Bulkoa

Privacy policy

Last updated: 3 November 2026

Bulkoa processes health data (weight, measurements, progress photos, allergies). This page explains which data, why, where it is stored, for how long, and how to get it back or delete it. No ads, no trackers, no data sold.

Data controller

Nicolas Tien Yu Song, sole trader (French micro-entreprise), SIRET 905 089 314 00033, 3 rue des Frères Berger, 90500 Beaucourt, France. Contact: support@bulkoa.app.

Data collected

  • Account: e-mail address, password (never readable, hashed by Supabase), dates you accepted the terms and gave health consent.
  • Profile: first name, sex, date of birth, height, job and working hours, number of training sessions and place, goal (muscle gain or maintenance), pace, meals and times, budget, store, kitchen equipment, habits.
  • Health data: weight and weigh-ins, measurements, progress photos, diets, excluded foods and allergies.
  • Safety question (pregnancy, illness, treatment, eating disorder, injury): only "caution advised" (yes or no) and the date of the answer, never the box ticked.
  • Friends (only if you turn sharing on): display name, sharing preferences, friends and requests, invitation codes, posted activities (workouts, records, kilos gained or steady weight, days in a row), reactions, groups, blocks and reports. Never your measurements, progress photos, calories, budget or e-mail; your exact weight only if you allow it.
  • Profile photo (optional), stored in a private space.
  • Meal plans, shopping lists, ticked items and "I already have it" (for your cupboard), prices you corrected, saved recipes, workouts.
  • Subscription: status, plan and end date, sent by Apple through RevenueCat (never your bank details).
  • Technical: account identifier, timestamps. No advertising data, no tracking identifier, no usage analytics.

Why, and on what legal basis

  • Providing the service (calculating your needs, generating your plan, shopping list and programme, tracking progress): performance of the contract.
  • Health data: based on your explicit consent, given through a separate box at sign-up. You can withdraw it at any time by deleting your account.
  • Sharing with your friends: based on your consent, given by turning sharing on; you can withdraw it at any time ("Turn off sharing" deletes your posted feed). Posted activities are deleted after 30 days. Reports are kept while they are handled.
  • Managing your subscription and answering your requests: performance of the contract.
  • Meeting legal obligations (billing through Apple, requests from authorities): legal obligation.

Where and for how long

App data is hosted by Supabase on servers located in the European Union. Photos (progress, profile) are in private spaces, readable only by you, shown through temporary links.

Data is kept as long as your account exists. When you delete your account (Profile → Delete my account), everything is erased immediately, photos included; the host's technical backups are erased within 7 days at the latest.

An encrypted copy stays on your iPhone so the app works offline; it is erased when you sign out. Nothing is stored in iCloud.

Processors

  • Supabase (Supabase Pte. Ltd.): database, authentication, photo storage. Servers in the European Union.
  • Resend: sending account e-mails (address confirmation, forgotten password, code, security alerts) and subscription e-mails (thank you, cancellation); receives only your e-mail address and the content of these e-mails, never your health data. Servers in the European Union (eu-west-1). These e-mails are transactional: no advertising.
  • RevenueCat Inc. (once subscriptions open): receives an anonymous account identifier and purchase status, never your health data.
  • Apple: in-app purchases and refunds; reminders are local notifications scheduled on your iPhone, with no server.
  • Netlify, Inc.: hosting of this website, with no cookies or analytics; no app data is stored there.
  • Google (Gemini) is used only by the team to create illustrations: no user data is ever sent to it.

Transfers outside the European Union

Some providers are based outside the European Union: Supabase in Singapore; Resend, RevenueCat, Apple and Netlify in the United States. When data may be accessed from outside the Union (technical support, purchase management), the transfer is covered by a European Commission adequacy decision (EU–US Data Privacy Framework) or by its standard contractual clauses.

Your rights

  • Access and portability: Profile → Account and security → Export my data (CSV or JSON), photos included through temporary links.
  • Rectification: every answer can be changed in the app.
  • Erasure: Profile → Delete my account erases everything, straight away.
  • Withdrawing health consent: by deleting your account (the service cannot work without this data).
  • Objection, restriction, questions: write to support@bulkoa.app, answer within one month at most.
  • Complaint: to the French data protection authority, CNIL (www.cnil.fr/en).

Ads, trackers and cookies

No advertising, no trackers, no data sold or rented. This website uses no cookies (no analytics, no ads).

Minors

Bulkoa is for people aged 18 and over. The questionnaire stops if the date of birth shows under 18, and no account is created.

Changes

If anything important changes, you will be told in the app before it applies. The date of the last update is shown at the top of this page.