Tayb — Privacy Policy

Tayb ("we", "us", "our") is a health and nutrition platform that offers personalised meal plans, recipes, shopping lists and wellness information.

Tayb is commercially operated by Drink 18 VOF. That company determines the purposes and means of the processing of your personal data and is therefore the data controller within the meaning of Article 4(7) GDPR.

Data controller: Name: Drink 18 VOF Legal form: General partnership (vennootschap onder firma) Address: Drink 18, 2140 Antwerpen, Belgium Company number: 0760.812.768 VAT number: BE0760812768 Register of legal entities: RPR Antwerpen, afdeling Antwerpen Email: privacy@tayb.app Phone: +32 494 54 54 68 Country: Belgium

---

2.1 Data you provide yourself

During registration:

• Email address
• First and last name
• Password (stored encrypted; we never see your password in readable form)
• Date of birth (for age verification and nutritional calculations)

During profile setup (onboarding):

• Gender (male/female — used for nutritional calculations, not for identity)
• Weight, height and optional waist circumference
• Activity level (how active you are in daily life)
• Life stage (e.g. pregnancy, breastfeeding, menopause — see section 5)
• Primary health goal (e.g. weight loss, more energy, balance)
• Dietary preferences (e.g. vegetarian or vegan)
• Allergies (EU top-14 allergens)
• Ingredient preferences (dislikes)
• Fitness level and workout schedule
• Household size and maximum cooking time
• Fasting preferences (Islamic fasting, intermittent fasting, or none)

Optionally, if you choose to:

• Phone number
• Address details (street, postcode, city, country)
• Profile photo
• Bio/description

2.2 Data collected automatically

When using the app:

• IP address and user agent (browser type/device) upon login
• Device information (name, type, platform: iOS/Android)
• Session data (for security purposes)
• Push notification tokens (if you enable notifications)

When starting a trial:

• Device ID (to prevent trial abuse)
• Normalised email address (to prevent alias abuse)
• IP address and user agent (browser type/device), also to prevent abuse; kept for up to 1 year (see §9)

When you join the referral programme (accepting the programme terms):

• Date, language choice, version number and a checksum (hash) of the exact terms text you were shown
• A pseudonymised verification code (keyed hash, HMAC) derived from your IP address — for this acceptance record we do not store your IP address as a readable field, and the IP address cannot be read back from the code. The code is linked to your account and therefore remains personal data
• Browser/device info (user agent), app version and platform

2.3 Data you actively track

• Daily water intake
• Body measurements over time (weight, waist circumference)
• Fasting log (completion, energy and hunger levels, reason for breaking)
• Meal completion and shopping list ticking

2.4 Location data

We request permission for your location once (via your operating system) in order to:

• Calculate prayer times for Islamic fasting (fajr/maghrib)
• Set your time zone correctly
• Offer seasonal ingredients
• Suggest which country you shop in

Your location is stored with limited precision (~11 metres) and is only used for Tayb features such as prayer times and seasonal ingredients. We do not sell or share your location with third parties outside our processors.

You can also manually select a city instead of using GPS. We do not continuously track your location.

To find the place name for your position (when you set your location or travel location, or with the location button for your shopping country), your position is sent once to our own service in the EU. That service does not store your position and does not write it to a log.

Your shopping country. Prices and shops belong to a country and a currency. When you choose a shop for your shopping list, the app suggests which country you are probably shopping in. That suggestion is determined on your device, not stored and not sent to our servers. Your shopping country only changes once you confirm it yourself; your stored home location stays as it is. Without location permission you choose your country from the list. Legal basis: performance of the contract (Art. 6(1)(b)).

Vendors nearby. If you use "Vendors nearby", we show local vendors (such as farm shops, organic shops and grocers) on a map and in a list, sorted by distance. The app fetches the vendors for your country and calculates distances and filters on your device: your location is not stored or sent to our servers for this. The map tiles come from our own CDN (cdn.tayb.app, at Cloudflare, see §7); it sees which map area you are viewing, not your coordinates. Without location permission you choose a city. The listings themselves are business data from public sources; a vendor can have their listing changed or removed via "Is this your business?" (legitimate interest, Art. 6(1)(f)).

