Terms of Use, Privacy, Cookies, Disclaimers & Copyright

1. Service identity and contact details

The service operates under the trade name Arouri. For support, privacy requests, feedback, technical issues, subscriptions and administrative contact, use info@arouri.gr.

The service is provided by the sole proprietorship “APOSTOLOU CHRISTOS” (ΑΠΟΣΤΟΛΟΥ ΧΡΗΣΤΟΣ), established at Chatzopoulou 2, 41221 Larissa, Greece, Greek tax number (ΑΦΜ) 138741486. Use the email address above for every request. If any information changes, the most recently published version of these terms prevails for future use.

2. Acceptance of the terms before registration

Registration, sign-in, the use of a trial or of a Pro or Elite subscription, and access to any Arouri content all presuppose that the user has read, understood and accepted these terms, the privacy policy, the disclaimers and the use of necessary technical storage.

• Without acceptance of the terms, the disclaimers and the privacy policy, account creation is not completed.
• Acceptance may be recorded technically together with the terms version, date, time, account email and the related session identifier.
• If the user does not agree with any term, they must not use the platform.
• The terms may be updated. For material changes, the platform may ask for fresh acceptance.
• For a digital service with immediate access, when a subscription is activated the user expressly consents to performance beginning immediately and acknowledges that, if the user withdraws within the 14 days, only the amount proportionate to the days during which the service was accessible is owed and the remainder is refunded (Article 14(3) of Directive 2011/83/EU, Greek Law 2251/1994) — see section 9.

2.1 Minimum registration age — 15 years

Account creation is permitted only to people aged 15 and over. The limit follows from Article 21 of Greek Law 4624/2019 on information society services and is essential here, because the platform processes health-related data.

Registration asks for the date of birth and the application is rejected automatically if the user is below the limit; moving on to the next step is not possible. The date of birth is stored so that the age stays accurate: it is refreshed automatically every year, because it feeds the calorie calculation and the sleep recommendation. You can correct it in Settings, but never to a value that produces an age below the limit — the same check applies both at registration and at any later edit, so that the limit cannot be bypassed from another screen. A false declaration of age is a breach of these terms and leads to deletion of the account as soon as it is detected.

2.2 What exactly you accept at registration

Registration is completed only with two mandatory, express and affirmative acceptances (no pre-ticked boxes): the safe-use condition, and these terms together with the privacy and cookie policy. Acceptance is recorded with date and time and covers the whole of this text, including the purpose of use and encryption (article 12), the public leaderboard and photos (article 19), the map and open data (article 16) and the limitation of liability (article 20). Consent to marketing email is optional and can be withdrawn freely.

2.3 Amendment of the terms

The terms may be amended for legal, technical or operational reasons. A material amendment that limits your rights is notified by email and/or by a message inside the platform at least 15 days before it takes effect. If you do not agree, you can cancel the subscription and delete your account before the effective date, with no charge for the future. Every version carries a date and a number. The updated terms are shown inside the platform at your next sign-in and use continues only after you expressly accept them; the acceptance is recorded on your account with date and version. Additions of features or benefits (e.g. a new programme or perk) may apply from publication.

3. What Arouri is and what it is not

Arouri is a digital tool that supports and organises everyday life. It combines elements of a training programme, meals, nutrition planning, personal logs, a calendar, wellness, goals, an AI coach, a map of training venues and user support.

The platform does not provide medical diagnosis, treatment, prescription, individualised medical acts, mental health services, clinical dietetics services or physiotherapy services. It does not replace a doctor, a dietitian, a psychologist, a physiotherapist, a coach supervising you in person, or any other licensed professional advice.

Arouri is solely a supporting digital tool for organising and logging. Every piece of information, suggestion, calculation or content shown on the platform is purely informative and supportive. Use of the tool and every decision based on it is made at the sole responsibility, judgement and choice of the user.

4. Health, exercise and personal safety

• If you have an injury, a medical condition, medication, a pregnancy, a history of cardiac, metabolic or orthopaedic issues, or any other special condition, consult a professional before applying any suggestion.
• The goal pace (“gentle”, “normal”, “fast”) sets the calorie deficit or surplus of your plan. The “fast” pace applies the largest permitted deficit (up to 25% or 750 kcal per day, never below the minimum calorie floors) and is meant for periods of up to 8 weeks; the platform does not offer it under 18 years of age or at a low body-mass index, and gives no deficit at a BMI below 18.5. If you experience strong fatigue, dizziness, weakness or uncontrolled hunger, switch to a gentler pace and consult a professional.
• Stop exercising immediately if you feel pain, dizziness, shortness of breath, chest pressure, numbness, unusual fatigue or any other symptom.
• The visual exercise guides are informative. Correct technique depends on your body, experience, equipment, space and in-person supervision.
• Arouri does not guarantee weight loss, muscle gain, better health, psychological improvement, an athletic result or any result within a given time.

5. Nutrition, meals, allergies and wellness

Nutrition suggestions, meals, calories, macronutrients and meal prep are supporting estimates. They are not medical or clinical dietetic instructions.

• The user must check allergens, labels, quantities, product suitability and any personal contraindications.
• If there is an allergy, an eating disorder, a medical condition, a pregnancy, a special diet or medication, a specialist's opinion is required.
• Logs of sleep, water, energy, mood, muscle fatigue and body metrics are personal wellness information and do not constitute medical monitoring.

6. AI coach, transparency and accuracy limits

The user is informed that they are talking to a digital AI coach, an algorithmic support system. The coach answers on the basis of the data the user has logged and the platform's logic. The Arouri AI coach, and Arouri in general, can make mistakes, misread incomplete data, be unaware of information that has not been entered, or give a general answer when there is not enough basis for a specific one.

• The AI's answers are supportive and informative, not binding instructions.
• The user must not rely solely on the AI coach for matters of health, safety, injuries, mental health, medication, allergies or emergencies.
• In an emergency, the user must contact the competent emergency services and not the platform.
• Arouri may use local logic, rules, algorithms, future AI models or external services only where this is necessary for operation, improvement or support.

