1. The short version
- Your health information stays on your phone. Your food diary, fluids, labs, medications, dialysis sessions and profile are stored only on your device. We don't have a server copy and can't see them.
- No ads. No advertising ID. We never sell your data. Your health information is never used for advertising or analytics.
- A few features need the internet, and we explain each one below: barcode lookups, photo plate analysis (only where the on-device model isn't available), family sharing (end-to-end encrypted), purchases, referrals and pseudonymous usage analytics that never include health values (you can turn this off).
- You're in control. “Delete all my data” in the app removes everything stored on your phone and your family share. You can also ask us to delete anything else at mobrix.dev/renaly/delete-data or support@mobrix.dev.
- Renaly is for adults (18+).
- Renaly is not a medical device. It does not diagnose, treat, cure or prevent any disease.
2. Who we are
Renaly is published by Roman Gavrilov, an individual developer established in the Republic of Moldova (“we”, “us”). For data we process ourselves (described in section 4), we are the “controller” under the EU General Data Protection Regulation (GDPR) and UK GDPR, and the “business” or “regulated entity” under US state privacy laws.
EU/UK representative (Art. 27 GDPR / UK GDPR): Not appointed. We rely on the exemption in Art. 27(2)(a) GDPR: our processing of personal data relating to people in the EEA and UK is occasional, does not include large-scale processing of special categories of data, and is unlikely to result in a risk to your rights and freedoms. Health data stays on your device and never reaches us; usage analytics are switched off unless you turn them on; the cloud plate-photo feature is not offered in the EEA, UK or Switzerland; and family-sharing data is encrypted on your phone with a key we never hold. You can reach us directly at support@mobrix.dev for any question about your data, and we will answer within one month.
3. Information that stays on your phone
Renaly stores the following only on your device, in the app's private storage:
- Profile: name (or nickname), kidney condition, weight, height, sex, whether you have diabetes
- Food diary, saved meals, fluids and oxalate/nutrient totals
- Lab results you enter or import (e.g. eGFR, creatinine, potassium, phosphorus, hemoglobin, albumin, blood pressure, PTH, calcium, bicarbonate, UACR, HbA1c, glucose)
- Medications and reminder times
- Dialysis sessions, dry weight and weight gain between sessions
- Settings (units, language, limits you set, theme, analytics choice)
We don't receive this information. It isn't sent to our servers or used for analytics.
On-device processing of photos. When you scan an ingredient list (additive scanner), import a lab report from a photo, or snap a plate on a phone that supports Google's on-device Gemini Nano model, the photo is processed on your phone. It stays in memory while being processed. Renaly doesn't save it or send it anywhere.
Camera. Renaly uses the camera only while you're scanning a barcode, label, lab report or plate.
Android backup. Android Auto Backup is turned on for Renaly's database and settings. If backup is enabled on your phone, Android saves an encrypted copy of this data to your own Google account so it can be restored on a new phone. This backup is handled by Google under Google's Privacy Policy. We can't access it. You can turn backup off in your phone's settings (usually Settings > Google > Backup).
Weekly summary card. If you share your weekly summary card, it goes through your phone's share sheet to the app and people you choose. The card doesn't show nutrient numbers.
Feedback. If you tap “Send feedback”, your own email app opens with a draft that includes the app version and Android version. Nothing is sent unless you send the email. If you do, we receive your email address and whatever you write.
4. Information that leaves your phone
4.1 Barcode lookups (Open Food Facts)
When you scan a packaged food, the barcode number is sent to Open Food Facts (a non-profit food database based in France) to look up the product. Like any website, Open Food Facts receives your IP address with the request. We don't send your name, health information or any identifier.
4.2 Photo plate logging (Renaly Plus, not offered in the EEA, UK or Switzerland)
If your phone doesn't support on-device Gemini Nano, a plate photo you take is sent once to Google's Gemini API (through Google Firebase AI Logic) to estimate the foods and portions. Renaly doesn't store the photo, on our servers or anywhere else.
Important: this feature currently uses Google's unpaid Gemini API service. Under Google's Gemini API Additional Terms, Google may use the photos and the results it returns to provide, improve and develop Google products and services, and human reviewers at Google may look at them. Please photograph only your food. Avoid people, faces, documents or anything else personal in the frame. If you'd rather not use the cloud service, you can log meals by search or barcode instead.