---

Method	Explanation
Registration form	Email, name, password, date of birth
Onboarding steps	6 steps in which you set up your profile, goals and preferences
App settings	Changes to profile, preferences and privacy settings
Automatically during use	IP address, device info, session data (for security)
Manual tracking	Water intake, body measurements, fasting log
External login services	Apple Sign-In or Google Sign-In (if you choose this; not yet active)
Payment providers	Subscription status via Stripe (web); in-app purchases via App Store/Play Store with RevenueCat once the app is in the stores

---

Purpose	Which data	Legal basis
Create and manage account	Email, name, password or social login credentials	Performance of contract (Art. 6(1)(b))
Generate personalised meal plans	Weight, height, activity level, goals, allergies, life stage data where relevant	Consent (Art. 6(1)(a)) + explicit consent for special categories (Art. 9(2)(a))
Support food safety	Allergies, dietary restrictions, preferences	Consent (Art. 6(1)(a)) + explicit consent for health data (Art. 9(2)(a))
Provide fasting and religion-related features	Fasting preferences, observances, prayer time settings, relevant life stage data	Consent (Art. 6(1)(a)) + explicit consent for special categories insofar as these reveal religion or health (Art. 9(2)(a))
Track progress	Body measurements, water intake, logs, history	Consent (Art. 6(1)(a)) + explicit consent for health data (Art. 9(2)(a))
Display safety warnings	Weight, age, life stage, allergies, BMI or derived signals	Consent (Art. 6(1)(a)) + explicit consent for health data (Art. 9(2)(a))
Sharing a household	What your household members see of you: your name, profile photo, role, since when you are a member, whether you have Premium and whether you can become the owner; the shared family plan, the shopping lists and the pantry. If you invite someone, we only store the invite code, not an email address	Performance of contract (Art. 6(1)(b))
Your allergies in the family plans	Your allergies, so that every family plan takes the allergies of everyone at the table into account. A plan names an allergen, never who has it; in a household of two this does point to your household member	Explicit consent: your acceptance when you create or join the household (Art. 9(2)(a)); you withdraw it by leaving the household or stopping sharing
Process subscription and payments	Subscription status, payment provider ID, billing details; the country of your location in your profile and, only at the moment of a purchase via the web, the country of your connection (via Cloudflare, not stored), to determine whether paying is possible in your country; after the payment we also compare the country of your billing address for this purpose	Performance of contract (Art. 6(1)(b)) and, where legally required, legal obligation (Art. 6(1)(c))
Prevent trial abuse and combat fraud	Device ID, normalised email address, IP address, user agent, subscription history	Legitimate interest (Art. 6(1)(f))
Secure your account	IP address, session information, MFA credentials, login history	Legitimate interest (Art. 6(1)(f))
Send functional emails	Email address, name, account status	Performance of contract (Art. 6(1)(b))
Marketing communications	Email address, name	Consent (Art. 6(1)(a))
Offers for Tayb Premium	Email address, name, language, the counters of your usage (see "Showing your usage and improving the app") and, for a push, your push token	Exception for customers (Belgian Royal Decree of 4 April 2003, art. 1, 1°; ePrivacy Directive art. 13(2)): we may send our customers offers for our own, similar services without prior consent, by email and as a notification in the app (also as a push, if you turn push on). When you register you can refuse this, and in every offer by email or in the app you can unsubscribe with one click; a push opens the notification with that link. You then get a confirmation and we stop sending you offers, on every channel. Other emails and notifications about your account, such as about the end of your trial, will still come
Push notifications	Push token, device information, notification preferences	Consent (Art. 6(1)(a))
Customer support	Ticket content, account details, communication history	Performance of contract (Art. 6(1)(b))
Error tracking and app stability	Error reports, technical logs, device info	Legitimate interest (Art. 6(1)(f))
Usage analytics, only with your consent	Predefined usage events (which features you use) with your user ID, and a summary of them per day and per subscriber, including an estimate of how likely you are to cancel	Consent (Art. 6(1)(a))
Showing your usage and improving the app	Counters of what you do in the app: recipes, ingredients and exercises viewed, plans created, recipes cooked, workouts completed, shopping lists, favourites and your streak of active days. We store totals, not a list of what you viewed	Legitimate interest (Art. 6(1)(f)): showing you your own usage during and after your trial, including in the emails at the end of it, and understanding which features work. You can object (see §11)
Calculate prayer or fasting times	Location or manually chosen place, time zone, calculation preferences	Consent (Art. 6(1)(a)); if the chosen feature may reveal religious belief, also explicit consent (Art. 9(2)(a))
Legal obligations	Audit logs, financial data, tax records	Legal obligation (Art. 6(1)(c))
Referral programme: recording your acceptance of the programme terms	Acceptance date, terms version and checksum of the text shown, language choice, pseudonymised IP verification code, user agent, app version, platform	Performance of contract (Art. 6(1)(b)); for the evidence details (IP code, user agent) legitimate interest (Art. 6(1)(f): proof and fraud prevention)
Referral programme: abuse checks and review of rewards	Number and status of invited accounts, aggregated device counts, review decisions (outcome, time, reason)	Legitimate interest (Art. 6(1)(f)); a final refusal only happens after human review — see the programme terms
Referral programme: showing progress to the person who invited you	Your first name with the initial of your last name (e.g. "Jan D."), your registration date and whether you already count	Performance of contract (Art. 6(1)(b)): whoever invited you must be able to follow their progress. We never show your full last name, email address or other details to other users
Friends programme: showing your invitation to whoever opens your link	Your first name with the first letter of your last name (e.g. "Jan D.") — visible to anyone who opens your invitation link, even without an account	Performance of contract (Art. 6(1)(b)): you share your invitation link yourself; the recipient only sees this masked name, never your full last name or other data
Partner programme: participation, commissions and payouts	Your name as a partner, your tax number and your IBAN (encrypted), your BIC, your VAT number if you are VAT-registered, your acceptance of the partner agreement, your commissions and payouts	Performance of contract (Art. 6(1)(b)); for the accounting, legal obligation (Art. 6(1)(c))
The waitlist	Your email address, your language, a hashed IP code, your place on the list, the friend code you came with, and how you found us: a category (a search engine, social media, a campaign, a link on another site, a friend or directly) and the name of a campaign, never the full web address	Consent (Art. 6(1)(a)): the tick box when you sign up. How you found us: legitimate interest (Art. 6(1)(f)), knowing which channel works; you can object to this (see §11)

