Privacy policy

Updated 28 September 2026 · Applies to the Rewild app and this website

The short version: Rewild collects what it needs to run — your sign-in identity, the entries you log, optional profile and support information, your subscription status, and the technical data any app needs to talk to its servers. No ads, no advertising trackers, no third-party analytics, no selling or renting your data. Ever.

1. Who we are

Rewild is operated by IntenseLife AG, Mühlebachstrasse 25, 8008 Zürich, Switzerland ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at office@intenselife.ch.

2. What we collect, and why

Your account

Rewild supports Apple, Google and Facebook sign-in, and one-time email codes, where each method is enabled for your build. We never ask for a provider password inside Rewild. Our authentication service receives an account identifier and, depending on the method and what you share, your email address, name and profile picture. Sign-in credentials are managed by the authentication system, separately from your profile and support data. For email-code sign-in, this service sends your email address and the code email to Infobip for delivery.

Apple lets you hide your email address; if you choose that, we receive Apple's private relay address instead of your real one, and Rewild works normally with it. Different sign-in addresses may create separate accounts. To add another sign-in method to the account you already use, connect it from Profile while signed in. Rewild does not automatically import a Healary account or its data.

Why: to create your account and keep your entries attached to it.

The entries you log

Rewild's purpose is logging your days across three pillars: meals (such as breakfast or a snack), movement (such as a short walk or strength work), and mind (such as last night's sleep or quiet minutes) — what you logged, the day it belongs to, and when it happened. Entries are saved on your device first and then synced to your account on our backend.

These entries can reveal information about your lifestyle and wellbeing, so we treat them as sensitive: they are used solely to show you your own history, they are never used for advertising or sold. Service providers process the data needed to deliver the features you choose, as described below.

Optional profile, city and images

You can provide a display name, birth year, height, weight, preferred units and city. Unknown measurements stay empty. If you choose an avatar, Rewild uploads that image to private storage. Camera and photo-library access occur only when you choose those actions. Uploaded profile and support images have location metadata removed and are served through access-controlled, expiring links.

City text searches go through our backend to Google Places. Optional “Locate me” uses your device's location and geocoding services to suggest a city. Precise coordinates are transient on the device and may be processed by its geocoding provider; Rewild's backend stores only the city you select. Rewild does not track your location in the background.

Optional food recognition

After separate AI consent, Rewild sends the food photo or meal transcript you submit through our backend to OpenAI for recognition. Native speech services turn speech into text; Rewild's food backend receives the transcript, not a recording. Review the recognized foods and portions before saving. A confirmed photo meal can retain the photograph as its private cover. Cancelling recognition does not save a meal. You can withdraw AI consent in the app.

Steps and activity rewards

If you enable steps, Rewild reads step samples and source identifiers from Apple Health or Android Health Connect. This integration requests steps only. It merges overlapping sources according to your source preferences on that device. Daily step and goal summaries, source selections and collected reward receipts can be saved to your account; raw health sample intervals are processed on your device. You can change access in your device's health settings. Completing Apple's authorization dialog does not tell Rewild whether you allowed reading data.

Earned hearts record food, step-goal and confirmed mindful-session activity. The account stores the source, date, time zone and earning inputs so retries do not award twice. Internal defaults used for reward calculations are not personalized dietary advice. Editing a profile measurement earns no reward.

Support and optional reply notifications

Support stores the category, subject, messages, up to three image attachments per message, read status and optional satisfaction feedback you submit. Authorized Rewild support staff can view and reply to tickets; staff replies and status changes are audited. Avoid including information that is unnecessary for your support request.

If you enable support-reply notifications, we store a device push token and send generic reply notifications through Expo and Apple or Google. Notification text does not include your message, health details or attachment. You can disable these notifications in Profile or your device settings. A queued notification already handed to the platform may still arrive after you turn the option off.

Your subscription

Payment is handled entirely by the app store you bought Rewild from — Apple's App Store or Google Play — and we never see your card or bank details. To know whether your subscription is active, we use RevenueCat (RevenueCat, Inc., USA) as our subscription-management processor. RevenueCat receives the store's purchase receipt, your device model and an approximate region derived from your IP address — and no advertising identifier. Your purchase history is linked to your account identifier so that your subscription follows your account rather than a single device; we declare this linkage in the App Store's App Privacy section when Rewild is listed.

