Privacy Policy · Wertox

Last updated: 25 October 2026 · Deutsche Fassung

This is a translation. In case of any differences, the German version (Datenschutzerklärung) applies.

1. Controller

Nikolai Halbeisen
Contact: nikohalb@gmail.com

We have not appointed a data protection officer because the legal requirements for this are not currently met. We review this regularly.

2. What data we process

Wertox is a fitness coaching app. To provide the service, we process:

• Account data: name, email address, password (stored encrypted). If you sign in with Apple or Google, we receive your name and email address from them, and from Google also your profile picture.
• Profile and health data (only what you enter or allow yourself): age, gender, height, weight, body fat estimate, body measurements, training goals, training and nutrition entries, drinks, supplements, hunger and fullness, digestion, muscle soreness, daily mood and journal, sleep, steps, heart rate and HRV (after your permission, from Apple Health or Health Connect, see section 5).
• Photos (optional): photos for the form check and the body fat estimate, photos of meals, your fridge or a menu, in hardcore mode a photo of your scale's display, plus profile and group pictures. Body and food photos are sent to the AI for analysis (section 3). Only you can see your body photos; you can delete them one by one in the app.
• Cycle (optional, women only): If you enter the start of your last period and your usual cycle length under Profile, Body data, this is a specially protected health data category (Art. 9 GDPR). We use it only to calculate your calories: in the second half of the cycle the body retains water, so the app does not lower your daily target then. The details themselves are not sent to the AI; your coach only learns that the second half of your cycle is under way, so that water on the scale is not read as a setback. Nobody else sees them. The legal basis is your explicit consent (Art. 9(2)(a) GDPR, section 2a). With “Angaben löschen” (delete details) they are gone at once, at the latest with your account.
• Blood pressure, blood values and health details (optional): If you log your blood pressure, photograph lab reports of your blood values or fill in the “Health” section of your profile (pre-existing conditions, medication, injuries and complaints, and, if you wish, whether alcohol, nicotine, medication or performance-enhancing substances affect your training), this is specially protected health data (Art. 9 GDPR). We use it only for your coaching: your AI coaches and the weekly analysis (section 3) take it into account. The AI reads the values on a report photo (section 3); they only count once you confirm them. Nobody else sees these details; they never appear on your profile for others, in the feed or in leaderboards. The app does not diagnose anything. The legal basis is your explicit consent (Art. 9(2)(a) GDPR, section 2a). You can delete every entry and every photo in the app; at the latest they are deleted with your account.
• Chat content with the AI coaches.
• Technique videos (optional): If you send your trainer a video of an exercise in the chat (30 seconds at most), we store the video in your chat history. Only you can see it. To answer, our server takes six to eight still frames from the video and sends them with your question to the AI (section 3); the frames are deleted afterwards and not stored. You delete the video with the chat history of that coach or with your account. The legal basis is your consent by sending it (Art. 6(1)(a) GDPR).
• Voice input: If you speak a message instead of typing it, the speech recognition of Apple (iPhone) or Google (Android) turns your words into text. In doing so, the recording may be sent to Apple's or Google's service and processed there; whether it stays on your device depends on your device and its settings. Apple's or Google's privacy policy applies to this. Wertox only receives the finished text, never a recording.
• Social features: your profile (name, username, picture, bio, level, streaks, achievements), posts, stories, comments and reactions, friendships and followers, direct messages and group chats with text, photos, videos and voice messages, duels, raids and the leaderboard. What you write or send is seen by the people it is meant for. Voice messages are stored as an audio file on our server until you delete them or your account. A new account starts with visibility set to “Nur Freunde” (friends only): others then see only your name and your picture, while the rest of your profile and your posts are seen only by your friends. You appear in the leaderboard “Alle in Wertox” (everyone in Wertox) only if you choose so yourself: under Social, Duels, Leaderboard with “Mich hier zeigen” (show me here). For a new account it is off, and you can change it at any time. If you appear there, others see your first name, your level, your title and your steps, elevation and training days in the chosen period. Your friends always see you in their leaderboard. You change the visibility of your profile in Settings under “Wer sieht was?” (who sees what). Whether friends see when you were last online and whether you have read their message is set in Settings. Reporting and blocking are available for posts, messages and groups.
• Live duel with camera: If you start a live duel, picture and sound go directly from your device to your opponent's device; in doing so, their device also sees your IP address. Our server only sets up the connection and stores none of it. To set up the connection, your device asks a Google server (STUN) for its public address; Google sees your IP address in the process.
• When you use the app: For each day we store when you first and last opened the app. From this the app learns your daily routine, so that the morning and evening cards arrive at your time and nothing disturbs you at night. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
• Technical error reports: If an error occurs in the app, we store your user ID, the platform (iOS/Android), the app version, the screen last opened and the technical error text in order to fix the error. We delete them after 60 days. If you delete your account before that, they remain until then without any link to you.
• Usage counts: So that we know which parts of the app are used and which are not, the app counts per day how often you open a screen (e.g. “Ernährung”, nutrition), tap a main button (e.g. “Training starten”, start training, or “Essen eintragen”, log food) and open the app. Only that short name is stored, with a number, your user ID and the date. No content: no chat messages, no text, no values you enter, no device identifier, no third-party service. Counting only happens if you ticked “Nutzungsanalyse” (usage analytics) at first launch (consent, Art. 6(1)(a) GDPR). You can withdraw your consent at any time in Settings under “Daten und Datenschutz” (data and privacy); we then delete your counts at once. Otherwise they are deleted after 180 days, at the latest with your account.
• Security: If we fend off an attack on an account (for example many wrong passwords), we store the event with the IP address for 90 days. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
• City and gym (optional): If you add a city or a gym to your profile, others see it on your profile, and you appear on the page of that city or gym: in the list “Trainieren hier” (training here) and, if you trained this week, with the number of your training days since Monday in “Diese Woche vorne” (ahead this week). You do not appear there if your profile is set to “Nur ich” (only me) or if you have blocked the person or they have blocked you. The city you enter for weather and drinks is separate and is not shown; for the weather only its name is sent to the weather service wttr.in. If you clear the field, you disappear from the page at once. The legal basis is your consent by entering it (Art. 6(1)(a) GDPR).
• Posts “von der App gemessen” (measured by the app): If you share a record, a streak or a duel win, the post shows the numbers from your entries (for example exercise, weight, repetitions, time of the set). It is only shared when you tap it. A clip with sound is seen only by your friends.
• Waiting list: If you join the waiting list on the website, we store your email address until you get access or ask for it to be deleted.

