Privacy Policy

Version 1.0 · Published July 9, 2026

Table of Contents

1. Who We Are
2. Scope of This Privacy Policy
3. What Personal Data We Collect
4. Data Users Provide Directly
5. Data Collected Automatically
6. Meal Photos and AI Analysis
7. Nutrition, Wellbeing, Habit, and Health-Adjacent Data
8. Data from Apple Health, Google Health Connect, Wearables, or Integrations
9. Payment and Subscription Data
10. Device, Analytics, Diagnostics, and Crash Data
11. Cookies, SDKs, Attribution, and Tracking Technologies
12. How We Use Personal Data
13. Legal Bases Under GDPR / UK GDPR
14. Special Category or Sensitive Data Considerations
15. AI Processing and Automated Insights
16. Personalisation and Recommendations
17. Push Notifications and Reminders
18. Marketing Communications
19. When We Share Personal Data
20. Processors and Service Providers
21. International Data Transfers
22. Data Retention
23. Security
24. Children and Minimum Age
25. User Rights Under GDPR, UK GDPR, and Swiss FADP
26. How to Exercise Your Rights
27. Account Deletion and Data Deletion
28. App Store Purchases and Third-Party Platforms
29. Third-Party Links and Services
30. Changes to This Privacy Policy
31. Contact Details

1. Who We Are

This Privacy Policy is issued by:

NXL GmbH Baarermattstrasse 8D 6340 Baar Switzerland Commercial register number: CH-170-4014802-3 UID: CHE-162.454.965

NXL GmbH ("NXL", "we", "our", or "us") is the data controller responsible for personal data processed through the mobile application Spru (the "App") and related services (together, the "Services").

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights available to you.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

• the Spru mobile application (iOS and Android);
• any associated websites operated by NXL (e.g. https://spru.app);
• customer support interactions related to the App; and
• any other service that links to this Privacy Policy.

This Privacy Policy does not apply to third-party websites, applications, or services that Spru may link to or integrate with, including Apple, Google, and other platforms, which are governed by their own privacy policies. See Section 29.

This Privacy Policy should be read together with our Terms & Conditions.

3. What Personal Data We Collect

The exact personal data we collect about you depends on:

• which features you choose to use;
• the permissions you grant on your device (e.g. camera, photo library, notifications, health data access);
• whether you connect optional integrations (e.g. Apple Health, Google Health Connect); and
• your device and operating system settings.

Categories of personal data we may collect include, without limitation:

• Account data: email address, authentication identifiers, account creation date
• Profile information: display name, age or age range, height, weight, gender, activity level
• Goals and preferences: nutrition goals, hydration goals, dietary preferences, allergies, food preferences
• Meal and nutrition data: meal photos, AI-inferred food items, portion size estimates, nutrition estimates (calories, macronutrients, micronutrients), meal history, manually logged meals
• Hydration and habit data: water intake logs, habit tracking activity, streaks, progress and engagement history
• Avatar/engagement data: avatar ("Spru") evolution state and progress
• Health-adjacent integration data: data received from Apple Health, Google Health Connect, or other connected wearables, where enabled (see Section 8)
• Subscription and payment-related data: subscription tier, purchase status, transaction identifiers (see Section 9)
• Device and technical data: device identifiers, device model, operating system version, app version, IP address, language and locale settings
• Usage and analytics data: in-app events, feature usage, session data, screen views
• Diagnostics data: crash logs, uncaught exceptions, and error reports (see Section 20)
• Notification data: push notification tokens, notification interaction data
• Support data: messages, attachments, and information you provide when contacting customer support

We do not require you to provide all of the above categories to use the core features of the App. Some data is required to create an account and use basic functionality; other data is collected only if you choose to enable specific features.

4. Data Users Provide Directly

You provide personal data directly to us when you:

• create an account (e.g. email address, authentication credentials);
• complete or edit your profile (e.g. age, height, weight, gender, goals, dietary preferences, allergies);
• log meals, water intake, or habits manually;
• upload or capture meal photos;
• interact with the Spru avatar or in-app features;
• subscribe to Premium or manage your subscription;
• contact customer support or provide feedback; and
• respond to in-app surveys or prompts, where offered.