---

Health data

Tayb may process data considered as health data under the GDPR. This may include:

• body weight, height, waist circumference and other body measurements;
• health and nutritional goals or preferences that may reveal something about your health;
• allergies and certain dietary restrictions;
• life stage information such as pregnancy, breastfeeding or menopause;
• activity level, calorie and hydration goals;
• fasting and progress data insofar as these have a health dimension.

We only process such data for features where it is reasonably necessary, such as personalisation, safety warnings, allergy filtering and progress tracking.

Religious data

If you activate certain fasting or prayer time features, we may process data that could reveal your religious beliefs, such as:

• Ramadan or other observance settings;
• prayer time calculation preferences.

We only process this data if you actively use or enable those features.

Legal basis and consent

For these special categories we use as a general rule:

• Art. 6(1)(a) GDPR as the ordinary legal basis; and
• Art. 9(2)(a) GDPR as the exception for special categories, based on your explicit consent.

We request this consent separately from the general terms and conditions, through clear choices in the app. Consent is not assumed from the mere fact that you enter data; we request an active confirmation.

You can withdraw your consent at any time via Profile → Privacy. Once you do so, we will stop the relevant processing for the future and delete the data covered by that consent, including in your meal plans, unless another valid legal basis still exists for a limited part. If you withdraw your consent for Allergy safety while you are in a household, you leave that household, because a household takes every member's allergies into account; if you are the owner, another member takes over the household, and if no other member can take it over, it is dissolved. The consequence may be that certain personalised features are no longer available. You can then still use Tayb for browsing, recipes, the encyclopaedia and other basic features.

Tayb is a wellness and lifestyle app. The app supports personalised meal planning, bodyweight planning, shopping lists, fasting support and similar features. Tayb is not a medical device and does not provide medical diagnosis, treatment, monitoring or therapeutic advice.

Our information and suggestions are intended as general information about nutrition, exercise and wellbeing. Warnings such as "consult a doctor" or "discuss this with your midwife" are aids and not a substitute for professional medical advice.

