Privacy policy

Last updated: 29 October 2026. Available in English and Polish; both versions describe the same scope.

1. Who we are

TRT Buddy is published by NoxoLabs Wojciech Tokarzewski, Wiosenna 8b, 16-002 Nowe Aleksandrowo, Poland, VAT ID PL5422749616 (“we”). We are the controller of the personal data described in this policy. For anything about privacy, write to [email protected].

2. Data on your phone

Therapy plans and their versions, doses and skips, journal, symptoms, weight, lab results, visits, notes and attached documents are stored on your device. The database is encrypted with SQLCipher; its key is kept in the phone’s secure storage (Keychain or Android Keystore). The database is excluded from iCloud and Google device backups. Reminders are scheduled locally on the phone.

The data stays until you delete it. Backups, CSV exports and PDF reports you create leave the app only when you save or share them, and remain wherever you put them. A CSV export, and a backup without a passphrase, are not encrypted.

3. Purchases and Pro — RevenueCat

The app uses RevenueCat, Inc. (USA) as our processor to sell and restore Pro and check whether it is active. RevenueCat receives:

• a random App User ID created by the app (shown in the app as your Support ID) — it is a pseudonym, not anonymous: it links your purchases and the events below;
• purchase and subscription history, store receipts, product, Pro status, store country, currency, and app and system version.

Purpose and legal basis: providing what you buy, restoring purchases and Pro access granted by support — Art. 6(1)(b) GDPR (contract).

Offer measurement. When the Pro offer is shown, including during onboarding, RevenueCat may record that it was viewed, how you interacted with it, the offer and product, the time, and whether a purchase or trial started, linked to the same ID. We use this to see whether the offer works. Legal basis: our legitimate interest in measuring the effectiveness of our offer — Art. 6(1)(f) GDPR. You can object at any time by writing to us with your Support ID; we then delete your RevenueCat record (see Delete data).

RevenueCat does not receive your therapy data, lab results, documents, notes or answers you give in onboarding. We do not use RevenueCat data for advertising.

Retention: as long as your purchases may need to be verified or restored, or until you ask us to delete the record. RevenueCat removes deleted data from its backups on its own schedule.

4. App Store and Google Play

Apple and Google process your payment and store account under their own privacy policies, as separate controllers. We do not receive your card details, name or store account. We receive sales reports from the stores.

5. Email and feedback

If you write to us — by email or from Settings → Help us improve — we process your email address, your message and, only if you tick it, technical details (app version, system and phone model). The app sends nothing by itself; your mail app or the app you choose sends the message. We use this to answer you and handle your requests: Art. 6(1)(f) GDPR (our legitimate interest in providing support) and, for requests about your rights, Art. 6(1)(c) GDPR. Our email is hosted by OVHcloud (OVH SAS, France). We keep correspondence for up to 2 years after the matter is closed, and records of requests about your rights for as long as needed to show how we handled them. Please do not send lab results or other health documents by email.

6. This website

trtbuddy.app uses no cookies, analytics, trackers, external fonts or scripts. It is hosted by Cloudflare, Inc. as our processor, which processes technical data needed to deliver and protect the site (such as IP address, time and requested address). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running a secure website.

7. AI document reading

The app may later offer optional reading of lab documents with AI. It is switched off in the current version, and nothing is sent to an AI service. Before it is switched on, we will update this policy — naming the provider, what is sent and how long it is kept — and the app will ask for your explicit consent before each use. Until then the app has no AI feature.

8. Transfers outside the EEA

RevenueCat and Cloudflare are based in the USA and may process data there. Transfers rely on the EU Standard Contractual Clauses in their data processing terms or, where the recipient is certified, the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards.

9. Permissions

Notifications are optional and used only for reminders. The camera, photos and files are used only when you choose to attach a document or photo; it stays on your phone. The app lock uses your phone’s Face ID, Touch ID, fingerprint or passcode — the app never receives biometric data. We do not collect contacts or location.

10. Your rights

You have the right to access, rectify and erase your data, restrict its processing, data portability, and to object to processing based on our legitimate interest. Data on your phone is fully under your control in the app. For RevenueCat or email data, write to [email protected]; because there is no account, include your Support ID (Settings → Help and information → Support ID) so we can find the record. You can complain to the Polish supervisory authority (President of the Personal Data Protection Office, uodo.gov.pl) or the authority in your country. We do not make decisions based solely on automated processing.

11. Deleting data and cancelling

How to delete data on your phone and with RevenueCat: Delete data. Deleting data or the app does not cancel a subscription — cancel it in the App Store or Google Play. Cancelling does not delete data.

12. Age and intended use

The app is intended for adults aged 18 and over. TRT Buddy is a personal organizer and log; it does not diagnose, interpret results or recommend doses or treatment.

13. Changes

We will publish changes here with a new date. Before adding a new recipient of data or a new kind of processing, such as AI reading, we will update this policy and tell you in the app.