5. Data Collected Automatically

When you use the App, certain data is collected automatically, including:

• device identifiers and device/OS information;
• IP address and approximate location derived from it;
• app usage data (features used, screens viewed, session duration, interaction events);
• analytics events generated by our analytics tooling (see Section 20);
• diagnostic and crash data; and
• notification tokens used to deliver push notifications.

The exact data collected automatically depends on your device settings (e.g. whether you have restricted tracking, location, or advertising identifiers at the operating system level) and any privacy choices you make within the App.

6. Meal Photos and AI Analysis

Spru allows you to capture or upload photos of meals so that our AI-powered systems can attempt to identify food items, estimate portion sizes, and estimate nutritional content.

In relation to meal photos, we want you to understand that:

• meal photos you capture or upload are processed by AI systems, including third-party AI providers acting as our processors (see Section 20);
• AI-generated food identification, portion estimates, and nutrition estimates are estimates only and may be inaccurate, incomplete, or unreliable;
• you should review and, where necessary, correct AI-generated results before relying on them;
• meal photos may be retained to provide your meal history and to allow you to review past entries, subject to the retention periods in Section 22; and
• see Section 15 for how meal photo data may or may not be used to improve our AI systems.

7. Nutrition, Wellbeing, Habit, and Health-Adjacent Data

Spru helps you track nutrition, hydration, habits, and general wellbeing. Data you provide or that is generated through your use of these features (nutrition estimates, hydration logs, habit streaks, goals, dietary preferences, and allergy information) is health-adjacent data.

We treat this data with particular care because, depending on your jurisdiction, some of it may qualify as special category or sensitive personal data (see Section 14).

Spru is not a medical device, and it does not provide medical advice, diagnosis, or treatment. Nutrition and wellbeing information provided through the App is for general informational and educational purposes only. You should consult a qualified physician, registered dietitian, or other healthcare professional before making decisions that affect your health, particularly if you have a medical condition, allergy, or are pregnant, breastfeeding, or otherwise in a vulnerable health situation.

8. Data from Apple Health, Google Health Connect, Wearables, or Integrations

Spru currently supports optional, user-enabled integrations with:

• Apple Health (HealthKit), on iOS devices; and
• Google Health Connect, on Android devices.

These integrations are read-only and are limited to two data types:

• step count (Steps on Health Connect, step count on HealthKit); and
• sleep duration (SleepSession on Health Connect, sleep analysis on HealthKit).

We do not write any data back to Apple Health or Google Health Connect. We do not read weight, nutrition, active energy, heart rate, or any other health data type from these platforms.

Raw health samples are not uploaded to our servers. Only two derived values leave your device — your 7-day average step count and your 7-day average sleep duration — which are used as inputs to your wellbeing score.

Where you enable one of these integrations:

• you will be asked to grant permission at the operating system level for each specific data type;
• you may revoke this permission at any time through your device's system settings;
• data obtained through these integrations is used to provide and personalise the Services (e.g. combining hydration or activity data with in-app tracking); and
• we do not control, and are not responsible for, how Apple or Google collect or process data within their respective health platforms — see their own privacy policies for details.

We may support additional wearable or third-party health platform integrations in the future. Any new integration will be reflected in an updated version of this Privacy Policy and, where required, will be subject to your consent before activation.

9. Payment and Subscription Data

Spru offers a free tier and a Premium subscription tier.

Subscriptions purchased through the App are billed by Apple App Store or Google Play, as applicable. When you subscribe:

• Apple or Google processes your payment method and full payment card details; NXL does not receive or store your full card number, CVV, or bank account details;
• we receive limited transaction data from our subscription management provider (see Section 20), such as subscription status, product identifier, purchase/renewal dates, and anonymised or truncated transaction identifiers, to manage entitlements (i.e. to know which features you have access to); and
• refunds, billing disputes, and payment method changes are handled by Apple or Google in accordance with their respective policies — see Section 28.

10. Device, Analytics, Diagnostics, and Crash Data

We and our service providers collect technical and analytics data to operate, secure, and improve the App, including:

• device model, operating system and version, app version, language, and locale;
• IP address and approximate location derived from it;
• unique device or install identifiers;
• in-app analytics events (e.g. feature usage, screens viewed, taps, session length); and
• crash logs, uncaught exceptions, unhandled promise rejections, and console diagnostics, captured through our analytics provider PostHog; server-side errors are logged to Google Cloud Error Reporting with your user identifier replaced by a truncated one-way hash (see Section 20).