Wertox is for people aged 16 and over. If we learn that someone is younger, we delete the account. Additional protection applies to 16- and 17-year-olds: when losing weight, the coaches never set a faster pace than the app's usual one or a target weight below a healthy weight, and the photo check does not rate the body.

2a. Legal bases

• Account, operation of the app, friends, messages, posts you publish yourself: performance of the contract (Art. 6(1)(b) GDPR).
• All health data (the list is in the app under Settings, Data and privacy) and its processing by the AI: your explicit consent at first launch (Art. 9(2)(a) and Art. 6(1)(a) GDPR). If you share health details in a post yourself, this happens at your explicit initiative.
• Leaderboard “Alle in Wertox”, “Bei Google auffindbar” (findable on Google), city and gym, usage analytics: your consent (Art. 6(1)(a) GDPR, for leaderboard values also Art. 9(2)(a) GDPR), which you can withdraw at any time with the respective switch.
• Security, prevention of abuse, error reports, server logs, moderation of reported content: our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR) and our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).
• Proof of your consents: legal obligation (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Without an account and without consent to health data and AI you cannot use Wertox, because the coaching is based on exactly that. All other details are optional.

3. AI processing

The coaching features are based on AI models from Anthropic (Claude). For this, your chat messages and relevant fitness data (e.g. training log, goals, nutrition, sleep, steps, body values) are sent to the Anthropic API and processed there to generate the answer. This includes what your coach has remembered about you (also sentences from your journal) and, during a running duel, your opponent's first name and score. Once a week the AI analyses your entries of the last 90 days to find patterns your coaches turn into tips. If you set the switch “Your team reads along” in your journal to “Only for you”, no text you write in your journal is sent to the AI or to your coaches any more, and notes your team took from it are deleted; your mood and your other entries (food, training, sleep) are still used. If you photograph a lab report of your blood values, the whole photo is sent to Anthropic so the values can be read; it may also show your name, your date of birth and your doctor. We store the photo privately on our server and, besides it, only the values that were read. Photos for the form check and body fat estimate as well as photos of meals, fridge or menu are also sent to Anthropic for analysis. If your full name appears in a text, we first replace it with your first name; your email address is not sent to the AI. If you send a technique video, only still frames from it go to Anthropic, not the video itself. If you withdraw your consent to AI processing, nothing more is sent to Anthropic.