This feature isn't offered in the European Economic Area, the United Kingdom or Switzerland.
4.3 Family / caregiver sharing (optional, end-to-end encrypted)
If you turn on family sharing, Renaly creates an encrypted daily snapshot containing:
- your name, your condition, today's nutrient totals and limits, the names of foods you logged today, and your latest lab values,
- and any items your caregiver logs for you.
This snapshot is encrypted on your phone with AES-256-GCM before it's uploaded to our database provider, Supabase (EU region). The key needed to decrypt it exists only in the invite you share with your caregiver's phone. The server, Supabase and we can only see encrypted data (ciphertext) and can't read it. The server also handles technical data needed to deliver it, such as a random share identifier, timestamps and connection data (like IP addresses).
You can stop sharing at any time. Stopping sharing, or “Delete all my data”, deletes the share from the server. Shares nobody opens or updates for 90 days are deleted automatically. Caregivers join free and don't need to buy anything.
4.4 Usage analytics (you can turn this off)
To see which features help people and fix confusing screens, Renaly sends usage events to PostHog (EU cloud):
- a random install ID created by Renaly (not your name, email, phone number or advertising ID),
- app events: screens and features used, onboarding steps completed, paywall views and purchases,
- app version, Android version and language/region setting (locale),
- your IP address, which is part of any internet connection and which PostHog may use to derive a coarse location (country or city).
We never send health values, food names, lab results, names or photos to analytics. In the European Economic Area, the United Kingdom and Switzerland, analytics is off unless you turn it on during onboarding or in Privacy settings. Everywhere else it is on by default and you can turn it off at any time in Renaly (Privacy settings > “Share usage data”). Once it is off, no further events are sent.
4.5 Purchases (RevenueCat and Google Play)
Subscriptions and the lifetime purchase are processed by Google Play. We never see your payment card details. To check which plan you have, Renaly uses RevenueCat, which receives your random install ID (as the app user ID), Google Play purchase tokens and purchase details (product, price, currency, dates, trial and renewal status). Google handles payments under Google's Privacy Policy.
4.6 Referrals
If you install Renaly from a friend's invite link, the referral code from the Google Play install referrer and your random install ID are sent to Renaly's referral server so we can give you (and your friend) a free month and prevent abuse.
4.7 Support and deletion requests
If you email us or use the deletion request page, we receive your email address, your message and anything you choose to include.
5. What we never do
- We don't show ads and don't use the advertising ID.
- We don't sell or rent personal information, and we don't “share” it for cross-context behavioral advertising (as defined by California law).
- We don't use health information for advertising, marketing or analytics.
- We don't build profiles to make automated decisions with legal or similarly significant effects. Food verdicts are calculated on your phone from the limits you control, and they never change your limits automatically.
- We don't knowingly collect data from children.
6. Why we use data and our legal bases (EEA, UK, Switzerland)
| What | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Family sharing snapshot (includes health data) | To show your chosen caregiver your day, at your request | Explicit consent (Art. 9(2)(a)) and performance of our contract with you (Art. 6(1)(b)). You give consent when you turn sharing on and can withdraw it by turning sharing off. |
| Plate photos to Google Gemini API | Estimating your plate (not offered in the EEA, UK or Switzerland) | Consent (Art. 6(1)(a)), and explicit consent (Art. 9(2)(a)) to the extent a photo could reveal health information |
| Barcode number to Open Food Facts | Looking up the product you scanned | Performance of contract (Art. 6(1)(b)) |
| Purchases via Google Play and RevenueCat | Selling and managing Renaly Plus, restoring purchases | Performance of contract (Art. 6(1)(b)); legal obligations such as tax and accounting (Art. 6(1)(c)) |
| Referral code and install ID | Granting referral rewards and preventing abuse | Performance of contract (Art. 6(1)(b)); legitimate interests in preventing fraud (Art. 6(1)(f)) |
| Usage analytics (PostHog) | Understanding feature use and improving the app | Consent (Art. 6(1)(a)), asked for during onboarding and withdrawable at any time by turning analytics off. Events are pseudonymous and never contain health values. |
| Support emails and deletion requests | Answering you and handling your rights | Performance of contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
Health data is special-category data. Apart from family sharing and plate photos, which rely on your explicit consent, we don't process your health data at all. It stays on your phone.
Withdrawing consent doesn't affect processing that already happened.
7. Who receives data (service providers and processors)
| Recipient | Role | What it receives | Location |
|---|---|---|---|
| Google (Google Play, Google Play Billing, Android Auto Backup) | Independent controller for Play, billing and backup | Purchase and payment data; your encrypted backup in your Google account | Global |
| Google (Firebase AI Logic / Gemini API) | Processes plate photos; under the unpaid Gemini API terms Google may also use them for its own product improvement (see 4.2) | Plate photos (only when the on-device model isn't available; not offered in EEA/UK/CH) | United States and other countries where Google operates |
| RevenueCat, Inc. | Processor | Install ID, purchase tokens, purchase details | United States |
| PostHog (EU cloud) | Processor | Install ID, app events, app/OS version, locale, IP address | European Union |
| Supabase (EU region) | Processor | Encrypted family-sharing data (ciphertext) and technical metadata | European Union |
| Open Food Facts | Independent recipient of lookups | Barcode number, IP address | France (EU) |
| Referral server | Operated by us, hosted by Supabase, European Union (Frankfurt) | Referral code, install ID | European Union |
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition (in which case this policy continues to apply).
8. International transfers
We keep data in the EU wherever we can (PostHog EU, Supabase EU). Some providers, such as RevenueCat and Google, may process data in the United States or other countries. When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), plus additional safeguards such as encryption. Contact us for a copy of the relevant safeguards.
9. How long we keep data
| Data | How long |
|---|---|
| Data on your phone | Until you delete it, use “Delete all my data”, clear the app's storage, or uninstall Renaly |
| Android backup | Managed by Google and your Google account settings |
| Family sharing data (Supabase) | Until you stop sharing or delete your data; automatically deleted after 90 days without activity |
| Plate photos | Not stored by Renaly. Google's retention is described in the Gemini API terms. |
| Analytics events (PostHog) | 12 months, then deleted |
| Purchase records (RevenueCat, Google Play) | For as long as needed to provide your purchase and meet tax and accounting obligations |
| Referral records | 12 months after the reward is granted |
| Support emails and deletion requests | 24 months after your request is resolved |
10. Security
- End-to-end encryption for family sharing: AES-256-GCM, with the key kept only in the invite shared between phones. Our servers store only ciphertext.
- Encryption in transit: all network connections made by Renaly use HTTPS/TLS.
- On-device storage: your data lives in Renaly's private app storage, which other apps can't read. Android backups are encrypted by Google.
- Data minimization: analytics uses a random install ID and never includes health values or names.
- Access control: only authorized people who need it can access our service provider accounts.
No system is perfectly secure. Protect your phone with a screen lock, especially if you track health information. If we learn of a breach that affects you, we'll notify you and the authorities as the law requires.
11. Your rights
Depending on where you live, you have the right to:
- access your personal data and get a copy (portability),
- correct inaccurate data,
- delete your data,
- restrict or object to processing, including analytics,
- withdraw consent at any time,
- not be discriminated against for using your rights,
- appeal a decision we make about your request (US states that provide this right),
- complain to a data protection authority, such as your local EU supervisory authority, the UK Information Commissioner's Office (ico.org.uk) or the Swiss FDPIC.
How to exercise your rights:
- Data on your phone: you can view, edit, export (doctor PDF report, Plus) and delete it yourself in Renaly. We can't access it, so we can't do this for you.
- Everything else (analytics, purchase records, referral records, family share): use mobrix.dev/renaly/delete-data or email support@mobrix.dev. Because we don't use accounts, we may ask for your install ID (shown in the app) or your Google Play order number so we can find your records. We don't ask for more than we need to verify your request.
- We'll reply within one month (GDPR/UK GDPR) or 45 days (US state laws). We can extend this where the law allows and will tell you if we do.
- US residents: you may use an authorized agent, and we may ask the agent for proof of authorization. If we deny your request, you can appeal by replying to our decision email with “Appeal” in the subject line. If you're still unhappy, you can contact your state Attorney General.
12. Deleting your data
- In the app: Privacy settings > Delete all my data. This permanently deletes everything stored on your phone and deletes your family share from the server.
- Uninstalling Renaly removes the data on your phone. It doesn't cancel a subscription or delete your Android backup.