This data helps us identify and fix bugs, understand feature usage, and improve app performance and stability.

11. Cookies, SDKs, Attribution, and Tracking Technologies

In-app tracking technologies. The App uses software development kits (SDKs) from the service providers listed in Section 20 (e.g. analytics, crash reporting, subscription management) to collect device and usage data as described above.

Advertising and attribution SDKs. We do not use a third-party mobile attribution SDK (such as AppsFlyer, Adjust, or Branch), and we do not track you across apps or websites owned by other companies.

We do capture first-party marketing attribution: where you arrive via a campaign link, we record the campaign parameters carried by that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and any advertising click identifier it contains (such as gclid, fbclid, or ttclid). On Android we also read the Google Play install referrer. This information is stored on your account record and attached to analytics events so that we can understand which campaigns bring people to Spru. Because this is first-party data and is not shared with advertising networks for cross-app tracking, it does not trigger Apple's App Tracking Transparency prompt.

Website cookies and local storage. Our marketing website at https://spru.app does not use advertising cookies. It stores a first-party visitor identifier and the campaign attribution parameters described above in your browser's local storage for up to 90 days, and uses the same analytics provider as the App. If you sign up through the website, the email address and any comment you submit are stored so that we can contact you (see Section 20).

Where required by applicable law (e.g. ePrivacy Directive implementations, GDPR), we will obtain your consent before activating non-essential tracking technologies, and will provide a mechanism to withdraw consent at any time.

12. How We Use Personal Data

We use personal data to:

• create, maintain, and secure your account;
• provide core App functionality (meal logging, AI meal analysis, hydration tracking, habit tracking, goals, streaks, avatar progression);
• generate nutrition estimates and personalised insights and recommendations;
• process and manage Premium subscriptions and entitlements;
• send push notifications and reminders you have opted into;
• provide customer support and respond to inquiries;
• monitor, maintain, and improve the performance, security, and reliability of the Services;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• comply with legal obligations; and
• with your consent where required, send marketing communications (see Section 18).

We do not use personal data for purposes incompatible with those described in this Privacy Policy without providing further notice and, where required, obtaining your consent.

13. Legal Bases Under GDPR / UK GDPR

Where the GDPR or UK GDPR applies to our processing of your personal data, we rely on the following legal bases, as applicable to the specific processing activity:

• Performance of a contract (Art. 6(1)(b) GDPR): to create your account, provide the Services you request, and manage your subscription.
• Consent (Art. 6(1)(a) GDPR): for processing that requires opt-in consent, such as optional health integrations, certain analytics or tracking technologies, marketing communications, and any use of data for AI model improvement that requires consent under Section 15.
• Legitimate interests (Art. 6(1)(f) GDPR): for product analytics, security, fraud prevention, and service improvement, balanced against your rights and interests. You may object to processing based on legitimate interests at any time using the contact details in Section 31.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with tax, accounting, consumer protection, or other applicable legal requirements.

Where we process special category data under Article 9 GDPR, we rely on explicit consent (Art. 9(2)(a) GDPR) or another applicable Article 9 exception, as described in Section 14.

14. Special Category or Sensitive Data Considerations

Some data processed by Spru — including health-adjacent nutrition data, allergy information, and data obtained from Apple Health or Google Health Connect — may constitute special category data under Article 9 GDPR / UK GDPR, or sensitive personal data under the Swiss FADP, depending on the jurisdiction and the specific data involved.

Where this is the case:

• we will only process such data on the basis of your explicit consent, or another valid legal basis recognised under applicable law;
• you may withdraw consent at any time, which will stop future processing of that data (without affecting the lawfulness of processing before withdrawal), as described in Section 26; and
• we apply additional technical and organisational safeguards to this category of data, as described in Section 23.

Allergy and dietary restriction information you provide is used solely to power in-app features (e.g. filtering or flagging) and is not used for any purpose beyond providing and improving the Services, except as otherwise described in this Privacy Policy.

