Privacy Notice
Last updated: 2026-10-17 · Version health-v2-2026-10
This notice explains what personal data TrendKeep collects, why, and what your rights are. It covers the current version of TrendKeep: your account, your weigh-ins and your trends. Before we add new features (body composition, nutrition, training or device sync, AI features, or an iOS app), we will update this notice. Where the law requires it, we will also ask for your consent again.
1. Who we are
TrendKeep (trendkeep.nl) is a web app for logging your weight and seeing your trend over time.
The controller of your personal data is:
Llee Tossel, a private individual based in the Netherlands, who runs TrendKeep as a free, non-commercial service Email: privacy@trendkeep.nl
When this notice says "we" or "us", it means Llee Tossel. TrendKeep is not run by a registered company. If a company is registered to run TrendKeep, we will update this notice with its details and let you know before the change takes effect.
We are not legally required to appoint a Data Protection Officer. For any privacy question, email privacy@trendkeep.nl.
2. What data we collect
Account data
- Your email address.
- Your password. Our authentication provider stores only a salted hash; we never see or store your password in readable form.
Profile and settings (you choose whether to fill these in)
- Display name, preferred units (kg or lb), time zone.
- Height, starting weight and goal weight.
Weigh-ins
- Your weight, the date and time of each weigh-in, and any note you add.
Consent records
- The date and time you gave or withdrew consent, and which version of the consent text you saw.
Technical data
- Sign-in session data, stored in a cookie that keeps you logged in.
- Server and security logs that our providers create automatically: IP address, browser and device type, time of the request, the page or endpoint requested, and error details.
- Delivery records for the emails we send you, such as the account confirmation and password reset emails.
Health data. Your weight, height, starting and goal weight, and any notes about your body are data concerning health. The GDPR (Article 9) treats this as a special category of personal data. We only process it with your explicit consent (see section 4).
We do not use advertising, analytics or tracking cookies. We do not sell your data and we do not use it for advertising or profiling.
3. Why we use your data and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in and keep you signed in | Account data, session cookie | Necessary to perform our agreement with you (GDPR Art. 6(1)(b)) |
| Store your weigh-ins and profile, and calculate and show your trend and goal progress | Health data, time zone, units | Your explicit consent (Art. 9(2)(a)) and necessary to perform our agreement (Art. 6(1)(b)) |
| Send service emails: confirm your email address, reset your password, and tell you about important changes to your account, this notice or our Terms | Email address | Necessary to perform our agreement (Art. 6(1)(b)) |
| Keep TrendKeep secure, prevent abuse and fix errors | Technical data, logs | Our legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Record your consent and handle your privacy requests | Consent records, request records | Legal obligation to demonstrate consent and handle requests (Art. 6(1)(c), Art. 7(1), Art. 12) |
We do not make any decisions about you based only on automated processing. Your trend line is a mathematical average, and only you can see it.
4. Your explicit consent for health data
Before we store any weight or body data, we ask for your explicit consent. You give it with a separate checkbox that is not ticked in advance and is not combined with accepting our Terms. You give this consent:
- for one specific purpose: storing your weigh-ins, height, starting and goal weight and notes, and using them to show your trends to you, and nothing else;
- freely: you can say no; but TrendKeep cannot work without weigh-ins, so we cannot create a working account without this consent;
- revocably: you can withdraw this consent at any time by emailing privacy@trendkeep.nl. TrendKeep will then delete your health data. We handle that request within one month. Withdrawal in Settings is coming soon.
When you withdraw your consent, we stop processing and permanently delete your health data. We will also offer to delete your whole account. Withdrawing consent does not make the processing we did before you withdrew it unlawful.
5. Who we share your data with
We do not sell or rent your data to anyone. We only share it with the service providers ("processors") we need to run TrendKeep. Each of them has signed a data processing agreement with us and may only use your data on our instructions.
| Provider | What they do for us | Data involved | Where your data is |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore; part of a US-based group) | Database and user authentication | All account, profile, weigh-in and consent data; sign-in logs | Stored in the EU, in Frankfurt, Germany (Amazon Web Services) |
| Vercel (Vercel Inc., USA) | Hosts the website and runs our server code | Your requests to TrendKeep pass through Vercel, including the data you enter; short-term server logs (IP address, request details) | Our server code runs in Frankfurt, Germany. Static content is served from Vercel's worldwide network, and logs may be processed in the USA. |
| Resend (Plus Five Five, Inc., USA) | Account emails (confirmation, password reset) are sent by our auth provider Supabase via Resend (EU, Ireland) from noreply@trendkeep.nl. | Your email address, the email content (which never contains your health data) and delivery status | Sent from the EU, in Ireland. Some support and logging may take place in the USA. |
We may also disclose data when the law requires us to, for example when a court or authority issues a valid order. If TrendKeep is ever sold or merged, your data may pass to the new owner, who will remain bound by this notice. We will tell you before that happens.