If you have health complaints, serious allergies, are pregnant, breastfeeding, taking medication or have other medical questions, always contact a doctor or other qualified healthcare provider.

---

We never sell your personal data to third parties. We only share your data with service providers and processors that help us provide the Service, and only for the purposes described in this policy.

We share data with the following categories of processors:

Payment processors

Processor	Purpose	Shared data	Country
Stripe	Web payments and invoicing	Email address, user ID, language preference (so that Stripe sends your receipts in your language where possible), subscription tier, amount; name, billing address, VAT number and, for a SEPA Direct Debit, your IBAN are provided by you directly to Stripe	Ireland (EU); possible transfer to the US under the EU-US Data Privacy Framework or SCCs
RevenueCat	In-app purchases (iOS/Android) — not yet active: enabled at launch in the App Store and Play Store; we will update this policy then	App user ID, transaction ID, product ID	US

Authentication providers

Processor	Purpose	Shared data	Country
Apple	Sign in with Apple — not yet active	Apple user ID, email	US/Ireland
Google	Sign in with Google — not yet active	Google user ID, email, name	US/Ireland

Communication services

Processor	Purpose	Shared data	Country
SendGrid (Twilio)	Email delivery	Email address, name, email content	US, under the EU-US Data Privacy Framework; in addition, standard contractual clauses (SCCs) in the data processing agreement
Expo Push Service (Expo, Inc.) and Firebase Cloud Messaging (Google)	Push notifications in the mobile apps — not yet active: only once those apps are available	Device tokens, notification content	US/Ireland

Hosting, network & storage

Processor	Purpose	Shared data	Country
Hetzner	Server hosting (databases and APIs)	All data; your connection to us (HTTPS) and the backups are encrypted	Germany (EU)
Cloudflare	Network and security layer for all traffic (proxy, firewall, access control for our admin panel), hosting of the website and the web version of the app, and file storage (R2)	IP address and request data with every request, including the search term when you look up a city and your position when we determine your place name, on their way to our own service; profile photos in storage	Storage: EU jurisdiction; traffic: global network, with SCCs/DPF for any transfer

Error tracking

Processor	Purpose	Shared data	Country
Sentry (Functional Software, Inc.)	Error tracking	Error reports, user ID (no name/email), device info	EU region (Frankfurt)

Analytics

Processor	Purpose	Shared data	Country
PostHog (PostHog, Inc. — Cloud EU)	App usage analysis, only with your consent	User ID and predefined usage events (which features you use); no automatic capture of screens or input	EU data centre (Frankfurt)

Analytics is off by default and is only enabled if you choose so in Profile → Privacy. PostHog processes this data solely on our instructions.

We conclude data processing agreements with these processors in accordance with GDPR Article 28 (see implementation checklist); a processor that is not yet active (RevenueCat, Apple and Google for sign-in, the push services) is only enabled once that has been done.

---

Our primary infrastructure is located in the EU. However, some of our service providers may process or make data accessible from countries outside the European Economic Area, including the United States.

When this occurs, we ensure a valid transfer mechanism under Chapter V of the GDPR, for example:

• an adequacy decision where available and applicable for the recipient concerned;
• standard contractual clauses (SCCs); or
• another legally permitted safeguard.

Which safeguard applies depends on the specific provider and service at the time of use. We verify this before launch and review it when providers or legislation change.