Technical data

When the app or this website talks to our servers, those servers keep standard, short-lived connection records — your IP address, the time of the request, and the app version and platform — to run the service and prevent abuse.

What we deliberately do not collect

• No advertising identifiers, ad networks, or cross-app tracking.
• No third-party analytics or behavioural profiling.
• No contact-book access or background location tracking.
• No payment card details — the store keeps those.

3. Who processes data for us

We use these providers to operate Rewild and deliver the features described in this policy:

• Supabase, Inc. (USA) — hosts our backend database and authentication and private image storage. Your account data and synced entries are stored on Supabase infrastructure in the United States (US East region).
• Infobip — delivers authentication emails, including one-time sign-in codes. It processes the recipient email address, message content and delivery information needed to send those emails and troubleshoot delivery.
• RevenueCat, Inc. (USA) — manages subscription status, as described above.
• Expo (650 Industries, Inc., USA) — delivers over-the-air app updates. When Rewild starts, it asks Expo's servers whether a newer version of the app exists; that request carries your IP address, device platform and app version, and never your entries. If you enable support-reply notifications, Expo also processes the device token and generic notification payload for delivery.
• Railway — runs Rewild's application services, including food recognition and account/support requests.
• OpenAI — processes food photos and transcripts for the AI features you separately consent to use.
• Google Places — processes city search text to return city suggestions.
• Vercel Inc. (USA) — hosts this website and keeps standard, short-lived server logs.

Separately, Apple Inc., Google LLC and Meta process the sign-in methods you choose under their own privacy policies. Apple and Google also process store purchases, native speech, geocoding and device notification services where you use them. We do not control that processing.

4. International transfers

We are based in Switzerland. Some of the processors named in this policy store data in the United States, as described above. Where data leaves Switzerland or the European Economic Area, we rely on recognised safeguards — in particular the EU Standard Contractual Clauses (with the Swiss addendum) and, where a provider is certified, the EU–US and Swiss–US Data Privacy Frameworks.

5. Legal bases

Where the EU GDPR applies, we process your data:

• to perform our contract with you — running your account and sync, and honouring your subscription (Art. 6(1)(b) GDPR) — for your account and subscription data;
• for the entries you log, where they amount to data concerning health, on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by choosing to log them and can withdraw at any time by deleting your entries or your account;
• for our legitimate interests in keeping the service secure and preventing abuse (Art. 6(1)(f) GDPR);
• with your consent wherever we ask for it separately — which you can withdraw at any time.

Under the Swiss FADP, we process your data lawfully, in good faith and proportionately, and rely on your explicit consent where we process sensitive personal data.

6. How long we keep data

Your account and entries are kept for as long as your account exists. If you ask us to delete your account, we delete your account data and entries from our backend within 30 days, and we ask RevenueCat to delete or anonymise the subscriber record it holds for you — except where a law requires specific records to be kept longer. Purchase records held by Apple or Google follow their own retention. Server connection logs are short-lived and rotate automatically.

7. Your rights

You can ask us for access to your data, a copy of it in a portable format, correction, deletion, or restriction of processing, and you can object to processing based on legitimate interests. Write to office@intenselife.ch and we will respond within 30 days. You can also complain to a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

Use Delete account in Profile when available, or email us from the address linked to your account. Deletion removes owned records, uploaded images and notification tokens and requests applicable processor cleanup. Interrupted cleanup is retried; shared catalogue assets and other accounts are preserved. Deleting a Rewild account does not cancel an App Store or Google Play subscription. Manage cancellation in the store where you subscribed.

8. Security

Entries are stored locally on your device under the protections of your phone's operating system, and synced to our backend over encrypted connections (TLS). Access to production data is restricted to the people who need it to operate the service. No method of storage or transmission is perfectly secure, but we design for the failure modes we can control.

9. Children

Rewild is made for adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

10. This website

This website is a static page. It sets no cookies and runs no analytics or trackers, and its fonts are served from our own host — your visit sends nothing to a third-party font service. Our hosting provider (Vercel Inc., USA) keeps standard, short-lived server logs to run the service, as described above.

11. Changes

When we change this policy, we will update the effective date at the top and, for material changes, tell you in the app before the change takes effect.

12. Contact

IntenseLife AG · Mühlebachstrasse 25, 8008 Zürich, Switzerland · office@intenselife.ch