6.1 Automated processing and profiling (Article 22 GDPR)

The platform produces automated and personalised results: the training and meal programme, calorie and water targets, the readiness index, level and XP, achievements, leaderboard position and the match score for training venues. The logic rests on the details you declare (age, sex, height, weight, goal, activity level, available equipment) and on your logs.

None of these outputs produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR: they are suggestions you can ignore, modify or replace. You keep the right to human intervention, to express your point of view and to contest any automated result, at info@arouri.gr.

6.2 Artificial intelligence transparency

The AI coach is an artificial intelligence system and not a human being. This is stated expressly, as the transparency obligations of Regulation (EU) 2024/1689 (AI Act) require. The answers are produced by a third-party provider's language model, may contain inaccuracies and do not constitute medical, nutritional or other professional advice. The platform is not a medical device and is not intended for the diagnosis, prevention, monitoring or treatment of disease.

7. Account, password and access

The user is responsible for the accuracy of their details, for the security of their password and for every use made through their account. The platform does not require email confirmation to create an account, but it uses email for the welcome message, password reset, subscription updates and support contact.

A backup/recovery code is no longer used. If the user forgets their password, they follow the “Forgot password” procedure by email.

7.1 Sign-in and sign-up with Google

The user may create an account or sign in with their Google account (“Continue with Google”). In that case Google confirms to us only the email address, the name and a technical identifier of the Google account; we never receive the Google password nor access to contacts, files or any other data of that account. Sign-up is completed with the same steps as every sign-up (date of birth, acceptance of the terms, plan selection). An account created with Google has no Arouri password; the user may set one at any time via “Forgot password”. If an Arouri account with the same email already exists, signing in with Google opens that account. Use of the Google account is additionally governed by Google’s terms and privacy policy.

7.2 Suspension or termination of an account by us

We reserve the right to suspend or terminate an account where any of the following applies: a breach of the terms, in particular articles 18 and 19; a false declaration of age or identity; an attempt at intrusion, automated data extraction or abuse of the API; fraudulent use of a payment method or persistent non-payment; any action that endangers security or other users.

Wherever feasible, notice and a reasonable period to comply come first. In cases of immediate security risk or clear illegality, suspension is immediate. The user is informed of the reason, can contest it at info@arouri.gr, and keeps the right to export their data before final deletion, unless the law forbids it.

8. Subscription, trial, price and payments

Arouri offers two paid subscriptions: Pro and a Elite. The free trial gives access to everything Pro gives and everything Elite gives, for a limited time and with no automatic charge. When the trial ends, access may be restricted until a Pro or Elite subscription is activated.

Pro€25/month€15/monthGym · Outdoors · Home.

Elite€45/month€25/montheverything Pro has, together with Yoga · Pilates · Running.

For both plans the price shown is an introductory offer for a limited time, with 24% VAT included. The price that applies to you is always the one shown at checkout before you complete the payment.

8.1 Partner prices

Arouri may partner with gyms or other sports venues (“partners”). Anyone who creates an account through a partner’s link receives a partner price for Pro and Elite (monthly or annual), as shown at checkout, and their account is linked to that partner; the sign-in page and their plan may display the partner’s logo. The partner price applies for as long as the partnership lasts: if the partnership is paused or ends, the current billing period runs to its end as paid and the plan’s standard price applies from the next renewal, with prior notice by email. The user may cancel at any time. Arouri may also, at its discretion or in agreement with the partner, grant partner members extra free-trial days at no charge. The partner does not gain access to the user’s personal data or records. In agreement with the partner, Arouri may adjust for its members which sections, cards and features of the platform are shown or available (for example hiding a section or unlocking a feature regardless of plan); the adjustment applies only for as long as the partnership lasts and does not affect the data the user has recorded, which remains available to them.

Payments and subscription management run through Stripe or another external payment provider. Arouri does not store full card details on its own servers.

• The price may change for future periods, offers or new packages.
• Renewal is monthly, unless something different is shown at checkout.
• Switching between the Pro and Elite plans is done from subscription management, whenever you choose.
• The platform may send a reminder email roughly 2 days before the subscription needs an action.
• For every payment we issue a receipt only; no invoice is issued, not even afterwards.

8.1 Documents: receipts only, never an invoice

The Pro and Elite subscriptions are a service to consumers. For every payment we issue a receipt and nothing else . No invoices are issued. A receipt is not reissued, is not converted and is not replaced by an invoice — neither at the time of payment nor after it. If you need an invoice for business or professional use, the service does not provide one; you know this and accept it before every payment, when you choose the plan.

8.2 Referral programme ("Bring a friend")

Every account has a personal referral code (format AR-XXXXXX), visible in the profile menu. When a new person creates an account with your code and completes a real subscription payment, you earn one discount credit for the next renewal of your own subscription. The programme is optional, has no limit on invitations and may be changed or ended for the future with notice inside the platform; credits that have already matured are kept.

