🇬🇧 EN
Sub-processors
Current publication-ready legal information for the Strenqo mobile app.
Version: 1.1.1
Last updated: 2026-07-11
Language: English (the Italian version is canonical in case of discrepancy)
1. Foreword
This page lists the third-party service providers ("sub-processors" under Art. 28 GDPR) that process personal data on behalf of Strenqo to provide the service.
The list reflects the state as of 2026-07-02.
2. Active sub-processors
2.1 Supabase
- Legal name: Supabase Inc.
- Location: United States (Delaware)
- Data hosting country: European Union (
eu-west-1) - Purpose: PostgreSQL database, authentication, file storage, Edge Functions, realtime sync, audit and rate limiting
- Categories of data: profile, workouts, nutrition, body check-ins, uploaded photos/files, AI conversations, preferences, health/wearable snapshots, privacy requests
- Transfer safeguard: data at rest hosted in the EU; US operational support covered by DPA/SCC
2.2 Google Gemini
- Legal name: Google LLC / Google Ireland Limited
- Location: United States / Ireland
- Purpose: AI Coach, food-photo analysis, uploaded file/photo analysis for plans, workout/nutrition plan generation, personalized notifications and briefings
- Categories of data: user messages, profile and fitness context, recent workout/nutrition/recovery data, user-uploaded photos/files, Coach preferences and memory if enabled
- Condition: only when AI data consent is enabled; Coach memory can be disabled separately where available
- Transfer safeguard: EU-US Data Privacy Framework + SCC fallback
2.3 RevenueCat
- Legal name: RevenueCat, Inc.
- Location: United States
- Purpose: Pro subscription and entitlement management
- Categories of data: user UUID, subscription status, product identifier, subscription lifecycle events
- Notes: RevenueCat does not receive health data or full payment-card data
2.4 Resend
- Legal name: Resend, Inc.
- Location: United States
- Purpose: transactional email, including export/delete confirmations and policy updates
- Categories of data: recipient email, language, transactional email content
2.5 Apple
- Legal name: Apple Inc. / Apple Distribution International Ltd
- Location: United States / Ireland
- Purpose: App Store, in-app purchases, APNs, Sign in with Apple, on-device HealthKit, platform/store diagnostics if enabled by the user
2.6 Google
- Legal name: Google LLC / Google Ireland Ltd
- Location: United States / Ireland
- Purpose: Google Play, Play Billing, FCM, Google Sign-In, on-device Health Connect, Google Maps SDK Android, platform/store diagnostics if enabled by the user
2.7 WHOOP
- Legal name: WHOOP, Inc.
- Location: United States
- Purpose: optional wearable integration via OAuth and server-side sync of fitness/recovery/sleep data into Strenqo
- Categories of data: authorized WHOOP account data, encrypted OAuth tokens, API data saved as Strenqo wearable snapshots/sources
2.8 Oura
- Legal name: Oura Health Oy / Oura Health Ltd. and affiliates
- Location: Finland / United States
- Purpose: optional wearable integration via OAuth and server-side sync of sleep/recovery/SpO2 data into Strenqo
- Categories of data: authorized Oura account data, encrypted OAuth tokens, API data saved as Strenqo wearable snapshots/sources
2.9 Garmin
- Legal name: Garmin International, Inc. and affiliates
- Location: United States / Switzerland and other affiliates
- Purpose: optional wearable integration via OAuth 1.0a and server-side sync of fitness/recovery/sleep data into Strenqo
- Categories of data: authorized Garmin account data, encrypted OAuth tokens, API data saved as Strenqo wearable snapshots/sources
2.10 OpenFoodFacts
- Legal name: Open Food Facts
- Location: France
- Purpose: public food database for text/barcode search
- Categories of data: food queries or barcodes without Strenqo user identifiers
2.11 ipwho.is
- Location: United States
- Purpose: IP geolocation fallback for country/market detection
- Categories of data: IP address only
2.12 ipapi.co
- Legal name: Kickfire LLC
- Location: United States
- Purpose: secondary IP geolocation fallback
- Categories of data: IP address only
2.13 Expo
- Legal name: Expo, Inc.
- Location: United States
- Purpose: Google Sign-In Auth Proxy, EAS build and OTA update infrastructure
- Categories of data: Google OAuth authorization code in transit during login; build infrastructure does not receive runtime user data
3. Services we do not use
Strenqo does not use third-party advertising SDKs, third-party analytics SDKs, attribution/mobile measurement SDKs, behavioral trackers, cross-context marketing profiling services, or Sentry/other third-party crash-reporting SDKs in the current build.
4. Summary by data type
| Data type | Sub-processors that see it | Notes |
|---|---|---|
| Profile, workouts, nutrition, weight, photos/files | Supabase (EU) | Primary hosting |
| AI conversations, AI-submitted photos/files, user context | Supabase + Google Gemini | Only with AI consent enabled |
| Coach memory and AI notifications | Supabase + Google Gemini | Memory can be disabled where available |
| Pro subscription | Supabase + RevenueCat + Apple/Google | RevenueCat does not receive health data |
| Transactional email | Resend | No marketing |
| Push token | Apple/Google | Only if notifications are enabled |
| HealthKit / Health Connect data | Apple/Google on-device + Supabase when saved in Strenqo | Only with OS permissions |
| Cloud wearable data | WHOOP/Oura + Supabase; Garmin only after approval/availability and user connection | Only if the user connects the account |
| Outdoor route GPS coordinates | Supabase + Google Maps SDK Android | Only for outdoor cardio/GPS |
| Food search | OpenFoodFacts | Query/barcode without user identifier |
| IP for country/market | ipwho.is, ipapi.co | Only when local fallbacks are insufficient |
| Google OAuth code in transit | Expo Auth Proxy | Google login only |
5. Contacts
- Controller: Andreas Mondo — Via Pianezza 16, 10040 Givoletto (TO), Italy
- Email: strenqo-support@strenqo.eu
- PEC: andreasmondo@ultracert.it
End of document.