6. Transfers outside the European Economic Area
Your data is stored in the EU. Some of our providers belong to companies based outside the EEA, and their staff or systems may access or process some data from there, for example for support, security or logging. When that happens, we rely on these safeguards:
- Supabase: the European Commission's Standard Contractual Clauses, which are part of Supabase's data processing agreement.
- Vercel: the EU-US Data Privacy Framework, under which Vercel Inc. is certified, and Standard Contractual Clauses.
- Resend: the EU-US Data Privacy Framework, under which Resend is certified according to its data processing agreement, and Standard Contractual Clauses.
All traffic is also encrypted in transit, and data is encrypted at rest. You can ask us for a copy of these safeguards at privacy@trendkeep.nl.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Account, profile, weigh-ins and consent records | As long as you have an account. Until the in-app tools ship, email privacy@trendkeep.nl and we handle deletion requests within one month. |
| Health data after you withdraw consent | Until the in-app tools ship, email privacy@trendkeep.nl and we handle withdrawal requests within one month. |
| Database backups | Our provider makes encrypted backups and overwrites them on a rolling basis. Deleted data disappears from all backups within 7 days. |
| Server, security and email delivery logs | Kept for a short time by our providers, generally between 1 and 30 days. |
| Records of your privacy requests (what you asked, when, and what we did) | 2 years after your request is closed, so that we can show we handled it correctly. These records contain only your email address and the request details, never your health data. |
8. Your rights
Under the GDPR, you have the right to:
- Access: get a copy of your personal data.
- Rectification: correct inaccurate data. You can edit your profile and weigh-ins yourself at any time.
- Erasure: have your data deleted (see section 9).
- Data portability: get your data in a machine-readable format (JSON and CSV) so that you can take it to another service.
- Withdraw consent for your health data at any time (see section 4).
- Object to processing that is based on our legitimate interests (section 3).
- Restriction: ask us to limit processing temporarily, for example while we check a correction.
How to use your rights
- Download your data, withdraw consent and delete your account in Settings → Privacy are coming soon. Until then, email privacy@trendkeep.nl and we'll handle your request within one month.
- By email: write to privacy@trendkeep.nl from the email address linked to your account. If you write from another address, we may ask you to confirm your identity first.
We respond within one month. For complex requests we may extend this by up to two more months, and we will tell you if we do. Using your rights is free.
9. Deleting your account
Download your data, withdraw consent and delete your account in Settings → Privacy are coming soon. Until then, email privacy@trendkeep.nl and we'll handle your request within one month. When we process that request, deletion permanently removes your account, profile, weigh-ins and consent records from our live systems. Remaining copies in backups expire within 7 days. We cannot undo a deletion.
10. How we protect your data
- All connections to TrendKeep use encrypted HTTPS (TLS).
- Data is stored encrypted at rest in an EU data centre.
- Row-level security in our database means each account can only read and change its own data.
- Passwords are stored only as salted hashes. Passwords must be at least 8 characters.
- Only the people who need access to production systems have it, and their accounts are protected with multi-factor authentication.
- We use no third-party trackers or advertising scripts. Our font is served from our own domain, not from Google.
- We keep health data out of our logs and emails.
No system is completely secure. If a data breach is likely to put your rights at risk, we will report it to the Autoriteit Persoonsgegevens within 72 hours. If the risk to you is high, we will also tell you directly and without undue delay.
11. Children
You must be 16 or older to use TrendKeep. Dutch law does not allow us to rely on the consent of children under 16 without permission from a parent or guardian, so we do not offer TrendKeep to them. When you sign up, you confirm that you are 16 or older. If we find out that someone under 16 has created an account, we will delete it. If you think a child has signed up, please email privacy@trendkeep.nl.
12. Cookies and local storage
We only use storage that is strictly necessary to provide the service you asked for, or that remembers a choice you made. Under the Dutch Telecommunications Act (Telecommunicatiewet, article 11.7a), no cookie consent banner is needed for this.
| Name | Type | Purpose | How long |
|---|---|---|---|
sb-…-auth-token (may be split into several numbered parts) | First-party cookie | Keeps you securely signed in | Until you sign out, or until your session expires |
theme | Local storage in your browser | Remembers whether you chose light, dark or system mode | Until you clear your browser storage |
We do not use analytics, advertising or social media cookies. If that ever changes, we will ask for your consent first.
13. Complaints
If you are unhappy with how we handle your data, please email privacy@trendkeep.nl first, and we will do our best to resolve it.
You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl. If you live or work in another EU country, you can also complain to the data protection authority there.
14. Changes to this notice
We update this notice when TrendKeep or the law changes, and always before we launch features that use new kinds of data. We will tell you about important changes in the app or by email before they take effect. If a change needs your consent, for example for a new type of health data, we will ask you for it and will not assume you agree.
15. Contact
Llee Tossel (TrendKeep), the Netherlands privacy@trendkeep.nl