Privacy Policy

1. What we collect

Account: your email address, the name you enter, and your password stored as a bcrypt hash — we never see the password itself. If you sign in with Google, we receive your email address and name from Google instead.

Fasting sessions: the goal you choose, when a fast starts and ends, and whether you finished or stopped it.

Journal: the hour, how you felt, symptoms you note and any free text you write. This is health data — see section 3.

Guides and newsletter: if you request a guide, your email address, the name you give, the moment you consented, and the IP address that consent came from — kept as proof that the consent was real.

Security: failed login attempts, stored as a one-way hash of the email or IP address rather than the address itself, so we can slow down brute-force attacks.

We do not use advertising or analytics trackers, and we do not sell data to anyone.

2. Why we may use it, in law

To provide the App you paid for or signed up to: performance of our contract with you.

To keep the App secure and working: our legitimate interest in a service that is not abused.

To send you a guide or newsletter: your consent, which you can withdraw at any time using the link in every email.

To keep accounting records: our legal obligations under Romanian law.

3. Health data

What you write in the journal — symptoms, how you feel, why you are fasting — is data about your health. European law treats it as a special category and it needs your explicit consent.

You give that consent by choosing to write in the journal. You can withdraw it by deleting your entries or your account, and nothing else in the App stops working if you never write anything.

Journal entries are never sent to the AI assistant. Only the question you type is.

4. The AI assistant and your data

When you ask the assistant something, the text of your question is sent to Anthropic (Claude) to produce the answer, together with material from Viorel Simac's own books and articles. If knowledge search is enabled, OpenAI is used to compute the embeddings that make the search work.

Your journal, your fasting history and your email address are not sent.

These providers process the request to answer it. They do not use it to train their models under the business terms we use.

Do not type into the assistant anything you would not want leaving the App — a chat window is not a medical record.

5. Who else processes your data

OVHcloud — hosting for the application and the database.

Lemon Squeezy — sale, payment and invoicing of paid plans, as Merchant of Record. Card details go to them, never to us.

Mailgun — sending emails (confirmations, guides, newsletter).

Anthropic and OpenAI — the AI assistant and knowledge search, as described above.

Cloudflare — the anti-robot check on the sign-up and sign-in forms.

Google — only if you choose to sign in with Google.

Each one acts on our instructions, under a data processing agreement.

6. Where your data is

The server that runs the App is in the United States (OVHcloud, Virginia). Mailgun and the AI providers are also United States companies. That means your data leaves the European Union.

These transfers rely on the European Commission's Standard Contractual Clauses, and, where the provider is certified, on the EU–US Data Privacy Framework.

If you would rather your data stayed inside the EU, tell us — we can say where things stand and, for hosting, move it.

7. How long we keep it

Your account, fasting sessions and journal: while your account exists. When you delete your account from the Account page, they are removed immediately and permanently.

Newsletter and guide subscribers: until you unsubscribe, plus the proof of consent for 3 years afterwards.

Invoices and accounting records: 10 years, as Romanian law requires.

Failed login attempts: 15 minutes.

8. Your rights

You can ask for a copy of your data, correct it, delete it, take it elsewhere in a portable format, object to a use of it, or withdraw a consent you gave.

You can delete your account yourself, at any time, from the Account page in the app. It asks you to type a word first, then removes your account, your fasting sessions and your journal on the spot — there is no waiting period and no undo. If you would rather we did it, write to office@sutherland.ro from the address on the account.

If you think we have handled your data badly, tell us first. You also have the right to complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

9. Cookies

A session cookie keeps you signed in. A small cookie named sm_lang remembers the language you chose. The anti-robot check sets its own cookie while it runs.

That is all. There are no advertising or tracking cookies, which is why the App does not ask you to accept any.

10. Children

The App is not for people under 18 and we do not knowingly collect their data. If you believe a minor has an account, write to office@sutherland.ro and we will remove it.

11. Changes

If we change this policy in a way that affects you, we will email you before it takes effect. The date at the top always shows the current version.

12. Contact

Anything about your data: office@sutherland.ro. We answer within 30 days, usually much sooner.