- On the web: mobrix.dev/renaly/delete-data lets you request deletion of analytics, purchase and referral records even without the app.
- Subscriptions aren't cancelled by deleting data. Cancel in Renaly (which opens Google Play) or in Google Play > Payments & subscriptions.
13. Children
Renaly is intended for adults 18 and older. It isn't directed to children, and we don't knowingly collect personal information from anyone under 18 (or under the age of digital consent where you live). If you believe a child has provided us with personal information, contact support@mobrix.dev and we'll delete it.
14. Notice for California residents (CCPA/CPRA)
Notice at collection. In the past 12 months, we (and our service providers) collected the following categories of personal information:
| Category (Cal. Civ. Code §1798.140) | Examples in Renaly | Source | Purpose | Sold or shared? |
|---|---|---|---|---|
| Identifiers | Random install ID, IP address, Google Play purchase token, email address (if you contact us) | You / your device | Providing purchases and referrals, analytics, support, security | No |
| Commercial information | Plan purchased, trial and renewal status | Google Play via RevenueCat | Providing Renaly Plus, accounting | No |
| Internet or other electronic network activity | Screens and features used, onboarding steps, paywall views | Your device | Analytics and improving the app | No |
| Geolocation (approximate) | Country or city inferred from IP address | Your device's connection | Analytics, security | No |
| Sensitive personal information (health) | Encrypted family-sharing snapshot (we can't read it); food photos sent for analysis where applicable | You | Only to provide the feature you asked for | No |
| Photos | Plate photos (see 4.2) | You | Providing photo plate logging | No |
We use sensitive personal information only to provide the services you request, as allowed by Cal. Code Regs. tit. 11 §7027(m). We don't use it to infer characteristics about you. Retention periods are in section 9. We don't sell or share personal information and have no actual knowledge of selling or sharing personal information of consumers under 16. You can exercise your rights to know, delete, correct and non-discrimination as described in section 11.
15. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut and similar US state laws)
This section applies to “consumer health data” under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370, and similar laws.
- Categories we collect: (a) the encrypted family-sharing snapshot, which includes health information but which we can't decrypt; (b) plate photos sent for analysis where applicable; (c) the fact that you use a kidney health app, which could be inferred from your install ID, purchases and usage events.
- Purposes: providing the features you requested (family sharing, photo plate logging, Renaly Plus), analytics to improve the app, security and fraud prevention.
- Sources: you and your device.
- Who we share it with: the service providers in section 7, acting on our instructions, and Google as described in 4.2. We don't sell consumer health data.
- Your rights: confirm whether we collect or share your consumer health data, access it (including a list of third parties and affiliates it was shared with), withdraw consent, and delete it. Use the methods in section 11. You can appeal a denial as described there, and Washington residents can contact the Washington State Attorney General.
- Consent: we collect consumer health data only when you use a feature that needs it (for example, turning on family sharing or taking a plate photo), and we don't share it except as described in this policy. Where the law requires separate consent, we ask for it in the app first.
- Geofencing: we don't use geofencing.
Most of your health information never reaches us, because it stays on your phone.
16. Permissions Renaly uses
| Permission | Why |
|---|---|
| Internet, network state | Barcode lookups, photo plate analysis, family sharing, purchases, referrals, analytics; checking whether you're offline |
| Camera | Scanning barcodes, ingredient lists, lab reports and plates, only while you're scanning |
| Notifications | Medication and binder reminders, trial reminder |
| Alarms & reminders (exact alarms) | Delivering medication reminders at the time you set |
| Run at startup | Restoring your reminders after your phone restarts |
| Vibrate | Reminder alerts |
| Google Play billing | Buying Renaly Plus |
Renaly doesn't request location, contacts, microphone, SMS or advertising ID permissions.
17. Medical disclaimer
Renaly is a nutrition and lab tracking app. It is not a medical device and does not diagnose, treat, cure or prevent any disease. Default limits are based on published kidney guidelines (KDIGO, KDOQI, UK Kidney Association, AUA) and common renal dietitian practice. Always follow the advice of your nephrologist and renal dietitian.
18. Changes to this policy
If we make material changes, we'll update the effective date and let you know in the app before the changes take effect. If a change requires your consent (for example, a new use of health data), we'll ask for it first.