Anthropic stores inputs and outputs for at most 30 days and then deletes them automatically. If Anthropic's safety system detects a possible violation of its usage policies, Anthropic may keep the content concerned for up to 2 years. Under our contract, Anthropic may not use your data to train its models. Anthropic is based in the USA. The transfer is based on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), which are part of our contract with Anthropic. We will send you a copy on request.

The coaches are AI; this is not medical advice. For health questions, please see a doctor. In the app the coach is labelled “KI-Coach” (AI coach), and in your data export the coaches' messages are marked as AI content (ki_generiert).

4. Who processes your data on our behalf

We have a contract under Art. 28 GDPR with all service providers. They may process your data only for us and must protect it at least as well as this policy describes.

• Hetzner Online GmbH, Germany: server and database, data center Falkenstein.
• Anthropic PBC, USA: AI coaching (section 3). Standard Contractual Clauses.
• Resend, USA: emails (sign-in codes and, if you wish, the daily report with your values of the day). EU-US Data Privacy Framework.
• Expo (650 Industries, Inc.), USA: delivery of notifications and app updates. Expo sees your push token, a random identifier of the installation and your IP address. EU-US Data Privacy Framework.
• Google (Firebase Cloud Messaging), Ireland and USA, and Apple (Apple Push Notification Service), Ireland and USA: delivery of notifications. The text of the notification passes through these services. If a notification comes from your coach, it may refer to your health (for example your training). EU-US Data Privacy Framework.
• ElevenLabs, USA (only for the camera counter with voice): short announcements (counting and coach lines) without account data. EU-US Data Privacy Framework.

Without a processing contract, but with data flow:

• Google (STUN server) sees your IP address during a live duel. In a live duel, picture and sound go directly to your opponent; their device also sees your IP address.
• Open Food Facts (France), if active the US food database USDA (USA) and the weather service wttr.in only receive a barcode, a search term or a city name from our server, without any link to you.
• Apple and Google for “Sign in with Apple/Google” and for voice input, under their own privacy policies.

On your device: Google ML Kit recognises barcodes (Android) and movements for the camera counter directly on your device; the images do not leave your device.

4a. Website and signing in in the browser

On wertox.app you can sign in to read your data (week, feed, profile, progress, plans). For this we set two technically necessary cookies:

• wx_web: keeps you signed in, is valid for 7 days and cannot be read by scripts on the page.
• wx_csrf: a random value that stops other sites from submitting anything in your name.

There are no analytics, advertising or tracking cookies and no external fonts or services. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); the cookies are strictly necessary for the service you request (§ 165(3) Austrian Telecommunications Act, TKG 2021). If you sign in with a code by email, we send it via Resend.

Server logs: For every request to the app or the website, our server records the IP address, the time and the address requested, without sign-in data or cookies, in order to detect errors and attacks (legitimate interest, Art. 6(1)(f) GDPR). We delete the operating system logs after 14 days. The access logs of the web server are overwritten as soon as they reach a fixed size.

4b. Shared links, profile on Google and duels with strangers

• Shared links: If you share a post, your profile or a duel invitation as a link, the linked page and its preview image (the picture that messengers like WhatsApp show next to the link) only show your first name and what you shared. Posts “Nur für Freunde” (friends only), private profiles, weight, body data and photos never appear on it. Messengers load the preview image from our server themselves when the link appears in a chat. If your profile is visible to everyone, anyone who has the link to one of your posts can read it on wertox.app without signing in, with your first name, the text and the measured values; not posts “Nur für Freunde”. Every post link contains a random identifier that cannot be guessed.
• Duel invitation by link: The page wertox.app/duell/… shows your first name, the discipline, the duration and your daily average in this discipline over the last week. Anyone with the link sees this. The link is valid for 14 days and for one opponent; after that the page only says that the invitation is over.
• Profile on Google: By default your profile page (wertox.app/u/…) is closed to search engines and visible only to signed-in friends. Only if you switch on “Bei Google auffindbar” (findable on Google) in the app under Settings, Privacy, and your profile is visible to everyone, do we show your first name, username, bio and your public posts to everyone and allow search engines to include the page. You can switch it off at any time; it can take a few days until search engines remove the page from their index.
• Open duel (“Aushang”, duel with strangers): If you post an open duel, others with a similar daily average see your first name, the discipline and the duration, but not your average. If someone accepts, you both see only first names and the score in the duel. Chat, wall and profile details are only available once you are friends. Blocking ends such a duel at once.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR), and for the profile on Google your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the switch.

