Privacy Policy

Last updated: October 20, 2026 · Version 1.6.0

1. Who We Are

Rekomp ("app", "we", "us") is a personal GLP-1 medication tracker integrated with protein and body-weight logging.

Rekomp is currently operated by Kalima, acting as data controller under the Brazilian General Data Protection Law (Lei nº 13.709/2018 — "LGPD") and applicable international privacy frameworks.

Mailing address: Curitiba, Paraná, Brazil.

Data Protection Officer (DPO) / Privacy contact: dpo@rekomp.com.br

If Rekomp is transferred to a legal entity in the future, this Policy will be updated to reflect the new controller, with prior notice to users through the app.

2. The Core Principle: Local Storage

Rekomp was designed with a local-first (offline-first) architecture. In concrete terms:

• The app has no account system. You do not create a login, email, or password.
• The app has no proprietary server that stores your personal data. Our only service that receives data is the photo meal analysis (Section 4.8), which forwards the photo for analysis and does not keep it.
• All data you enter is stored in a local database (SQLite) on your own device.
• The app does not sync your health or nutrition data to the cloud.
• If you uninstall the app or use "Erase all data," your data is permanently deleted from the device — we hold no copy.

As a practical consequence: we, the operators of Rekomp, do not have access to your dose, symptom, weight, or nutrition records. The app does not send them; the usage analytics and session recording described in Section 4 do not include those values.

3. Data Processed Locally on Your Device

The following data is entered by you and stays only on your device:

4. Data We Collect for Technical Operation and Improvement (app and website)

While your health records stay local, the app uses technical tools that process usage data, without the values of your records, for stability and product improvement:

4.1 Usage Analytics (PostHog)

We use PostHog to understand how the app is used in aggregate. Events are tied to a random device identifier, not to your name, and include:

• App usage: screens viewed, setup steps completed, app opens, records created and reports generated (without their content), reminder settings, and responses to the rating prompt.
• Setup answers, as categories: treatment stage (for example, whether you already use or are about to start), areas you want help with, how you heard about the app, medication type (commercial, compounded, or other), dose-interval range, and whether you set a goal weight.
• Progress, without values: for example, that a weight milestone was reached — not which milestone, what weight, or how much was lost.
• Subscription: subscription screen views, plan chosen, trial start, purchase, and restore.

Because some of these categories relate to your treatment, we handle them with the same care as sensitive data. Events do not include the medication name, dose in mg, weight, goals, symptoms, foods, or the content of notes.

4.2 Session Recording (PostHog)

To understand where people struggle when using the app, PostHog records the sequence of screens and taps during use (session recording). Recording is configured to mask all text, input fields, and images before upload, so the content you type or see on screen — such as doses, weights, and notes — is not readable in the recording. Screen layouts and taps may be visible.

4.3 Crash Reporting (Sentry)

We use Sentry to detect and fix app errors and crashes. When an error occurs, technical information is collected (error type, screen, device model, OS version) for diagnosis. We do not send your health data in these reports.

4.4 Notifications

The app schedules local notifications on your device (dose reminders, a reminder to buy more medication before your stock runs out, and a daily protein reminder, when enabled). For notifications to work, there may be technical processing of a notification identifier by the platform's notification service (Apple APNs or Google FCM).

4.5 App Stores (Apple and Google)

When you download or update Rekomp from the App Store or Google Play, Apple and Google collect data according to their own privacy policies, outside our control (e.g., download metrics and performance data). We recommend reviewing those platforms' policies.

4.6 Payments and Subscription

Rekomp offers an optional subscription, Rekomp Premium; without it, the app works on the free plan, with limited features. Payment is processed by your device's store — the Apple App Store (iOS) or Google Play (Android) — with subscription management provided by RevenueCat, Inc. acting as our processor. When you subscribe, the store (Apple or Google) and RevenueCat process purchase and subscription data — such as an anonymous app-user identifier, the product purchased, transaction and renewal status, and country — to validate and manage your access. We do not collect or store your credit card or payment details; Apple or Google handles that. This purchase data is separate from, and does not include, your local health, nutrition, or weight data, which never leaves your device.

4.7 Analytics on this website (rekomp.com.br)

Unlike the app, which is local-first, this website (rekomp.com.br) uses analytics tools to understand how the pages are used:

• Google Analytics (Google LLC): uses cookies (e.g., _ga) to measure visits and navigation in aggregate. It is loaded only with your consent, given in the cookie banner. Legal basis: consent. You can decline or revoke at any time via the banner, the "Cookies" link in the site footer, or by blocking cookies in your browser settings.
• Vercel Analytics (Vercel Inc.): aggregated page visit and performance metrics, without cookies and without identifying you individually.

Your consent choice is stored locally in your browser only to remember the preference. This website usage data does not mix with the app's health data, which stays on your device.