• Amount: each credit is worth −10% of the amount of your next renewal (monthly or annual) and one credit applies per renewal; additional credits apply one by one to the following renewals. Only for accounts among the first 500 registered on the platform ("Founders") the size of the credit rises with the number of friends who paid: −15% with one friend, −30% with three, −45% with five; one credit still applies per renewal, at the rate the account has reached when it is applied.
• Active friends ("Pro free" / "Elite free"): from 13/09/2026, for every account, the number of your friends who hold an active, paid subscription at the given moment (and whose first payment has passed the 14-day period) determines an additional reward that is recalculated daily: with three (3) to four (4) active friends, your next charge is reduced by the amount of the monthly Pro subscription (currently €15) — a Pro subscriber is not charged, an Elite subscriber pays the difference; with five (5) or more, your next charge is reduced by the amount of the monthly Elite subscription (currently €25) and a Pro subscriber receives Elite access for as long as the condition holds, with no change to their subscription. The reduction is applied as a coupon on the very next invoice (annual subscriptions: one monthly value per charge), replaces for that charge the credit of the previous paragraph (credits are kept for later charges) and stops automatically, from the next charge, once active friends fall below the respective threshold. For Founders, whichever of the two (ladder or active-friends reward) is greater applies.
• When it activates: only after the friend has really paid and the 14-day withdrawal period of article 9.1 has passed. Until then the credit shows as "pending" and has no monetary value.
• How it is applied: as a discount coupon on your next invoice at the payment provider (Stripe). It cannot be cashed out, transferred or set off against refunds. If you have no active subscription, it applies to your next payment.
• Revocation: if the friend receives a refund (withdrawal or any other refund), disputes the charge (chargeback) or deletes their account, every credit not yet applied to a paid invoice is cancelled automatically. A credit already applied to a paid invoice is not reversed.
• Does not count — and the account may lose its credits — when we find: self-referral (the same person), sign-up from the same device as the referrer, payment with the same card, use of an email that had previously been deleted, or any other scheme to obtain discounts. Such cases are logged and handled under article 7.1.
• Extra incentives: every friend who pays adds 5,000 XP to your account, up to 15,000 XP in total from referrals (article 19); discount credits are given for up to 5 friends per account — further friends only count towards the "Brought N friends" badge; the first 500 registered accounts receive a permanent "Founder" badge on their profile and on the public leaderboard; a Pro subscriber with five (5) active friends sees Elite for as long as the condition holds, as described above. The "Brought N friends" badge on the public leaderboard shows a count only, never identities.
• Data: the referrer sees the friend's email masked only (e.g. m***@example.com) and the status of the credit; the friend sees no details of the referrer. To prevent abuse we keep a random device identifier from sign-up and the anonymous card fingerprint provided by the payment provider (not the card number). More in article 10.

9. Withdrawal, cancellation, deletion and refunds

9.1 The 14-day right of withdrawal

As a consumer you have the right to withdraw from the subscription contract within fourteen (14) calendar days from the day it was concluded, without giving a reason and without any penalty. The right is provided for by Directive 2011/83/EU and by Greek Law 2251/1994. Under Article 25 of the same Directive, this right cannot be waived by contract; no provision of this text excludes or restricts it.

9.2 Immediate start of the service and what it means

By activating the subscription you expressly request that the service begin immediately, before the 14-day period expires, and you acknowledge that once the service has been fully performed for the period you have paid for, the right of withdrawal for that period is exhausted. The express request and the acknowledgement are given by accepting these terms at activation.

9.3 What is refunded — pro rata calculation

If you exercise the right of withdrawal within the 14 days, you owe only the amount corresponding to the days on which you had access to the service, calculated pro rata against the total price of the period. The rest is refunded to you.

Example: on a 30-day monthly subscription priced at €15.00, withdrawal on the third day corresponds to a charge of €1.50 and a refund of 13,50 €.

9.4 How withdrawal is declared

The withdrawal statement is submitted through Arouri's contact channel, which is available at any moment from any screen of the platform:

• from the Help & contact button, which sits permanently at the bottom right inside the app, choosing the subject “Subscription withdrawal”; or
• by a message to info@arouri.gr from your account's email address.

Any clear statement from which your identity and your wish to withdraw can be established is enough. No specific form, reason or template is required. You receive an acknowledgement of receipt in your email.

9.5 Refund deadline and method

The refund is made using the same means of payment used for the original transaction, at no cost to you, within 14 days at the latest from the day we received your statement.

9.6 After the 14 days

Once the 14 days have passed, and for subscription periods that have already been fully performed, no refund is made. Automatic renewal of the subscription does not start a new withdrawal period, since it is not a new contract but the continuation of the existing one.

9.7 Cancelling a subscription — different from withdrawal

Cancellation stops future renewals and does not affect amounts already paid. Withdrawal undoes the contract within the 14 days and leads to a pro rata refund. These are two different rights and you can exercise whichever suits you.

Cancellation is allowed at any time, without giving a reason and without any extra charge, from your profile's management area (Settings → Subscription management). Access is kept until the end of the period already paid for.

9.8 Free trial

The free trial involves no charge, requires no card details and does not convert automatically into a paid subscription. It ends on its own; to continue, you choose a plan yourself. Since no payment is made, no question of a refund arises.

9.9 Account deletion

If you delete your account, your account data, logs and history are scheduled for permanent deletion from the servers and the database. Deleting an account is independent of withdrawal: on its own it does not produce a refund, but neither does it undo a right of withdrawal that had already been exercised in time.

9.10 Digital service conformity

The subscription is a digital service within the meaning of Directive (EU) 2019/770, as transposed into Greek law. We must supply it in line with its description, with the qualities you can reasonably expect and with the updates needed to keep it in conformity. In case of a lack of conformity you have the right to have it brought into conformity, to a proportionate price reduction, or to terminate with a refund, as the law provides. The request is submitted at info@arouri.gr.

9.11 Out-of-court dispute resolution

If a dispute arises and is not resolved directly with us, as a consumer you may turn to an alternative dispute resolution body (ADR) — for example the Greek Consumer Ombudsman (synigoroskatanaloti.gr) — or use the European Online Dispute Resolution platform: ec.europa.eu/consumers/odr. This possibility does not affect your right to bring the matter before the competent courts.

10. Privacy policy, GDPR and user data

Arouri processes data that the user enters or generates while using the service: email, name, profile details, goals, sleep, steps, energy, muscle fatigue, meals, workouts, body logs, wellness choices, theme settings, usage history, contact forms, notifications, subscription details, optional consent to marketing communication, and technical operating data.

Purposes of processing

• Creating and managing the account.
• Syncing data across devices.
• Personalising suggestions, training, nutrition, meals, wellness and the AI coach.
• Security, abuse prevention, logging of basic server events and technical support.
• Managing the trial, the subscription, payments, cancellations and legal obligations.
• Running the referral programme (article 8.2): linking referrer and friend, calculating and applying credits, preventing abuse with a device identifier and an anonymous card fingerprint from the payment provider.
• Sending operational email such as the welcome message, password reset, subscription updates and replies to forms.
• Sending promotional or general Arouri newsletters only where the user has given separate, optional consent.