15. AI Processing and Automated Insights

Spru uses artificial intelligence and machine learning systems, including third-party AI providers, to power features such as meal photo recognition, nutrition estimation, and personalised insights.

You should understand that:

• meal photos and related inputs may be processed by AI systems, including third-party AI providers acting as our processors (see Section 20);
• AI systems may infer food items, portion sizes, nutritional values, and other attributes from the data you provide;
• AI outputs are estimates and may be inaccurate, incomplete, or change over time as our models and methods are updated;
• automated insights and recommendations generated by the App are informational only and do not constitute medical, dietary, or health advice, and are not a substitute for professional consultation; and
• you remain responsible for reviewing AI-generated outputs and for the decisions you make based on them.

Use of data for AI model training and improvement.

We may use de-identified or aggregated data derived from user content and usage data to evaluate, maintain, and improve our AI systems and the accuracy of our nutrition estimates. Where we do so:

• we apply de-identification or aggregation techniques intended to prevent the data from being reasonably linked back to you; and
• we do not use your raw, identifiable meal photos or personal data to train general-purpose or third-party AI models outside the scope of providing and improving the Services described in this Privacy Policy.

Concretely: when you log a meal by photo or description, the image or text is sent to Google's Gemini API for the sole purpose of identifying the foods present and estimating portion sizes. The AI provider returns only food names and estimated quantities; nutrient values are then looked up in our own food databases rather than generated by the model. Meal photos are not attached to your name or email address when sent for analysis.

16. Personalisation and Recommendations

We use the personal data described in this Privacy Policy — such as your goals, dietary preferences, meal history, hydration logs, and habit activity — to personalise your experience, including:

• tailoring nutrition and hydration recommendations;
• adjusting insights and progress summaries; and
• evolving the in-app avatar based on your engagement.

Personalisation is based on your in-app activity and the information you choose to provide. The App gives you the following controls, in Settings:

• About you — age range, height, weight, sex, and activity level, which determine your calorie and energy targets;
• Goals — dietary preferences, food rhythm, daily water goal, daily calorie target, and units;
• Notifications — a master toggle plus per-meal reminders and times, water reminders, Spru nudges, streak alerts, and quiet hours;
• Health data — the optional Apple Health / Health Connect integration described in Section 8, which is off by default;
• Marketing emails — opt in or out at any time;
• Language; and
• Delete profile — see Section 27.

The App does not currently offer an in-app toggle to opt out of product analytics. If you wish to object to analytics processing, contact us using the details in Section 31 and we will action your request.

17. Push Notifications and Reminders

With your permission, we send push notifications, including meal logging reminders, hydration reminders, streak and progress updates, and other engagement or informational notifications.

• You will be asked to grant notification permission at the operating system level before receiving push notifications.
• You may disable push notifications at any time through your device's system settings, or through in-app notification preferences where available.
• Notification delivery relies on platform push services (Apple Push Notification service, Firebase Cloud Messaging/Google) and our notification delivery provider (see Section 20).

18. Marketing Communications

Where we send marketing communications (e.g. product updates, promotional offers, or newsletters) by email or push notification, we will do so only in accordance with applicable law, which may require your prior opt-in consent.

You may opt out of marketing communications at any time by:

• following the unsubscribe instructions included in the communication;
• adjusting your notification or communication preferences in the App, where available; or
• contacting us using the details in Section 31.

Opting out of marketing communications does not affect transactional or service-related communications (e.g. account, security, or billing notices), which we may still need to send you.

19. When We Share Personal Data

We do not sell your personal data. We may share personal data in the following circumstances:

• With service providers and processors who perform services on our behalf (e.g. hosting, analytics, AI processing, subscription management, notification delivery) — see Section 20;
• With Apple and Google as necessary to process App Store / Google Play purchases and to support platform integrations you enable (e.g. Health Connect, HealthKit);
• For legal reasons, where we believe disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of NXL, our users, or others;
• In connection with a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and, where required, notice to affected users; and
• With your consent, for any other purpose we disclose to you at the time of collection.

20. Processors and Service Providers

We work with the following service providers to operate the Services. This list reflects a review of the Spru codebase and infrastructure carried out on 10 September 2026.

