Last updated: 29 August 2026
Version française · English
This policy describes the personal data processed in connection with the EVOLV application, the purposes of that processing, its recipients, and the rights available to users.
EVOLV is a fitness and nutrition tracking application. It is designed so that most of the information entered by the user remains on the user's device. No data is sold, rented or used for advertising purposes.
The data controller is Ayoub Ouaid, 143 rue Général de Gaulle, 62221 Noyelles-sous-Lens, France, publisher of the EVOLV application, within the meaning of Regulation (EU) 2016/679 (GDPR).
Any question relating to this policy may be sent to supportevolv@gmail.com.
The following information is stored in the application's storage, on the user's device, and is not transmitted to any server:
This data is deleted along with the application if it is uninstalled. The publisher holds no copy of it and is unable to restore it.
Data leaves the device in the four cases described below, and in those cases only.
Creating an account protects access to the application. The authentication provider Supabase then stores the user's email address, first name and an encrypted password. The publisher never has access to the password in clear text. Where the user signs in with Google, Google transmits the email address and name; the Google password is not disclosed.
This information is used solely for identification purposes. No fitness, nutrition or health data is associated with the account on the publisher's servers.
Using a conversational coach or the meal analysis feature causes the request to be sent to a relay server operated by the publisher (Cloudflare Workers), which forwards it to Google's Gemini model.
The following is transmitted at the moment these features are activated:
These elements constitute health-related data within the meaning of Article 9 of the GDPR. They are transmitted only at the user's initiative, the application remaining fully usable without recourse to these features. Their use constitutes explicit consent to that transmission, which may be withdrawn at any time by ceasing to use them.
The relay server retains neither the message, nor the image, nor the answer. It performs no disk writes and keeps no log of the content transmitted. Only a per-IP request counter is held in memory for one minute, in order to prevent abuse. Processing carried out by Google is governed by the Gemini API terms.
Scanning a barcode causes that code alone to be sent to the public OpenFoodFacts database, in order to obtain the product's nutrition record. No information relating to the user accompanies the request.
Payments are processed exclusively by Apple's App Store or the Google Play Store, with the technical provider RevenueCat verifying the status of the subscription. The publisher has access neither to card numbers nor to payment details. Only the active or inactive status of the subscription, linked to a technical identifier, is communicated to it.
| Data | Recipient | Retention |
|---|---|---|
| Profile, journal, workouts, photos, steps | None (device only) | Until uninstall or erasure |
| Email address, first name, password | Supabase | Until the account is deleted |
| AI requests, meal photographs, profile context | Relay server, then Google (Gemini) | No retention by the publisher |
| Barcode | OpenFoodFacts | Not applicable (no personal data) |
| Subscription status | Apple, Google, RevenueCat | Duration of the subscription |
The application displays no advertising. It contains no advertising tracker and no third-party analytics tool. No data is sold, rented or disclosed to third parties for commercial purposes. No profile is built for such purposes. No decision producing legal effects is taken on the basis of automated processing.
Each permission may be declined or withdrawn at any time in the operating system settings. The application remains usable, the corresponding feature being unavailable.
Users have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw consent at any time.
These rights may be exercised directly within the application:
Any written request, in particular where access to the application has been lost, may be sent to supportevolv@gmail.com. A reply will be provided within one month.
Users also have the right to lodge a complaint with the French Data Protection Authority (CNIL).
Certain providers (Google, Cloudflare, Supabase, RevenueCat) may process data outside the European Union, in particular in the United States. Such transfers are governed by the standard contractual clauses adopted by the European Commission and, where applicable, by the EU–US Data Privacy Framework.
Exchanges with the publisher's servers and those of its providers are encrypted using the TLS protocol. Passwords are at no point stored in clear text. Data held on the device benefits from the protections offered by the operating system; locking the device with a passcode, fingerprint or facial recognition is recommended.
In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the data subjects, those subjects will be informed as soon as possible.
The application is not intended for persons under the age of sixteen. It calculates calorie targets and offers training programs that are not suitable for a younger audience without supervision. No data concerning a child under sixteen is knowingly collected; should this occur, it will be deleted upon notification to the contact address.
EVOLV is not a medical device. Calorie targets, training programs and the answers of the conversational coaches are estimates and suggestions provided for information purposes. They are not a substitute for the advice of a doctor, a dietitian or any other healthcare professional. Consulting a professional is recommended before undertaking a diet or a training program, in particular in the event of illness, pregnancy or an eating disorder.
This policy may change along with the application. The date of the latest update appears at the head of the document. Any substantial change to the processing described will be notified within the application before it takes effect.