4.8 Photo Meal Analysis (Premium)

The Scan your plate feature, part of Rekomp Premium, estimates the protein in a meal from a photo. It only runs when you tap to take or choose a picture, and the app tells you about the upload before the first time. When you use it:

• The photo is shrunk on your device and sent over an encrypted connection (HTTPS) to a service of ours hosted on Cloudflare, together with your anonymous subscription identifier (RevenueCat), which is used only to confirm that your subscription is active.
• That service forwards the photo to Google Gemini (Google LLC), an artificial intelligence provider, solely to identify the foods and estimate portions and protein. The answer comes back to your device, where you check it, correct it, and decide what to save.
• We do not keep the photo: our service does not write the image anywhere. Google handles it under the Gemini API terms for paid services: the content is not used to train or improve Google's products and may be retained for a limited time solely to detect abuse and meet legal obligations (ai.google.dev/gemini-api/terms).
• Only the photo is sent. Your medication, weight, symptom, and protein records are not part of the upload, and what you save from the analysis stays on your device like any other record.
• Avoid including people, documents, or other personal information in the photo.

The estimate is approximate and can be wrong; it does not replace advice from a nutritionist.

5. Third-Party Service Providers

The companies below act as processors or service providers, handling only the technical data described in Section 4:

We do not sell, rent, or commercialize personal data. We do not share health data with insurers, employers, advertisers, or pharmaceutical companies.

6. Legal Basis for Processing

We process data based on the following legal grounds:

• Performance of service: data you enter locally is necessary for the app to function (logging medication, nutrition, progress).
• Legitimate interest: aggregated technical usage and crash data, to ensure stability and improve the product, always proportionally.
• Consent: for processing the sensitive health data you enter and for the usage analytics and session recording described in Section 4, upon your acceptance of this Policy during setup; and, for sending a photo to the meal analysis (Section 4.8), each time you choose to use that feature. You may withdraw consent at any time through the contact in Section 15.

7. Your Rights

You have the following rights at any time:

• Access and portability: the app has a built-in function to export all your data as a JSON file, directly on the device. You can also create a PDF report of your records to take to an appointment: the file is created on your device and only leaves it when you choose to share it.
• Correction: you can edit any record directly in the app.
• Deletion: the "Erase all data" function permanently removes your records from the device. Uninstalling the app also deletes local data.
• Withdrawal and objection: you can withdraw consent or object to usage analytics and session recording by emailing dpo@rekomp.com.br. The app does not currently offer a setting to turn off usage analytics.
• Contact: for any other requests, contact dpo@rekomp.com.br.

Because we hold no server-side copy of your health data, the most direct way to exercise deletion and portability rights is through the app's own functions.

8. California Residents — CCPA / CPRA Notice

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: you may request information about what personal data we collect and how it is used. Given that health data stays on your device and we do not hold it, the technical data we process through PostHog and Sentry is limited to pseudonymous usage events, masked session recordings, and crash reports.
• Right to delete: you may request deletion of personal data we hold. Use the app's "Erase all data" function for local data. For analytics and crash data, contact dpo@rekomp.com.br.
• Right to opt out of sale: we do not sell personal data. This right is not applicable.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise CCPA rights, contact us at dpo@rekomp.com.br. We will respond within 45 days as required by law.

9. International Users

Rekomp is available internationally. The app is operated from Brazil, and this Policy is primarily governed by Brazilian law (LGPD). Users outside Brazil — including users in the United States and the European Union — are welcome to use the app. Because your health data never leaves your device, there is no international transfer of health data. The limited technical data processed by PostHog (usage events and masked session recordings) and Sentry, and the meal photos you choose to analyze (processed by Cloudflare and Google, Section 4.8), are subject to those providers' own privacy policies and data transfer mechanisms.

10. Security

We adopt technical and organizational measures appropriate to the local nature of the app:

• Data stored in the app's protected sandbox within the device operating system.
• Technical communications (analytics, session recording, and crashes) and the meal analysis photo transmitted over encrypted connections (HTTPS).
• Data minimization: analytics events use categories only, never health values, and session recording masks text, input fields, and images.

No system is absolutely secure. Since data lives on your device, the physical and logical security of your device (screen lock, OS updates, not using a compromised device) also matters for protecting your information.

11. Data Retention and Deletion

Your data stays on the device as long as you keep the app installed and do not request deletion. There is no server-side retention because there is no server storing this data. Deletion is controlled by you through the app.

The technical data described in Section 4 (usage events, session recordings, and crash reports) is kept by PostHog and Sentry for the retention period configured in each service and then deleted. To request deletion sooner, contact dpo@rekomp.com.br.

12. Children

Rekomp is not intended for users under 18 years of age. The app addresses prescription medication, a topic that requires adult supervision and professional guidance. We do not knowingly collect data from minors. If a minor has used the app, we recommend uninstalling and deleting data by a parent or legal guardian.

13. Educational Content — Not Medical Advice

14. Changes to This Policy

This Policy may be updated to reflect changes to the app, third parties, or applicable law. Relevant changes will be communicated through the app. The date of the last update and version number appear at the top of this document.

15. Contact

Questions, requests, or exercise of rights: dpo@rekomp.com.br