Legal bases

• Performance of a contract/service, for the operation of the account and the subscription.
• Consent where required, such as for optional cookies/analytics, marketing email or special features.
• Legitimate interest in security, abuse prevention and service improvement, where the user's rights do not override it.
• Legal obligation for tax, accounting or regulatory data where required.

Arouri promotional communication

At registration, or through a future setting, the user may optionally allow Arouri to use their email for news, offers, promotions, general material, educational content and product updates. This choice is not needed to create an account, is recorded with the date of consent and can be withdrawn at any time through support at info@arouri.gr or through a future unsubscribe option.

10.1 Legal bases for processing (Article 6 GDPR)

• Performance of a contract — Article 6(1)(b): creating and running the account, providing the service, syncing logs, taking part in the public leaderboard under a pseudonym (article 19), managing the subscription and support.
• Consent — Article 6(1)(a): marketing email, analytics cookies, the profile photo, uploading moments, use of location for the map. It can be withdrawn freely, at any time, without affecting the lawfulness of processing before the withdrawal.
• Legitimate interest — Article 6(1)(f): systems security, prevention of abuse and fraud, aggregated and non-identifying operating statistics, account usage counters (screens and entries per day, article 13).
• Legal obligation — Article 6(1)(c): tax and accounting documents for subscriptions.

10.2 Health-related data (Article 9 GDPR)

Your weight, body measurements, sleep, mood, reported fatigue, the injuries or limitations you declare and your nutrition data are data concerning health and belong to the special categories of Article 9 GDPR.

Their processing rests solely on your explicit consent, under Article 9(2)(a) GDPR, which you give at registration by accepting these terms and confirm every time you enter such a piece of data. The consent is freely revocable: you can delete individual logs or your entire account from Settings. On withdrawal, processing stops for the future. Without this consent the service cannot work, since it is its very core.

10.3 Retention periods

• Active account: the data is kept for as long as the account exists.
• Account deletion: the data is deleted from active systems immediately. Backups are recycled and the data stops being recoverable within 30 days.
• Inactivity: accounts with an active or previous subscription are not deleted for inactivity — they stay until you delete them yourself. Exception: an account that used only the free trial, never continued to a subscription and stayed inactive for more than 6 months after the trial ended may be deleted together with its data, with a notification email. Signing up again with the same email remains possible.
• Referral programme: credit records are kept for as long as the referrer's account exists; when an account is deleted the credits concerning it are deleted too, and the event history is anonymised.
• Subscription documents: kept for 5 years, as tax law requires, regardless of account deletion.
• Security records (sign-in and error logs): up to 12 months.
• Account usage counters (screens and entries per day): for as long as the account exists; deleted with it.
• Public leaderboard name: after you leave it stays reserved for a while, so that nobody else can take it and appear as you.

10.4 Contact for data protection matters

No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR are not met. Every request, question or complaint concerning personal data is addressed to info@arouri.gr and answered within one month, with the possibility of a two-month extension for complex requests, of which you are informed.

11. User rights over personal data

The user can request access, rectification, erasure, restriction, portability, withdrawal of consent where consent applies, or object to processing where the law provides for it. Requests are sent to info@arouri.gr.

If the user believes that data protection rights are being infringed, they can turn to the competent data protection authority. For Greece, the competent authority is the Hellenic Data Protection Authority.

12. Purpose of use, data encryption and allocation of responsibility

12.1 What the platform was built for — and what you must not enter

Arouri was created and is offered solely for logging and organising training, nutrition, body measurements and wellness habits. It is not a medical record, it is not a document storage system and it is not intended for any other purpose.

The user is expressly asked NOT to enter into the platform — in any field, including free-text notes: identity card, passport, social security (ΑΜΚΑ), tax (ΑΦΜ) or other identification numbers; medical diagnoses, disease history, medication or test results; special category data (health, religion, political opinions, sex life, biometrics); financial details or passwords for other services; data about other people. The platform's fields accept free text for training and nutrition notes and nothing else.

Any entry beyond the purpose described above is made at the sole choice, judgement and responsibility of the user. The user acknowledges that they choose themselves what they type and that we never asked for such information, nor is it needed for the service to work.

12.2 How the data is protected — exactly what applies

• Passwords. They are stored as a one-way bcrypt hash. They are not kept in readable form and cannot be recovered by anyone, ourselves included.
• Your logs. Training, nutrition, measurements, wellness and notes are stored in the database encrypted with AES-256-GCM (authenticated encryption). The same applies to the account name.
• The key is kept separately from the database, in a protected environment file outside the site's public folder. A copy of the database without the key is unreadable.
• The admin panel has no function for viewing your logs. Administration sees account and subscription details (email, plan status, consents, aggregate statistics) — not the content of your days.
• Card details are never stored at Arouri; they are handled exclusively by the certified payment provider.
• What we do NOT claim. The encryption uses at rest a key held by the server — this is not a zero-knowledge system. Anyone who obtained simultaneous access to the server and to the key could technically decrypt it. We do not claim an inability we cannot prove: we prefer the accurate wording to the reassuring one.

12.3 Responsibility of the user

• The password, the device and access to it are the user's responsibility. A strong, unique password and signing out of shared devices are required.
• Sharing access details with a third party, use on an infected device or deliberately publishing content is done at the user's responsibility.
• The user should keep their own copies of any data they consider critical; the platform provides a data export for that purpose.
• Acceptance at registration. Creating an account on arouri.gr requires express, affirmative acceptance of these terms, which is recorded with date and time. Without it, registration is not completed.

12.4 Security incidents and limits of liability

No digital system can guarantee absolute security. In the event of a security incident we undertake to contain it, assess it and make the notifications required by Articles 33 and 34 GDPR — notification of the Data Protection Authority within 72 hours and notification of the affected users where there is a high risk.

