Privacy Policy — Koji

• Data controller: Axiome — Hugues ROMAIN

• Contact / exercising your rights: huguesromaindev@gmail.com

• Application: Koji (com.koji.app)

Account data: identifier, email, first name, language, and preferences.

Health data you enter (special category under Article 9 GDPR): morning journals (belly, energy, mood, sleep), meals and related feelings, transit, symptoms, and menstrual-cycle data if you provide it.

Submitted media: photographs of your plates when you use dish recognition.

Subscription and usage data: subscription status, journaling activity, and minimal technical data necessary for the operation of the Service.

• Provide the journal and insights (meal / cycle / symptom correlations) — legal basis: performance of the contract, and explicit consent for health data.

• Analyze a plate photo to suggest a dish name and tags — legal basis: performance of the contract / consent when required.

• Manage reminders you enable — legal basis: performance of the contract.

• Manage subscriptions and purchases — legal basis: performance of the contract.

• Ensure security and proper operation — legal basis: legitimate interest.

• Your plate photos and related text are used solely to suggest a dish, tags, and insights within the App.

• They are not used for advertising or third-party profiling.

• They are never used to train AI models.

• Supabase — hosting of the database, authentication, and file storage where applicable.

• Artificial intelligence providers (including xAI) — image analysis required for dish recognition, only for the duration of processing.

• Superwall and Apple / Google — management and processing of subscriptions and in-app purchases.

Your data is never sold or shared for advertising purposes.

• Data is hosted through our processors with appropriate security measures (encryption in transit, access controls).

• Each user only accesses their own data.

• Account data and journals are retained for as long as the account remains active.

• Account deletion triggers deletion of associated data, without prejudice to any legal retention obligations.

• Other data is retained for as long as necessary to provide the Service, then deleted or anonymized.

In accordance with the GDPR, you have the following rights:

• access to your data;

• rectification of inaccurate data;

• erasure (“right to be forgotten”) — you can delete your account directly within the App;

• objection to and restriction of processing;

• portability of your data;

• withdrawal of consent relating to health data;

• complaint with the competent supervisory authority (in France, the CNIL).

To exercise these rights: huguesromaindev@gmail.com.

We implement appropriate technical and organizational measures: secure authentication, access isolation, encrypted transmission, and data minimization.

Koji is intended for people aged 16 or over. If you are under 16, you must not use the App.

We may update this policy. In the event of a material change, you will be informed by an appropriate means. The last updated date appears at the top of the document.

For any questions regarding your personal data:

• Email: huguesromaindev@gmail.com

• Data controller: Axiome — Hugues ROMAIN