Weight Journal — privacy policy
Last updated: 27 September 2026
Weight Journal helps you keep track of your weight, body measurements and progress photos. That is personal and, under the GDPR, health data. This policy explains what we collect, why, where it is stored and how you stay in control. It applies to the Android and iOS apps and to the web app at weight-journal.nextim.app.
1. Who we are
The controller of your data is NEXTIM LABS SRL, Tax ID (CUI): 55575324, Trade register: J2026054077007, București, România. Contact: suport@nextim.app.
2. What we collect
| Data | Why |
|---|---|
| Account: email address, name, password (stored only as a hash), language, unit system, time zone offset | To create your account, sign you in, send confirmation and password-reset emails, and show dates in your local time |
| Sign in with Google or Apple (only if you choose it): the account identifier and email address the provider shares with us | To sign you in without a password |
| Profiles: name, date of birth, sex, height, target weight | To calculate BMI, progress and your target |
| Health data: weight entries, body measurements, progress photos and the notes you add to them | This is the journal itself |
| GLP-1 treatment journal (only if you use it): medication, treatment periods, doses (number, optional amount) and their notes — medication and notes encrypted | To show your treatment next to your weight and mark the treatment periods on your chart |
| Reminder settings | To remind you to weigh in |
| Purchases (when lifetime access is bought): status, store, product and date — never your card details, which stay with Google or Apple | To unlock lifetime access and meet accounting obligations |
| Technical data: IP address and device information in server logs, sign-in tokens | To keep the service secure and working |
3. Legal basis
- Your explicit consent (Art. 9(2)(a) GDPR) for health data. You can withdraw it at any time by deleting the entries, photos or your whole account; this does not affect processing that happened before.
- Performance of our contract with you (Art. 6(1)(b)) for your account, profiles, reminders and purchases.
- Legal obligations (Art. 6(1)(c)) for purchase records we must keep under tax and accounting law.
- Legitimate interest (Art. 6(1)(f)) for server logs used to keep the service secure.
4. How we protect it
- All connections are encrypted (HTTPS/TLS).
- Names, notes and the email addresses shared by Google or Apple are encrypted in the database.
- Progress photos are encrypted before they are written to disk, with a key kept separate from the rest of the data, and stored under random file names. Location and device data (EXIF, including GPS coordinates) are removed from every photo.
- Backups are encrypted on the server before they leave it; only we hold the key that can decrypt them.
- Access to the servers is limited to us, with key-based authentication.
5. Where your data is stored and who helps us
We do not sell your data, we do not show ads and the apps contain no analytics or tracking SDKs. We use a few service providers, each only for what is listed:
- OVHcloud SAS — hosting. The service runs on a server in Germany; encrypted backups are kept in France (Roubaix). Both are in the European Union.
- Proton AG (Switzerland) — sends the app's emails (account confirmation, password reset). Switzerland is recognised by the European Commission as providing an adequate level of data protection.
- Google and Apple — only if you use Sign in with Google or Sign in with Apple, and, when available, to process in-app purchases through Google Play and the App Store under their own privacy policies.
- Cloudflare — manages our domain's DNS. It does not see your data or the traffic between the app and our server.
6. How long we keep it
- Your data stays in the service until you delete it or your account.
- When you delete your account, your profiles, entries, measurements, photos and sign-in tokens are removed from the live database immediately. Encrypted backups expire automatically within 90 days.
- Server logs are deleted after 14 days.
- Purchase records are kept for as long as tax and accounting law requires.
7. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format and withdraw your consent. Most of this you can do directly in the app; for anything else — including a free copy of all your data — write to suport@nextim.app from the address of your account. We answer within one month.
You can also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in the country where you live.
How to delete your account: see Delete your account.
8. Children
Weight Journal is not intended for children under 16, and we do not knowingly collect their data.
9. Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. The date at the top shows the latest version.