To the fullest extent permitted by law, we are not liable for: indirect, incidental or consequential damage and loss of profit; loss or leakage caused by an act or omission of the user, by a third party or by the user's device; events of force majeure; interruptions, errors or unavailability of the service; and data the user chose to enter in breach of paragraph 12.1.

What is not excluded and could not be excluded. No provision of these terms limits liability for wilful misconduct or gross negligence, for harm to life, physical integrity or health, nor any rights granted to the consumer by mandatory law. In particular, Article 82 GDPR establishes a right to compensation for damage from unlawful processing and is not open to contractual waiver; a clause attempting a general exclusion of liability for a data breach against a consumer would be void under Greek Law 2251/1994. We state expressly that we do not seek such an exclusion: we take on the obligations the law places on a controller and limit ourselves only where the law allows.

13. Cookies, local storage and consent choices

The platform may use cookies, local storage, session storage or similar techniques for sign-in, security, theme preferences, mobile/desktop view behaviour, autosave, syncing and temporary UI state.

Categories

• Necessary: they work without an opt-in because they are required for sign-in, security, the session, storing consent and basic operation.
• Preferences: theme, accessibility, appearance and user experience.
• Referrals (essential, local storage): a random device identifier created on the first visit that accompanies sign-up (a brake on self-referral), and the friend code that arrived with an invitation link, so it can be pre-filled in the form. They do not identify a person and are not passed to third parties.
• Live chat (Tawk.to): session cookies of the support chat, only after you press “Open live chat” yourself. Until then nothing loads from Tawk.to.
• Improvement analytics: they are activated only with your acceptance and are used for usage statistics and improvement. Since 02/09/2026 traffic statistics are kept by Google Analytics (cookies _ga, _ga_*). If you choose “Reject” (rejecting the optional ones), the tag stays in a denied state and none of these cookies is written. You can change your mind at any time from the cookie settings — the change takes effect immediately.
• Anonymous traffic measurement (no cookies): since 14/09/2026 we count, on our own server, how many people visit the landing page and the platform, from which country and source (e.g. Google, Instagram), on which device and language, and how many go on to sign up, start a trial or subscribe. This measurement writes nothing to your device, keeps no IP address or personal identifier (it only uses a daily, non-reversible hash that does not link two days together), is not passed to third parties and stores only daily totals. In the same daily totals we also count how many screens visitors open (e.g. switching a section inside the platform, opening a window) and how many times they reopen the app. For signed-in users the same two numbers (screens and entries per day — nothing else: not which section you saw, not what you logged) are also kept on the account, for support and for improving the service (legal basis: legitimate interest, Article 6(1)(f) GDPR), and are deleted together with the account. Because it neither stores nor reads information on your device, it does not require consent and is not affected by your cookie choice.
• Marketing cookies: are not active at this time. If they are added, a separate notice and choice will be needed. The marketing email option at registration is separate from cookies.

The user can accept all, reject the optional ones or change their choices from “Cookie settings” in the footer.

14. Third-party providers, transfers and what we do not do with your data

14.1 We do not sell your data

We have never sold user data and we never will. Your data is not sold, rented, exchanged or made available to advertising networks, data brokers or any third party for their own purposes. It is not used to train third-party models. The providers listed below process it solely on our instructions, only to the extent needed for the service to work, and are bound by a processing agreement.

14.2 Who they are and what each one sees

The list is complete and specific. If a provider is added, it is listed here and the terms version changes.

• Hostinger — hosting, database and email delivery. It sees whatever is stored in your account, as the infrastructure provider. European Union.
• Stripe — payments and subscription management. It receives the email address and the billing details. Your card details never reach us — they are entered directly with Stripe. European Union and USA.
• Google (Gemini API) — produces the AI coach's answers. It receives your question and the details of your plan needed for the answer, only when you use the coach. USA.
• Google (Sign in with Google) — only if you choose “Continue with Google”. Google confirms to us your email, name and an account identifier; we send it none of your data (see article 7.1). USA.
• Google Analytics — usage statistics. It works only if you have accepted the optional cookies/analytics; until then the tag loads in a denied state (Google Consent Mode) and stores neither a cookie nor an identifier. The IP address is anonymised.
  What it receives: how many visits take place, from which country and on what device; which sectors of the platform you open (Today, Training, Nutrition and so on); that you made a log entry — the sector and the kind of action, never its content; and the declared characteristics of your profile, in bands: sex, age group (for example “35-44”, not your exact age), goal, training setting, programme type, subscription plan, level range, appearance theme and account age range. They are accompanied by a pseudonymous identifier — a one-way cryptographic fingerprint of your email, so that you are counted once across two devices; the email itself is not sent and cannot be derived from the fingerprint.
  What it never receives: name, email, phone, address, weight, height, calories, heart rate, sleep, mood, notes, meals, exercises — no health data and no exact measurement. All numeric details are sent as bands, so that no individual can be singled out. If you withdraw consent from the cookie settings, sending stops immediately. USA.
• Push providers (Google FCM · Apple APNs · Mozilla) — they deliver notifications to your device, only if you switch them on yourself. When you do, your browser creates a delivery address (endpoint) and two encryption keys; we store them linked to your account so that we know where to send. The content of every notification is encrypted end to end: the provider sees only that there is a message for your device, not what it says — only the device itself can open it. No health data or logs are sent. If you switch them off in Settings, the subscription record is deleted immediately. USA / EU.
• Brevo — a fallback route for sending email, if the main one is unavailable. It receives the email address and the content of the message. European Union.
• Tawk.to — live support chat with a human from our team. It loads only when you press “Open live chat” yourself in the help window; until then it does not load and stores nothing. Once you open it, it receives whatever you write in the chat, your account name and email (so that we know who is writing to us) and technical details about your device and connection. Conversations are kept in order to handle your request. USA (tawk.to inc.), under standard contractual clauses.
• Device platforms — Polar, Withings, Oura — only if you connect your account there yourself, from the "Devices" sector, through an authorisation (OAuth) you grant on each provider's own page. Arouri reads from the provider exclusively sleep, steps and weight for the last 14 days — nothing else — and sends it none of your data beyond the authorisation identifier. Access credentials are stored encrypted on our server and deleted as soon as you press "Disconnect" or delete your account. Whatever you have logged manually is never replaced by a device. For Apple Health there is no connection to Apple: the data is sent by your own iPhone, through a shortcut you run yourself with a personal key you can revoke at any time. The providers operate under their own privacy terms (Polar/Withings/Oura: EU).

