🔒 Privacy Policy — Suplio

📌 1. Overview and privacy commitment

GXDEVS takes your privacy seriously. This Privacy Policy sets out, clearly and transparently, how your personal and supplement/health information is collected, stored, used and protected in the Suplio app.

Suplio runs on an offline-first model with optional synchronised cloud backup (via Supabase). Your data works entirely on your device, and if you create an account it is synchronised to the cloud in encrypted form so you have a secure backup and access across devices.

This policy complies with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018), the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the Data Safety requirements of the Google Play Console.

📂 2. Data we collect and why

We collect only what the app strictly needs in order to work:

• Authentication and profile data: when you create or sign in to a Suplio account through Google OAuth or Supabase Auth, we collect your name, email address, age and the training level you set.
• Supplement, reminder and streak data: supplement names, dosages, scheduled times and daily intake status, kept so we can produce your statistics and calculate your streaks.
• Push notifications: we collect your device's notification token (Expo Push Token) so reminders arrive at the times you set.
• Advertising identifier: the app shows ads and measures how well the campaigns promoting it perform. For that, Google and Meta Platforms may access your Android Advertising ID (AAID), approximate location derived from your IP address, device information and ad interaction data. Section 4 covers this in full.

☁️ 3. Cloud infrastructure (Supabase)

For backup, authentication and synchronisation, Suplio uses infrastructure provided by Supabase, Inc. All data moving between the app and Supabase's servers is protected by encryption in transit (TLS/HTTPS) and at rest (AES-256), with Row Level Security (RLS) policies applied.

We do not sell, rent or share your personal data with third parties for marketing or advertising purposes.

📣 4. Advertising, measurement and third parties

Suplio is free and funded by ads. Two third parties are involved, each with a distinct and bounded role:

4.1 Serving ads — Google LLC (AdMob)

The ads shown inside the app are served by Google AdMob, a service operated by Google LLC.

Google and its advertising partners may collect and process the following to select, deliver and measure ads: your device advertising identifier (AAID), your IP address and the approximate location derived from it, your device model and operating system, and ad interaction data such as impressions and clicks. Google's own processing is described in How Google uses information from sites or apps that use our services.

4.2 Campaign measurement — Meta Platforms, Inc.

From version 1.5.8, Suplio includes the Meta Platforms, Inc. (Facebook) SDK for a single purpose: measuring and attributing ad campaigns — that is, knowing that an install came from a particular ad.

There is no Facebook login in Suplio, and none of your content is posted or shared to any social network.

Only the following is sent to Meta:

• Your Android Advertising ID (AAID).
• Basic device data: model, operating system and language.
• The install referrer provided by the Google Play Store.
• App events — install, open and completion of the initial onboarding — with no parameters attached.

What is never sent to Meta: your name, email address, photo, age, health data, the supplements you track, your schedule or your dose history. None of that leaves the project's Supabase database or your device's local storage.

Meta's own processing is described in the Meta Privacy Policy.

We do not sell your personal data, and your supplement data — the supplements you track, your schedule, your dose history and your streaks — is never shared with advertisers or used to target ads.

Legal basis. In the European Economic Area and the United Kingdom, both ad serving and campaign measurement rely on your consent (GDPR, Article 6(1)(a)), collected on first launch through a certified consent management platform. In those regions the measurement described in 4.2 only happens if you consent, and stops if you withdraw it.

In Brazil, ad serving (4.1) relies on your consent (LGPD, Article 7, I), while campaign measurement (4.2) relies on legitimate interest (LGPD, Article 7, IX), limited to what is strictly necessary to assess how well the ads promoting the app perform.

How to control it. You can withdraw or change your consent at any time, and the app will keep working either way:

• Change your choice in the app: go to Settings → Privacy → Ad preferences.
• Reset or delete your advertising ID: go to Android settings → Privacy → Ads and reset or delete the identifier. That limits both ad personalisation (4.1) and campaign measurement (4.2) — neither Meta nor Google can tie your device to a stable identifier any more. You will still see ads, but they will not be personalised.

Neither third party receives health or supplement data. Suplio is intended for users aged 18 and over, and we do not direct ads to children.

🗑️ 5. Deleting your account and data

You have the right to request complete and permanent deletion of your data and your account from our servers at any time.

You can request deletion by filling in our web data deletion request form, from inside the app under Settings → Account → Delete Account, or by emailing contato@gxdevs.com with the subject [Suplio] Account and Data Deletion. Every record held in the cloud is permanently removed within 5 business days.

✉️ 6. Data Protection Officer (DPO) contact

If you have questions, comments or requests about this Privacy Policy, get in touch with the development team: