Privacy Policy
Last updated: 10 July 2026. Effective on public launch.
Who we are (data controller)
Turul is operated by Häckl Gábor e.v., registered at 2141 Csömör, Liget utca 33, Hungary ("Turul", "we", "us"). We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at support@turul.app.
What data we collect
- Health and fitness data — workouts, sets/reps/weights, meals you log, fasting windows, body-composition measurements, and AI-generated programs derived from that data. Under the GDPR this is special-category (sensitive) data (Article 9) and we process it only on the basis of your explicit consent, given when you enter it.
- Account information — your email address and authentication credentials, managed via Supabase Auth.
- Device & usage data — technical data needed to operate and debug the service (e.g. request logs, error reports, app/version and platform).
- Payment data — when paid plans launch, billing is handled by Stripe; we do not store full card details. (Public billing is not live yet.)
Legal bases for processing (GDPR Art. 6 & 9)
- Explicit consent — for health/fitness (special-category) data. You can withdraw consent at any time (see Your rights).
- Contract — to provide the app features you request (tracking, history, AI programs) and, in future, to fulfil a paid subscription.
- Legitimate interests — to keep the service secure, debug issues, and prevent abuse, balanced against your rights.
- Legal obligation — where required, e.g. issuing compliant invoices for paid plans (see Sub-processors).
How we use your data
- Operate core features (tracking, history, progress views).
- Generate AI-assisted content, such as workout programs and meal analysis.
- Diagnose bugs and maintain service reliability.
- Communicate with you about your account or the service.
We do not sell your personal data, and we do not use it for third-party advertising.
Sub-processors & third parties
Turul relies on the following providers, each processing data under its own terms:
- Supabase — database, authentication, and storage (the primary store for your account and fitness data).
- OpenRouter — routes our AI requests to the model providers listed below. We do not use any other AI provider.
- Anthropic, Google and OpenAI — the only model providers we send data to. Depending on the feature, a request may include the text you typed, your fitness profile figures, or a photo you chose to submit for analysis. Requests are configured so that no provider may store or train on them, and the routing cannot substitute a provider outside this list.
- Stripe — payment processing for future paid plans.
- Szamlazz.hu — issuing legally compliant invoices (Hungarian NAV e-invoicing) for paid transactions.
- Resend — transactional email delivery.
- Sentry — error monitoring (personal data is scrubbed before transmission).
International transfers
Some providers (notably certain AI and infrastructure services) may process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.
Data retention & deletion
We retain your data for as long as your account is active and as needed to provide the service. A self-service data export/deletion flow is planned; until it ships, you can request export or deletion by emailing support@turul.app, and we will action it within the timeframe required by law.
Your rights
Subject to the GDPR, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data (rectification);
- request deletion (erasure / "right to be forgotten");
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time (without affecting prior processing);
- lodge a complaint with your supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).
To exercise any of these, email support@turul.app.
Children
Turul is not directed to children and is intended for users aged 18 or older. We do not knowingly collect data from anyone under 18.
Changes to this policy
We may update this policy as the product develops. Material changes will be reflected here with an updated "last updated" date, and, where required, communicated to you.
Contact
Häckl Gábor e.v. — 2141 Csömör, Liget utca 33, Hungary — support@turul.app