For product prices we use a public state price observatory, as well as the public price pages of supermarket chains. Those calls are anonymous: none of your data is sent. Because those pages do not allow the browser to read them directly, reading happens through the public proxy AllOrigins (api.allorigins.win), which receives only the address of the public page being read and your device's IP address — never account, plan or health details.

The interface fonts are served from our own server. They are not loaded from a third-party provider and your IP address is not transmitted anywhere for that purpose.

14.3 Transfers outside the European Union

Where a provider is located outside the EU or processes data there (noted above as USA), the transfer rests on the EU–US Data Privacy Framework where the provider participates in it, or on the European Commission's standard contractual clauses . No transfer is made for advertising or commercial purposes.

14.4 What never leaves

• Your password: it is not stored in readable form and is not transmitted anywhere. It is kept as a one-way cryptographic fingerprint — not even we can read it.
• Your card details: we do not receive them at all.
• Your notes and logs are not sent to any third party, apart from the specific extract the AI coach needs when you ask it something yourself.

14.5 Deletion

When you ask for your account to be deleted, your data is deleted immediately from the live database and the active systems — it does not go into a waiting queue. Any remnants in the hosting provider's backups are recycled in the normal backup retention cycle and are not used for any other purpose. Data the law requires us to keep (for example tax documents for transactions) is kept only for as long as the law provides. To prevent abuse (for example re-registration after deletion for a breach of the terms) we keep for 12 months an irreversible fingerprint (hash) of the deleted email — not the email itself, no name, no usage data. It serves solely to recognise whether the same email registers again, and it is deleted automatically after the 12 months. The same applies when the deletion is made by us under article 18.3.

14.3 Transfers outside the EEA and safeguards

Hosting, the database and email are served by Hostinger inside the European Union. Some providers, however, also process data outside the EEA — Stripe (payments) and Google (the Gemini API for the AI coach, Google Fonts).

Those transfers are made with the safeguards of Chapter V GDPR: Standard Contractual Clauses of the European Commission and/or the recipient's participation in the EU-US Data Privacy Framework, depending on the provider, combined with supplementary technical measures (encryption in transit, minimisation of the content transferred). What is transferred to the AI coach is only the text you type yourself — not your logs, your history or your measurements — and only at the moment you use it. A copy of the safeguards is available on request.

15. Product prices, meals and market data

Product prices, portion costs, supermarket chains and basket comparisons are indicative working estimates. They may come from publicly available sources, daily updates, product matching and calculations of grams, units or available pack sizes.

• Final in-store prices may differ because of availability, region, offers, update delays, packaging or price changes.
• Arouri does not sell supermarket products and does not guarantee availability or the final price at the till.
• The user must check allergens, labels, quantities and suitability before buying or consuming a product.

16. Map, training venues and open data

The map of training venues and the related suggestions are supporting features. A venue appearing there is not a recommendation, an advertisement, a partnership or a guarantee of quality, safety, opening hours, equipment or suitability. The user must confirm the information before travelling to or using any facility.

• Source and licence. The venue details come from OpenStreetMap (© OpenStreetMap contributors) and are made available under the Open Database License (ODbL)licence. The source is credited on every venue card, as the licence requires. We do not draw data from closed or proprietary third-party databases and we do not bypass the terms of use of other services.
• This is public business information. Only information already published openly about the venue as a business is shown — name, address, contact phone, opening hours, website and declared service categories. We do not publish details about individuals, staff or customers.
• What the match score is. It is an automatic estimate made by the app that compares the venue's publicly available categories with the goal the user has declared in their profile. It is personalised: the same venue shows a different score to different users. It is not a rating, a review, a quality ranking or a certification, nor a judgement about the business, and it does not come from a visit, an inspection or user experience.
• How it is calculated and where its limits are. When a venue has no publicly declared facilities, the app relies on clues from its name — a weaker indication, which is noted explicitly on the card. Open data can be incomplete, out of date or wrong.
• No commercial relationship. The venues shown are not partners, do not pay to be displayed, have not submitted their details to us and have not been vetted by us. The display order is set by the matching algorithm and by distance — never by payment.
• Correcting or removing a listing. A venue representative who spots incorrect details can correct them directly on OpenStreetMap, and the correction reaches us with the next update. For a request to remove or correct something in our own display, and for any matter concerning the personal data of a sole trader, send a message to info@arouri.gr; it is examined without delay.
• User location. Your position is used only locally, on your device, to calculate distance. It is not stored on our servers and is not shared with third parties or with the venues.

17. Intellectual property, trade identifiers and prohibition of copying

All content, design, structure, naming, logos, texts, screens, features, algorithms, user experience, templates, databases, visual assets and the overall concept and implementation of Arouri are protected by intellectual property and related rights (Greek Law 2121/1993, Directives 2001/29/EC and 96/9/EC). This expressly includes: the photographs and visual guides of the exercises (the triptychs and each individual step), the recipe photographs, the recipes, portions and nutrition plans, the training programmes, the texts and instructions, the icons and charts, the answers and plans of the AI coach, the catalogues of exercises, recipes, gyms and prices as databases (articles 2, 2A and 45A of Law 2121/1993), and the platform's code. This material was created or produced for Arouri with substantial investment and belongs exclusively to Arouri, regardless of the tool used to produce it.

• No Creative Commons licence, nor any licence other than the one in this article, is granted.
• The user receives only a personal, limited, non-exclusive and non-transferable licence to view and use the material inside the platform, for their own planning, for as long as they have lawful access. No other use is permitted.