4c. Automatic adjustments and analyses

The app automatically adjusts your calorie target and your plan amounts to your history (weight, food, training), and once a week the AI looks for patterns in your entries of the last 90 days. This is profiling. It has no legal effect on you: you can set your target yourself at any time, and the app never goes below a safe lower limit. You can object to the analysis at any time (nikohalb@gmail.com).

4d. Reports, moderation and access

If you report a post, comment, profile, message or group in the app, we store the report, the reason, your description, the reported content and who reported it. Without an account you report at wertox.app/melden: there we store the link, the reason, your description and your name and email address (optional for depictions of child sexual abuse), but no IP address; the confirmation of receipt and our decision go to that email address.

Before publishing, an automatic word filter checks new posts, comments and messages; a match is neither published nor stored. A human decides on reports. If we remove content or restrict an account, the person affected receives a statement of reasons as a notification and by email; they are not told who reported. Whoever reported receives our decision with the reason. The legal basis is our obligations under the Digital Services Act (Art. 6(1)(c) GDPR), for accounts also the terms of use with the community rules (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in a secure service (Art. 6(1)(f) GDPR). We delete reports and decisions 12 months after the decision, a report without a decision 12 months after it was received, in the case of a suspension 12 months after it ends.

To fix errors or to check a suspicion of abuse, the controller can look at your history with the coaches. Every such access is logged. We do not read direct messages between users unless a message is reported to us.

5. Apple Health / Health Connect

If you turn on the connection, Wertox reads the values you allow (e.g. steps, distance, floors, workouts from your watch, heart rate, resting heart rate, HRV, blood pressure, sleep, weight, body fat, active calories, VO2max, and at night respiratory rate, oxygen saturation and skin temperature) to personalise your training and your recovery. Wertox can write back your weight, your body fat, your active calories and your workouts if you allow it. The app shows the skin temperature only to you, as a deviation from your own normal range under recovery. This data is not sold to third parties and not used for advertising. You can withdraw the permission at any time in the system settings.

6. Retention and deletion

Your data is stored as long as your account exists. You can download a copy of all data at any time (in the app or on wertox.app under Account). You can delete your account with all data at any time in the app (Settings) or ask for deletion by email to nikohalb@gmail.com. You can also delete individual items without deleting the account: body photos, blood pressure readings, lab reports of your blood values including their photos, your health details, the chat history with a coach and entries from what your coach has remembered.

If you withdraw your consent to health data, we delete your health data at once, including your body photos and your histories with the coaches. Your account with name and email, your friends, messages and posts and your level remain until you delete them or your account.

Backups: The database is backed up daily. We delete backups on the server after 7 days. On the controller's own storage the backups are encrypted; there we keep the last 60 backups of the database (about 60 days) and the last 8 weekly backups of photos and videos. Deleted data therefore disappears from the backups after about 60 days. If we have to restore a backup, we delete previously deleted accounts and data again at once.

We delete error reports after 60 days, operating system logs with IP addresses after 14 days, security events after 90 days and usage counts after 180 days. Anthropic deletes copies after at most 30 days (section 3). We delete the proof of your consents together with your account.

7. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a data protection supervisory authority.

You have the right to withdraw a consent at any time with effect for the future, without the processing up to then becoming unlawful. You can object to processing based on legitimate interest. Write to nikohalb@gmail.com; we answer within one month and only to the email address of your account.

You can lodge complaints with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority of the country you live in.

8. No disclosure for advertising

We do not sell any data and do not pass any data to third parties for advertising. There is no advertising tracking in the app.

9. Changes and language

If features change, we adapt this policy and tell you in the app if it affects you. This policy is also available in German. In case of any differences, the German version applies.