Privacy in the Sporttáp app

Effective: 22 October 2026 · Version 1.0

1. Controller

DarwinAI (ARworks Kft.), Budapest, Hungary – contact via darwinai.hu.

2. Data we process

• Parent account: e-mail, name, password (hash only), language, login times, consent time.
• Child profile (entered by the parent): nickname, date of birth, sex (only for age-band reference values), sports, allergens, intolerances, disliked foods, optional health note (separate field, parent’s decision), optional dated weight and height.
• Usage data: sessions, races, planned and logged meals, shopping lists, learning progress, favourites.
• Technical: server logs (errors, security audit), session cookie.

3. Purpose and legal basis

Providing the service (contract, GDPR Art. 6(1)(b)); health-related child data (allergens, health note) is processed on the parent’s explicit consent (Art. 9(2)(a)), revocable any time by deleting the data. Security logging: legitimate interest (Art. 6(1)(f)).

4. Minors

Only a parent/guardian can register; children have no account or public profile. We ask only for the minimum data needed for planning, no photos.

5. Processors

• Hosting: Hetzner (EU, Germany), containers (Coolify).
• AI features (free-text meal parsing, Q&A): the entered text and non-identifying profile data (age, sport, allergens) go to the configured AI provider (DeepSeek, fallback OpenAI); no name or e-mail is sent. The feature can be disabled by the operator.
• E-mail: SMTP provider (if configured).
• Analytics: Umami (self-hosted, cookie-less, anonymised IP) on the public domain only.

6. Retention

For the lifetime of the account; deleting the account removes all household data immediately and permanently. Backups kept for up to 14 days.

7. Your rights

Access, rectification, erasure, portability (JSON export in Profile), objection, withdrawal of consent; complaints to the Hungarian NAIH.

8. Cookies

Only a strictly necessary session cookie (HttpOnly, SameSite). No marketing or tracking cookies; analytics is cookie-less.