---

Data type	Retention period	Explanation
Account data	Until deletion + 30-day recovery period	After deletion: 30-day recovery period, then permanently deleted, except the pseudonymised proof of acceptance and of our notices, and the financial data the law requires us to keep (see below)
Profile data	Until account deletion	Deleted upon account deletion
Body measurements (time series)	As long as your account exists	Your progress (trends); deleted when you withdraw your consent for it (Profile → Privacy) or delete your account
Fasting logs	As long as your account exists	Your fasting history, also across several Ramadans; deleted when you withdraw your consent for the fasting feature or delete your account
Water intake logs	As long as your account exists	Your daily tracking; deleted when you withdraw your consent for it or delete your account
Meal plans	As long as your account exists	Your meal planning; you can delete them one by one in the app, and they are deleted with your account. If you withdraw your consent for Body metrics, Health goals, Allergy safety or Fasting support, your meal plans with that data are deleted; a family plan remains for your household, without your data.
Shopping lists	As long as your account exists	Price comparison and purchase history; you can delete them one by one in the app, and they are deleted with your account. A list belonging to a meal plan is also deleted when that meal plan is deleted because you withdraw a consent.
Usage counters	As long as your account exists	Deleted with your account, or earlier if you object (§16)
Analytics data (only if you turn analytics on): your events at PostHog and on our server, and the summaries per day and per subscriber	Until you turn analytics off or delete your account; the events on our server for at most 18 months	Understanding how the app is used (see §16); deleted as soon as you turn analytics off
Login history	180 days	Security monitoring, automatically cleaned up
Session data	Until logout or expiry	Automatically cleaned up
Audit logs	1 year, then automatically deleted; anonymised upon account deletion	Security and compliance purposes
Email delivery logs	1 year	Error tracking and delivery tracking
Support tickets	2 years after closure	Customer service
Payment data, including the record of your request to start Premium immediately (time, language, text checksum, payment session), as evidence for a possible legal claim; without a completed payment, we delete that record after 30 days	10 years from the end of the year of the payment	The EU VAT One-Stop Shop (OSS) scheme requires this for sales to consumers in other EU countries (VAT Directive art. 369 duodecies; Belgian VAT Code art. 58quater §7); we keep one period for the whole payment register, also for Belgian customers and for payouts to partners (Belgian accounting obligation: seven years, Belgian VAT Code art. 60, Belgian Code of Economic Law art. III.86); we keep them for the years after that as evidence in case of a legal claim, which can run for ten years
Trial abuse data	1 year	Fraud prevention
Marketing consent history	Until your account is deleted	Proof of your consent; deleted with your account
Proof of acceptance of the terms and privacy policy (document, version, language, text checksum, date), and of our notice of a material change (document, version, channel, time sent)	Until your account is deleted; then 10 years, pseudonymised, then automatically deleted	Evidence for a possible legal claim (limitation period); after deletion without your name or readable email address, only a pseudonymised verification code of your email address
Referral programme terms acceptance (date, version, language, text checksum)	For as long as you participate, until your account is deleted	Proof of your acceptance (contract/evidence records); deleted together with your account
Evidence details of that acceptance (pseudonymised IP verification code + key version, user agent, app version, platform)	2 years, then automatically deleted	Fraud prevention; data minimisation — the acceptance itself remains provable without these details
Referral programme review history (flagged rewards: outcome, time, reason)	Until account deletion	Accountability for decisions about rewards
Waitlist	Until you create an account or unsubscribe, and at most 12 months after you signed up	Your place on the waitlist; deleted automatically afterwards

Dormant accounts. If you do not log in for 2 years, we send you an email. If you then do not log in within 30 days, we delete your progress data (body measurements, fasting and water logs, meal plans and shopping lists); your account remains.

The periods in the table apply as long as your account exists. If you delete your account, your personal data is permanently deleted after the 30-day recovery period, including data with its own period in the table (such as email sending logs, support tickets, trial data and your acceptance of the referral programme terms). Only this remains:

• Proof that you accepted the terms and privacy policy, and that we notified you of a material change, is kept for 10 years, pseudonymised (without your name or readable email address), for a possible legal claim
• Payment data and accounting records are kept for 10 years from the end of the year of the payment. The EU VAT One-Stop Shop (OSS) scheme requires this for sales to consumers in other EU countries (VAT Directive art. 369 duodecies; Belgian VAT Code art. 58quater §7); we keep that one period for the whole payment register, also for Belgian customers (Belgian accounting obligation: seven years, Belgian VAT Code art. 60, Belgian Code of Economic Law art. III.86). This also applies at Stripe: we delete your customer data there, the invoices remain
• If you took part in the partner programme, the payout records are kept for 10 years from the end of the year (the same period as our whole payment register; the Belgian accounting obligation is seven years; we keep them for the years after that as evidence in case of a legal claim, which can run for ten years), and the evidence of your agreement for as long as a legal claim is possible; we keep your identity details no longer than necessary
• If you reviewed an exercise animation as a member of the Tayb team (approving it or asking for changes), your name and that decision, with your notes, are kept for as long as the approved version of that exercise can be shown and then for 10 years, as evidence of who released the exercise, for a possible legal claim
• Audit logs are anonymised (your user ID is replaced by a non-traceable code)
• If you unsubscribed from our emails, or an email could not be delivered, a pseudonymised verification code of your email address stays on our block list so that we do not email you again, for as long as that unsubscribe applies
• Error reports at Sentry (with your user ID, never your name or email address) disappear after Sentry's retention period