All processors are required, under data processing agreements, to process personal data only on our documented instructions, to implement appropriate technical and organisational security measures, and to assist us in complying with applicable data protection law.

We do not use Sentry, AppsFlyer, Adjust, OpenAI, or Anthropic. Crash and error reporting is handled by PostHog and by Google Cloud Error Reporting; marketing attribution is first-party only, as described in Section 11.

21. International Data Transfers

NXL is based in Switzerland. Depending on the service providers we use, your personal data may be processed in Switzerland, the European Economic Area (EEA), the United Kingdom, the United States, or other countries.

Where personal data is transferred outside Switzerland, the EEA, or the UK to a country that has not been recognised as providing an adequate level of data protection, we rely on appropriate safeguards, which may include:

• adequacy decisions issued by the Swiss Federal Data Protection and Information Commissioner (FDPIC), the European Commission, or the UK government, as applicable;
• the EU Standard Contractual Clauses (SCCs), and, where relevant, the Swiss Addendum to the SCCs;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs; and
• additional contractual, technical, and organisational safeguards with our processors.

In practice:

• Our application servers, database, and meal photo storage are hosted in the United Kingdom (Google Cloud, London region). Meal photos and your account data are not stored outside that region by us.
• Product analytics and error data are processed in the European Union (PostHog EU region).
• Subscription and entitlement data is processed in the United States (RevenueCat).
• Email addresses submitted through our marketing website are stored in the United States (Amazon Web Services).
• AI meal analysis is performed by Google's Gemini API, which may process data outside the United Kingdom and the EEA.
• Push notifications are relayed via Expo and then through Apple and Google's notification infrastructure.
• Nutrition reference lookups (USDA FoodData Central, Open Food Facts) send food names or barcodes only, never personal data.

22. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Our retention periods are:

• Account data: retained for the life of your account. On deletion it is removed from our live systems immediately; residual copies in encrypted database backups are overwritten within 30 days.
• Meal photos: retained for 90 days from upload, or until you delete your account, whichever is sooner.
• Nutrition, hydration, habit, and avatar progress data: retained for the life of your account, and deleted when you delete your account.
• Analytics data: retained for 24 months.
• Crash and diagnostic data: retained for 30 days.
• Support messages: retained for 24 months from the close of your enquiry.
• Payment and subscription records: retained for 10 years, as required by Swiss accounting law (Art. 958f Swiss Code of Obligations).
• Marketing consent records: retained for 3 years after you withdraw consent, to demonstrate compliance.

23. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or destruction, including:

• encryption in transit — all traffic between the App and our servers uses TLS, and our database accepts only encrypted connections;
• encryption at rest — databases and file storage are encrypted at rest by our hosting provider;
• network isolation — our database has no public internet address, and internal services are not reachable from the public internet;
• authentication — sign-in is handled by Google Firebase Authentication using email sign-in links, Sign in with Apple, or Google Sign-In. We never store passwords. Every request to our servers is verified against a signed authentication token;
• least-privilege access controls — internal services are granted only the specific permissions they need, and credentials are held in a dedicated secrets manager rather than in code;
• short-lived access to meal photos — photo storage is private, and access is granted only through time-limited signed links;
• pseudonymisation in logs — user identifiers are replaced with a truncated one-way hash before being written to server logs or error reports; and
• rate limiting on our public API to reduce abuse.

No method of transmission or storage is completely secure. While we take reasonable steps to protect your personal data, we cannot guarantee absolute security.

If we become aware of a data breach affecting your personal data, we will notify you and/or the relevant supervisory authority where required by applicable law (including the Swiss FADP, GDPR, and UK GDPR).

24. Children and Minimum Age

Spru is not directed at children, and we do not knowingly collect personal data from children under the age of 13, or under the age of digital consent in your jurisdiction if that age is higher.

The GDPR permits each EU member state to set the age of consent for information society services at any age between 13 and 16, and member states have made different choices. Where the applicable age in your country is higher than 13, that higher age applies to you. If you are below the applicable age, you may use the Services only with the consent and supervision of a parent or legal guardian.

We do not currently operate an age-verification mechanism beyond the age you tell us during onboarding.

If you believe a child has provided personal data to us without appropriate parental or guardian consent, please contact us using the details in Section 31 so that we can investigate and, where appropriate, delete the data.