17.1 What is expressly prohibited

Without Arouri's prior written permission, the following is prohibited for any purpose and by any means:

• copying, downloading, saving or taking screenshots / screen recordings of photographs, guides, recipes, plans or screens of the platform in order to reproduce, distribute or publish them;
• republishing on websites, apps, social media, print, presentations or products, with or without editing;
• selling, renting, reselling or passing the material or the access on to third parties, and sharing an account;
• using the material to train or evaluate artificial-intelligence models, to build datasets or to create derivative works;
• automated extraction (scraping, crawling, bots, bulk downloads) of any part of the platform or its databases;
• removing, hiding, cropping or altering the "AROURI.gr" mark, the logo or any rights notice on the photographs and screens (articles 66A and 66B of Law 2121/1993);
• decompiling, reverse engineering, copying the structure, the interface or the algorithms and using them in a competing product.

The only permitted uses are: personal viewing inside the platform, sharing exclusively through Arouri's built-in sharing features (Story, cards), as they are generated and with Arouri's mark, and whatever the law expressly permits without a licence (e.g. a short quotation with attribution).

17.2 Distinctive signs

The name "Arouri", the logo, the "AROURI.gr" mark, the domain name arouri.gr and the platform's visual identity are protected as distinctive signs and trade name, regardless of registration. Their use — or the use of similar signs likely to cause confusion — in products, services, domain names, social-media accounts, advertising or keywords, and any presentation implying a relationship with or endorsement by Arouri, is prohibited without written permission.

17.3 Consequences

Any breach of this article constitutes an infringement of intellectual property rights and a material breach of these terms. Arouri is entitled, cumulatively:

• to delete the infringer's account immediately, without notice and without a refund (article 9), and to refuse future registration;
• to demand that the infringement cease and not be repeated, as well as damages of at least twice the fee that would have been due for lawful use, or the full loss and the infringer's profit (article 65 of Law 2121/1993), with interim measures where required;
• to file a criminal complaint: infringement of intellectual property rights is a criminal offence (article 66 of Law 2121/1993: imprisonment of at least one year and a fine), as are the removal of marks and the circumvention of technical protection measures (articles 66A, 66B);
• to claim the legal and out-of-court costs of detecting and pursuing the breach.

The marks on the photographs and the technical access records the platform keeps (article 10.3) may be used as evidence. Anyone who notices copied Arouri material can report it to info@arouri.gr.

18. Prohibited uses

Using the platform for an unlawful purpose, breaking into accounts, automated data extraction, attacks, abuse of the API, falsifying details, distributing malicious content, harassment, infringing third-party rights or attempting to access non-public code or data is prohibited.

18.1 Names, photos and profile details

The account name, the public username and the profile photo must be your own and must not offend anyone. The following are prohibited in particular: names or images that are abusive, racist, sexual, violent or threatening; names impersonating another person, a public figure, a company, a trade mark or the Arouri team itself (for example “admin”, “support”, “Arouri”); names containing other people's personal data (phone numbers, addresses, emails); advertising messages, links or calls to action; false age or identity details.

18.2 Behaviour that affects the platform or other users

Any action that distorts the operation or the reliability of the platform is prohibited: artificially generating logs or XP with automation, scripts or multiple accounts; exploiting a bug instead of reporting it to info@arouri.gr; overloading or abusing the interfaces (API), the AI coach or notifications; attempting to access other people's data or accounts; harassing, threatening or targeting other users, inside or outside the platform, because of the public leaderboard.

18.3 Measures and notification

Depending on the seriousness and on repetition, we may — immediately and without prior warning where the breach is obvious — (a) remove the profile photo or change the account name or the public username; (b) exclude the account from the public leaderboard, without affecting its XP and logs; (c) permanently delete the account and its data, in accordance with article 7.1. For every such measure you are informed by email at your account address, with the reason stated. The change takes effect on your device at the next sign-in or refresh of the platform. You can contest the measure at info@arouri.gr within 14 days; the appeal is examined by a human. Any refund for the current subscription period is decided in accordance with article 9 and with mandatory consumer protection law. Warnings (strikes): every removal of a "Moment" by the Arouri team with a stated reason (article 19.1) counts as one warning; you are informed of the reason and of your number of warnings by email and by a notification in the platform. Upon reaching ten (10) warnings the account may be deleted under this article, with notification and the right of appeal as above.

19. Public leaderboard, username and profile photo

The leaderboard is a public, global table: its content is visible to every signed-in user of the platform. From 15/09/2026 every account takes part automatically from the moment it is created — not under your real name, but under a pseudonym (username) that the platform assigns to you at sign-up. You can change the pseudonym whenever and as often as you like (as long as no other user is using it) and add or remove a profile photo; the photo is optional and is uploaded only by your own action. Your email and your real name are never publicly linked to the pseudonym. The end of the trial or of the subscription does not remove you from the table; the profile is removed only when the account is deleted (by you or by us).

What is published: your pseudonym (the automatic one or the one you chose), your profile photo if you have uploaded one, your level and the emblem of your tier, your total XP, the number of your valid logs, your position in the ranking and how it has changed, your plan (Trial, Pro or Elite — not the amount, not payment details), and the start date of your account. Removal by us. If we remove you from the leaderboard under article 18.3, you cannot rejoin by yourself; you can submit an appeal from the Leaderboard sector, which is examined by a human, and reinstatement is done by us.

What is never published: your email, your password, your weight, your body measurements, your meals, your notes, your workouts, your sleep, your location, your payment details or any other log in your account.