---

We take appropriate technical and organisational measures to protect your data, including but not limited to:

• encryption of data in transit and, where appropriate, at rest;
• secure storage of authentication credentials using modern hashing and encryption standards;
• pseudonymisation where possible: for the referral programme's acceptance record we store no readable IP address, only a pseudonymised verification code (keyed hash); that code remains personal data and is covered by this policy;
• role-based access control and logging of sensitive access;
• session security, rate limiting and anti-abuse measures;
• backups, monitoring and error tracking; and
• incident response and data deletion procedures.

No system is entirely risk-free, but we regularly evaluate our security and strive to minimise risks as much as possible.

---

Under the GDPR you have the following rights:

Right	How to exercise
Access — You may request which data we hold about you	In the app: Profile → Privacy → "Export data". Or email privacy@tayb.app
Rectification — You may have inaccurate data corrected	In the app: Profile → Account. Your date of birth is fixed once it has been filled in; if it is wrong, email privacy@tayb.app
Erasure — You may request deletion of your data	In the app: Profile → Account → "Delete account". We delete your data after a 30-day recovery period, with the exceptions in §9 (among other things, the pseudonymised proof of acceptance and the financial data the law requires us to keep)
Restriction — You may request temporary restriction of processing	Email privacy@tayb.app
Data portability — You may request your data in a portable format	In the app: Profile → Privacy → "Export data" (JSON format)
Objection — You may object to processing based on legitimate interest	Email privacy@tayb.app
Withdraw consent — You may withdraw previously given consent	In the app: Profile → Privacy, per type of consent (health data, allergies, health goals, fasting, progress, analytics). You stop sharing your allergies with your household in your household settings (stop sharing, or leave the household).

Filing a complaint

If you believe we are not processing your data correctly, you can file a complaint with a supervisory authority:

• Belgium (our establishment): Data Protection Authority (GBA) — www.gegevensbeschermingsautoriteit.be
• The Netherlands: Dutch Data Protection Authority (AP) — www.autoriteitpersoonsgegevens.nl

You always have the right to file a complaint with the supervisory authority of your own EU member state. We appreciate it if you contact us first at privacy@tayb.app so we have the opportunity to address your question or complaint.

---

You can delete your account at any time via the app:

1. Go to Profile → Account → Delete account
2. Confirm via a 4-step process (including password verification)
3. Your account is deactivated immediately
4. After 30 days your data is permanently deleted, with the exceptions in §9
5. Within those 30 days you can recover your account by logging in again

Upon deletion the following data is erased:

• Profile and personal information
• Health and preference settings
• Meal plans and history
• Favourite recipes and ingredients
• Push notification tokens and sessions

Audit logs are anonymised (not deleted) in order to meet our security and legal obligations.

---

For questions about this privacy policy or about the processing of your data:

Email: privacy@tayb.app Post: Drink 18 VOF, Drink 18, 2140 Antwerpen, Belgium

We respond to requests regarding your privacy rights within one month. For complex or numerous requests, this period may be extended by two months; we will then let you know within the first month (GDPR Art. 12(3)).

---

Tayb is intended for users aged 18 and over. This age requirement is a product policy of Tayb and not a statement that the GDPR itself always requires a minimum age of 18.

We do not knowingly collect data from persons under 18 years of age. If we reasonably determine that someone under 18 has created an account, we may block or delete the account and erase or anonymise the personal data involved, to the extent permitted by law.

Please contact us at privacy@tayb.app if you suspect that a minor has registered.

---

We may update this privacy policy from time to time, for example when new features are added or legislation changes.