25. User Rights Under GDPR, UK GDPR, and Swiss FADP

Depending on your location, you may have some or all of the following rights in relation to your personal data:

• Right of access: to obtain confirmation of, and access to, the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): to request deletion of your personal data, subject to applicable exceptions.
• Right to restriction of processing: to request that we limit how we use your personal data in certain circumstances.
• Right to data portability: to receive personal data you have provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where technically feasible.
• Right to object: to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: with a supervisory authority, including:
  • the Swiss Federal Data Protection and Information Commissioner (FDPIC), if you are in Switzerland;
  • your local supervisory authority, if you are in the EEA; or
  • the UK Information Commissioner's Office (ICO), if you are in the United Kingdom.

These rights are subject to applicable legal limitations and exceptions under the Swiss FADP, GDPR, and UK GDPR, as relevant to your location.

26. How to Exercise Your Rights

To exercise any of the rights described in Section 25, you may:

• use in-app self-service tools where available (e.g. profile editing, account deletion); or
• contact us at the details in Section 31.

We may need to verify your identity before fulfilling your request. We will respond within one month of receiving your request. Where a request is complex or you have made several requests, we may extend this by a further two months, and will tell you within the first month if we need to do so.

27. Account Deletion and Data Deletion

You may delete your account at any time from within the App: go to Settings → Delete profile, then confirm by typing DELETE. No email or support request is required.

When you delete your account:

• your profile, meal history, hydration and habit logs, goals, and avatar progress will be deleted or anonymised, subject to the retention periods in Section 22;
• some data may be retained for a limited period where necessary to comply with legal obligations (e.g. financial records for tax purposes) or to resolve disputes; and
• data already shared with processors will be deleted from their systems in accordance with our agreements with them, subject to their own deletion timelines.

Deletion is immediate, not scheduled, and there is no grace period. When you confirm deletion, we delete your authentication account, permanently delete all of your meal photos from storage, delete your customer record with our subscription provider, and delete your account row from our database. All associated records — meals, water and mood logs, notification preferences and history, push tokens, referrals, and feedback — are removed at the same time. This cannot be undone.

Two things to be aware of:

• Encrypted database backups are retained on a rolling basis and are overwritten within 30 days. Your data is not restored or used during that window; it simply ages out of the backup cycle.
• Deleting your Spru account does not cancel your subscription. Subscriptions are billed by Apple or Google, and must be cancelled separately through your App Store or Google Play account settings. See Section 28.

28. App Store Purchases and Third-Party Platforms

Premium subscriptions are purchased and billed through the Apple App Store or Google Play, depending on your device.

• Apple and Google act as the merchant of record for in-app purchases made through their respective platforms and process your payment information under their own privacy policies.
• NXL does not receive or store your full payment card details.
• Refunds, billing disputes, and subscription management (e.g. cancellation) for App Store or Google Play purchases are handled directly by Apple or Google in accordance with their respective policies.
• We receive limited transaction and entitlement data from Apple/Google (via our subscription management provider) to activate and manage your Premium access.

29. Third-Party Links and Services

The App may contain links to, or integrations with, third-party websites, platforms, or services (e.g. Apple, Google, and other integrations you choose to enable). This Privacy Policy does not apply to those third-party services, which are governed by their own privacy policies and terms. We encourage you to review the privacy practices of any third-party service before providing personal data to it.

30. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law.

• If we make material changes, we will provide notice through the App, by email, or by other reasonable means before the changes take effect, and, where required by law, we will obtain your consent.
• The "Last updated" date at the top of this Privacy Policy indicates when it was last revised.
• Your continued use of the App after a revised Privacy Policy takes effect constitutes acknowledgement of the update, subject to any additional consent requirements under applicable law.

Prior versions of this Privacy Policy will be retained in os/legal/agreements/ for reference (e.g. this document as privacy_policy_v1.md).

31. Contact Details

If you have questions about this Privacy Policy or how we handle personal data, please contact:

NXL GmbH Baarermattstrasse 8D 6340 Baar Switzerland

Email: privacy@spru.app Website: https://spru.app

You also have the right to lodge a complaint with your local data protection supervisory authority — see Section 25.