sthenia
GuidesFRDownload
← Back to home

Privacy Policy — Sthenia

Last updated: 20 June 2026

This is an English translation provided for convenience. In the event of any discrepancy, the French version prevails.

1. Purpose of this policy

Sthenia is a mobile sports-nutrition app published by JB Labs (see section 2). It helps users track their diet, generate meal plans tailored to their sport, goal and budget, and analyse their meals.

Protecting your personal data matters to us. This policy explains what data we process, why, on what legal basis, with whom, for how long, and what your rights are. It is written in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

2. Data controller

The controller of your data is:

  • Jordan Buch, sole trader (entrepreneur individuel, "EI"), trading under the name JB Labs
  • SIRET: 91034828300029
  • Address: 47 rue Vivienne, 75002 Paris, France
  • Contact: [email protected]

For any question about your personal data, you can write to this address.

3. Who this policy applies to

Sthenia is reserved for people aged 18 or over. We do not knowingly collect data about minors. If we learn that an account was created by someone under 18, we will delete it. If you believe a minor has provided us with data, contact us at [email protected].

4. What data we process and on what basis

We only process the data necessary to provide the service:

  • Account data: email address, password (stored encrypted). Legal basis: performance of the contract (our terms of use).
  • Sports and nutrition profile data: age, sex, height, weight, training frequency and type, goal (e.g. body recomposition, muscle gain, weight loss), dietary preferences and restrictions, indicative budget. Legal basis: performance of the contract, to calculate your needs and generate your plans.
  • Usage data: logged meals, generated plans, recipes, favourites, image-analysis results, app usage statistics. Legal basis: performance of the contract and legitimate interest (service improvement and security).
  • Subscription data: your subscription status, provided by Apple, Google and our technical provider RevenueCat. We neither process nor store your payment-card details: payments are handled exclusively by the App Store and Google Play. Legal basis: performance of the contract.
  • Technical data: connection logs, device technical identifiers, diagnostic data. Legal basis: legitimate interest (security, abuse prevention, proper operation).

Sensitive data. Sthenia does not collect health data within the meaning of Article 9 GDPR (e.g. medical history, conditions, treatments). The profile data above (weight, goal, etc.) is processed solely to provide the nutrition service and does not constitute medical monitoring.

Photos. When you photograph a meal or your fridge, the image is sent for analysis and is not retained.

5. Use of artificial intelligence

Some features (generating plans and recipes, analysing images, estimating nutritional values) rely on artificial-intelligence models provided by third parties (notably Anthropic, OpenAI and Google). These providers act as processors, under their professional offerings (programming interfaces / APIs).

Accordingly, and in line with the terms of those professional offerings, your data is not used to train these providers' artificial-intelligence models.

Automated decisions. Plans and recommendations are generated automatically, but they do not produce legal effects concerning you. You retain control and can modify or ignore them. This content does not constitute medical or dietary advice (see section 11).

6. Retention periods

  • Your account and profile data is kept for the entire life of your account.
  • When you delete your account, your personal data is erased immediately and irreversibly from our active systems. Residual copies may temporarily remain in our encrypted backups, until they are rotated out, after which they are permanently deleted.
  • Technical data and connection logs are kept for at most 12 months.
  • We may keep anonymised data (aggregated statistics, technical logs, food-price contributions) that no longer identifies you, without a time limit.
  • Where there is a legal obligation or a dispute, certain data may be kept longer, strictly to the extent necessary.

7. Who has access to your data

Your data is processed by JB Labs and its technical processors, solely to operate the service:

  • Supabase: database hosting and authentication. The infrastructure is located in the European Union (Amazon Web Services, eu-west-3 region, Paris).
  • Apple and Google: app distribution and management of in-app purchases.
  • RevenueCat: technical management of subscriptions.
  • Expo: technical sending of push notifications. Your device's notification token transits through Expo for this sole purpose.
  • Anthropic, OpenAI, Google: providers of the artificial-intelligence models, as processors via their professional APIs, with no training on your data (see section 5).

We do not sell your data and do not share it for any advertising purpose.

8. Transfers outside the European Union

Your data is primarily hosted in the European Union. Some providers — the artificial-intelligence model providers and our push-notification service (Expo) — may process data outside the European Union. In that case, such transfers are governed by appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission.

9. Your rights

Under the GDPR, you have the following rights over your data at any time and free of charge:

  • right of access and to a copy;
  • right to rectification;
  • right to erasure ("right to be forgotten");
  • right to restriction of processing;
  • right to object;
  • right to data portability;
  • right to set directives on the fate of your data after your death;
  • right to withdraw your consent where processing is based on it;
  • right to lodge a complaint with the CNIL.

You can exercise the right to erasure directly within the app, by deleting your account (app settings). For other rights, write to us at [email protected]. Proof of identity may be requested in case of doubt. We respond within one month, extendable if the request is complex.

10. Security

We implement technical and organisational measures to protect your data, including: encryption of communications (HTTPS) and of the database, encrypted storage of passwords, access restrictions, environment separation, and database-level access rules (per-user access policies).

11. Cookies, trackers and nutrition disclaimer

Cookies and trackers. The app does not use advertising cookies or third-party trackers for marketing. Only technical identifiers strictly necessary to the operation and security of the service are used. Our website may use strictly technical cookies; it does not use advertising cookies.

Disclaimer. Sthenia provides nutritional information for indicative purposes. It does not provide medical advice and is not a substitute for the advice of a healthcare professional (doctor, dietitian). Consult a professional before any significant change to your diet, in particular if you have a medical condition.

12. Deleting your account and your subscription

You can delete your account at any time from the app settings. Deletion immediately erases your personal data from our active systems.

Important: deleting your account does not cancel an active subscription. To stop billing, you must cancel your subscription directly in the App Store (Apple) or Google Play (Google).

13. Reference nutritional data

<!-- SYNC data attribution block — identical app + landing (C:\Sthenia lib/legal-content.ts, LEGAL_PRIVACY_EN). Any change requires the other repo. See docs/legal/ATTRIBUTIONS.md. -->

The nutritional values used by the app draw notably on the following sources: Anses. 2025. Ciqual food composition table (Etalab Open License). Food product data: © Open Food Facts — database available under the Open Database License (ODbL), contents under the Database Contents License. https://world.openfoodfacts.org

14. Contact and complaints

For any question: [email protected].

You may also contact the French data protection authority (CNIL): 3 place de Fontenoy, TSA 80751, 75334 Paris Cedex 07 — phone +33 1 53 73 22 22 — www.cnil.fr.

15. Changes to this policy

We may amend this policy to reflect legal developments or new features. The last-updated date appears at the top of the document.