android runs a background sync roughly twice a day so last night's sleep is ready when you open the app. With it off, Turul reads only while you are using the app.
• What we do with it: store it in your account, show it on your wellness cards and charts, and use it in your daily briefing, which is computed on our own servers. We do not send Health Connect data to AI providers, we do not use it for advertising or profiling, we do not sell it, and we do not share it with anyone beyond the infrastructure providers listed below.
• Deleting it: revoking permission stops future reads but does not erase what was already synced. Email support@turul.app and we will delete it, or delete your account to remove all of it.

Google API Limited Use

Turul's use of information received from Google APIs — the Google Calendar data described above — adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use this data only to provide and improve the calendar features you can see in the app; we do not transfer it to others except as needed to provide those features, for security purposes, or to comply with the law; we do not use it for advertising; and we do not allow humans to read it, except with your explicit consent for support you have asked for, for security purposes, to comply with the law, or where the data is aggregated and anonymised. Google Calendar data is not sent to AI providers and is not used to train any model. You can disconnect your calendar in the app at any time, which deletes the stored events and revokes our access.

Sub-processors & third parties

Turul relies on the following providers, each processing data under its own terms:

• Supabase — database, authentication, and storage (the primary store for your account and fitness data).
• OpenRouter — routes our AI requests to the model providers listed below. We do not use any other AI provider.
• Anthropic, Google and OpenAI — the only model providers we send data to. Depending on the feature, a request may include the text you typed, your fitness profile figures, or a photo you chose to submit for analysis. Requests are configured so that no provider may store or train on them, and the routing cannot substitute a provider outside this list.
• Stripe — payment processing for future paid plans.
• Szamlazz.hu — issuing legally compliant invoices (Hungarian NAV e-invoicing) for paid transactions.
• Resend — transactional email delivery.
• Sentry — error monitoring (personal data is scrubbed before transmission).
• Expo — delivery of push notifications to your device (the notification text and your device token; never your health or calendar data).
• Railway and Vercel — hosting for the Turul API and the web app.
• Google — only where you connect Google Calendar, as the source of the calendar data described above.

International transfers

Some providers (notably certain AI and infrastructure services) may process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Data retention & deletion

We retain your data for as long as your account is active and as needed to provide the service. A self-service data export/deletion flow is planned; until it ships, you can request export or deletion by emailing support@turul.app, and we will action it within the timeframe required by law. Health Connect readings and synced calendar events are covered by the same request; disconnecting a calendar in the app deletes its stored events straight away.

Your rights

Subject to the GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data (rectification);
• request deletion (erasure / "right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time (without affecting prior processing);
• lodge a complaint with your supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

To exercise any of these, email support@turul.app.

Children

Turul is not directed to children and is intended for users aged 18 or older. We do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy as the product develops. Material changes will be reflected here with an updated "last updated" date, and, where required, communicated to you.

Contact

Häckl Gábor e.v. — 2141 Csömör, Liget utca 33, Hungary — support@turul.app