In the event of material changes:

• We will send a notification via the app or by email
• We will state the date of the last modification at the top of this document
• We will give you the opportunity to review the changes

Last modified: 10 November 2026

---

Push notifications

Push notifications will come with the mobile apps, once those are available; the web version does not send push notifications. If you enable them, you will receive alerts about:

• Security warnings (new login, password change)
• Subscription events (renewal, cancellation, payment issue)
• Your household (e.g. a household member adds something to the shopping list or creates a weekly plan)
• Announcements from Tayb to all users (e.g. about a new feature or an outage)
• Fasting reminders (suhoor/iftar, if you enable this)

You can disable push notifications at any time via Profile → Notifications in the app; security warnings stay on, because they protect your account. Your phone's settings turn off all push notifications.

Analytics

We use PostHog (PostHog Cloud, EU data centre in Frankfurt) to understand how the app is used (e.g. which features are popular, where users get stuck). Analytics is off by default. If you enable it via Profile → Privacy, we send predefined usage events together with your user ID to PostHog; there is no automatic capture of screens or entered text. PostHog processes this data as a processor on our instructions (GDPR Art. 28). You can disable analytics again at any time via Profile → Privacy.

With the same switch we also store those events on our own server (in the EU) and summarise them per day and per subscriber, including an estimate of how likely you are to cancel. If you turn analytics off, this stops, and we delete what was already there: your events at PostHog and on our server, and the summaries. Separately from that switch, we count what you do in the app, to show you your own usage and to improve the app (see §4, legitimate interest). If you object (see §11), we stop counting for you and delete your counters.

The offers for Tayb Premium around the end of your trial (see §4) include a summary of your usage. You can unsubscribe in any offer with one click; you then get a confirmation and the offers stop.

Error tracking (Sentry)

We use Sentry (EU region, Frankfurt) to detect and fix technical errors in the app. This involves sending error reports, device information and your user ID (not your name or email) to Sentry. We actively filter personal data from error reports.

---

We do not process credit card numbers or other card details. Payments are handled by:

• Stripe (for web payments)
• Apple App Store and Google Play Store (for in-app purchases, via RevenueCat — once the app is in the stores)

From these parties we only receive the status of your subscription (active, expired, etc.) and a reference number. For the privacy policies of these parties, we refer you to their own documentation.

Exception: partner programme. If you take part in our partner programme and are entitled to a payout, we store your IBAN and tax number. These details are kept encrypted, used only for the payout and the statutory administration, and not shared with the payment processors above.

---

If you use Islamic fasting, we may request your location to calculate prayer times (fajr and maghrib). This works as follows:

• We request permission once via your operating system
• You can also manually select a city (without GPS)
• We calculate prayer times on our own server; your location is not sent to any external service for this
• Your GPS coordinates are stored with limited precision (4 decimal places, ~11 metres) as a privacy-by-design measure — both for your home location and for a travel location
• We only use your location for Tayb features (prayer times, seasonal ingredients, time zone) — not for advertising or tracking
• We do not sell or share your location with third parties outside our processors
• You can change your location at any time in the settings

When you use the fasting features or create a plan, the app sends your device's time zone along. We only use it if you have not set a location, so that "today" and your fasting times are correct; we do not store or log it.

Travel mode. When you travel, you can temporarily set a different location so that your prayer times and fasting windows are correct at your destination. You choose that location yourself: via GPS, from a list of destinations or by searching for a place name. We store the coordinates (rounded, ~11 metres), the place name and the time zone until you turn travel mode off or choose another location. We derive the time zone from the coordinates, not from your device's clock. If you search for a place by name, the search term goes to our own list of cities, which is kept in our own database in the EU; no search term is sent to an external service and we do not keep the search terms. Because your destination can say something about your religious beliefs, travel mode falls under the same explicit consent as the rest of the fasting feature (Art. 9(2)(a)). If you withdraw that consent, we delete your travel location together with your fasting settings.

Your location is stored in our database (EU) to repeat the calculation without asking you again. You can change or delete your location at any time in the app settings.

---

The web version of the app (app.tayb.app) and the admin interface of Tayb (used exclusively internally by our team) use functional cookies for:

• Session management (staying logged in)
• CSRF protection

We do not use tracking cookies or advertising cookies. No third-party cookies are placed. If you turn on analytics (see §16), PostHog stores an identifier in your browser's storage with your consent. Functional cookies do not require consent under the ePrivacy Directive.

---

This privacy policy applies to the Tayb web app (app.tayb.app, also as an app on your home screen if you install it there), the associated services and, once available, the mobile apps.

Last update: 10 November 2026