Privacy Policy

Version 1.1 · Effective July 10, 2026

1. Who controls your data

The data controller for GLPath is Costin Alexiu, a natural person, based in Bucharest, Romania. For anything about your data or this policy, email glpath@glpath.pro.

2. What we collect

• Account: your name, email address, and password (stored as a one-way hash).
• Profile, including health attributes: height, sex, age range, medication, phase, shot frequency, and your weight/dose targets.
• Tracking logs: weight, medication doses, protein, water, side effects, and phase history — whatever you choose to log.
• Progress photos you upload.
• Subscription metadata for GLPath Plus — plan, status, and billing period. Your card details are never stored or seen by our server; they stay with our payment processor, Revolut.
• Notification preferences — which reminders you want and how.
• Technical security logs — standard server access and error logs used to keep the service running safely.

3. Why we process it, and on what legal basis

We process your account and billing data to provide the service you signed up for and to fulfil our contract with you (GDPR Article 6(1)(b)). We process all of your health data — everything you log about your body, your medication, and your photos — only on the basis of your explicit consent (Article 9(2)(a)), which you give during registration and can withdraw at any time. We process technical security logs on the basis of our legitimate interest in keeping GLPath secure and available (Article 6(1)(f)).

4. Who else sees it

We use four services to run GLPath, and nothing else touches your data:

• Our hosting provider — a dedicated server in Bucharest, Romania (EU), which stores the database and files that make up the app.
• Revolut — processes GLPath Plus payments. They see your billing details; we never do.
• Our SMTP relay — delivers transactional email only (reminders, password resets); it does not see anything beyond what's needed to send that email.
• Anthropic — powers the optional AI-assisted meal estimation feature. See §4a below for exactly what this involves.

We run no analytics, no advertising, and no third-party trackers.

4a. AI-assisted meal estimation

If you use the optional AI meal-estimation feature, the meal description you type and/or a photo of your meal is sent to Anthropic, our AI provider, to estimate nutrition values (calories, protein, carbs, sugars, and fat). This happens only when you actively use the feature — manual meal logging never involves Anthropic at all.

A photo you submit for AI estimation is held only in a short-lived private server-side temporary location during processing and deleted immediately afterwards — never kept as a permanent copy, never made public. The analysis itself runs in memory; only the resulting nutrition estimate — plain numbers, which you can review and edit before saving — is stored in your account.

5. Cookies

GLPath uses only essential cookies: a session cookie, a CSRF (XSRF) token, and — if you tick "remember me" — a login-remembering cookie. These are required for the app to function, so no cookie banner is shown. Your light/dark/auto theme choice is stored in your browser's local storage, not a cookie.

6. Where your data is stored

Your data is stored on our server in Bucharest, Romania, within the EU. In normal operation, we don't transfer your data outside the European Economic Area, with one exception: if you choose to use the optional AI-assisted meal estimation feature described in §4a, the meal text and/or photo you submit for that single request is transferred to Anthropic PBC in the United States. This transfer is being placed under standard contractual clauses (data processing agreement in progress — see §4a and our subprocessor list for status). It happens only when you actively choose to use the feature; manual meal logging never leaves the EEA.

7. How long we keep it

We keep your data for as long as your account exists. When you delete your account, your data — including your photos — is erased immediately. We also run nightly, access-restricted backups of the database for disaster recovery; a deleted account's data fully drops out of those backups within 14 days.

8. Your rights

• Access — export your data as CSV or Excel from Settings, or download everything (including your photos) as a zip file.
• Rectification — everything you log can be edited or deleted in-app (photos are corrected by deleting and re-uploading).
• Erasure — delete your account from Profile → Delete account; this is immediate.
• Portability — the CSV/Excel exports and the "download everything" zip are both portable formats you can take elsewhere.
• Restriction, objection, and withdrawal of consent — email glpath@glpath.pro. Because your health data is processed only with your consent and GLPath cannot function without it, withdrawing that consent means deleting your account — we'll help you do that if you ask.

9. Children

GLPath is not intended for anyone under 18, and we don't knowingly collect data from children.

10. International users

We apply this same GDPR-based standard to every user, wherever you're located. If you're in the United Kingdom, we apply the equivalent protections under UK GDPR. If you're in the United States, the same rules apply: GLPath is not medical advice, we never sell your data, and you have the same access, correction, and deletion rights described above.

11. Complaints

If you have concerns about how we handle your data, we'd like the chance to address them first at glpath@glpath.pro. You can also lodge a complaint with Romania's supervisory authority, ANSPDCP (www.dataprotection.ro), or with the data protection authority in your own EU country.

12. Changes to this policy

If we make material changes to this policy, we'll ask you to re-consent through the same in-app consent flow before you continue using GLPath.