• Responsibility for content. The user bears sole and full responsibility for every image and every name they upload. They declare and warrant that they hold the relevant rights or have the express permission of every person depicted and every rights holder.
• Prohibited content. Photos or names are prohibited where they are unlawful, offensive, abusive, racist, sexual or violent, misleading or promotional, where they identify or impersonate another person, where they contain third-party trade marks or works without permission, or where they depict a minor without the consent of the person exercising parental responsibility.
• Licence to use. By uploading a photo you grant a limited, non-exclusive, revocable licence solely for it to be displayed on the leaderboard and on your profile inside the platform. No other use is made of it: it is not sold, not licensed to third parties, not used for advertising and not used to train models.
• We do not pre-moderate content. Images and names are not checked in advance. We reserve the right to remove any photo or name, or to exclude an account from the leaderboard, immediately and without warning, where there is a reasonable suspicion of a breach.
• Disclaimer for use by third parties. Anything published on a public table can be seen, saved, photographed, copied or republished by anyone who has reached it. We bear no liability for any such use, copying, sharing, alteration or misuse of your photo or your name by other users or by third parties, inside or outside the platform.
• Removal does not recall third-party copies. Deletion from the leaderboard removes the details from our own systems, but cannot recall copies, screenshots or caches held by third parties.
• Accuracy of the ranking. Positions, XP and changes are calculated automatically and are indicative. They may contain errors, delays or corrections. The leaderboard is not a contest, creates no claim, carries no prize and gives rise to no obligation on our part towards the user.
• What you control. Taking part under a pseudonym is part of the service (legal basis: performance of the contract, Article 6(1)(b) GDPR) and cannot be switched off separately; you do, however, fully control your pseudonym and your photo. At any time you can change the pseudonym to one that does not identify you and remove your photo. Deleting your account (article 10) removes the profile from the table. The pseudonym may stay reserved for a while, so that nobody else can take it and appear as you.
• Reporting abuse. If you spot a photo or a name that concerns you or breaches the above, send us a message at info@arouri.gr and it will be examined without delay.

Choosing a pseudonym and uploading a photo are done at the sole responsibility of the user. To the extent permitted by law, any liability on our part for damage connected with the publication, the display or the use of the details published under a pseudonym or that the user chose to make public is excluded.

19.1 "Moments": 24-hour photos

Every user of the platform (all accounts take part in the leaderboard) can share "Moments": one photo with an optional caption, visible only to signed-in users of the platform — not publicly on the internet. Uploading is always your own choice. All rules of this article about images (responsibility for content, third-party rights, prohibited content) and of article 18 apply.

• Duration: every moment lives for 24 hours. It is then deleted permanently and completely from our systems — the file, the caption, the views and the reports. No archive, copy or "memory" is kept, and there is no restore. The user can delete it earlier, with the same result.
• One view per viewer: every participant sees each moment once. There is no download or saving inside the platform; a screenshot by a viewer cannot be technically prevented in a browser and is expressly forbidden without the creator's consent.
• Limit and reward: up to 24 moments per day; every moment adds 50 XP. If the user deletes a moment earlier, its XP is removed and the day's slot is freed; at the natural 24-hour expiry the XP is kept. A moment taken down because of reports or by the administration loses its XP.
• Content: only your own photos, without third parties who did not consent, minors, sensitive health data, nudity, violence, advertising or misleading content. Viewers can report a moment; after three reports or an administrator's decision it is taken down immediately, and repeated breaches are handled under articles 7.1 and 18.3.
• Responsibility: every moment is uploaded at the sole and full responsibility of the user, who declares that they hold the rights to the image, that it does not depict third parties without their consent and that the content is lawful. By uploading, the user consents to the display — within the platform community — of the image, the caption and their username for 24 hours. Arouri does not pre-select, does not review in advance and bears no responsibility for the content of moments, for their use by other users (e.g. a screenshot) or for any damage connected with their publication, to the extent permitted by law. The liability paragraph at the end of this article applies in full.
• Data: the photo is stored in a private area of the server (not at a public address) and rewritten without metadata (e.g. location). We record who viewed which moment only to guarantee the single view, and the number of uploads per day for the limit; everything is deleted together with the moment. Legal basis: your consent given by uploading each moment (article 6(1)(a) GDPR), revocable by deleting the moment or your account — your active moments are then deleted too.

20. Limitation of liability and availability

The platform is provided “as is” and “as available”. We do not guarantee that it will be uninterrupted, free of errors or inaccuracies, or that it will produce specific results for every user. The user accepts that any AI or automated suggestion may contain an error and must be checked before it is applied.

• We are not liable for injuries, dietary reactions, incorrect exercise execution, incorrect data entry, a user's decision, failure to reach a goal, third-party services or third-party price changes.
• We are not liable for data loss caused by force majeure, an error of a third-party provider, a user error, a malicious act or a technical event outside our reasonable control.
• Nothing in these terms excludes rights that mandatory consumer legislation does not allow to be excluded.

To the fullest extent permitted by law, any liability of the platform for any direct, indirect, incidental, special or consequential damage connected with the use of, or the inability to use, the tool is excluded, including loss of data, loss of profit or failure to reach goals. The platform's total aggregate liability, from any cause, does not exceed the amount that the particular user paid for their subscription over the last 12 months. This limitation does not affect rights that mandatory legislation does not allow to be limited (for example wilful misconduct, gross negligence, liability for personal injury where the law imposes it).

21. Applicable law, contact and complaints

These terms are governed by Greek and European Union law, with respect for mandatory consumer protection and personal data protection provisions. For any request, complaint or support matter, the user can get in touch at info@arouri.gr.

Last updated: 16/09/2026 · Terms version 2026-09-16-v23 · In force from 16/09/2026

21.1 Assignment and transfer of the business

The user cannot assign their account or their rights to a third party. In the event of a merger, an acquisition or a transfer of the business, the contract and the data may be transferred to the successor. In that case you will be informed in advance and with reasonable notice, the successor is bound by the same terms and the same level of protection, and you keep the right to delete your account before the transfer.

21.2 Language, version and archiving of the contract

The language of the contract and of the terms is Greek; any translation is provided for convenience and, in the event of divergence, the Greek text prevails. Every published version carries a date and a version number and remains accessible at arouri.gr/legal.html. The text in force on the date of your registration is kept and is supplied as a copy on request at info@arouri.gr.